Bayes stopped working

2010-01-17 Thread Casartello, Thomas
I recently updated my machine from Fedora 11 to Fedora 12 and I noticed
Bayes has stopped working. Couldn't get anything revealing from Spamassassin
-D -lint . I use Mysql based bayes. Any suggestions on where else to check
for problems?

 

Thomas E. Casartello, Jr.

Staff Assistant - Wireless/Linux Administrator

Information Technology

Wilson 105A

Westfield State College

(413) 572-8245

 

Red Hat Certified Technician (RHCT)

 



smime.p7s
Description: S/MIME cryptographic signature


RE: Bayes stopped working

2010-01-17 Thread Casartello, Thomas
Already tried that. Didn't help. Odd thing is that I'm using SA through Maia
Mailguard which is heavily MySQL based and all the stuff for that is working
fine. It's just the Bayes stuff that stopped working..

 

Thomas E. Casartello, Jr.

Staff Assistant - Wireless/Linux Administrator

Information Technology

Wilson 105A

Westfield State College

 

Red Hat Certified Technician (RHCT)

 

From: Marc Perkel [mailto:m...@perkel.com] 
Sent: Sunday, January 17, 2010 11:46 AM
To: Casartello, Thomas
Cc: users@spamassassin.apache.org
Subject: Re: Bayes stopped working

 

MySQL has changed. I think there's a script called mysql-upgrade that you
need to run.

Casartello, Thomas wrote: 

I recently updated my machine from Fedora 11 to Fedora 12 and I noticed
Bayes has stopped working. Couldn't get anything revealing from Spamassassin
-D -lint . I use Mysql based bayes. Any suggestions on where else to check
for problems?

 

Thomas E. Casartello, Jr.

Staff Assistant - Wireless/Linux Administrator

Information Technology

Wilson 105A

Westfield State College

(413) 572-8245

 

Red Hat Certified Technician (RHCT)

 



smime.p7s
Description: S/MIME cryptographic signature


RE: Bayes stopped working

2010-01-17 Thread Casartello, Thomas
 on an undefined value at
/usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
375.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 3179.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 4352.

Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)

-Original Message-
From: Marc Perkel [mailto:m...@perkel.com] 
Sent: Sunday, January 17, 2010 12:05 PM
To: users@spamassassin.apache.org
Subject: Re: Bayes stopped working

Have you verified that MySQL is working?

Casartello, Thomas wrote:

 Already tried that. Didn't help. Odd thing is that I'm using SA 
 through Maia Mailguard which is heavily MySQL based and all the stuff 
 for that is working fine. It's just the Bayes stuff that stopped working..

 Thomas E. Casartello, Jr.

 Staff Assistant - Wireless/Linux Administrator

 Information Technology

 Wilson 105A

 Westfield State College

 Red Hat Certified Technician (RHCT)

 *From:* Marc Perkel [mailto:m...@perkel.com]
 *Sent:* Sunday, January 17, 2010 11:46 AM
 *To:* Casartello, Thomas
 *Cc:* users@spamassassin.apache.org
 *Subject:* Re: Bayes stopped working

 MySQL has changed. I think there's a script called mysql-upgrade that 
 you need to run.

 Casartello, Thomas wrote:

 I recently updated my machine from Fedora 11 to Fedora 12 and I 
 noticed Bayes has stopped working. Couldn't get anything revealing 
 from Spamassassin -D -lint . I use Mysql based bayes. Any suggestions 
 on where else to check for problems?

 Thomas E. Casartello, Jr.

 Staff Assistant - Wireless/Linux Administrator

 Information Technology

 Wilson 105A

 Westfield State College

 (413) 572-8245

 Red Hat Certified Technician (RHCT)



smime.p7s
Description: S/MIME cryptographic signature


RE: Bayes stopped working

2010-01-17 Thread Casartello, Thomas
Any thoughts on that junk?

Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)


-Original Message-
From: Casartello, Thomas 
Sent: Sunday, January 17, 2010 12:07 PM
To: 'Marc Perkel'; users@spamassassin.apache.org
Subject: RE: Bayes stopped working

Yes it is working...Just found something new when running amavisd debug

plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 124.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 124.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 139.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 367.
plugin: eval failed: Can't call method untie_db on an undefined value at
/usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
375.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method untie_db on an undefined value at
/usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
375.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 668.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 130.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 979.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 1099.
plugin: eval failed: Can't call method untie_db on an undefined value at
/usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
375.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 329.
plugin: eval failed: Can't call method untie_db on an undefined value at
/usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
375.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 1672.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 662.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line

RE: Bayes stopped working

2010-01-17 Thread Casartello, Thomas
spamassassin-3.3.0-0.26.rc1

That's my version. I wonder if I've hit a bug...

Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)


-Original Message-
From: Casartello, Thomas 
Sent: Sunday, January 17, 2010 12:10 PM
To: 'Marc Perkel'; users@spamassassin.apache.org
Subject: RE: Bayes stopped working

Any thoughts on that junk?

Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)


-Original Message-
From: Casartello, Thomas 
Sent: Sunday, January 17, 2010 12:07 PM
To: 'Marc Perkel'; users@spamassassin.apache.org
Subject: RE: Bayes stopped working

Yes it is working...Just found something new when running amavisd debug

plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 124.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 124.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 139.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 367.
plugin: eval failed: Can't call method untie_db on an undefined value at
/usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
375.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method untie_db on an undefined value at
/usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
375.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 668.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 130.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 979.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 1099.
plugin: eval failed: Can't call method untie_db on an undefined value at
/usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
375.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm
line 612, GEN17 line 329.
plugin: eval failed: Can't call method untie_db on an undefined value at
/usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
375.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method db_readable on an undefined value
at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/Plugin/Bayes.pm line
302.
plugin: eval failed: Can't call method tie_db_readonly on an undefined
value at /usr/lib

RE: Bayes stopped working

2010-01-17 Thread Casartello, Thomas
Yes it happened immediately after upgrading to Fedora 12. I just inquired
there about this.

Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)


-Original Message-
From: Kai Schaetzl [mailto:mailli...@conactive.com] 
Sent: Sunday, January 17, 2010 2:11 PM
To: users@spamassassin.apache.org
Subject: Re: Bayes stopped working

Thomas Casartello wrote on Sun, 17 Jan 2010 12:47:44 -0500:

 spamassassin-3.3.0-0.26.rc1

That seems to be coming from Fedora/Rawhide? If so, I'd inquire there as 
well.

Kai

-- 
Get your web at Conactive Internet Services: http://www.conactive.com





smime.p7s
Description: S/MIME cryptographic signature


RE: Bayes stopped working

2010-01-17 Thread Casartello, Thomas
Tried the rC3 unofficial version. Same issue. I'll try going back to 3.2.5
and see what happens.

Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)


-Original Message-
From: Kai Schaetzl [mailto:mailli...@conactive.com] 
Sent: Sunday, January 17, 2010 3:31 PM
To: users@spamassassin.apache.org
Subject: Re: Bayes stopped working

Thomas Casartello wrote on Sun, 17 Jan 2010 14:33:35 -0500:

 Yes it happened immediately after upgrading to Fedora 12. I just inquired
 there about this.

Yeah. Nobody really knows when this rpm was done, it may contain a bug 
that's already fixed. It's also possible there's some issue with the newer 
Perl. SA 3.3.0 should be coming out next week, you may want to wait and 
then get that. Or grab the RC (URL is in some recent message by Warren 
Togami on this list) and try that.

Kai

-- 
Get your web at Conactive Internet Services: http://www.conactive.com





smime.p7s
Description: S/MIME cryptographic signature


RE: Bayes stopped working

2010-01-17 Thread Casartello, Thomas
Went back to 3.2.5 and that fixed it...

Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)


-Original Message-
From: Casartello, Thomas 
Sent: Sunday, January 17, 2010 3:54 PM
To: users@spamassassin.apache.org
Subject: RE: Bayes stopped working

Tried the rC3 unofficial version. Same issue. I'll try going back to 3.2.5
and see what happens.

Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)


-Original Message-
From: Kai Schaetzl [mailto:mailli...@conactive.com] 
Sent: Sunday, January 17, 2010 3:31 PM
To: users@spamassassin.apache.org
Subject: Re: Bayes stopped working

Thomas Casartello wrote on Sun, 17 Jan 2010 14:33:35 -0500:

 Yes it happened immediately after upgrading to Fedora 12. I just inquired
 there about this.

Yeah. Nobody really knows when this rpm was done, it may contain a bug 
that's already fixed. It's also possible there's some issue with the newer 
Perl. SA 3.3.0 should be coming out next week, you may want to wait and 
then get that. Or grab the RC (URL is in some recent message by Warren 
Togami on this list) and try that.

Kai

-- 
Get your web at Conactive Internet Services: http://www.conactive.com





smime.p7s
Description: S/MIME cryptographic signature


Re: Bayes stopped working

2010-01-17 Thread Casartello, Thomas
Thanks for the info Robert. I guess that explains the issues. Sorry  
all for the confusion I didn't know about these compatibility issues.  
I will withdraw the bugzilla report I put in.

Sent from my iPhone

On Jan 17, 2010, at 9:12 PM, Robert LeBlanc r...@renaissoft.com  
wrote:

 Warren Togami wrote:
 On 01/17/2010 04:34 PM, Martin Gregorie wrote:
 On Sun, 2010-01-17 at 15:57 -0500, Casartello, Thomas wrote:

 Went back to 3.2.5 and that fixed it...

 Thomas,

 Please tell Fedora about it / add a bug on Fedora bugzilla.

 I'm on Fedora 10 and, since updates dried up since the new year,  
 need to
 move to F12 Real Soon Now.


 Martin




 Bayes is working just fine for me on Fedora 12 with
 spamassassin-3.3.0-*.  What version of amavis is this?

 Warren

 Warren,

 I believe Thomas is using amavisd-maia (from the Maia Mailguard  
 suite),
 which has not yet been updated for perl 5.10 and SA 3.3.  A new  
 release
 (Maia 1.03) will address these compatibility issues once the new SA
 release is finalized.

 -- 
 Robert LeBlanc r...@renaissoft.com
 Renaissoft, Inc.
 Maia Mailguard http://www.maiamailguard.com/



Spam coming from hotmail.

2009-11-09 Thread Casartello, Thomas
I've been getting a lot of non-scoring spam coming from hotmail over the
last couple weeks. It's one user that's been complaining about it.

Here's a few samples:

 

From: Jeffry Mouswen [mailto:jmouswenf...@hotmail.com] 
Sent: Monday, November 09, 2009 12:27 AM
To: mo...@csus.edu; nightmareofdre...@gmail.com
Cc: user's name removed
Subject: Interested in it

 

What you up to,

I just felt compelled to communicate to you about the brilliant new way I
buy my pharmaceuticals.

