Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread Mauricio Tavares
On Wed, Jul 9, 2014 at 5:44 PM, Ted Mittelstaedt wrote: > > > On 7/9/2014 11:37 AM, Mauricio Tavares wrote: >> >> On Wed, Jul 9, 2014 at 2:23 PM, Ted Mittelstaedt wrote: >>> >>> >>> First of all why do people insist on hiding names of companies that >>> do stuff like this? It just makes it look

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread John Hardin
On Wed, 9 Jul 2014, Ted Mittelstaedt wrote: You are an administrator. YOU ARE PAID BY CLUELESS USERS TO PROTECT THEM AND THEIR DATA, DAMMIT. ...unless it involves some actual, you know, effort on their part. And in this instance, Large DP Company *is* doing something proactive to protec

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread David F. Skoll
On Wed, 09 Jul 2014 14:44:27 -0700 Ted Mittelstaedt wrote: > David DID NOT say that. He said that "he was shocked to discover" > Why are you assuming he is under NDA or he is an employee of this > company? Let me clarify the situation: 1) I'm the owner of Roaring Penguin, so my boss is unlikel

Fwd: help with a sintax rule appreciated

2014-07-09 Thread Sergio
Hi all, first of all, big thanks for all the inputs. I am seeing a nice quantity of blocked spammers it was really a high rate of them and KAM you, as always, are right. It is taking some FP on the run, but from 640 blocked emails less than a 1 percent were FP, that FPs are being taking care on a

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread Ted Mittelstaedt
On 7/9/2014 11:37 AM, Mauricio Tavares wrote: On Wed, Jul 9, 2014 at 2:23 PM, Ted Mittelstaedt wrote: First of all why do people insist on hiding names of companies that do stuff like this? It just makes it look like your manufacturing an event that doesn't exist, it destroys your credibili

Re: I was wrong - Bayes filter not quite right

2014-07-09 Thread motty cruz
I had similar issue, I am running FreeBSD, in my etc/group vscan:*:110:clamav also, cd /var ls -la drwxr-x 8 vscan vscan amavis because inside /var/amavisd db .spamassassin Thanks, On Wed, Jul 9, 2014 at 1:26 PM, Bruce Sackett wrote: > On Jul 8, 2014, at 9:42 AM,

Re: I was wrong - Bayes filter not quite right

2014-07-09 Thread Bruce Sackett
On Jul 8, 2014, at 9:42 AM, John Hardin wrote: > > On Tue, 8 Jul 2014, motty cruz wrote: > >> Hi Bruce, >> I was having similar issues, can you do su - vscan and restart amavisd >> service? > > user "vscan" != user "amavis". > >> On Tue, Jul 8, 2014 at 8:54 AM, Bruce Sackett wrote: >> >>> S

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread Mauricio Tavares
On Wed, Jul 9, 2014 at 2:23 PM, Ted Mittelstaedt wrote: > > First of all why do people insist on hiding names of companies that > do stuff like this? It just makes it look like your manufacturing > an event that doesn't exist, it destroys your credibility. > You mean besides NDAs and polici

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread Ted Mittelstaedt
First of all why do people insist on hiding names of companies that do stuff like this? It just makes it look like your manufacturing an event that doesn't exist, it destroys your credibility. Secondly, if you think that this is an example of "badness" on Windows security best practices you sim

Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread David F. Skoll
On Wed, 09 Jul 2014 05:44:34 +0200 Karsten Bräckelmann wrote: > If you deliberately try to sneak past sensible security measures, you > should not be surprised to be blocked. The attempt by an honest user > to disguise any $file (he did it on purpose, so he knows there's > issues with that) is in

Re: Deleting Bayes Data and MySQL Tables

2014-07-09 Thread John Hardin
On Wed, 9 Jul 2014, Asai wrote: Greetings, We've been running Spamassassin (3.3.1 currently, concurrently with Amavis) using MySQL as a backend for many years now and we have 1 million + entries in the Bayes table. At this time, there seems to be a lot of spam getting through the filters an

Deleting Bayes Data and MySQL Tables

2014-07-09 Thread Asai
Greetings, We've been running Spamassassin (3.3.1 currently, concurrently with Amavis) using MySQL as a backend for many years now and we have 1 million + entries in the Bayes table. At this time, there seems to be a lot of spam getting through the filters and we currently have our spam leve

Re: help with a sintax rule appreciated

2014-07-09 Thread Kevin A. McGrail
On 7/9/2014 9:08 AM, RW wrote: VERP and similar schemes work on the envelope, so checking the From header should relatively safe. Not debating that point because it's not really my point. I'm trying to focus on the fact that the existence of the schema he is looking for with the rule looks t

Re: help with a sintax rule appreciated

2014-07-09 Thread RW
On Wed, 09 Jul 2014 08:54:08 -0400 Kevin A. McGrail wrote: > On 7/9/2014 1:00 AM, Sergio wrote: > > It seems that my rule using "Received" instead of "From" did the > > trick, the rule is working now. > Sergio, > > The format of that email address is likely verp or some related > format that enc

Re: help with a sintax rule appreciated

2014-07-09 Thread Kevin A. McGrail
On 7/9/2014 1:00 AM, Sergio wrote: It seems that my rule using "Received" instead of "From" did the trick, the rule is working now. Sergio, The format of that email address is likely verp or some related format that encodes the recipient in the From address so that bounces can be processed (h

Re: help with a sintax rule appreciated

2014-07-09 Thread RW
On Wed, 09 Jul 2014 13:42:26 +0200 Benny Pedersen wrote: > On 9. jul. 2014 07.00.44 CEST, Sergio wrote: > >It seems that my rule using "Received" instead of "From" did the > >trick, the rule is working now. It should run only on the From header. Otherwise it may FP on VERP and similar rewriting

Re: help with a sintax rule appreciated

2014-07-09 Thread Benny Pedersen
On 9. jul. 2014 07.00.44 CEST, Sergio wrote: >It seems that my rule using "Received" instead of "From" did the trick, >the rule is working now. It 2 diffrent spams :) >> These are the headers from amazoncoupons-user=domain@lastawhdak.com: > headerBLACKLIST_REGEXFrom:address =~ /\=.

Re: SA on a backup MX

2014-07-09 Thread Axb
On 07/09/2014 12:40 AM, RW wrote: use_learner 0 use_learner ( 0 | 1 ) (default: 1) Whether to use any machine-learning classifiers with SpamAssassin, such as the default 'BAYES_*' rules. Setting this to 0 will disable use of any and all human-trained classifiers.