Re: word file spam

2009-10-13 Thread Jonas Eckerman
McDonald, Dan wrote: The word doc has a pretty standard 419 body in it, I recall some mutterings on this list about using wvHtml to regularize word docs. My ExtractText plugin can use a command line tool to extract text from word documents and add the text to the message so it is available

Re: word file spam

2009-10-13 Thread Jonas Eckerman
John Hardin wrote: There were mutterings about a generic plugin that would take an attachment, process it somehow (e.g. wvHtml, antiword, ps2ascii, or whatever was appropriate), and insert the results into the body text to be scanned by the regular rules. That sounds very much like my

Re: Problems with Razor2

2009-10-13 Thread Matus UHLAR - fantomas
On 10.10.09 22:31, Rick Knight wrote: I have installed the latest SpamAssassin (3.2.5) and Razor2. Razor2 does not appear to be working. When I check my system logs I see this... warn: razor2: razor2 check failed: Permission denied razor2: Can't read conf file:

just enabled DCC

2009-10-13 Thread Dan Schaefer
I just enabled DCC yesterday and everything appears to be working (DCC is registered). Just to make sure, can someone post an email to pastebin that has a DCC hit? Thanks. -- Dan Schaefer Web Developer/Systems Analyst Performance Administration Corp.

Re: just enabled DCC

2009-10-13 Thread Jason Bertoch
Dan Schaefer wrote: I just enabled DCC yesterday and everything appears to be working (DCC is registered). Just to make sure, can someone post an email to pastebin that has a DCC hit? Thanks. IIRC, a message with test in the subject and body will match, although your logs should tell you

Re: just enabled DCC

2009-10-13 Thread Dan Schaefer
Jason Bertoch wrote: Dan Schaefer wrote: I just enabled DCC yesterday and everything appears to be working (DCC is registered). Just to make sure, can someone post an email to pastebin that has a DCC hit? Thanks. IIRC, a message with test in the subject and body will match, although your

Re: just enabled DCC

2009-10-13 Thread Jeff Mincy
From: Dan Schaefer d...@performanceadmin.com Date: Tue, 13 Oct 2009 08:54:29 -0400 Jason Bertoch wrote: Dan Schaefer wrote: I just enabled DCC yesterday and everything appears to be working (DCC is registered). Just to make sure, can someone post an email to

Re: Hostkarma whitelist needs something..

2009-10-13 Thread Jason Bertoch
Jari Fredriksson wrote: I just started using Katz's wiki rules and it brought HOSTKARMA with it. Is this really a whitelist? Funny, after the discussions yesterday, I did the same thing only to wake up this morning with a mess of mis-marked messages due to hits on hostkarma. Until I can do

Re: just enabled DCC

2009-10-13 Thread Matus UHLAR - fantomas
Dan Schaefer wrote: I just enabled DCC yesterday and everything appears to be working (DCC is registered). Just to make sure, can someone post an email to pastebin that has a DCC hit? Thanks. Jason Bertoch wrote: IIRC, a message with test in the subject and body will match, although

Re: just enabled DCC

2009-10-13 Thread Dan Schaefer
Jeff Mincy wrote: From: Dan Schaefer d...@performanceadmin.com Date: Tue, 13 Oct 2009 08:54:29 -0400 Jason Bertoch wrote: Dan Schaefer wrote: I just enabled DCC yesterday and everything appears to be working (DCC is registered). Just to make sure, can someone post an

Re: word file spam

2009-10-13 Thread Matus UHLAR - fantomas
John Hardin wrote: There were mutterings about a generic plugin that would take an attachment, process it somehow (e.g. wvHtml, antiword, ps2ascii, or whatever was appropriate), and insert the results into the body text to be scanned by the regular rules. On 13.10.09 11:13, Jonas

Re: word file spam

2009-10-13 Thread John Hardin
On Tue, 13 Oct 2009, Jonas Eckerman wrote: John Hardin wrote: There were mutterings about a generic plugin that would take an attachment, process it somehow (e.g. wvHtml, antiword, ps2ascii, or whatever was appropriate), and insert the results into the body text to be scanned by the

