[SAtalk] Re: One persistent spammer defeating SA.

2003-12-12 Thread era
On Fri, 12 Dec 2003 01:38:16 -0500, Bryan Hoover [EMAIL PROTECTED] posted to spamassassin-talk: [EMAIL PROTECTED] wrote: For many of these, one can observe that the user name in the From: header often also occurs in the Subject line. This could be a useful rule pattern, although there are

[SAtalk] Re: Will Recipe work to skip certian messages?

2003-12-12 Thread era
On 12 Dec 2003 08:45:08 +0200, I posted to spamassassin-talk: :0fw * ! ^From.*@([^ .]+\.)*rose-hulman\.edu\ | spamc -options ... Oh, maybe the character class should also include comma and @ ... my bad. FWIW, the first whitespace character is a space, and the second is a tab. /*

[SAtalk] Re: SA Long Process Times / Memory Utilization (Possible Bug?)

2003-12-12 Thread era
On Thu, 11 Dec 2003 15:42:55 -0700, Dan Tappin [EMAIL PROTECTED] posted to spamassassin-talk: My hunch, which could be totally wrong, is that when parsing these messages the multiple headers in the Outlook attached messages is causing the problem. Do you generally manage to process large

RE: [SAtalk] Need a rule for IE Exploit

2003-12-12 Thread Larry Gilson
-Original Message- From: Fred Hello, I am out the door on my way to work but we need a rule for a new IE exploit just released, Visit this page, the exploit is harmless but to the spoofer, it's man's best friend. http://www.zapthedingbat.com/security/ex01/vun1.htm I think

[SAtalk] sa-learn on hand-sorted mailboxes

2003-12-12 Thread greg
Just for curiosity (normally I just let autolearning happen without interference from my meddling fingers), I tried to use sa-learn. $ sa-learn --spam --mbox SPAM Learned from 0 message(s) (15 message(s) examined). $ sa-learn --ham --mbox mail/saved-messages Learned from 0 message(s) (20

Re: [AMaViS-user] Re: [SAtalk] Can't locate AAAA.pm

2003-12-12 Thread Per olof Ljungmark
Matt Kettler wrote: At 11:46 AM 12/11/2003, Per olof Ljungmark wrote: amavisd is running chroot'ed /usr/local/libdata/perl5/site_perl/i386-openbsd/Net/DNS/RR/.pm exists on the system. But does it exist relative to the root of the chroot? All Perl is at its usual place in the above

[SAtalk] Hit Digits

2003-12-12 Thread Kai Poppe/Redaktion SDCE
Hello List, is there any possibility to change the digits of hit points from 1 (5.0) to 3 (5.000) that are shown in the report ? Since in the .cf files there are 3-digits hit points i would preffer to see them in the report, too... any config-line i overlooked while seeing through the

[SAtalk] AWL casuing false positives

2003-12-12 Thread Peter McGarvey
I've seen several instanaces where the AWL mechanism has cause non-spam email to be classed as spam. Here is example report from one of these: Content analysis details: (50.7 points, 5.0 required) pts rule name description --

[SAtalk] Mass-check corpus cleanup using included scripts. How??

2003-12-12 Thread Smart,Dan
I'm trying to do the mass-check corpus cleanup using the method in CORPUS_SUBMIT file. My hard-sorted spams and hams are stored in MBOXs. I'm assuming that the scripts: mass-check-results-to-mbox, mboxget, and extract-message-from-mbox are used to help in this process to check and purge

RE: [SAtalk] Need a rule for IE Exploit

2003-12-12 Thread Mark Muller
Friend gave this to me this morning: uri CUSTOM_IE_URL_SPOOF /\x01\s*\@|\#01\s*\@/ score CUSTOM_IE_URL_SPOOF (up to you, I set it to 5.0) describe CUSTOM_IE_URL_SPOOFCustom: URL tries to spoof its identity via an IE trick Anyone care to

[SAtalk] how to change config path of SA ?

2003-12-12 Thread Stephen Figueroa
RH9, amavisd-new (p6), spamassassin 2.6 : I believe the config path that spamassassin is using is /usr/share/spamassassin. However, I want it to use my chrooted amavis directory of /var/amavisd/usr/share/spamassassin. How and where can I change this ? Any help to this newbie is appreciated.

RE: [SAtalk] AWL casuing false positives

2003-12-12 Thread Colin A. Bartlett
Peter McGarvey Sent: Friday, December 12, 2003 8:46 AM I've seen several instanaces where the AWL mechanism has cause non-spam email to be classed as spam. Here is example report from one of these: -4.9 BAYES_00 BODY: Bayesian spam probability is 0 to 1% 56 AWL

Re: [SAtalk] AWL casuing false positives

2003-12-12 Thread Matt Kettler
At 01:46 PM 12/12/03 +, Peter McGarvey wrote: pts rule name description -- -- -4.9 BAYES_00 BODY: Bayesian spam probability is 0 to 1% [score: 0.] 56 AWL

RE: [SAtalk] Re: SA Long Process Times / Memory Utilization (Possible Bug?)

