[SAtalk] a few newbie questions

2003-12-21 Thread Geoffrey Lane
I would like to increase the accuracy of my spamassassin rules... First I have used kmail and piped my mail through the standard /usr/bin/spamassassin without any switches if size of message is less than 250kb and my next rule filters the mail with a X-Spam-Status: YES header to filter to a

[SAtalk] MSGID_FROM_MTA_SHORT problem

2003-12-21 Thread Andreas Kotowicz
Hi, I just received an email from a friend that was marked as spam - though it isn't spam. (I'm using spamassassin 2.61). here are the headers: MIME-Version: 1.0 Content-Type: multipart/related; boundary==_NextPart_000_0075_01C3C7D9.80663B40 X-Mailer: Microsoft Office Outlook, Build

[SAtalk] random words spam

2003-12-21 Thread es
Is there an sa recipe for this latest innovation, with body as follows? pique tantrum bob deduce bizarre proscribe tropopause amtrak goal canst fool earphone anisotropic horrify casein traversable anion cell stolen contact uproot descent Thanks Newbie question - how do I automatically have my

[SAtalk] spamd timeouts

2003-12-21 Thread Jack Gostl
Every now and then a spam slips through with no header markups. I finally tracked some of these down and found that spamd took so long to finish that spamc finally timed out. (In this case, 742 seconds.) I'm not sure what causes this. I'm running 2.60, and I thought that very slow RBLs were

[SAtalk] Re: random words spam

2003-12-21 Thread David Gibbs
[EMAIL PROTECTED] wrote: Is there an sa recipe for this latest innovation, with body as follows? This spam seems to be designed to bypass bayesian analysis ... and it appears to work. Almost every piece of spam like this I've seen has the BAYES_00 rule, which has a negative score. Almost all

Re: [SAtalk] Provider issue

2003-12-21 Thread Erik van der Meulen
On Sat, Dec 20, 2003 at 12:29:26PM +0100, Erik van der Meulen wrote: Now I thought of the following scenario: If I filter my incoming mail first with: spamassassin -d in order to get 'vanilla' messages (remove signs of my ISP's check) and consecutively do a normal SA spam-check as I

[SAtalk] ... SA 2.61 eats mails ...

2003-12-21 Thread Kai Poppe/Redaktion SDCE
Hello list, i've got a serious problem on my hand. Having installed postfix i set up SpamAssassin and it perfectly worked until 2 days ago. I believe, I changed nothing important but suddenly the mails piped from spamassassin through sendmail to run into the appropiate mailboxes are deleted the

RE: [SAtalk] MSGID_FROM_MTA_SHORT problem

2003-12-21 Thread Gary Funck
Known problem/bug? http://bugzilla.spamassassin.org/show_bug.cgi?id=2311 If it is not working for you, you can disable the test by setting its score to 0: SCORE MSGID_FROM_MTA_SHORT 0 in your user_prefs, or local.cf depending upon whether you're running as a user or a sysadmin. -Original

Re: [SAtalk] Re: random words spam

2003-12-21 Thread Chris Thielen
David Gibbs said: [EMAIL PROTECTED] wrote: Is there an sa recipe for this latest innovation, with body as follows? This spam seems to be designed to bypass bayesian analysis ... and it appears to work. Almost every piece of spam like this I've seen has the BAYES_00 rule, which has a

Re: [SAtalk] ... SA 2.61 eats mails ...

2003-12-21 Thread Rubin Bennett
SA Can't delete anything, so it's either your MDA (probably Procmail) or your email client (broken filter?) that's doing the deleting. HTH, Rubin On Sun, 2003-12-21 at 12:34, Kai Poppe/Redaktion SDCE wrote: Hello list, i've got a serious problem on my hand. Having installed postfix i set up

[SAtalk] replacing .cf files

2003-12-21 Thread Amnon
Since I didn't get any replies to my question about replacing the .cf files in /usr/share/spamassassin with the newer ones that are on the SA site (running ver. 2.60), I decided to try it anyway. Well no errors, log looks fine, and spam is being flaged. That is until. Later on in the day I

Re: [SAtalk] replacing .cf files

2003-12-21 Thread Brook Humphrey
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sunday 21 December 2003 12:04 pm, Amnon wrote: So I guess one cannot just replace the .cf files with newer ones, right? not sure what version you are using but it would appear not. On a side not when I upgraded my servers to using 2.60 I found it

Re: [SAtalk] Non-functioning sa-learn in SA 2.61 on Mandrake 9.2 system

2003-12-21 Thread Ian Southam
My sa-learn is no longer working. I had it functioning under Mandrake 9.1 and again under Mandrake 9.2 upgraded from 9.1. Check you have a perl module called DB_File installed. Without this, sa-learn will quietly fail (unless you have debug switched on). -- Ian

Re: [SAtalk] replacing .cf files

2003-12-21 Thread Martin Radford
At Sun Dec 21 20:04:48 2003, Amnon wrote: Since I didn't get any replies to my question about replacing the .cf files in /usr/share/spamassassin with the newer ones that are on the SA site (running ver. 2.60), I decided to try it anyway. Well no errors, log looks fine, and spam is being

[SAtalk] Image-only spam

2003-12-21 Thread Barry Callahan
I installed Spamassassin from a RedHat RPM as a test a day or two ago, and it's properly flagging about 1/3 of the incoming SPAM as such. I have not played around with any of the settings yet. Half of what's getting through has a score of 3.6 - 4.0. This is not the group that overly concerns

[SAtalk] To: you Cc: friend -- New spammer trick?

