[SAtalk] Re: Is BigEvil for me?

Gary Funck wrote: > > > From: Robert Menschel > Here's an idea that I've been considering for a while: have SA change its > scoring strategy to use a Neural Net, instead of using the strictly additive > scoring. SA would still use its custom rules to detect spam markers, but it Just a couple comm

Re: [SAtalk] Questions about Bayes training

On January 09, 2004 10:49 pm, Robert Menschel wrote: > Hello Pedro, > > Friday, January 9, 2004, 11:58:55 AM, you wrote: > >> Probably some stupid questions, but I'm having trouble finding > >> documentation to explain proper Bayes Feeding Techniques: > >> > >> Do I have to keep feeding Bayes ham a

[SAtalk] Web Front End

Anyone have or know of a web front end so users can set their own scores, whitelists & blacklists which is saved to their own user rules? Regards, Steve --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software C

[SAtalk] Re: Pyzor reporting

Bryan Hoover wrote: > > Alan Munday wrote: > > > > Is anyone finding pyzor reporting a bit hit and miss? > > Just got my first spam in days today. Taught Bayes, reported to Razor2, > and you reminded me about Pyzor. I got: > > [EMAIL PROTECTED] pyzor report --mbox 66.250.40.33:24441 (200,

RE: Re[2]: [SAtalk] Is BigEvil for me?

> From: Robert Menschel > Sent: Friday, January 09, 2004 7:34 PM [...] > > Evil rules, if/when guaranteed, can be scored at or above your spam > threshold. An example from my personal files (where my spam threshold is > 9): > uri RM_u_53x /53x\.net/i > describe RM_u_53

Re: [SAtalk] My custom rulesets for random-word spam

Hello Brent, Thursday, January 8, 2004, 2:10:15 PM, you wrote: BJN> (the RND_UC_CHAR pattern) and I've just updated it for a few new variants BJN> that have shown up in the past couple of days. The second one, BJN> x_headers.cf, builds on the ideas in the thread "X-Mailer is totally BJN> bogus"

Re[2]: [SAtalk] Re: dictionary words in ascii part of mime

Hello Kenneth, Friday, January 9, 2004, 6:22:41 AM, you wrote: KP> --On Friday, January 09, 2004 1:53 AM -0700 Bob Proulx <[EMAIL PROTECTED]> KP> wrote: >> For me personally SA is still tagging the spam at a very good rate. I >> am only seeing these types of spams in my caughtspam folder. KP>

Re[2]: [SAtalk] Questions about Bayes training

Hello Pedro, Friday, January 9, 2004, 11:58:55 AM, you wrote: >> Probably some stupid questions, but I'm having trouble finding >> documentation to explain proper Bayes Feeding Techniques: >> >> Do I have to keep feeding Bayes ham as I feed it spam? PS> For best results, feed all human-identif

Re[2]: [SAtalk] Yahoo, etc

Hello Evan, Friday, January 9, 2004, 12:29:33 PM, you wrote: EP> --On Friday, January 09, 2004 2:24 PM -0600 "Michael H. Collins" EP> <[EMAIL PROTECTED]> wrote: >> Sorta off topic, mebby, but: >> >> As good as SA is working here I have users that are constantly reminding >> me that they get "ab

Re: [SAtalk] Bayes sa-learning routine

Hello Kevin, Friday, January 9, 2004, 4:56:54 PM, you wrote: KR> Once I have run the sa-learn routine on a group of thousands of messages, is KR> it necessary to keep all of those messages to run the next time I run KR> sa-learn? It takes a while for sa-learn to process thousands of message so K

Re[2]: [SAtalk] Is BigEvil for me?

Hello Bert, Friday, January 9, 2004, 1:36:03 PM, you wrote: BR> I appreciate everyone's responses. I'll give BigEvil a shot and see what BR> happens. I've been running 2.60 with Bayes turned on for a while now and it is BR> working well, but I still seem to be getting a continuous stream of tho

Re[2]: [SAtalk] Is BigEvil for me?

Hello Nix, Friday, January 9, 2004, 12:28:39 PM, you wrote: N> On Thu, 8 Jan 2004, Robert Menschel uttered the following: >> Yes, there are three reasons you might not want to use bigevil. >> >> 1) You like getting spam. >> >> 2) You run SA with a threshold level very different from the default

Re: [SAtalk] Re: New spam slipping through

Hello Bob, Thursday, January 8, 2004, 9:03:08 PM, you wrote: BP> Bo Stark wrote: >> The last few days a few new spams have flew under the radar and not been >> caught. What they all have in common is that they have alot of random words >> at the end of the mail. Been trying to feed them through B

[SAtalk] Re: optimal bayes "size"/"number of tockens" ?

