RE: [sniffer] Stock SPAM now HTML
Isn't it time to call for an exorcist? From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran JovanovicSent: donderdag 2 februari 2006 5:31To: sniffer@SortMonster.comSubject: [sniffer] Stock SPAM now HTML Well the plain text stock spam has just taken a turn to more interesting and SNF is not capturing it yet as of 10:55 EST. I have submitted a couple to spam@ Now they are including part of a picture to make up the text. Here is what the source looks like CHINA WORLimg src="" CORP. br Syimg src="" br Price $img src="" br Shares out: img src="" Million br Market Capitimg src="" Million br Significant Revenue Growth iimg src="" br Averagimg src="" br Rating: Stroimg src="" Buy br 7 days trading img src="" $2.50 br 30 day trading target: $3.img src="" br Goran Jovanovic Omega Network Solutions
RE: [sniffer] Stock SPAM now HTML
Will it ever stop :( Probably not. Actually maybe I shouldn't be wishing that SPAM stops because then I would lose a revenue streamhmm conundrum Goran Jovanovic Omega Network Solutions -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Thursday, February 02, 2006 7:20 AM To: Goran Jovanovic Subject: Re: [sniffer] Stock SPAM now HTML On Wednesday, February 1, 2006, 11:30:49 PM, Goran wrote: GJ GJ GJ GJ Well the plain text stock spam has just taken a turn to more GJ interesting and SNF is not capturing it yet as of 10:55 EST. I have submitted a couple to spam@ GJ GJ Now they are including part of a picture to make up the text. GJ Here is what the source looks like Isn't it amazing. I've coded some abstracts for this. More to come. _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Stock SPAM now HTML
This is going to get harder and harder to identify and fight. Is it worthwhile to put something like this in a new category which we are very confident about and so if it fails on the new combined image/text thing we can delete it outright? Not sure if this is a good idea or not but I had to add extra static filters to pop the older text only stock spam above my delete weight. This combined image/text is going to make it tougher I think. Thoughts? Goran Jovanovic Omega Network Solutions -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Thursday, February 02, 2006 11:40 AM To: Goran Jovanovic Subject: Re[2]: [sniffer] Stock SPAM now HTML There are some new mutations of the latest campaigns out today. These ones look like they were hand tweaked (not evolved by machine). They are a lot tougher, but I think we've got some abstracts coming out that will get them. This new trend - using embedded images, adding static to images to avoid hashing systems, stuffing text, and avoiding links and email addresses is going to increase. _M On Thursday, February 2, 2006, 11:12:59 AM, Goran wrote: GJ Will it ever stop :( GJ Probably not. Actually maybe I shouldn't be wishing that SPAM stops GJ because then I would lose a revenue streamhmm conundrum GJ Goran Jovanovic GJ Omega Network Solutions GJ -Original Message- From: [EMAIL PROTECTED] GJ [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Thursday, February 02, 2006 7:20 AM To: Goran Jovanovic Subject: Re: [sniffer] Stock SPAM now HTML On Wednesday, February 1, 2006, 11:30:49 PM, Goran wrote: GJ GJ GJ GJ Well the plain text stock spam has just taken a turn to more GJ interesting and SNF is not capturing it yet as of 10:55 EST. I GJ have submitted a couple to spam@ GJ GJ Now they are including part of a picture to make up the text. GJ Here is what the source looks like Isn't it amazing. I've coded some abstracts for this. More to come. _M This E-Mail came from the Message Sniffer mailing list. For GJ information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html GJ This E-Mail came from the Message Sniffer mailing list. For GJ information and (un)subscription instructions go to GJ http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
[sniffer] Automate MDaemon Updating
Has anyone got an automated updating script for updating rulebases for MDaemon. I am just demoing the software now. The plugin seems to be working well. I have used the Imail script from the website that Bill Landry contributed (thanks Bill). Is there a way to automatically send the conformation email that the update worked as it was supposed to like it does in IMail? If we discontinue Imail usage and go to MDaemon will the Sniffer license transfer OK? (Only running one server with it at a time). Thanks, Grant --- [This E-mail scanned for viruses by EA Media Internet Services] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: [sniffer] Automate MDaemon Updating