2003-12-12 Thread Dan Tappin
The thing is that 'normal' large messages do not cause this. I have tested this. I can't recreate the issue with a regular message. I just sent a test message with a Word, PDF, AutoCAD drawing and an Excel file - total 1 MB. Took about 2 to 3 seconds to send. These forwarded messages can

RE: [SAtalk] sa-learn on hand-sorted mailboxes

2003-12-12 Thread Jason Staudenmayer
Set the -D and make sure it's reading the mbox right. I had a problem with that. If it's running ok the spamassassin has already learned these mails. It's smart enough not to learn the same or similar message more than once. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL

Re: [SAtalk] Hit Digits

2003-12-12 Thread Matt Kettler
At 01:58 PM 12/12/03 +0100, Kai Poppe/Redaktion SDCE wrote: is there any possibility to change the digits of hit points from 1 (5.0) to 3 (5.000) that are shown in the report ? Since in the .cf files there are 3-digits hit points i would preffer to see them in the report, too... any config-line i

Re: [SAtalk] Hit Digits

2003-12-12 Thread Kai Poppe/Redaktion SDCE
Well the _REPORT_ version is terse, and usually used in headers, but I thought the body report (_SUMARY_) had the full 3 digits. Does yours not do this? What version? Nope, mine does not. SpamAssassin 2.61 is the version. ## 10_main.cf: clear_report_template report_charset text/plain [...]

[SAtalk] Mysterious SA tags in SPAM message?

2003-12-12 Thread Kang , Joseph S.
All: I just saw the strangest thing in my Yahoo! Mail bulk e-mail folder. It was the usual collection of pornographic spams. But, there was one message that really caught my eye. The subject line was: *SPAM* The Beautiful Art of Female [snip]. xdvldmgzyohhmcn.

Re: [SAtalk] Mysterious SA tags in SPAM message?

2003-12-12 Thread Matt Kettler
At 10:53 AM 12/12/2003, Kang , Joseph S. wrote: === Anyone know how this could have happened? I'm just curious. I've NEVER seen Yahoo! tagged bulk email with SA tags. Odds are the open relay that the spammers sent the mail through was running

[SAtalk] Nested Meta Rules

2003-12-12 Thread Nayana Hettiarachchi
Hi, i have made few customs rules and i was playing around with them little more and i was kinda curious if a rule like this will actually work, as per my experiment i noticed that it is not working. meta TTOFFICE_BLOCK (__TOOFFICE (!__FROMOFFICE || !__FROMRAIBLE)) describe

RE: [SAtalk] AWL casuing false positives

2003-12-12 Thread Matt Kettler
At 10:10 AM 12/12/2003, Colin A. Bartlett wrote: I have found that AWL works quite well and I keep it enabled. The only time that it is a pain is if I send myself or someone else a test using GTUBE. That f's up the AWL until I send a few hams. There's a way to remove the sender from the AWL but I

RE: [SAtalk] Mysterious SA tags in SPAM message?

2003-12-12 Thread Kang , Joseph S.
Oops. I sent my reply directly to Matt instead of the list... -Joe -Original Message- From: Kang , Joseph S. Sent: Friday, December 12, 2003 10:17 AM To: 'Matt Kettler' Subject: RE: [SAtalk] Mysterious SA tags in SPAM message? From: Matt Kettler [mailto:[EMAIL PROTECTED]

RE: [SAtalk] Mysterious SA tags in SPAM message?

2003-12-12 Thread Matthew . van . Eerde
I'm just curious. I've NEVER seen Yahoo! tagged bulk email with SA tags. Odds are the open relay that the spammers sent the mail through was running SA. Yes, you'd think anyone using SA would check for open relay, but it does happen.. I've gotten spam like this before. Hmm... this

Re: [SAtalk] Mass-check corpus cleanup using included scripts. How??