I found this virtual distributor at http://LudovicLen.insanejournal.com and
I believed that you could use it too. They use the right amount of
judiciousness and trade in identical items as at your SavOn.

It'll be great when you guys finally purchase their reasonably-priced stuff!

See you soon,
Ronin

  _  

Hotmail: Trusted email with Microsoft's powerful SPAM protection. Sign up
now.
http://clk.atdmt.com/GBL/go/177141664/direct/01/%0d%0ahttp:/clk.atdmt.com/G
BL/go/177141664/direct/01/%0d%0a 

 

 

From: shebrome ascange [mailto:ashebromefu...@hotmail.com] 
Sent: Friday, November 06, 2009 10:08 PM
To: marsik...@msn.com; user's name removed; stacyber...@yahoo.com;
farmbab...@hotmail.com
Cc: davedebbiealexb...@msn.com
Subject: U finished it again

 

Howdy! 

I just was dying to write you about the brilliant new manner in which I get
a hold of my medicine.

I discovered this cyber dispensary at http://denyounvid.spaces.live.com and
I could tell that you could use it too. They use the correct amount of care
and have indistinguishable medicines as at your SavOn.

It'll be a blast when you guys finally obtain their first-rate medications!

Talk to you really soon,
Tomoyuki

  _  

Find the right PC with Windows 7 and Windows Live. Learn more.
http://www.microsoft.com/Windows/pc-scout/laptop-set-criteria.aspx?cbid=wl;
filt=200,2400,10,19,1,3,1,7,50,650,2,12,0,1000cat=1,2,3,4,5,6brands=5,6,7,
8,9,10,11,12,13,14,15,16addf=4,5,9ocid=PID24727::T:WLMTAGL:ON:WL:en-US:WWL
_WIN_evergreen2:112009 

 

 

From: silonoho erahofonw [mailto:serahofonwar...@hotmail.com] 
Sent: Saturday, November 07, 2009 1:57 AM
To: dillbert2...@yahoo.com; user's name removed
Cc: bo...@yahoo.com; ay...@aol.com
Subject: Happy

 

Hi,

I stumbled across this online shop at http://6yo.org/s/?QOREQ and I was
positive that you could use it too. They have the correct amount of privacy
and sell equivocal medications as at your area store.

  _  

Hotmail: Trusted email with powerful SPAM protection. Sign up
http://clk.atdmt.com/GBL/go/177141665/direct/01/  now.

 

From: stuhanst bbigelart [mailto:bbigelartscr...@hotmail.com] 
Sent: Tuesday, November 03, 2009 1:00 PM
To: davidwr...@hotmail.com
Subject: Thank ya

 

I just ended a phone call with my co-worker, who says hi, and she wanted
to talk with us about a wicked site she wants us to try. She disclosed to me
that this site boasts an unmatched supply and nice prices that dishonor our
area vendor! 

Don't even say that you don't hate paying too much for your medicines as
much as I'm aware that you do. Well our answer is right there on the web at
http://jeenpeul.livejournal.com This internet supplier is totally reputable
and safe. He was the marketing and sales strategist behind many of
Microsoft's software deals. Their 

While the imperial powers in Africa prospered off of the raw materials of
the land and slavery (economic values), the African natives suff

To your health!
Rioun

  _  

Hotmail: Trusted email with Microsoft's powerful SPAM protection. Sign up
now.
http://clk.atdmt.com/GBL/go/177141664/direct/01/%0d%0ahttp:/clk.atdmt.com/G
BL/go/177141664/direct/01/%0d%0a 

 

 

From: asthog alhora [mailto:asthogain...@hotmail.com] 
Sent: Monday, November 02, 2009 3:04 PM
To: aaronragsd...@yahoo.com
Subject: All the possibilities

 

I just finished chatting with my girlfriend, who says hi, and she wanted
to talk with us about a great shop she heard about. She told me that this
virtual store shows a wide variety and fair prices that dishonor our
neighborhood outlet! 

Don't even act like you don't dislike getting ripped off for your drugs as
much as I am sure you do. Well our cure is right there in cyberspace at
http://bingperkin.livejournal.com This cyber location is totally reputable
and safe. software became the industry standard in the early 1980s and has
just increased in distribution 

ered from political and economic situations. Politically, most African
Empires were emerging through new military technology and religious

Let me know how it goes!
Rouppoun

  _  

New Windows 7: Find the right PC for you. Learn more.
http://www.microsoft.com/windows/pc-scout/default.aspx?CBID=wlocid=PID2472
7::T:WLMTAGL:ON:WL:en-US:WWL_WIN_pcscout:112009 

 

 

Thomas E. Casartello, Jr.

Staff Assistant - Wireless/Linux Administrator

Information Technology

Wilson 105A

Westfield State College

(413) 572-8245

 

Red Hat Certified Technician (RHCT)

 



smime.p7s
Description: S/MIME cryptographic signature


RE: [SPAM:6.0] Spam coming from hotmail.

2009-11-09 Thread Casartello, Thomas
Yeah I should have attached those instead of copying and pasting the Outlook 
crap. Was pretty stupid, my apologies.

Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)

-Original Message-
From: rich...@buzzhost.co.uk [mailto:rich...@buzzhost.co.uk] 
Sent: Monday, November 09, 2009 8:47 AM
Cc: Spamassassin Mailing List
Subject: Re: [SPAM:6.0] Spam coming from hotmail.