Oliver Thalmann wrote: > > Hi > > are there some recommendations for tuning the size > (number of tokens) of a bayes db ? > > i.e. are there some recommendations of optimal number of > tokens, maximum recommended number of tokens, etc ? > > i currently have something like this > > sa-learn -

Re[4]: [SAtalk] Simple newbie question

Hello Justin, Friday, January 9, 2004, 11:05:14 AM, you wrote: >> > More importantly, the "learn" tells SA to ignore this score in >> > determining whether to learn this email as spam or ham. Otherwise an >> > email that is spam to everyone else will get learned as ham >> > because of a >> > lar

Re: [SAtalk] Re: Fresh WhoIs data (emails, phones, etc.) on sale!

On Fri, 9 Jan 2004, Steve Thomas wrote: > Yay. Yet another a-hole blatantly disregarding the various WHOIS directorys' terms > of use and raping it for marketing purposes. Gee, I can't wait to get three more > copies of the same spam for every domain I own... Awww, Gee, I thought that he was be

[SAtalk] bug? (OT: My REALY REALY Crazy idea!! ahahahahahah)

I got spam this morning entitled "Do you want bigger breasts?" This was flagged X-Spam-Status: No, hits=1.1 required=5.0 tests=PENIS_ENLARGE Maybe it is time to explain certain things of life to SA? --- This SF.net email is sponsored by: P

[SAtalk] Re: Bayes sa-learning routine

Kevin Roberts wrote: > > Once I have run the sa-learn routine on a group of thousands of messages, is > it necessary to keep all of those messages to run the next time I run > sa-learn? It takes a while for sa-learn to process thousands of message so > I was wondering if I only ran sa-learn on th

[SAtalk] Re: Pyzor reporting

Alan Munday wrote: > > Is anyone finding pyzor reporting a bit hit and miss? Just got my first spam in days today. Taught Bayes, reported to Razor2, and you reminded me about Pyzor. I got: [EMAIL PROTECTED] pyzor report --mbox Reporting using: > > $ formail -s spamassassin -r < /var/spool/mai

[SAtalk] Bayes sa-learning routine

Once I have run the sa-learn routine on a group of thousands of messages, is it necessary to keep all of those messages to run the next time I run sa-learn? It takes a while for sa-learn to process thousands of message so I was wondering if I only ran sa-learn on the new hand sorted messages, woul

Re: [SAtalk] OT: My REALY REALY Crazy idea!! ahahahahahah

--On Friday, January 09, 2004 3:17 PM -0800 Chris Petersen <[EMAIL PROTECTED]> wrote: > don't forget well-endowed in both male and female aspects! I got spam this morning entitled "Do you want bigger breasts?" >From KFC, yes. On me? HECK NO! :) Evan ---

RE: [SAtalk] OT: My REALY REALY Crazy idea!! ahahahahahah

It might have to mortgage it's house first so it can but the new cell phone booster so it can order those herbs and so it can afford that hot date tonight assuming it failed to make those ebay sales. -Original Message- From: [EMAIL PROTECTED] on behalf of Todd Schuldt

Re: [SAtalk] OT: My REALY REALY Crazy idea!! ahahahahahah

> How many do think would end up with an overly outgoing well blessed > healthy abit thin gorilla with a huge desire to descramble tv while > becoming financially secure and well insured don't forget well-endowed in both male and female aspects! -- Chris Petersen Programmer / Web Designer

RE: [SAtalk] OT: My REALY REALY Crazy idea!! ahahahahahah

Just make sure it's fed all those herbal supplements to bolster its immune system to counter-act the bayes poisoning.. \\^// {. .} oO0o-(_)-o0Oo Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL P

Re: [SAtalk] OT: My REALY REALY Crazy idea!! ahahahahahah

How many do think would end up with an overly outgoing well blessed healthy abit thin gorilla with a huge desire to descramble tv while becoming financially secure and well insured Chris Santerre wrote: Ok, this one is out in left field but I think it would make spam fun. The idea jumped i

Re: [SAtalk] Pyzor reporting

On January 09, 2004 04:50 pm, Alan Munday wrote: > Is anyone finding pyzor reporting a bit hit and miss? > > Reporting using: > > $ formail -s spamassassin -r < /var/spool/mail/spamtrap > > Gave a pyzor error for each of the messages: > > Pyzor -> report failed: Exited with non-zero exit code 1 > >

RE: [SAtalk] Is BigEvil for me?