2003-12-12 Thread Matt Kettler
At 09:34 AM 12/12/2003, Smart,Dan wrote: I'm assuming that the scripts: mass-check-results-to-mbox, mboxget, and extract-message-from-mbox are used to help in this process to check and purge improperly sorted mails out of the mbox. How are these used? Don't see any docs anywhere, and nothing in

RE: [SAtalk] AWL casuing false positives

2003-12-12 Thread Colin A. Bartlett
Matt Kettler Sent: Friday, December 12, 2003 11:16 AM At 10:10 AM 12/12/2003, Colin A. Bartlett wrote: I have found that AWL works quite well and I keep it enabled. The only time that it is a pain is if I send myself or someone else a test using GTUBE. That f's up the AWL until I send a few

Re: [SAtalk] Nested Meta Rules

2003-12-12 Thread Matt Kettler
At 11:12 AM 12/12/2003, Nayana Hettiarachchi wrote: i have made few customs rules and i was playing around with them little more and i was kinda curious if a rule like this will actually work, as per my experiment i noticed that it is not working. meta TTOFFICE_BLOCK (__TOOFFICE

[SAtalk] SA Ximian Evolution 1.4

2003-12-12 Thread Karl Hakmiller
I've tried everything I can think of to get the Evolution (1.4) mail client to use SA (2.60) as a filter for spam mail but have come up MT. The Evo FAQ states that Use Specific Headers and X-Spam-Flag (Yes) will work but it doesn't. Neither does any other X-* header value of the many I've tried.

RE: [SAtalk] Mysterious SA tags in SPAM message?

2003-12-12 Thread Gary Funck
Ah. That's what I was starting to think as I typed up my original message. I agree. It seems funny to do a check for SPAM and not do any sort of check for open relay. I'm no expert on Received headers, but: Received: from 212.214.136.47 (EHLO smtp-fe2.ballou.se)

Re: [SAtalk] SA Ximian Evolution 1.4

2003-12-12 Thread Rubin Bennett
What exactly are you trying to do? I use Sendmail-Procmail-SA on my mailserver (Mandrake 9.2). I access my email via IMAP using Evolution 1.4. I used the Evolution filters successfully for quite some time until I started using SA. Now I have *no* rules in my Evolution filters, and a simple

[SAtalk] SA report on an email ?

2003-12-12 Thread Darxus
How can I see a spamassassin report of an email ? I'd like to do something like pipe the email through a command. With spamprobe I do spamprobe -T score, and it tells me everything it thought about the email. In my SA preferences I have: rewrite_subject 0 report_safe 0 clear_headers add_header

[SAtalk] DB_File problem prevents Bayes working

2003-12-12 Thread Fred Bennett
Hello. My first post here, so be gentle ;-) I got Spamassassin 2.61 installed and it's working. Bayes is enabled, but when I try to train it or do anything with sa-learn I get something like this: Use of uninitialized value in numeric lt () at

RE: [SAtalk] SA tests performed

2003-12-12 Thread Barb Bautista
Thanks T, Can you recommend a good site for building/customizing rule sets. Thanks. -Original Message- From: Terry Milnes [mailto:[EMAIL PROTECTED] Sent: Wednesday, December 10, 2003 10:45 AM To: Barb Bautista Cc: [EMAIL PROTECTED] Subject: Re: [SAtalk] SA tests performed Barb

[SAtalk] Will Recipe work to skip certian messages?

2003-12-12 Thread Mitchell D. Baker
What I want to do is skip an message that originates from our domain... I have the following in the /etc/procmailrcfile: :0: * [EMAIL PROTECTED] ${DEFAULT} # From system.rose-hulman.edu :0: * [EMAIL PROTECTED] ${DEFAULT} # This seems to work most of the time we when certain messages have

[SAtalk] regarding spamassassin configuration

2003-12-12 Thread Hanumantharaju M
Hi, Can any one tell me the procedure to configure spamassassin with sendmail. I have sendmail 8.12.8 running, my case is a relay server(HUB) with no local accounts. i have installed spamassassin which runs as spamd. I want all the spam mails figured should be redirected to one of the

Re: [SAtalk] SA report on an email ?

2003-12-12 Thread Steve Thomas
On Fri, Dec 12, 2003 at 01:35:09PM -0500, [EMAIL PROTECTED] is rumored to have said: How can I see a spamassassin report of an email ? I'd like to do something like pipe the email through a command. spamassassin -t email.txt -- I've had a wonderful time, but this wasn't it. - Groucho

Re: [AMaViS-user] Re: [SAtalk] Can't locate AAAA.pm

2003-12-12 Thread Mark Martinec
Per, | I'm having trouble with a newly installed server. | OpenBSD 3.4 GENERIC#0 i386 | amavisd-new latest stable | amavisd is running chroot'ed | | /usr/local/libdata/perl5/site_perl/i386-openbsd/Net/DNS/RR/.pm | exists on the system. | Not all mails will trigger the following error, I'm

[SAtalk] daily / weekly reports

2003-12-12 Thread JohnT
hi all, will shortly be installing SA 2.61. i'd like to have a report sent to me with a breakdown of SA's activity, either daily or weekly or whatever. ideally, for it to list Sender, Recipient, Subject and Spam Score for all mails that have been marked as Spam. was thinking of writing a shell