On Mon, 2009-11-09 at 07:56 -0500, Casartello, Thomas wrote:
 I’ve been getting a lot of non-scoring spam coming from hotmail over
 the last couple weeks. It’s one user that’s been complaining about it.
 
 Here’s a few samples:
{serious ascii murder commited}

I could not stop laughing at this given the context...


 __
 Hotmail: Trusted email with Microsoft's powerful SPAM protection. Sign
 up now.




smime.p7s
Description: S/MIME cryptographic signature


RE: [SPAM:6.0] Spam coming from hotmail.

2009-11-09 Thread Casartello, Thomas
Here are two of the messages in a more proper form. Again I apologize for the 
earlier message.

Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)


-Original Message-
From: Casartello, Thomas 
Sent: Monday, November 09, 2009 9:20 AM
To: 'rich...@buzzhost.co.uk'
Cc: Spamassassin Mailing List
Subject: RE: [SPAM:6.0] Spam coming from hotmail.

Yeah I should have attached those instead of copying and pasting the Outlook 
crap. Was pretty stupid, my apologies.

Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)

-Original Message-
From: rich...@buzzhost.co.uk [mailto:rich...@buzzhost.co.uk] 
Sent: Monday, November 09, 2009 8:47 AM
Cc: Spamassassin Mailing List
Subject: Re: [SPAM:6.0] Spam coming from hotmail.

On Mon, 2009-11-09 at 07:56 -0500, Casartello, Thomas wrote:
 I’ve been getting a lot of non-scoring spam coming from hotmail over
 the last couple weeks. It’s one user that’s been complaining about it.
 
 Here’s a few samples:
{serious ascii murder commited}

I could not stop laughing at this given the context...


 __
 Hotmail: Trusted email with Microsoft's powerful SPAM protection. Sign
 up now.


Received-SPF: pass (hotmail.com: Sender is authorized to use
'toblosas...@hotmail.com' in 'mfrom' identity (mechanism
'include:spf-a.hotmail.com' matched)) receiver=mx1.wsc.ma.edu;
identity=mailfrom; envelope-from=toblosas...@hotmail.com;
helo=col0-omc3-s1.col0.hotmail.com; client-ip=65.55.34.139
Received: from col0-omc3-s1.col0.hotmail.com
(col0-omc3-s1.col0.hotmail.com [65.55.34.139])
by mx1.wsc.ma.edu (Postfix) with ESMTP id A54CB37600A
for kcout...@wsc.ma.edu; Mon,  9 Nov 2009 03:52:05 -0500 (EST)
Received: from COL114-W59 ([65.55.34.136]) by
col0-omc3-s1.col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
 Mon, 9 Nov 2009 00:49:29 -0800
Message-ID: col114-w59276e20ff6f4849346832af...@phx.gbl
Content-Type: multipart/alternative;
boundary=_bd552ac0-b167-4ee2-926d-d8eb2b4270a0_
X-Originating-IP: [92.124.6.234]
From: oblosas towazoco toblosas...@hotmail.com
To: david-deprosp...@juno.com, jlwedge...@msn.com,
davedebbiealexb...@msn.com, seva...@yahoo.com,
diamond.1...@juno.com
CC: stacyber...@yahoo.com
Subject: Afternoon
Date: Mon, 9 Nov 2009 00:49:29 -0800
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 09 Nov 2009 08:49:29.0207 (UTC)
FILETIME=[8C758870:01CA6119]

--_bd552ac0-b167-4ee2-926d-d8eb2b4270a0_
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable


How are you=2C



If i recollect correctly=2C you weren't feeling well the other week
and I t=
hought you'd want to see
http://www.google.com/reader/item/tag:google.com=
=2C2005:reader/item/bfbff5e0da68bbf1



This store is an internet store with great collections. Immediately
you'll =
know that it's a bargain!



Get better=2C

Gerek
 =20
_
Hotmail: Trusted email with powerful SPAM protection.
http://clk.atdmt.com/GBL/go/177141665/direct/01/=

--_bd552ac0-b167-4ee2-926d-d8eb2b4270a0_
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

html
head
style!--
.hmmessage P
{
margin:0px=3B
padding:0px
}
body.hmmessage
{
font-size: 10pt=3B
font-family:Verdana
}
--/style
/head
body class=3D'hmmessage'
How are you=2CBR
BR
If i recollect correctly=2C you weren't feeling well the other week
and I t=
hought you'd want to see A
href=3Dhttp://www.google.com/reader/item/tag:g=
oogle.com=2C2005:reader/item/bfbff5e0da68bbf1http://www.google.com/reader=
/item/tag:google.com=2C2005:reader/item/bfbff5e0da68bbf1/ABR
BR
This store is an internet store with great collections. Immediately
you'll =
know that it's a bargain!BR
BR
Get better=2CBR
GerekBR br /hr /Hotmail: Trusted 
email with powerful
SPAM =
protection. a
href=3D'http://clk.atdmt.com/GBL/go/177141665/direct/01/' ta=
rget=3D'_new'Sign up now./a/body
/html=

--_bd552ac0-b167-4ee2-926d-d8eb2b4270a0_--
Received-SPF: pass (hotmail.com: Sender is authorized to use
'jmouswenf...@hotmail.com' in 'mfrom' identity (mechanism
'include:spf-a.hotmail.com' matched)) receiver=mx2.wsc.ma.edu;
identity=mailfrom; envelope-from=jmouswenf...@hotmail.com;
helo=blu0-omc2-s12.blu0.hotmail.com; client-ip=65.55.111.87
Received: from blu0-omc2-s12.blu0.hotmail.com
(blu0-omc2-s12.blu0.hotmail.com [65.55.111.87])
by mx2.wsc.ma.edu (Postfix) with ESMTP id 530D814002
for kcout...@wsc.ma.edu; Mon,  9 Nov 2009 00:27:50 -0500 (EST)
Received: from BLU139-W3 ([65.55.111.72]) by
blu0-omc2-s12.blu0.hotmail.com

RE: [SPAM:6.0] Spam coming from hotmail.

