Virus Alerts treated as SPAM

[#1]

I have received two Alerts from the PN anti-virus filter, and these were placed in my spam folder.  It appears this is because the original message containing the virus had its subject line marked  [-SPAM-], and this appeared in the text of the alert.  I think that messages should be filtered into spam folders on the basis of the subject line, and not on the text of the message.  Certainly, any messages generated by PN to its customers should never end up treated as spam by PN's own filters.

[#2]

How would this be treated in the subject line?
Here is a spam warning
or
This is not a spam message
or
is ham spam
or
when was spam invented?
All these could be "genuine" messages ...... 

[#3]

Quote from: tomcat

I have received two Alerts from the PN anti-virus filter, and these were placed in my spam folder.  It appears this is because the original message containing the virus had its subject line marked  [-SPAM-], and this appeared in the text of the alert.  I think that messages should be filtered into spam folders on the basis of the subject line, and not on the text of the message.

They are filtered based on the X-pn-pstn: header and your individual spam preferences. The actual text in the body of the email is irrelevant. There's something else at play here that's causing your virus notifications to be handled in this fashion I suspect.

Quote

Certainly, any messages generated by PN to its customers should never end up treated as spam by PN's own filters.

Agreed. You might want to consider raising a support ticket and attaching the full headers to some of these emails. That way we can raise an internal problem if necessary.

[#4]

What did happen the mythical 0.0003% false positive SLA for Postini?
If they really were meeting this target there would be no need for whitelisting, special plusnet relay headers etc.

[#5]

I'm using the Postini quarantine option and have only seen I think three false positives out of probably 1-2000 emails total (including spams) in the last week or so.
One problem is that some emails that Postini does not think are spam are having the Postini headers misinterpreted by Plusnaet and tagged as spam (the opposite happens sometimes as well).

[#6]

I mentioned this a couple of weeks ago but it wasn't picked up by pn 
http://community.plus.net/forum/index.php/topic,64414.0.html

The odd thing about them is that there are no headers as the emails come from pn.
See my original message for headers
Jeff

[#7]

I'll need the full headers from a few of these notifications that have ended up in people's spam folders, or ended up getting marked as spam.
Once I have these, we can investigate accordingly.

[#8]

This one came the other day:
From: Email Alerting Service <unquarantine@quarantine.plus.com>
Subject: Alert:  An email addressed to you has been quarantined
To: jeff@xxxx.co.uk
Date: Sat, 10 May 2008 15:05:19 +0100
Message-Id: <E1JuphN-0002TK-Cc@pih-sunmxcore10.plus.net>
This is the FULL header
Jeff

[#9]

Here is the full header of the virus alert

Quote

From: Email Alerting Service <unquarantine@quarantine.plus.com> Subject: Alert: An email addressed to you has been quarantined To: <---@--------> Date: Wed, 14 May 2008 15:46:36 +0100 Message-Id: <E1JwIFW-0002s4-7r@pih-sunmxcore11.plus.net>

the text of the alert contained the following

Quote

The subject line of the mail received was: *      [-SPAM-] Fw: Picturs

Does this explain why the alert was placed in my spam folder?

[#10]

Quote from: tomcat

Here is the full header of the virus alert Quote The subject line of the mail received was: *       [-SPAM-] Fw: Picturs Does this explain why the alert was placed in my spam folder?

I thought it might be that. If the original message was in spam, thats were it placed the notification of the virus.

[#11]

Here's a couple more:

From: Email Alerting Service <unquarantine@quarantine.force9.co.uk>
Subject: Alert:  An email addressed to you has been quarantined
To: jay@schlackman.org
Date: Sat, 17 May 2008 00:11:57 +0100
Message-Id: <E1Jx95e-00002z-RP@pih-sunmxcore15.plus.net>

From: Email Alerting Service <unquarantine@quarantine.force9.co.uk>
Subject: Alert:  An email addressed to you has been quarantined
To: jay@schlackman.org
Date: Wed, 21 May 2008 01:19:56 +0100
Message-Id: <E1Jyc3f-0001wn-11@pih-sunmxcore17.plus.net>

As emphasised by previous posters, this is the entirety of the raw header. They are unusually short...

[#12]

Quote from: jschlackman

They are unusually short...

This is because this email is generated by the process which performs the quarantining on our mail platform and are written directly to the storage. Due to the way this is done I really can't think off the top of my head how this is happening. If you could leave one of these affected mails in your mailbox we might be able to track down how this is happening.

[#13]

I am pretty sure I have two in my SPAM folder which I didn't delete, you are welcome to look at them.
Jeff

[#14]

Both are in my spam folder right now, mailbox name is "james"

[#15]

I think I've got this sorted now on our staging platform, I just need to test it a bit more before rolling it out, which hopefully will be tomorrow. FYI it is because of the way we determine which directory a mail gets delivered to not checking if it's a virus email.