... I know tweaking it to be smaller and possibly faster is the key but I must say that it doesn't even boggle down my system the way it is or the way it was... I started by just downloading and installing it and found that it worked great and I haven't looked back since. The bigevil catches

[SAtalk] RE: RE : [AMaViS-user] Pounding

Thinking more about blocking it at the MTA. As the SA/Amavis box is not the Main server and there might be times that the SA box will not know all the valid users is it possible to create a list of account that i want SA/Amavis to check and all other go through uncheck? Paul PS sorry about the c

Re: [SAtalk] erroneous hits on whitelist by odd languages?

On Fri, Jan 09, 2004 at 11:16:29AM -0800, Clint Byrum wrote: > Has anyone else seen mail marked as "USER_IN_WHITELIST", but mostly > contains foreign characters. I've searched the mail for every entry in > my whitelist, and there's no way any of them have been in my whitelist. > > I've posted them

RE: [SAtalk] OT: My REALY REALY Crazy idea!! ahahahahahah

It's gotta be controlled via an RF sensor so all the Gorillas in a particular radius start going nuts and everyone can blame the one in the epicenter! Steven -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Timothy Donahue Sent: Friday, January 09, 2004 3:

Re: [SAtalk] OT: My REALY REALY Crazy idea!! ahahahahahah

So feeding it Nigerian scam spam would increase it's financial well-being (and possibly cause it to speak with an accent), feeding it medical spam would cause it to become healthier, and pr0n spam would increase its, er, social well-being? What happens when you feed it ham? (It's Friday afternoon

Re: [SAtalk] OT: My REALY REALY Crazy idea!! ahahahahahah

Op vrijdag 9 januari 2004 23:34, schreef Chris Santerre: > Tamogachi Gorilla Spam!!! > (Watch someone market this and make millions.) > Tamogachi Gorilla Spam (tm.) Patent pending...blah blah lol.. Hey! That was my idea :P~ -- Met vriendelijke groet, Tim Stoop Random quote/fortune: Moe

RE: [SAtalk] OT: My REALY REALY Crazy idea!! ahahahahahah

Sounds like fun, when is the beta program opening up :-) > -Original Message- > From: Chris Santerre [mailto:[EMAIL PROTECTED] > Sent: Friday, January 09, 2004 5:35 PM > To: Spamassassin-Talk (E-mail) > Subject: [SAtalk] OT: My REALY REALY Crazy idea!! ahahahahahah > > > Ok, this one is

[SAtalk] OT: My REALY REALY Crazy idea!! ahahahahahah

Ok, this one is out in left field but I think it would make spam fun. The idea jumped in my head from a Spam-L post. Are you sitting down? Tamogachi Gorilla Spam!!! So we figure out a way to implement a pet gorilla program into spamassassin. Each spam runs thru an algorithm to produce a token. T

RE: [SAtalk] SA 2.55, (?/?)

> On Thu, 2004-01-08 at 12:39, Russell Mann wrote: > > Received: from [EMAIL PROTECTED] by dude.myhost.com by uid 504 with > > qmail-scanner-1.20rc3 > > (clamscan: 0.60. spamassassin: 2.55. Clear:RC:0:SA:0(?/?):. > > Processed in 16.851793 secs); 08 Jan 2004 10:20:46 - > > Hello, > > > > Th

Re: [SAtalk] Yahoo, etc

On Fri, 2004-01-09 at 12:24, Michael H. Collins wrote: > Sorta off topic, mebby, but: > > As good as SA is working here I have users that are constantly reminding > me that they get "absolutely no spam" on their yahoo, hotmail etc. > accounts. I don't like those two, but do have a coupe of othe

Re: [SAtalk] Yahoo, etc

On January 09, 2004, Mi wrote: > > >users that are constantly reminding me that they get "absolutely no spam" > >on their yahoo, hotmail etc. accounts. > > My guess is yes, they are telling the truth, and it has nothing to do with > their provider. > > While most people get tons of spam, I kno