2009-11-09 Thread Casartello, Thomas
Someone kindly showed me pastebin. Here are my samples FINALLY in proper
form (my apologies for any inconvenience.):
http://pastebin.com/m44e99f80
http://pastebin.com/m4a64ab62

Oh that's a good point. That is pretty funny, obviously their outgoing
protection isn't too good.

Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)


-Original Message-
From: Matus UHLAR - fantomas [mailto:uh...@fantomas.sk] 
Sent: Monday, November 09, 2009 9:36 AM
To: users@spamassassin.apache.org
Subject: Re: [SPAM:6.0] Spam coming from hotmail.

On 09.11.09 09:20, Casartello, Thomas wrote:
 Yeah I should have attached those instead of copying and pasting the
 Outlook crap. Was pretty stupid, my apologies.

no, you should have publiched them somewhere and paste a link. Sending spam
to any mailing list is a bad idea, unless the mailing list recommends that.

btw, it was this advertising signature what made him laugh:

  __
  Hotmail: Trusted email with Microsoft's powerful SPAM protection. Sign
  up now.



-- 
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Fighting for peace is like fucking for virginity...


smime.p7s
Description: S/MIME cryptographic signature


RE: Constant Contact

2009-10-16 Thread Casartello, Thomas
I've heard ads on the radio for Constant Contact before, so I would guess
they're legitimate.

Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)


-Original Message-
From: Adam Katz [mailto:antis...@khopis.com] 
Sent: Friday, October 16, 2009 12:50 PM
To: Spamassassin Mailing List
Subject: Constant Contact

Does anybody here know anything about the legitimacy of Constant
Contact http://www.constantcontact.com/anti_spam.jsp ?

In preparing a list of HOSTKARMA_W violators for Marc, I noticed a
very large amount of spam, coming from completely different companies,
was sent through constantcontact.com servers using their Safe
Unsubscribe feature.

After some web searches, I decided to use the unsubscribe feature, but
apparently I needed to unsubscribe every email address with every
company that uses constantcontact.com.  To me, this means it is quite
clear that Constant Contact's anti-spam policy is improperly enforced
at best and flagrantly ignored at worst.

The biggest problem is that they're well seeded in the DNS whitelists,
including HostKarma and IADB, and they often use SPF, which gets the
OK from my double-check in khop-bl.

Before I write a custom rule to add points to anything passing through
a constantcontact.com relay, I was wondering if anybody here had
thoughts on this.

(Note, questionable custom rules like this get tested on my production
servers with near-zero scores, then real scores, and /then/ they find
their way to my sa-update channels.)


smime.p7s
Description: S/MIME cryptographic signature


HTML Image Spam

2009-08-31 Thread Casartello, Thomas
Any good way of blocking HTML images? I have Fuzzy Ocr, and when I copy this
message and send the picture directly in the message, Fuzzy OCR picks it up.
What they're doing is using an img src tag to show the picture with the
Viagra/cialis pills which is on a remote website instead of attaching or
putting the image directly in the message.

 

Thomas E. Casartello, Jr.

Staff Assistant - Wireless/Linux Administrator

Information Technology

Wilson 105A

Westfield State College

(413) 572-8245

 

Red Hat Certified Technician (RHCT)

 



smime.p7s
Description: S/MIME cryptographic signature


RE: HTML Image Spam

2009-08-31 Thread Casartello, Thomas
Well my client doesn't load images, and I already check against the zen rbl.
The guy who got the message is making a big stink about the fact that he got
the message. I figured there's really not that much that can be done.

Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)


-Original Message-
From: LuKreme [mailto:krem...@kreme.com] 
Sent: Monday, August 31, 2009 8:17 PM
To: users@spamassassin.apache.org
Subject: Re: HTML Image Spam

On 31-Aug-2009, at 18:04, Casartello, Thomas wrote:
 What they're doing is using an img src tag to show the picture  
 with the
 Viagra/cialis pills which is on a remote website instead of  
 attaching or
 putting the image directly in the message.

Run a mail client that doesn't load images from remote servers?

Check incoming mail against the zen rbl.

Both of these will help.

-- 
You think you can catch Keyser Soze? You think a guy like that
comes this close to getting caught, and sticks his head out? If
he comes up for anything it'll be to get rid of me. After that
my guess is you'll never hear from him again.



smime.p7s
Description: S/MIME cryptographic signature


RE: HTML Image Spam

2009-08-31 Thread Casartello, Thomas
Well said :)

Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)


-Original Message-
From: LuKreme [mailto:krem...@kreme.com] 
Sent: Monday, August 31, 2009 8:27 PM
To: users@spamassassin.apache.org
Subject: Re: HTML Image Spam

On 31-Aug-2009, at 18:19, Casartello, Thomas wrote:
 Well my client doesn't load images, and I already check against the  
 zen rbl.
 The guy who got the message is making a big stink about the fact  
 that he got
 the message. I figured there's really not that much that can be done.