Re: just enabled DCC

2009-10-13 Thread Matus UHLAR - fantomas
On 13.10.09 09:18, Dan Schaefer wrote: I followed your instructions and received the following: [1486] dbg: dcc: network tests on, registering DCC [1486] dbg: dcc: dccifd is not available: no r/w dccifd socket found [1486] dbg: dcc: dccproc is not available: no dccproc executable found

Re: DNSBL Comparison 20091010

2009-10-13 Thread Matus UHLAR - fantomas
On søn 11 okt 2009 02:31:58 CEST, John Rudd wrote On Sat, Oct 10, 2009 at 16:44, Warren Togami wtog...@redhat.com wrote: Given that zen.spamhaus.org is a combination of XBL and PBL, this data seems to confirm the good reputation of Spamhaus. Er.. Zen is a combination of SBL, XBL, and PBL.

Re: just enabled DCC

2009-10-13 Thread Jeff Mincy
From: Dan Schaefer d...@performanceadmin.com Date: Tue, 13 Oct 2009 09:18:44 -0400 Jeff Mincy wrote: From: Dan Schaefer d...@performanceadmin.com Date: Tue, 13 Oct 2009 08:54:29 -0400 Jason Bertoch wrote: Dan Schaefer wrote: I just enabled

Re: just enabled DCC

2009-10-13 Thread Dan Schaefer
Jeff Mincy wrote: From: Dan Schaefer d...@performanceadmin.com Date: Tue, 13 Oct 2009 09:18:44 -0400 Jeff Mincy wrote: From: Dan Schaefer d...@performanceadmin.com Date: Tue, 13 Oct 2009 08:54:29 -0400 Jason Bertoch wrote: Dan Schaefer wrote:

Re: DNSBL Comparison 20091010

2009-10-13 Thread McDonald, Dan
On Tue, 2009-10-13 at 15:42 +0200, Matus UHLAR - fantomas wrote: On søn 11 okt 2009 02:31:58 CEST, John Rudd wrote On Sat, Oct 10, 2009 at 16:44, Warren Togami wtog...@redhat.com wrote: Given that zen.spamhaus.org is a combination of XBL and PBL, this data seems to confirm the good

Re: Problems with Razor2

2009-10-13 Thread Benny Pedersen
On tir 13 okt 2009 11:14:32 CEST, Matus UHLAR - fantomas wrote /etc/mail/spamassassin/.razor/razor-agent.conf what unix user have its homedir there ? -- xpoint

Re: DNSBL Comparison 20091010

2009-10-13 Thread Benny Pedersen
On tir 13 okt 2009 16:22:55 CEST, McDonald, Dan wrote On Tue, 2009-10-13 at 15:42 +0200, Matus UHLAR - fantomas wrote: On søn 11 okt 2009 02:31:58 CEST, John Rudd wrote On Sat, Oct 10, 2009 at 16:44, Warren Togami wtog...@redhat.com wrote: Given that zen.spamhaus.org is a combination of XBL

RE: SA needs a new paradigm for rule structure

2009-10-13 Thread Chris Santerre
-Original Message- From: Ted Mittelstaedt [mailto:t...@ipinc.net] Sent: 2009-10-10 02:40 To: Marc Perkel Cc: users@spamassassin.apache.org Subject: Re: SA needs a new paradigm for rule structure Marc Perkel wrote: I've brought this idea up over the years but I'll try to

Re: just enabled DCC

2009-10-13 Thread Jeff Mincy
From: Dan Schaefer d...@performanceadmin.com Date: Tue, 13 Oct 2009 10:17:43 -0400 Jeff Mincy wrote: From: Dan Schaefer d...@performanceadmin.com Date: Tue, 13 Oct 2009 09:18:44 -0400 Jeff Mincy wrote: From: Dan Schaefer

Re: Problems with Razor2

2009-10-13 Thread Matus UHLAR - fantomas
On tir 13 okt 2009 11:14:32 CEST, Matus UHLAR - fantomas wrote /etc/mail/spamassassin/.razor/razor-agent.conf On 13.10.09 16:27, Benny Pedersen wrote: what unix user have its homedir there ? according to OP, smmsp (iirc) -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/

RE: .cn Oddity

2009-10-13 Thread Chris Santerre
-Original Message- From: jdow [mailto:j...@earthlink.net] {^_-} (Some of the ninjas are burned out. I have one such to my back when we're both in the room beating away at our CPUs.) +1 burnout. Too many things going on. Will eventually get my 232nd wind and be back in