2003-12-21 Thread Bob Proulx
In the last month my girlfriend and I have been getting a number of spams which have been addressed To: me and Cc: to her. This seems to be a new spammer trick. Use not just a database of email addresses but a database of To: Cc: headers combined in an attempt to get through people's filters.

RE: [SAtalk] Image-only spam

2003-12-21 Thread Tom Meunier
Before you play with the settings, consider updating to the current version of SpamAssassin. You're probably using 2.44; the current version is 2.61. At this point, that much spam getting through would be expected behavior. -tom -Original Message- From: [EMAIL PROTECTED]

RE: [SAtalk] Image-only spam

2003-12-21 Thread Gary Funck
Try Fred's rules, http://www.merchantsoverseas.com/wwwroot/gorilla/90_FVGT.cf esp. this combo image only rule: metaFVGT_combo_IMAGEONLY1 ((HTML_IMAGE_ONLY_02 + MIME_HTML_ONLY + MIME_HTML_ONLY_MULTI) 1) describeFVGT_combo_IMAGEONLY1 FVGT - Image only type spam? score

Re: [SAtalk] Non-functioning sa-learn in SA 2.61 on Mandrake 9.2 system

2003-12-21 Thread Clive Dove
On Sunday 21 December 2003 15:28, Ian Southam wrote: My sa-learn is no longer working. I had it functioning under Mandrake 9.1 and again under Mandrake 9.2 upgraded from 9.1. Check you have a perl module called DB_File installed. Without this, sa-learn will quietly fail (unless you

Re: [SAtalk] Non-functioning sa-learn in SA 2.61 on Mandrake 9.2 system

2003-12-21 Thread Larry Rosenman
--On Sunday, December 21, 2003 17:48:35 -0500 Clive Dove [EMAIL PROTECTED] wrote: On Sunday 21 December 2003 15:28, Ian Southam wrote: My sa-learn is no longer working. I had it functioning under Mandrake 9.1 and again under Mandrake 9.2 upgraded from 9.1. Check you have a perl module

Re: [SAtalk] Image-only spam

2003-12-21 Thread Barry Callahan
Heh. Ya know what? You were right. RedHat gave me 2.44. I just upgraded to 2.6.1 We'll see how it goes. Thanks. Barry Tom Meunier wrote: Before you play with the settings, consider updating to the current version of SpamAssassin. You're probably using 2.44; the current version is

[SAtalk] Strange DNSBL problem with spamassassin

2003-12-21 Thread Robert Lacroix
Hi all, I have a strange problem with SpamAssassin and I can't find out a solution to this: We use a McAfee Webshield SMTP in front of an IMail server, that scans for viruses and passes emails to IMail which runs on another port than 25. IMail analyzes the email then using spamc/spamd. When a

[SAtalk] Scanning bounce message attachments ?

2003-12-21 Thread Simon Byrnand
Hi All, Recently our domain has been joe jobbed by some spammer, so our users are getting a lot of bounce messages with spam attachments. Unfortunately SpamAssassin is letting most of them through because the header tests won't match the headers from the attached spam message. Is there any

[SAtalk] spamp.py and 4 hard messages

2003-12-21 Thread PieterB
Hello, I created a Python script that can process Unix mbox files and generate statistics on the Bayesian filtering of SpamAssassin. I've ran the script (called 'spamp.py') on a Unix mbox containing a total of 4381 messages. The mbox contained 2615 dutch non-spam messages, 1 misclassified

Re: [SAtalk] To: you Cc: friend -- New spammer trick?

2003-12-21 Thread Evan Platt
--On Sunday, December 21, 2003 3:13 PM -0700 Bob Proulx [EMAIL PROTECTED] wrote: In the last month my girlfriend and I have been getting a number of spams which have been addressed To: me and Cc: to her. This seems to be a new spammer trick. Use not just a database of email addresses but a

[SAtalk] memory leaking spamd procs

2003-12-21 Thread jpff
(writing on behalf of the day job) We are suffering from run-away spamd processes, growing to large memory usage and in effect killing all mail delivery. This last happened Sunday pm and until someone gets to the office we are still without mail. Looking through the archives I found a message