If he wants to get absolutely no spam that is very very easy.  
Disconnect the Ethernet cord.

Short of that, he WILL get spam. SA is good, it's not that good.  
Nothing is.

-- 
I'll trade you 223 Wesley Crushers for your Captain Picard



smime.p7s
Description: S/MIME cryptographic signature


RE: HTML Image Spam

2009-08-31 Thread Casartello, Thomas
It's all at t35.com
valrietaolheqs.t35.com that's where they want you to go.

The picture is stored on: 
alfredlolzs.t35.com



Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)


-Original Message-
From: John Hardin [mailto:jhar...@impsec.org] 
Sent: Monday, August 31, 2009 8:43 PM
To: users@spamassassin.apache.org
Subject: Re: HTML Image Spam

On Mon, 31 Aug 2009, Casartello, Thomas wrote:

 What they're doing is using an img src tag to show the picture with 
 the Viagra/cialis pills which is on a remote website instead of 
 attaching or putting the image directly in the message.

What's the hostname in the img src URI? Does it hit any URIBL?

-- 
  John Hardin KA7OHZhttp://www.impsec.org/~jhardin/
  jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
---
   No representation without taxation!
---
  51 days since a sunspot last seen - EPA blames CO2 emissions


smime.p7s
Description: S/MIME cryptographic signature


RE: Low score

2009-08-12 Thread Casartello, Thomas
Looks like I'm just going to forget about it. The person who complained about 
it deleted the message so there's no way I can get at the headers. Oh well 
sorry about that. Thanks anyway for the advice.

Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)

-Original Message-
From: --[ UxBoD ]-- [mailto:ux...@splatnix.net]
Sent: Wednesday, August 12, 2009 8:02 AM
To: Casartello, Thomas
Cc: users@spamassassin.apache.org
Subject: Re: Low score

- Thomas Casartello tcasarte...@wsc.ma.edu wrote:



 Been getting a lot of low scoring stuff like this lately. Any suggestions?

Please post the complete email to pastbin so we can run it through our own 
installations.  It would help if you let us know which rules it actually hit 
on in your installation ?

Best Regards,


-- 
This message has been scanned for viruses and
dangerous content and is believed to be clean.

SplatNIX IT Services :: Innovation through collaboration



smime.p7s
Description: S/MIME cryptographic signature


Low score

2009-08-11 Thread Casartello, Thomas
Been getting a lot of low scoring stuff like this lately. Any suggestions?

 

-Original Message-

From: FedEx Courier Express NG [mailto:mas...@card.org] 

Sent: Monday, August 10, 2009 7:12 PM

Subject: Dear Customer/Beneficiary!

 

Dear Customer/Beneficiary!

 

Kindly contact our delivery department with the details

Given below: FedEx Courier Express NG#31330;

Contact Person: Mr.Ramon Moheno 

E-mail: fedex...@yahoo.com.hk 

 

 

Telephone: +234-706-285-2867.

 

Reasons: This is due to the fact that we are in possession

Of your Package containing a master card worth of five

Hundred Thousand United State Dollars that was registered

With us by the Master Card Award Team for shipment to you,

You are to act fast by providing your postal address and

Your direct phone number to enable us makes the delivery ASAP.

 

Note that as soon as our Delivery Team confirms your

Informations, it will take only two working days (48 hours)

For your package to arrive your designated address. For your

Information, the Mail, VAT  Shipping fees have been paid by

The Award Promo Board you will only have20to pay a sum of

$120.00 to the FedEx Courier Department being full payment

For the Security Keeping Fee of the FedEx Courier as stated

In our privacy terms  condition page.

 

 

Yours Faithfully,

Secretary

Mrs. Mercy Hunt 

=

COPYRIGHT #31330; 2009 MasterCard#31783;.

=

 

 

Thomas E. Casartello, Jr.

Staff Assistant - Wireless/Linux Administrator

Information Technology

Wilson 105A

Westfield State College

(413) 572-8245

 

Red Hat Certified Technician (RHCT)

 



smime.p7s
Description: S/MIME cryptographic signature


Physician List

2009-04-28 Thread Casartello, Thomas
Has anyone else noticed these messages as a problem? I have had a few
complaints about messages getting through my spam filter involving
Physicians List in the USA or something like that usually talking about
dentists too. I made this to target it (someone on the list showed me how to
do things like this which really seems to be helping to block EDU Spear
attacks)

 

body WSC_DENTISTSCAM /Dent ists|Send an email to Slater|Directory in the
United States|have won a prize money|D.entists|Reach Dentists|Physician
Mailing List|receive money|you will have your email taken off|Physicians in
the US|Pharmaceutical Company List|List of US Hospitals|Directory of US
Dentists/i

describe WSC_DENTISTSCAM Dentist scam.

score WSC_DENTISTSCAM 15

body   WSC_DENTIST_D /dentist/i

describe   WSC_DENTIST_D Email Contains dentist

score  WSC_DENTIST_D 0.1

body   WSC_DENTIST_P /physician|MD/i

describe   WSC_DENTIST_P Email contains physician

score  WSC_DENTIST_P 0.1

body   WSC_DENTIST_L /list|directory/i

describe   WSC_DENTIST_L Email contains directory/list

score  WSC_DENTIST_L 0.1

body   WSC_DENTIST_U /United States/i

describe   WSC_DENTIST_U Email contains United States

score  WSC_DENTIST_U 0.1

meta   WSC_DENTIST_1 WSC_DENTIST_D  WSC_DENTIST_P  WSC_DENTIST_L

describe   WSC_DENTIST_1 Likely dentist/physician list spam..contains
physician, dentist, and list or directory

score  WSC_DENTIST_1 7

meta   WSC_DENTIST_2 WSC_DENTIST_D  WSC_DENTIST_P  WSC_DENTIST_L 
WSC_DENTIST_U

describe   WSC_DENTIST_2 Very Likely dentist/physician list spam

score  WSC_DENTIST_3 10

 

Has anyone else been seeing these types of messages? 