Re: SA needs a new paradigm for rule structure

2009-10-13 Thread Marc Perkel
Title: RE: SA needs a new paradigm for rule structure Chris Santerre wrote: -Original Message- From: Ted Mittelstaedt [mailto:t...@ipinc.net] Sent: 2009-10-10 02:40 To: Marc Perkel Cc: users@spamassassin.apache.org Subject: Re: SA

Re: just enabled DCC

2009-10-13 Thread Dan Schaefer
Jeff Mincy wrote: From: Dan Schaefer d...@performanceadmin.com Date: Tue, 13 Oct 2009 10:17:43 -0400 Jeff Mincy wrote: From: Dan Schaefer d...@performanceadmin.com Date: Tue, 13 Oct 2009 09:18:44 -0400 Jeff Mincy wrote: From: Dan Schaefer

Re: Problems with Razor2

2009-10-13 Thread Rick Knight
Benny Pedersen wrote: On tir 13 okt 2009 11:14:32 CEST, Matus UHLAR - fantomas wrote /etc/mail/spamassassin/.razor/razor-agent.conf what unix user have its homedir there ? Thanks for the reply Benny. No user uase it's homedir at /etc/mail/spamassassin/.razor. The user that spamassassin

Re: Problems with Razor2

2009-10-13 Thread Rick Knight
Matus UHLAR - fantomas wrote: On 10.10.09 22:31, Rick Knight wrote: I have installed the latest SpamAssassin (3.2.5) and Razor2. Razor2 does not appear to be working. When I check my system logs I see this... warn: razor2: razor2 check failed: Permission denied razor2: Can't read conf

Re: Problems with Razor2

2009-10-13 Thread Rick Knight
Rick Knight wrote: Matus UHLAR - fantomas wrote: On 10.10.09 22:31, Rick Knight wrote: I have installed the latest SpamAssassin (3.2.5) and Razor2. Razor2 does not appear to be working. When I check my system logs I see this... warn: razor2: razor2 check failed: Permission denied razor2:

Another dcc question

2009-10-13 Thread Rick Knight
Just following this thread because I recently got dcc working also. In my case I didn't have dcc installed. After installing dcc everything seems to be working but now I'm wondering about dccifd. On my system dccproc is in /usr/local/bin but dccifd is in /var/dcc/libexec/. I also have

Re: Another dcc question

2009-10-13 Thread Jeff Mincy
From: Rick Knight rick_kni...@rlknight.com Date: Tue, 13 Oct 2009 08:53:21 -0700 Just following this thread because I recently got dcc working also. In my case I didn't have dcc installed. After installing dcc everything seems to be working but now I'm wondering about dccifd.

Re: Another dcc question

2009-10-13 Thread Rick Knight
Jeff Mincy wrote: From: Rick Knight rick_kni...@rlknight.com Date: Tue, 13 Oct 2009 08:53:21 -0700 Just following this thread because I recently got dcc working also. In my case I didn't have dcc installed. After installing dcc everything seems to be working but now I'm

Re: Another dcc question

2009-10-13 Thread Jeff Mincy
From: Rick Knight rick_kni...@rlknight.com Date: Tue, 13 Oct 2009 09:42:18 -0700 Jeff Mincy wrote: From: Rick Knight rick_kni...@rlknight.com Date: Tue, 13 Oct 2009 08:53:21 -0700 Just following this thread because I recently got dcc working also. In

Re: Another dcc question

2009-10-13 Thread Rick Knight
Jeff Mincy wrote: From: Rick Knight rick_kni...@rlknight.com Date: Tue, 13 Oct 2009 09:42:18 -0700 Jeff Mincy wrote: From: Rick Knight rick_kni...@rlknight.com Date: Tue, 13 Oct 2009 08:53:21 -0700 Just following this thread because I recently got dcc

Re: Another dcc question

2009-10-13 Thread Rick Knight
Jeff Mincy wrote: From: Rick Knight rick_kni...@rlknight.com Date: Tue, 13 Oct 2009 09:42:18 -0700 Jeff Mincy wrote: From: Rick Knight rick_kni...@rlknight.com Date: Tue, 13 Oct 2009 08:53:21 -0700 Just following this thread because I recently got dcc