[SAtalk] Question on SUBJ_HAS_UNIQ_ID-test

2003-12-12 Thread Mika A
Joop, how come our SA 2.60 matches this subject-header: Subject: Opetusteknologia-valmistelua with SUBJ_HAS_UNIQ_ID-rule? The subject is perfectly legit finnish and doesn't seem that unique... Thanks! -- Mika Aleksandroff - IT Services, Kymenlaakso Polytechnic

[SAtalk] SPAMD and SA-Learn

2003-12-12 Thread Mike Dabbs
I've been using SA for a little while now but am still not up to speed on all it can do. We are mostly a Windows shop here so we have very few techs who know Linux that well. We're using SPAMD to filter email and use a Windows-based email proxy to send/receive info to/from the SPAMD host. It

[SAtalk] Can't exec /tmp/bin/vuserinfo

2003-12-12 Thread Ross Tsolakidis
Hi all, I recently moved from SpamAssassin 2.2 to 2.6 and I have an error which has totally stumped me. SpamAssassin is catching spam (see below) but every now and then I don't actually get the original spam message, 60 % of the time I do, it's very temperamental. Eg: Dec 11 14:34:44

[SAtalk] SpamAssassin Procmail

2003-12-12 Thread Daniel Kaliel
I read through the readme and made a config change to the way procmail and spamassassin work together, however I now get the error: couldn't create or rename temp file. "/var/spool/mail/il -oi [EMAIL PROTECTED] I have a default /etc/procmailrc with the lines :0fw: spamassassin.lock *

[SAtalk] RE: Using outlook mail to feed sa-learn

2003-12-12 Thread John Hall
Hamilton, Kent [EMAIL PROTECTED] wrote in message news:[EMAIL PROTECTED] com... On your Linux box create three mail aliases (In sendmail syntax) spamlearn:|/usr/local/bin/sa-learn --spam --norebuild hamlearn: |/usr/local/bin/sa-learn --ham --norebuild spamforget:

[SAtalk] Memory leaks in Spam Assassin 2.5x and 2.6x on Solaris 9.

2003-12-12 Thread Andrew Whyte
Hi all, (Firstly, I'm not on this list, I'm only using it to log a bug. can you please reply directly to me, Thanks) I am seeing rather bad memory leak issue running spamd on Solaris 9 (sparc). I have Exim + Exiscan MTA, this allows parsing the messages off to SA for scanning, it's been

[SAtalk] Spam Domain Subject BlackLists for SA/Postfix/Modusgate

2003-12-12 Thread Dave Schneider
Compiled list of domains that are known spammers and compiled list of various subject lines used by spammers. http://www.exit0.us/index.php/SpamDomainBlackList or http://www.spamfighter.org/bb/article.php?42.0 --- This SF.net email is

[SAtalk] Re: [AMaViS-user] how to change config path of SA ?

2003-12-12 Thread Mark Martinec
Stephen, | RH9, amavisd-new (p6), spamassassin 2.6 : | | I believe the config path that spamassassin is using is | /usr/share/spamassassin. | However, I want it to use my chrooted amavis directory of | /var/amavisd/usr/share/spamassassin. | | How and where can I change this ? You need to

[SAtalk] help with spamassassin

2003-12-12 Thread Tuan Dao
hi spamassassin, i have to write an essay about spamassassin. my english is not very good. so is there a chance to get a german translation of your website or some other information?? greetings

Re: [SAtalk] Re: RHSBL Usage

2003-12-12 Thread Jeffrey Posluns
Thanks for the reference! If anyone wants to use blackhole.securitysage.com in SpamAssassin, here's how: header BLACKHOLE_SSAGE eval:check_rbl_from_host('ssage', 'blackhole.securitysage.com') describe BLACKHOLE_SSAGE Blacklisted as per blackhole.securitysage.com tflags

RE: [SAtalk] Mysterious SA tags in SPAM message?

2003-12-12 Thread Bruno Guerreiro
Hi. 503 is the userid of the spamd user. Since the first header indicates the localhost, my guess is that the mail was sent from the postfix machine itself, and not from another machine using it as a relay. Best regards. Bruno Guerreiro -Original Message- From: Gary Funck [mailto:[EMAIL

Re: [SAtalk] SA report on an email ?

