Re: [Fwd: Re: uol.com.br]

2005-11-16 Thread jdow
From: "Justin Mason" <[EMAIL PROTECTED]> -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Doc Schneider writes: I'm having one of those days. Original Message Subject: Re: uol.com.br jdow wrote: > Does that ISP have ANY redeeming virtues? I'm about to blacklist it > complet

Re: [Fwd: Re: uol.com.br]

2005-11-16 Thread Dan Hollis
On Wed, 16 Nov 2005, Justin Mason wrote: jdow wrote: Does that ISP have ANY redeeming virtues? I'm about to blacklist it completely due to its repeated "AntiSpam UOL" messages clogging my machine. I got a C/R from them after I posted to the fedora. I just killfiled it. use the 20_vbounce.cf ru

Re: [Fwd: Re: uol.com.br]

2005-11-16 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Doc Schneider writes: > I'm having one of those days. > > > > Original Message > Subject: Re: uol.com.br > Date: Wed, 16 Nov 2005 22:46:13 -0600 > From: Doc Schneider <[EMAIL PROTECTED]> > To: jdow <[EMAIL PROTECTED]> > References

[Fwd: Re: uol.com.br]

2005-11-16 Thread Doc Schneider
I'm having one of those days. Original Message Subject: Re: uol.com.br Date: Wed, 16 Nov 2005 22:46:13 -0600 From: Doc Schneider <[EMAIL PROTECTED]> To: jdow <[EMAIL PROTECTED]> References: <[EMAIL PROTECTED]> jdow wrote: Does that ISP have ANY redeeming virtues? I'm about t

uol.com.br

2005-11-16 Thread jdow
Does that ISP have ANY redeeming virtues? I'm about to blacklist it completely due to its repeated "AntiSpam UOL" messages clogging my machine. {^_^}

Re: RATWARE_ZERO_TZ=4.1

2005-11-16 Thread Kelson
Steven Lamb wrote: I guess if this is the case I need to lower the score for that rule as my kill value is a 3.5 If you're going to use SARE rules, you probably shouldn't lower your threshold. SARE, like the built-in SA rules, is calibrated for a threshold of 5. If a legit message hits 4.99

Re: RATWARE_ZERO_TZ=4.1

2005-11-16 Thread Matt Kettler
Steven Lamb wrote: > This is interesting. I would think that this rule could cause several > false positives. For instance anyone that is a hotmail user and has a > name that matches one of those patterns. I guess if this is the case I > need to lower the score for that rule as my kill value is a 3

Re: RATWARE_ZERO_TZ=4.1

2005-11-16 Thread Steven Lamb
This is interesting. I would think that this rule could cause several false positives. For instance anyone that is a hotmail user and has a name that matches one of those patterns. I guess if this is the case I need to lower the score for that rule as my kill value is a 3.5, or even worse how ab

Re: SARE stock ruleset? (Re: custom rule help)

2005-11-16 Thread Chris Thielen
Wolfgang Zeikat wrote: SARE is about to release a stock ruleset. Looks really good. I was going to work on one, Then I saw the ninjas have it under control, and I'm just sitting back and watching the fun. Not sure on the release date. GO, ninjas, GO! Any news when that one is going to be av

Re: RATWARE_ZERO_TZ=4.1

2005-11-16 Thread Matt Kettler
Steven Lamb wrote: > I have a false positive that I had to release two of today with this > rule as what appears to be the offending rule. can someone explain to me > what this rule checks for. so that I can try to fix it or just get rid > of it > It's looking for a combination of 3 things: 1) D

RATWARE_ZERO_TZ=4.1

2005-11-16 Thread Steven Lamb
I have a false positive that I had to release two of today with this rule as what appears to be the offending rule. can someone explain to me what this rule checks for. so that I can try to fix it or just get rid of it thanks Steven Lamb

SARE stock ruleset? (Re: custom rule help)

2005-11-16 Thread Wolfgang Zeikat
On 10/20/05 17:57, Chris Santerre wrote: Company: Symbol: Price: SARE is about to release a stock ruleset. Looks really good. I was going to work on one, Then I saw the ninjas have it under control, and I'm just sitting back and watching the fun. Not sure on the release date. GO, ninjas

Re: error in counting score?