We actually did that exact thing, went from Imail to MDaemon when Imail started drastically increasing their prices a year or so ago. We are using the same scripts now with MDaemon that we used in Imail and they just fine (I think they may be Bills Landry's scripts). As for license file, it transferred over without any issues either. The plugin works great too, MDaemon is much better than Imail, although I do miss declude functionality. We have MDaemon setup to automatically delete spam messages based upon some of the higher accuracy return codes (such as the adult themed ones) and have the ones that have a higher false positive chance to simply move the spam messages to the MDaemon user spam directory. I also setup a rule to automatically delete these spam captured messages every 5 days from the users spam directories to keep the clutter down. This works great for us and I would highly recommend that transition. Jim Matuska Jr. Computer Tech2, CCNA Nez Perce Tribe Information Systems [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Grant Stufft Sent: Thursday, February 02, 2006 9:25 AM To: sniffer@SortMonster.com Subject: [sniffer] Automate MDaemon Updating Has anyone got an automated updating script for updating rulebases for MDaemon. I am just demoing the software now. The plugin seems to be working well. I have used the Imail script from the website that Bill Landry contributed (thanks Bill). Is there a way to automatically send the conformation email that the update worked as it was supposed to like it does in IMail? If we discontinue Imail usage and go to MDaemon will the Sniffer license transfer OK? (Only running one server with it at a time). Thanks, Grant --- [This E-mail scanned for viruses by EA Media Internet Services] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re[4]: [sniffer] Stock SPAM now HTML
On Thursday, February 2, 2006, 11:46:05 AM, Goran wrote: GJ This is going to get harder and harder to identify and fight. Is GJ it worthwhile to put something like this in a new category which GJ we are very confident about and so if it fails on the new combined GJ image/text thing we can delete it outright? GJ Not sure if this is a good idea or not but I had to add extra static GJ filters to pop the older text only stock spam above my delete weight. GJ This combined image/text is going to make it tougher I think. Right now we're fighting these things with compound abstracts... They are the hardest rules to code properly so I'd feel uncomfortable giving them an elevated weight. _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: [sniffer] Automate MDaemon Updating
On Thursday, February 2, 2006, 12:25:01 PM, Grant wrote: GS Has anyone got an automated updating script for updating rulebases for GS MDaemon. I am just demoing the software now. The plugin seems to be GS working well. I have used the Imail script from the website that Bill GS Landry contributed (thanks Bill). Is there a way to automatically send GS the conformation email that the update worked as it was supposed to like GS it does in IMail? If we discontinue Imail usage and go to MDaemon will GS the Sniffer license transfer OK? (Only running one server with it at a GS time). I'm not an MDaemon expert, but I believe most folks use a CF rule to recognize the update notification and call out to the update script. As for transferring the license from one server to another - that's just fine, and the platform doesn't matter. SNF runs on just about anything (Windows, Linux, BSD, etc...). Someone here or on one of the MDaemon lists will probably have the correct CF incantation handy. Hope this helps, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: [sniffer] Automate MDaemon Updating
Attached is what I use, feel free to contact me off-list if you've got any specific questions. Originally taken from: http://www.sortmonster.com/MessageSniffer/Help/AutomatingUpdatesHelp.html -- Dave Habben Coordinator of Network Services Sauk Valley Community College Grant Stufft wrote: Has anyone got an automated updating script for updating rulebases for MDaemon. I am just demoing the software now. The plugin seems to be working well. I have used the Imail script from the website that Bill Landry contributed (thanks Bill). Is there a way to automatically send the conformation email that the update worked as it was supposed to like it does in IMail? If we discontinue Imail usage and go to MDaemon will the Sniffer license transfer OK? (Only running one server with it at a time). Here is my rule in my MDaemon\App\cfrules.dat, if you'd like a screenshot of the GUI version, I can provide that too [Rule004] RuleName=MessageSniffer Updates Enable=Yes ThisRuleCondition=All ProcessQueue=BOTH Condition01=SUBJECT|contains|AND|ecb894oj.snf Update| Action01=run a program|0,0,0,D:\MDaemon\MessageSniffer\RuleUpdates.bat RuleUpdate.bat: D: cd \MDaemon\MessageSniffer wget http://username:[EMAIL PROTECTED]/Sniffer/Updates/ecb894oj.snf -O ecb894oj.tst if exist ecb894oj.tst goto Test goto Done :Test snf2check.exe ecb894oj.tst myauthcode if errorlevel 1 goto Done if exist ecb894oj.old del ecb894oj.old ren ecb894oj.snf ecb894oj.old ren ecb894oj.tst ecb894oj.snf :Done if exist ecb894oj.tst del ecb894oj.tst