2003-12-12 Thread Evan Platt
--On Friday, December 12, 2003 1:35 PM -0500 [EMAIL PROTECTED] wrote: How can I see a spamassassin report of an email ? I'd like to do something like pipe the email through a command. spamassassin filename1 filename2 filename1 is the input, filename2 is the output. Or alternately,

Re: [SAtalk] SA Ximian Evolution 1.4

2003-12-12 Thread Kenneth Porter
--On Friday, December 12, 2003 1:31 PM -0500 Rubin Bennett [EMAIL PROTECTED] wrote: Now I have *no* rules in my Evolution filters, and a simple .procmailrc in my home directory that grabs all the X-Spam-Status: Yes marked mails and dumps them into my Junk IMAP folder. After getting frustrated

Re: [SAtalk] Mass-check corpus cleanup using included scripts. How??

2003-12-12 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Smart,Dan writes: I'm trying to do the mass-check corpus cleanup using the method in CORPUS_SUBMIT file. My hard-sorted spams and hams are stored in MBOXs. I'm assuming that the scripts: mass-check-results-to-mbox, mboxget, and

RE: [SAtalk] Question on SUBJ_HAS_UNIQ_ID-test

2003-12-12 Thread Mike Kuentz (2)
from looking at the eval test that runs for that rule, it checks against an English dictionary. Maybe you should disable the test score SUBJ_HAS_UNIQ_ID 0 Mike -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mika A Sent: Friday, December 12,

Re: [SAtalk] Hit Digits

2003-12-12 Thread Matt Kettler
At 10:50 AM 12/12/2003, Kai Poppe/Redaktion SDCE wrote: Nope, mine does not. SpamAssassin 2.61 is the version. Hmm, you're right.. It looks like that rounding behavior is hard-coded.. you'd have to modify the source code to change it. ---

Re: [SAtalk] SA Ximian Evolution 1.4

2003-12-12 Thread Rubin Bennett
For those times that I'm on the road and not able to fire up Evolution (bummer...), I use SquirrelMail on my server for webmail access. It's fast, clean, and It Just Works(tm). If you don't use Procmail on your IMAP server, it's VERY simple to add a rule to Evo to grab messages with the

RE: [SAtalk] SA tests performed

2003-12-12 Thread Chris Thielen
Barb Bautista said: Thanks T, Can you recommend a good site for building/customizing rule sets. Thanks. A good place to get started is www.exit0.us --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or

RE: [SAtalk] SA tests performed

2003-12-12 Thread Yackley, Matt
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Barb Bautista Sent: Wednesday, December 10, 2003 9:47 AM To: [EMAIL PROTECTED] Subject: RE: [SAtalk] SA tests performed Thanks T, Can you recommend a good site for building/customizing rule

[SAtalk] /tmp/sa.*

2003-12-12 Thread Erick Calder
I had a problem earlier where SA was hanging up incoming messages. the spamd process would spawn but never finish till my box was 100% busy. apparently the problem had to do with an upgrade of 2.44 to 2.60. I removed the old whitelist and bayes files for all my users and spamd recreated them

Re: [SAtalk] SA report on an email ?

2003-12-12 Thread Darxus
On 12/12, Steve Thomas wrote: spamassassin -t email.txt On 12/12, Matt Kettler wrote: pipe it through spamassassin -t Note: -t mode FORCES sa to generate a report, and it WILL contain text Works beautifully, thank you both. I swear I looked at the man page... don't know how I missed

RE: [SAtalk] RD: justified HTML

2003-12-12 Thread Matthew . van . Eerde
I get the justified part of your rule, but what about the rule references HTML? I'd consider renaming your rule to JUSTIFIED_74_EQUAL or some such. -Original Message- From: Regis Wilson [mailto:[EMAIL PROTECTED] Sent: Friday, December 12, 2003 9:35 AM To: [EMAIL PROTECTED] Subject:

[SAtalk] Virginia Busts Spammers

2003-12-12 Thread Scott Rothgaber
http://www.cnn.com/2003/TECH/internet/12/12/spam.charges/index.html --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything

RE: [SAtalk] Mass-check corpus cleanup using included scripts. Ho w??

2003-12-12 Thread Smart,Dan
Thanks for the insight. When I run mass-check-results-to-mbox I get: --- # sort -rn +1 ham.log | head -20 | ./mass-check-results-to-mbox open /usr/local/src/confham.1173754 failed: at ./mass-check-results-to-mbox line 125, line 1. X-Mass-Check-Warning: open

Re: [SAtalk] Virginia Busts Spammers

2003-12-12 Thread Greg Cirino - Cirelle Enterprises
No noticeable decrease in spam here... did they get the right guys? g - Original Message - From: Scott Rothgaber [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, December 12, 2003 2:20 PM Subject: [SAtalk] Virginia Busts Spammers |

Re: [SAtalk] Virginia Busts Spammers

2003-12-12 Thread Larry Rosenman
--On Friday, December 12, 2003 14:33:34 -0500 Greg Cirino - Cirelle Enterprises [EMAIL PROTECTED] wrote: No noticeable decrease in spam here... did they get the right guys? Yeah, but there are tons more to get :-(. the Policy Enforcement Director where I work was glad to see them caught,

[SAtalk] Rule Help...