RE: [SAtalk] Bigevil.cf 2.06f problems

That's why I love Putty! I just use the paste function in vi to update the .cf files - works like a charm. |-Original Message- |From: Chris Santerre [mailto:[EMAIL PROTECTED] |Sent: Friday, January 09, 2004 07:06 |To: '[EMAIL PROTECTED]'; [EMAIL PROTECTED] |Subject: RE: [SAtalk] Bigevil.c

[SAtalk] Pyzor reporting

Is anyone finding pyzor reporting a bit hit and miss? Reporting using: $ formail -s spamassassin -r < /var/spool/mail/spamtrap Gave a pyzor error for each of the messages: Pyzor -> report failed: Exited with non-zero exit code 1 Running: Pyzor report --mbox < /var/spool/mail/spamtrap Came b

RE: [SAtalk] Yahoo, etc

> -Original Message- > From: Michael H. Collins [mailto:[EMAIL PROTECTED] > Sent: Friday, January 09, 2004 2:24 PM > To: Spamassassin-Talk (E-mail) > Subject: [SAtalk] Yahoo, etc > > > Sorta off topic, mebby, but: > > As good as SA is working here I have users that are > constantly rem

Re: [SAtalk] How to upgrade

Quoting Gary Lopez <[EMAIL PROTECTED]>: > I would like to upgrade from 2.55 to the latest without disrupting the > e-mails and damaging my current setup. Is there a webpage or some > location someone can point me to ? > > Thanks > Gary > > > I'm no expert but I upgraded from 2.31 to 2.61 by

Re: [SAtalk] Delete SPAM

On Fri, Jan 09, 2004 at 09:27:11PM -, Andrew Cranson is rumored to have said: > > Is there a mySQL preference can be used to force spamassassin to > drop/delete all emails above a certain score? > SpamAssassin does not, and can not, delete mail. It's simply a filter - data goes into it, the

RE: [SAtalk] Is BigEvil for me?

Quoting Chris Santerre <[EMAIL PROTECTED]>: [snip ... snip] > LOL, no problem!!! Actually they do get minor mass checked by someone else > from time to time ;) > > I'm shooting for no FP's. And the results were VERY cool. It only seems like > a burden now because I have to tweak it to where I am

Re: [SAtalk] Delete SPAM

--On Friday, January 09, 2004 9:27 PM + Andrew Cranson <[EMAIL PROTECTED]> wrote: > Hi, > > Is there a mySQL preference can be used to force spamassassin to > drop/delete all emails above a certain score? Nope. SA cannot delete e-mails. Perhaps how you're calling SA (Procmail?) can delete

[SAtalk] SA-train bayes weighting

What is the easiest way to adjust how much weight is given to the bayes training list? I am training with thousands of specific emails that have been hand sorted and naturally if I have gone to the trouble to hand sort them, it would be nice if sa would not those exact same emails through again.

[SAtalk] Delete SPAM

Hi, Is there a mySQL preference can be used to force spamassassin to drop/delete all emails above a certain score? --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering

[SAtalk] How to upgrade

I would like to upgrade from 2.55 to the latest without disrupting the e-mails and damaging my current setup. Is there a webpage or some location someone can point me to ? Thanks Gary --- This SF.net email is sponsored by: Perforce Software.

RE: [SAtalk] Is BigEvil for me?

> -Original Message- > From: Nix [mailto:[EMAIL PROTECTED] > Sent: Friday, January 09, 2004 3:29 PM > To: Robert Menschel > Cc: Bert Rapp; [EMAIL PROTECTED] > Subject: Re: [SAtalk] Is BigEvil for me? > > > On Thu, 8 Jan 2004, Robert Menschel uttered the following: > > Yes, there are thr

Re: [SAtalk] Yahoo, etc

I dunno about that. I have a Yahoo account that I use for junk mail. Mainly, for downloading trail software where they want your email address to mail the download link to and for certain bbs/forums. I periodically get spam on that account. It doesn't happen that often, most goes into the bulk

RE: [SAtalk] Yahoo, etc

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Mi > Sent: Friday, January 09, 2004 12:37 PM > To: [EMAIL PROTECTED] > Subject: Re: [SAtalk] Yahoo, etc > > > >users that are constantly reminding me that they get > "absolutely no spam" > >on th

Re: [SAtalk] SA 2.55, (?/?)