 

Thomas E. Casartello, Jr.

Staff Assistant - Wireless Technician/Linux Administrator

Information Technology

Wilson 105A

Westfield State College

(413) 572-8245

 

Red Hat Certified Technician (RHCT)

 



smime.p7s
Description: S/MIME cryptographic signature


FW: [sa-list] Re: A rant about FUZZY_OCR

2009-04-27 Thread Casartello, Thomas
I rely on Fuzzy OCR for some messages. I get some with Viagra/Cialis images,
and just garbage text in the message. Other than FuzzyOCR, nothing usually
scores.

Thomas E. Casartello, Jr.
Staff Assistant - Wireless Technician/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)

-Original Message-
From: Jo Rhett [mailto:jrh...@netconsonance.com] 
Sent: Monday, April 27, 2009 6:07 PM
To: Dan Mahoney, System Admin
Cc: users@spamassassin.apache.org
Subject: Re: [sa-list] Re: A rant about FUZZY_OCR

On Apr 27, 2009, at 1:16 PM, Dan Mahoney, System Admin wrote:
 The problem exists now, there is PNG spam, and there will continue  
 to be, because it gets through.  Right now the only way I find this  
 blocked is if spamcop blocks it.


Just as a point of reference, I'd like to note that we haven't  
bothered with FuzzyOCR here and absolute none of the spam which  
reaches my inbox is a PNG or JPG or GIF spam.   SA does block it, and  
it does so without FuzzyOCR.

That said, we have jacked the scores for e-mail with images and no  
text and that might be why.   We never, ever receive valid e-mail with  
no text in it.

-- 
Jo Rhett
Net Consonance : consonant endings by net philanthropy, open source  
and other randomness





smime.p7s
Description: S/MIME cryptographic signature


RE: Phishing

2009-04-25 Thread Casartello, Thomas
Well by hacked I mean people that have fallen for the phishing and have sent 
their username and password. When I notice it on our network, we immediately 
reset the password and inform the user. But the emails we get are coming from 
other colleges where users have given away their passwords.

-Original Message-
From: SM [mailto:s...@resistor.net] 
Sent: Saturday, April 25, 2009 1:03 AM
To: users@spamassassin.apache.org
Subject: Re: Phishing

At 17:05 24-04-2009, Casartello, Thomas wrote:
One major issue we've been having lately is with phishing emails 
being targeted at us. They're being sent to us from hacked accounts 
at other educational institutes. The message usually is about Your 
EDU webmail account is expiring. Please send us your username and 
password to fix it. We've had some users fall for it, then their 
Exchange account gets turned into a spam machine (sending out usual 
junk spam as well as the original phishing message.) Because they 
are coming from legitimate sites, it's been very difficult to block 
these messages. I've been trying to write phrase rules with common 
words used in the message, but whoever's responsible for this is 
continually changing the message to prevent you from being able to 
catch them with phrase rules. Any thoughts?

There was a project from an educational institution to target 
phishing emails.  I don't recall the name of the project or whether 
the source code was released.

It is going to be a lot of work to keep the rules updated to catch 
these emails.  Analyze the emails instead of trying to apply the 
usual techniques to catch them.  Instead of considering the emails as 
coming from legitimate sites, you should treat that as a data point 
as part of the patterns to identify.  The words in the emails might 
change but the sender relies on some information for the phish to 
work.  You should be able to parse the mail traffic for that 
information.  BTW, there is a larger problem if there are hacked 
accounts available on the sending network and on your network.

Regards,
-sm 



RE: Phishing

2009-04-25 Thread Casartello, Thomas
Haha. Unfortunately I agree. Our CIO has sent out two or three emails to 
faculty and staff as well as students telling them to ignore these messages 
since they started arriving, but yet we've still had faculty and students who 
have given them away anyway.

-Original Message-
From: Arvid Ephraim Picciani [mailto:a...@exys.org] 
Sent: Saturday, April 25, 2009 4:06 AM
To: users@spamassassin.apache.org
Subject: Re: Phishing

Casartello, Thomas wrote:
 The phish are coming from real hacked accounts (Basically people that have
 gotten the phish email and fallen for it) at other Educational institutes
 (We already use SPF). 

I'd go  for a non technical solution here, since its effects only a 
small amount of organisations. Talk to the postmaster of the other 
organisations to track the source, make your users sensible to phishing 
attacks (seriously,  somone thinking 
peter-foo-...@students.myuniversity.edu is an admin, should not be 
allowed to use a computer until proper training)  Unfortunatly the 
amount of stupid people on universities seems to increase rapidly...


Phishing

2009-04-24 Thread Casartello, Thomas
One major issue we've been having lately is with phishing emails being
targeted at us. They're being sent to us from hacked accounts at other
educational institutes. The message usually is about Your EDU webmail
account is expiring. Please send us your username and password to fix it.
We've had some users fall for it, then their Exchange account gets turned
into a spam machine (sending out usual junk spam as well as the original
phishing message.) Because they are coming from legitimate sites, it's been
very difficult to block these messages. I've been trying to write phrase
rules with common words used in the message, but whoever's responsible for
this is continually changing the message to prevent you from being able to
catch them with phrase rules. Any thoughts?