Re: word file spam

2009-10-13 Thread Jonas Eckerman
Matus UHLAR - fantomas wrote: Yes, but generic plugin should be able extract images for later processing (FuzzyOCR or maybe even things like Bayes) too ;) That would depend on what you mean by generic. :-) It's a generic text extractor plugin, with the ability to call an OCR program for

Re: White lists and white rules

2009-10-13 Thread J.D. Falk
Ted Mittelstaedt wrote: Thus, any reputable blacklist service will ALSO need to constantly monitor to make sure that any IP that's listed still deserves to be there. Absolutely. I keep forgetting that anyone would think otherwise; major spam sources haven't been stationary in years. --

Re: [SA] Rule and Rule

2009-10-13 Thread Mark Martinec
Adam, That example may have been overly simplistic, but I thought it conveyed the idea. To see a real-world example, see KHOP_DNSBL_ADJ in http://khopesh.com/sa/khop-bl/khop-bl.cf (though please use the actual channel if you're going to use my rules, otherwise you won't get updates). Btw,

Receiving errors in --lint -D about SARE rules

2009-10-13 Thread Kevin Gagel
I'm recieving errors when I run --lint -D. I know they're warnings and don't mean anything tragic but I'd like to correct my installation to make them go away... [5543] dbg: rules: meta test SARE_HEAD_SUBJ_RAND has undefined dependency 'SARE_XMAIL_SUSP2' [5543] dbg: rules: meta test

Re: Receiving errors in --lint -D about SARE rules

2009-10-13 Thread Benny Pedersen
On tir 13 okt 2009 23:24:20 CEST, Kevin Gagel wrote [5543] dbg: rules: meta test SARE_HEAD_SUBJ_RAND has undefined dependency 'SARE_XMAIL_SUSP2' meta SARE_XMAIL_SUSP2 (0) -- xpoint

Re: Receiving errors in --lint -D about SARE rules

2009-10-13 Thread Kevin Gagel
Uh... OK. Meaning Kevin W. Gagel Network Administrator Local 5448 My blog: http://mail.cnc.bc.ca/blogs/gagel My shared files: http://mail.cnc.bc.ca/users/gagel On Tuesday 10/13/2009 at 3:01 pm, Benny Pedersen wrote: On tir 13 okt 2009 23:24:20 CEST, Kevin Gagel wrote [5543] dbg:

Re: SA needs a new paradigm for rule structure

2009-10-13 Thread RW
On Mon, 12 Oct 2009 10:49:06 -0700 Ted Mittelstaedt t...@ipinc.net wrote: I think if you sit down and start trying to define examples and run them through large databases of spam and ham you will find that it doesen't work the way you think it does. That is what I was talking about when I

Re: SA needs a new paradigm for rule structure

2009-10-13 Thread Adam Katz
Chris Santerre wrote: I thought I remembered a few years back that Baysian chains had a 10% increase in capture rate over straight Bayes rules. I would think that this is similar. Marc Perkel wrote: I've always thought that a second basian filter that would just look at rule hits would be

Re: [SA] Rule and Rule

2009-10-13 Thread Adam Katz
Mark Martinec wrote: Adam, Btw, channels only provide the khop-sc-neighbors.sa.khopesh.com for SA 3.3.0, but not the khop-bl.sa.khopesh.com, khop-blessed.sa.khopesh.com, and khop-general.sa.khopesh.com . First: It's awesome to see interest in my channels! Second: you are correct. I do

Re: Receiving errors in --lint -D about SARE rules

2009-10-13 Thread Benny Pedersen
On ons 14 okt 2009 00:11:02 CEST, Kevin Gagel wrote Uh... OK. Meaning missing rule are created, and the dependice problem is solved :) just do this for ever rule that miss destination rules, if you want to keep sare ninjas going -- xpoint

Re: Hostkarma whitelist needs something..

2009-10-13 Thread Adam Katz
Jari Fredriksson wrote: TOP HAM RULES FIRED -- RANKRULE NAME COUNT %OFMAIL %OFSPAM %OFHAM -- 5RCVD_IN_HOSTKARMA_W