On Thu, 2004-01-08 at 12:39, Russell Mann wrote: > Received: from [EMAIL PROTECTED] by dude.myhost.com by uid 504 with > qmail-scanner-1.20rc3 > (clamscan: 0.60. spamassassin: 2.55. Clear:RC:0:SA:0(?/?):. > Processed in 16.851793 secs); 08 Jan 2004 10:20:46 - > > > Hello, > > The spam tha

Re: [SAtalk] Yahoo, etc

users that are constantly reminding me that they get "absolutely no spam" on their yahoo, hotmail etc. accounts. My guess is yes, they are telling the truth, and it has nothing to do with their provider. While most people get tons of spam, I know many who don't get any at all. Because nobody k

Re: [SAtalk] Yahoo, etc

--On Friday, January 09, 2004 2:24 PM -0600 "Michael H. Collins" <[EMAIL PROTECTED]> wrote: > Sorta off topic, mebby, but: > > As good as SA is working here I have users that are constantly reminding > me that they get "absolutely no spam" on their yahoo, hotmail etc. > accounts. I don't like th

Re: [SAtalk] Is BigEvil for me?

On Thu, 8 Jan 2004, Robert Menschel uttered the following: > Yes, there are three reasons you might not want to use bigevil. > > 1) You like getting spam. > > 2) You run SA with a threshold level very different from the default 5.0 > score, and don't have the time or ability to adjust the bigevil

[SAtalk] SA-Train question

I am training sa with the saved messages that sa puts in the c:\etc\mail s/d. My question is if I am going to train from these messages, do I need to remove the auto-tagging that sa is doing in the subject line? Naturally this changes the way sa would see the message. As a do I need to turn off t

Re: [SAtalk] Trouble with whitelist_from_rcvd

On Friday 09 January 2004 02:03 pm, Justin Mason wrote: > I think so -- whitelist_from_rcvd is checking only untrusted headers, and > not looking at the trusted ones, which is incorrect. could you open a > bugzilla entry for this? Yep. I created this bug. http://bugzilla.spamassassin.org/show_bug.

[SAtalk] bigevil entry for the weekend....

I'm just getting to my 2 day corpus of spam and noticed this whacko: mdpillsource.com All over the place. You may want to right a rule for him or manually enter him just for the weekend until I update Monday or Tuesday. I'm not going to let any quick updates get posted without testing. But I figu

[SAtalk] Yahoo, etc

Sorta off topic, mebby, but: As good as SA is working here I have users that are constantly reminding me that they get "absolutely no spam" on their yahoo, hotmail etc. accounts. I don't like those two, but do have a coupe of other web mail accounts that get lots of spam. Are they telling the

RE: Re[2]: [SAtalk] Simple newbie question

Does anyone else find the 'learn' counter-intuitive? Shouldn't it be 'ignore'? Just my opinion. Don't know about "learn", but "ham" being opposed to "spam" is probably very counter-intuitive for Muslims and Jews :-) --- This SF.net email is

[SAtalk] RE: adding rules to the core set: need a volunteer!

> -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > Sent: Friday, January 09, 2004 2:58 PM > To: Chris Santerre > Cc: 'AltGrendel'; Spamassassin-Talk (E-mail); > [EMAIL PROTECTED] > Subject: adding rules to the core set: need a volunteer! > > > -BEGIN PGP SIGN

Re: [SAtalk] Questions about Bayes training

On January 09, 2004 01:48 pm, JR wrote: > At 10:37 PM (-0800) 1/8/2004 (Thursday), Robert Menschel wrote: > >Running these against my corpus, I find > >WORDWORD -- 4212s/14h of 87289 corpus (70035s/17254h) > >WORDWORD2 -- 4205s/12h of 87289 corpus (70035s/17254h) > > Probably some stupid questions

[SAtalk] adding rules to the core set: need a volunteer!

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Santerre writes: >> Maybe you should setup CSV and start a dev team? >> (I'd help if I could but I suck at regex) > >I had thought about it. Once I finish tweaking the regex, then it is only a >matter of adding/removing domains. No great regex k

RE: [SAtalk] FVGT file problem, aslo 2.61 problem

Did you get that from my SARE? I'm not sure if there is a comment that it requires 2.60 or not. Let me know. I've got sooo many fules by Fred its silly :) Chris Santerre System Admin and SA Custom Rules Emporium keeper http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm "A little non

RE: [SAtalk] Oh Joy, another abusable URI redirector

Having seen a few of these, I wonder whether there's any reason not to write a rule to catch them all at once. That is, could someone with access to a mass check try out the rule uri URI_REDIRECT/.https?:\/\//i describe URI_REDIRECT URI redirect score URI_REDIRECT 1.5 (that is, if

RE: [SAtalk] BigEvil and Debian amavisd-new/SA?