2003-12-12 Thread Dan Tappin
Here is a custom rule for a PayPal spoof virus that is going around. I can't get this to trigger a hit in SA. I have linted my rules and my config files are being loaded properly. header PAYPAL_VIRUS_001 Subject =~ /YOUR PAYPAL\.COM ACCOUNT EXPIRES/i describe PAYPAL_VIRUS_001 Wonderfull

RE: [SAtalk] Detecting strings of Gibberish

2003-12-12 Thread Erick Calder
the site says one can enter an e-mail address OR a domain name, but if I enter a domain name (unchecking the Username and FullAddress checkboxes) it complains: : The input was not a valid email address as defined by RFC822. Please go : back and enter an address which conforms to RFC822 I want to

RE: [SAtalk] filtering spam tagged email before hitting exchange 2000

2003-12-12 Thread Erick Calder
Gentian, to help alleviate mail processing do also try any of a number of RBLs out there. these tend to be IP-based so your server will never actually receive mail. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of JRileySent: Wednesday, December 10,

Re: [SAtalk] Rule Help...

2003-12-12 Thread Fred
Dan Tappin wrote: Here is a custom rule for a PayPal spoof virus that is going around. I missed that one, try this out, they work for all previous scams I've seen. header __RCVD_PAYPAL Received =~ /paypal\.com/i header __FROM_PAYPAL From =~ /paypal\.com/i uri __URI_PAYPAL /paypal\.com/i

Re: [SAtalk] Rule Help...

2003-12-12 Thread Matt Kettler
At 02:50 PM 12/12/2003, Dan Tappin wrote: Here is a custom rule for a PayPal spoof virus that is going around. I can't get this to trigger a hit in SA. I have linted my rules and my config files are being loaded properly. Which configfile did you add your rule to? local.cf or user_prefs? Do

RE: [SAtalk] Training based on previously detected spam

2003-12-12 Thread Efren Pedroza
Hello there (I'm pretty newbiew on SA) and maybe my questions are stupid, but any way, 1. When I run SA-Lear on HAM and SPAM confirmed directories (let's talk about 800 mails on each one), but after that I still getting some SPAM that aren't detected, If I wan to run SA-learn again, do I have to

Re: [SAtalk] /tmp/sa.*

2003-12-12 Thread Simon Byrnand
I had a problem earlier where SA was hanging up incoming messages. the spamd process would spawn but never finish till my box was 100% busy. apparently the problem had to do with an upgrade of 2.44 to 2.60. I removed the old whitelist and bayes files for all my users and spamd recreated

[SAtalk] spamassassin -r: Clean Mail Before Reporting?

2003-12-12 Thread sabat
The spamassassin manpage talks about setting up an alias to report spam, piping the mail to spamassassin -r. Since this reports to DCC and Razor, shouldn't one clean up the headers first? Isn't there risk of getting your own domain name into the spam report? (Or at least into your own Bayes

Re: [SAtalk] spamassassin -r: Clean Mail Before Reporting?

2003-12-12 Thread Matt Kettler
At 03:33 PM 12/12/2003, sabat wrote: The spamassassin manpage talks about setting up an alias to report spam, piping the mail to spamassassin -r. Since this reports to DCC and Razor, shouldn't one clean up the headers first? Isn't there risk of getting your own domain name into the spam report?

[SAtalk] BigEvilList_170 and vnunet.com

2003-12-12 Thread Ken Gordon
BigEvilList_170 catches vnunet.com. Is that appropriate? --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the

Re: [SAtalk] SA Ximian Evolution 1.4

2003-12-12 Thread Rubin Bennett
In Evolution: Tools-Filters-Add If: Specific Header X-Spam-Status is Yes Then: Move to Folder Junk OK. The search for the specific header is case sensitive... make sure you're looking for hte right thing. Also, I assume that Evo will strip the trailing : from the header, so no need to put it in

Re: [SAtalk] BigEvilList_170 and vnunet.com

2003-12-12 Thread Matt Kettler
At 04:06 PM 12/12/2003, Ken Gordon wrote: BigEvilList_170 catches vnunet.com. Is that appropriate? Depends on what you consider appropriate.. bigevil is autogenerated from some piles of spam. As such, it's going to be prone to FP cases. Bounce a message to Chris S and ask him to double-check