 

Thomas E. Casartello, Jr.

Staff Assistant - Wireless Technician/Linux Administrator

Information Technology

Wilson 105A

Westfield State College

(413) 572-8245

 

Red Hat Certified Technician (RHCT)

 



smime.p7s
Description: S/MIME cryptographic signature


RE: Phishing

2009-04-24 Thread Casartello, Thomas
The phish are coming from real hacked accounts (Basically people that have
gotten the phish email and fallen for it) at other Educational institutes
(We already use SPF). 

Thomas E. Casartello, Jr.
Staff Assistant - Wireless Technician/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)

-Original Message-
From: Jeff Chan [mailto:je...@surbl.org] 
Sent: Friday, April 24, 2009 9:43 PM
To: Casartello, Thomas
Cc: users@spamassassin.apache.org
Subject: Re: Phishing

On Friday, April 24, 2009, 5:05:38 PM, Thomas Casartello wrote:
 One major issue we've been having lately is with phishing emails being
 targeted at us. They're being sent to us from hacked accounts at other
 educational institutes. The message usually is about Your EDU webmail
 account is expiring. Please send us your username and password to fix it.
 We've had some users fall for it, then their Exchange account gets turned
 into a spam machine (sending out usual junk spam as well as the original
 phishing message.) Because they are coming from legitimate sites, it's
been
 very difficult to block these messages. I've been trying to write phrase
 rules with common words used in the message, but whoever's responsible for
 this is continually changing the message to prevent you from being able to
 catch them with phrase rules. Any thoughts?

If the phishes are claiming to come from your own domain, then
use SPF or DKIM on your real outbound mail.  Then any message
claiming to be from your domain that doesn't match the SPF record
or DKIM key can be considered a forgery and handled
appropriately.

Cheers,

Jeff C.
-- 
Jeff Chan
mailto:je...@surbl.org
http://www.surbl.org/



smime.p7s
Description: S/MIME cryptographic signature


URIDNSBL

2009-04-23 Thread Casartello, Thomas
Hello.

I am using the 3.0 line of SpamAssassin and it's being invoked through
amavisd-maia (Maia Mailguard.) I have a certain domain name that's blocked
in several of the URIDNSBL lists as fm.interia.pl however my DNSBL checks
are only doing interia.pl . My OS is Fedora 10 and SA is installed through
RPM. Is this something I can fix through configuration?

 

Thomas E. Casartello, Jr.

Staff Assistant - Wireless Technician/Linux Administrator

Information Technology

Wilson 105A

Westfield State College

(413) 572-8245

 

Red Hat Certified Technician (RHCT)

 



smime.p7s
Description: S/MIME cryptographic signature


RE: URIDNSBL

2009-04-23 Thread Casartello, Thomas
Many thanks.

Thomas E. Casartello, Jr.
Staff Assistant - Wireless Technician/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)


-Original Message-
From: Yet Another Ninja [mailto:sa-l...@alexb.ch] 
Sent: Thursday, April 23, 2009 8:40 AM
To: 'users@spamassassin.apache.org'
Subject: Re: URIDNSBL

On 4/23/2009 2:31 PM, Casartello, Thomas wrote:
 Hello.
 
 I am using the 3.0 line of SpamAssassin and it's being invoked through
 amavisd-maia (Maia Mailguard.) I have a certain domain name that's blocked
 in several of the URIDNSBL lists as fm.interia.pl however my DNSBL
checks
 are only doing interia.pl . My OS is Fedora 10 and SA is installed through
 RPM. Is this something I can fix through configuration?
 

get http://www.rulesemporium.com/rules/90_2tld.cf


smime.p7s
Description: S/MIME cryptographic signature


RE: URIDNSBL

2009-04-23 Thread Casartello, Thomas
I actually am at 3.2.5 sorry I misread. It works just fine. :)

Thomas E. Casartello, Jr.
Staff Assistant - Wireless Technician/Linux Administrator
Information Technology
Wilson 105A
Westfield State College

Red Hat Certified Technician (RHCT)


-Original Message-
From: Yet Another Ninja [mailto:sa-l...@alexb.ch] 
Sent: Thursday, April 23, 2009 9:09 AM
To: users@spamassassin.apache.org
Subject: Re: URIDNSBL

On 4/23/2009 2:57 PM, McDonald, Dan wrote:
 On Thu, 2009-04-23 at 14:40 +0200, Yet Another Ninja wrote:
 On 4/23/2009 2:31 PM, Casartello, Thomas wrote:
 Hello.

 I am using the 3.0 line of SpamAssassin and it's being invoked through
 amavisd-maia (Maia Mailguard.) I have a certain domain name that's
blocked
 in several of the URIDNSBL lists as fm.interia.pl however my DNSBL
checks
 are only doing interia.pl . My OS is Fedora 10 and SA is installed
through
 RPM. Is this something I can fix through configuration?

 get http://www.rulesemporium.com/rules/90_2tld.cf
 
 Does that work in 3.0.x?  I thought that was a 3.2.4 addition.

sorry... bypassed the 3.0 when reading - you're right

not supported.

Fedora 10 doesn't offer anything newer?

:-(



smime.p7s
Description: S/MIME cryptographic signature