2005-11-16 Thread Michael Monnerie
On Mittwoch, 16. November 2005 15:47 Matt Kettler wrote: > I don't know, but since that X-Spam-Status was built by amavis, not > SA, I'd be venturing to guess it's an amavis bug. It could have > truncated the list of tests somewhere... It generally works, just this one Mail was strange. It's the f

Re: spam from unresolved ip

2005-11-16 Thread Igor
On Wed, 2005-11-16 at 15:31, Richard Pijnenburg wrote: > Igor, > > You are looking at the document for version 3.1.x > But if i look at the verion in your example mail i see > " X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on mail.aaa.ru " > Perhaps that's the reason why? I have looked

Re: Installation Issues

2005-11-16 Thread Theo Van Dinter
On Wed, Nov 16, 2005 at 01:35:50AM -0500, Joey wrote: > checking module dependencies and their versions... > Segmentation fault > > I am running SA on on a RH7.3, FC4 and RHES3 server the funny thing is the > ONLY box it's working on is the RH7.3 which was installed via CPAN. > > I get the same

RE: geocities rule?

2005-11-16 Thread Pierre Thomson
Daryl C. W. O'Shea wrote: > List Mail User wrote: >> Of course, the originals transmogrify quite quickly and the '/?' >> was posted a couple of days ago. > > Actually it was posted a couple weeks ago. About two or three days > later I started to get spams without the query string. The rule

Re: Better way to whitelist a host ?

2005-11-16 Thread Christopher X. Candreva
On Tue, 15 Nov 2005, Matt Kettler wrote: > It's still a fine idea.. you can use procmail rules to avoid calling SA > for some addresses. It's a little bit of a hack, but it's really good for > when you really want to make sure you don't mark a message. Sometimes the obvious goes right over my h

Re: Picture based spam

2005-11-16 Thread Matt Kettler
At 07:03 AM 11/16/2005, Tony Melia wrote: Hi, I have setup SA 3.1 under FC4, which is working quite well. However, one type of message that still gets through is a series of mails that are made up of no text other than a varying subject, then a picture, which is black text on white, which

Re: error in counting score?

2005-11-16 Thread Matt Kettler
At 03:57 AM 11/16/2005, Michael Monnerie wrote: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline *** PGP Signature Status: unknown key *** Signer: unknown, Key ID = 3911B93370545879 *** BEGIN PGP VERIFIED MESSAGE *** X-Virus

3.1.0 syslogging

2005-11-16 Thread David Stern
We upgraded a server recently from 3.0.4 to 3.1.0 on solaris. The install is in a non-standard location and we're not using the CPAN install procedure. The startup command is /opt/spamassassin/bin/spamd -d --syslog-socket=inet \ -r /var/tmp/spamdnew.pid -i --username=smmsp \ -

Re: Picture based spam

2005-11-16 Thread List Mail User
>... >Hi, >I have setup SA 3.1 under FC4, which is working quite well. However, >one type of message that still gets through is a series of mails that are >made up of no text other than a varying subject, then a picture, which is >black text on white, which looks exactly like an ordinary email

Re: spam from unresolved ip

2005-11-16 Thread Richard Pijnenburg
Igor, You are looking at the document for version 3.1.x But if i look at the verion in your example mail i see " X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on mail.aaa.ru " Perhaps that's the reason why? Igor wrote: When sendmail receive mail it does revers dns lookup, and write res

spam from unresolved ip

2005-11-16 Thread Igor
When sendmail receive mail it does revers dns lookup, and write results in header "Received:" in brackets (): Received: from smtp.osdl.org (smtp.osdl.org [65.172.181.4]) by ... I look at http://spamassassin.apache.org/tests_3_1_x.html (Tests Performed: v3.1.x) and have not found checks on unre

Picture based spam

2005-11-16 Thread Tony Melia
Hi,     I have setup SA 3.1 under FC4, which is working quite well.  However, one type of message that still gets through is a series of mails that are made up of no text other than a varying subject, then a picture, which is black text on white, which looks exactly like an ordinary email. 

Re: geocities rule?

2005-11-16 Thread List Mail User
>... >List Mail User wrote: >> Of course, the originals transmogrify quite quickly and the '/?' >> was posted a couple of days ago. > >Actually it was posted a couple weeks ago. About two or three days >later I started to get spams without the query string. The rule worked >well for a few

Score Info (was RE: error in counting score?)

2005-11-16 Thread Tony Melia
Just on this point, when I set up amavisd and spamassassin on a test RH9 server, U used to get the score info, e.g no_real_name=.5, blah_blah_blah=2. On a new fedora core 4 system, SA 3.10, I don't get this info. Is there a flag I can set to get it? Regards,

error in counting score?

2005-11-16 Thread Michael Monnerie
X-Virus-Scanned: amavisd-new at X-Spam-Status: Yes, hits=5.55 tagged_above=-999 required=5 tests=NO_REAL_NAME=0.55 X-Spam-Level: * X-Spam-Flag: YES Ever seen such a thing? Why is the score 5.55, when only one rules with 0.55 makes a hit? mfg zmi -- // Michael Monnerie, Ing.BSc --- it-m