Re: [SAtalk] SA + Openldap problem

2003-12-12 Thread Keith Olmstead
Anybody have any suggestions?? --Keith On Thu, 4 Dec 2003, Keith Olmstead wrote: Date: Thu, 4 Dec 2003 14:32:56 -0500 (EST) From: Keith Olmstead [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: [SAtalk] SA + Openldap problem --- This

[SAtalk] SpamAssassin with Sendmail and spamass-milter

2003-12-12 Thread Brian Sneddon
To any of you running SpamAssassin 2.60+ with SendMail and spamass-milter 0.2.0 I am curious as to whether the -notfirsthop rules (such as Dynablock) are working correctly for you. (I'm aware of its move to SORBS) When SpamAssassin processes email through spamass-milter it's rarely matching

Re: [SAtalk] Detecting strings of Gibberish

2003-12-12 Thread Lucas Albers
Archive of this: http://marc.theaimsgroup.com/?t=10613675441r=1w=2 Analyze letter frequency for normal words, and detect non-normal letter frequency of gibberish. --luke I have noticed that many SPAM emails, end with seversl lines of gibberish, such as: lvwpdfobv qkviylqr qlmwacbc

Re: [SAtalk] SpamAssassin 2.61 released!

2003-12-12 Thread Vivek Khera
Great news... Any idea on how a rather nasty bug can be addressed before the next release? I had hoped it would be addressed in 2.61 (I've been away from the list for a while so I didn't see the pre-announcements). It apparently is affecting a fair number of people aside from myself:

Re: [SAtalk] spamassassin -r: Clean Mail Before Reporting?

2003-12-12 Thread Theo Van Dinter
On Fri, Dec 12, 2003 at 12:33:26PM -0800, sabat wrote: The spamassassin manpage talks about setting up an alias to report spam, piping the mail to spamassassin -r. Since this reports to DCC and Razor, shouldn't one clean up the headers first? Isn't there risk of getting your own domain name

Re: [SAtalk] SA for IM?

2003-12-12 Thread Vivek Khera
JV == Jonathan Vanasco [EMAIL PROTECTED] writes: JV AOL IM JV Maybe its an ichat only thing -- because everyone i know running iChat JV gets 10+ AOL IM spams a day. I'm averaging 15. zero for me, and I run iChat. none on my yahoo, either. i occasionally get some troller randomly chatting

RE: [SAtalk] Rule Help...

2003-12-12 Thread Dan Tappin
Hi Matt, I created in a custom .cf file in /etc/mail/spamassassin Dan -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Matt Kettler Sent: Friday, December 12, 2003 1:05 PM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: Re: [SAtalk] Rule Help...

Re: [SAtalk] SpamAssassin 2.61 released!

2003-12-12 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Vivek Khera writes: Great news... Any idea on how a rather nasty bug can be addressed before the next release? I had hoped it would be addressed in 2.61 (I've been away from the list for a while so I didn't see the pre-announcements). It

Re: [SAtalk] SpamAssassin 2.61 released!

2003-12-12 Thread Mike Vanecek
On Fri, 12 Dec 2003 14:30:09 -0800, Justin Mason wrote [snip] http://bugzilla.spamassassin.org/show_bug.cgi?id=2569 Missed that one; I've just set it to be fixed for 2.62. It seems pretty complex; either there's several failure cases, or nobody has yet done enough diagnosis to get to the

Re: [SAtalk] SpamAssassin doesn't recognize my configuration files

2003-12-12 Thread Dr Aldo Medina
El dom, 30-11-2003 a las 01:28, Chris Thielen escribió: Dr Aldo Medina said: Using Debian Sarge with spamassassin-2.60-2 deb package and procmail-3.22-7. Even when it used to work, since a few weeks it seems like spamassassin doesn't follow my local.cf rules. For example, even when I

[SAtalk] how it works

2003-12-12 Thread pacho baratta
Title: how it works I have a fresh installation of SA, a default local.cf (attached) and nothing more. Now SA acts great on GTUBE test, but when I forward to my new SA protected account a spam message nothing happens. Whats the trick? pacho

Re: [SAtalk] Virginia Busts Spammers

2003-12-12 Thread Scott Williams , Area4
If you see two spammers hang hopefully a 100 will stop or atleast move off shore. SCott At 01:40 PM 12/12/2003, Larry Rosenman wrote: --On Friday, December 12, 2003 14:33:34 -0500 Greg Cirino - Cirelle Enterprises [EMAIL PROTECTED] wrote: No noticeable decrease in spam here... did they

Re: [SAtalk] SpamAssassin 2.61 released!

2003-12-12 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mike Vanecek writes: On Fri, 12 Dec 2003 14:30:09 -0800, Justin Mason wrote [snip] http://bugzilla.spamassassin.org/show_bug.cgi?id=2569 Missed that one; I've just set it to be fixed for 2.62. It seems pretty complex; either there's several

[SAtalk] Trouble with bayesian classification and autolearn

2003-12-12 Thread J. S. Greenfield
I've been experimenting with configuration of spamassassin for sitewide use (in particular, using spamassassin 2.60 with sa-exim 3.1 and exim 4.30, under Solaris 8), and for the life of me, I can't seem to get bayesian classification and autolearn working. No matter what I do, my X-Spam-Status

Re: [SAtalk] how it works

2003-12-12 Thread Matt Kettler
At 06:33 PM 12/12/2003, pacho baratta wrote: I have a fresh installation of SA, a default local.cf (attached) and nothing more. Now SA acts great on GTUBE test, but when I forward to my new SA protected account a spam message nothing happens. What's the trick? forwarded spam is not the same as

Re: [SAtalk] Trouble with bayesian classification and autolearn

2003-12-12 Thread Matt Kettler
At 06:37 PM 12/12/2003, J. S. Greenfield wrote: bayes_path /etc/mail/spamassassin/bayes bayes_file_mode 0666 where both the bayes_path directory, and the spamd home directory (it's parent), are owned by spamd, and world writeable, at this point, for good measure. There's

[SAtalk] Spamassassin for qmail group alias

2003-12-12 Thread Asif Iqbal
Hi All I have been running spamassassin for my .qmail for a while with excellent success rate. But now I like to use it for a group alias This is how I have it set up # .qmail-group | /usr/local/bin/spamassassin | forward [EMAIL PROTECTED] Is it a valid setup ? I did receive a test email

RE: [SAtalk] Rule Help...

2003-12-12 Thread Matt Kettler
At 05:10 PM 12/12/2003, Dan Tappin wrote: Hi Matt, I created in a custom .cf file in /etc/mail/spamassassin Dan Hmm, then that should work correctly... --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or

[SAtalk] Re: Virginia Busts Spammers

2003-12-12 Thread Bryan Hoover
Scott Williams , Area4 wrote: If you see two spammers hang hopefully a 100 will stop or atleast move off shore. I was just thinking, I know spam is a big problem, and all that, but reading the article, I don't know. I hate to sound schizophrenic, but I mean, surely these guys are not

Re: [SAtalk] Re: Virginia Busts Spammers

2003-12-12 Thread Simon Byrnand
Scott Williams , Area4 wrote: If you see two spammers hang hopefully a 100 will stop or atleast move off shore. I was just thinking, I know spam is a big problem, and all that, but reading the article, I don't know. I hate to sound schizophrenic, but I mean, surely these guys are not

Re: [SAtalk] OUTCH! *OBFU*-Checks hit 'attached RFC-conform Mail'

2003-12-12 Thread Chris Thielen
On Fri, 2003-12-05 at 14:37, Chr. von Stuckrad wrote: Hi! I just found a perfectly legitimate E-Mail which neighter contained Spam-Text nor any html in my Spambox, hit by two 'ofsucation checks'. One I had generated with https://sandgnat.com/cmos/cmos.jsp in response to the ever

Re: [SAtalk] Re: paris hilton

2003-12-12 Thread Chris Thielen
On Fri, 2003-12-05 at 13:22, Chris Thielen wrote: Adam D. Lopresto said: snip My solution was to split the tokens into word/nonword classes and group them. The characters in the word character class get the \b word boundary check, while the non-word character classes simply match

Re: [SAtalk] Re: paris hilton

2003-12-12 Thread Chris Thielen
On Fri, 2003-12-05 at 12:05, Chris Thielen wrote: [EMAIL PROTECTED] said: snip If I enter a single-character string in the easy mode text box, the rules will somehow manage to drop the character from the obfuscated rules. I.e. for the input d I get the regex /(?!\bd\b)\b/i (and not the

Re: [SAtalk] Trouble with bayesian classification and autolearn

2003-12-12 Thread J. S. Greenfield
Thanks. I installed BerkeleyDB, DB_File, and corrected bayes_path as you indicated. No apparent change in behavior. Any other thoughts? Thanks, Jonathan Matt Kettler wrote: At 06:37 PM 12/12/2003, J. S. Greenfield wrote: bayes_path /etc/mail/spamassassin/bayes bayes_file_mode

Re: [SAtalk] Re: paris hilton

2003-12-12 Thread Chris Thielen
On Fri, 2003-12-12 at 19:44, Chris Thielen wrote: I haven't updated the version history because exit0 appears to be down, but the main link (http://sandgnat.com/cmos/cmos.pl) or the cgi Er... I'm dumb. Make that http://sandgnat.com/cmos/obfu.pl ... sure wish this list thing had a cancel

  1   2   >