I didn't know that! I added this info to the cf file for debian users. Thanks! --Chris > -Original Message- > From: Chris Thielen [mailto:[EMAIL PROTECTED] > Sent: Friday, January 09, 2004 4:38 AM > To: [EMAIL PROTECTED]; > [EMAIL PROTECTED] > Subject: RE: [SAtalk] BigEvil and Debian ama

RE: [SAtalk] Bigevil 2.06f posted.

> -Original Message- > From: AltGrendel [mailto:[EMAIL PROTECTED] > Sent: Friday, January 09, 2004 8:14 AM > To: Spamassassin-Talk (E-mail) > Subject: RE: [SAtalk] Bigevil 2.06f posted. > > > On Thu, 2004-01-08 at 20:33, Chris Santerre wrote: > > Sorry it took me so long to reply. I'm w

RE: [SAtalk] how to filter the MS Update virus?

True regarding the file transfer but the problem is that I also provide email services for serveral small companies. It's not up to the ISP to decide what you view but we do provide virus filteration (to a limited extent) and spam markup. Gary Smith N¬HYÞéX¬²š'²ŠÞu¼z·è­Ç¡ûpj·z·è

RE: [SAtalk] Bigevil.cf 2.06f problems

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Russell Mann wrote: >> I did a lynx -dump > >> /etc/mail/spamassassin/bigevil.cf. Hrmm...are there any special >> requirements above and beyond what SA requires? >> >> - -- >> Mike Loiterman >

[SAtalk] erroneous hits on whitelist by odd languages?

Has anyone else seen mail marked as "USER_IN_WHITELIST", but mostly contains foreign characters. I've searched the mail for every entry in my whitelist, and there's no way any of them have been in my whitelist. I've posted them on mywebsite http://spamaps.org/files/satalk/ Now, I found the entry

RE: [SAtalk] Bigevil.cf 2.06f problems

> I did a lynx -dump > > /etc/mail/spamassassin/bigevil.cf. Hrmm...are there any special > requirements above and beyond what SA requires? > > - -- > Mike Loiterman Do a wget on the file, because lynx wraps lines on you. -Russell ---

Re: Re[2]: [SAtalk] Simple newbie question

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Santerre writes: > > -Original Message- > > From: Robert Menschel [mailto:[EMAIL PROTECTED] > > Sent: Thursday, January 08, 2004 10:40 PM > > To: Steve Thomas > > Cc: John Fleming; [EMAIL PROTECTED] > > Subject: Re[2]: [SAtalk] Simple ne

Re: [SAtalk] Trouble with whitelist_from_rcvd

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Brett Simpson writes: >On Friday 09 January 2004 11:37 am, Brett Simpson wrote: >> Here's what I have in my user_prefs... >> trusted_networks 207.156.7. >> whitelist_from_rcvd [EMAIL PROTECTED] >> ns2b.hillsboroughcounty.org > >I found that if I set t

RE: [SAtalk] how to filter the MS Update virus?

Hi, On Fri, 9 Jan 2004, Gary Smith wrote: > In postfix I use the body.regexp for the body checks. > file: /etc/postfix/main.cf > body_checks = regexp:/etc/postfix/body_checks.regexp > > Contents (only three in there at this time) > > /^RSLxwtYBDB6FCv8ybBcS0zp9VU5of3K4BXuwyehTM0RI9IrSjVuwP94xfn0wg

RE: [SAtalk] Bigevil.cf 2.06f problems

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Santerre wrote: > How did you download the file? Did you go from a windows machine to > a *nix server? If there was a problem with this file, I would have > heard about it real fast :) I did a lynx -dump > /etc/mail

[SAtalk] Questions about Bayes training

At 10:37 PM (-0800) 1/8/2004 (Thursday), Robert Menschel wrote: Running these against my corpus, I find WORDWORD -- 4212s/14h of 87289 corpus (70035s/17254h) WORDWORD2 -- 4205s/12h of 87289 corpus (70035s/17254h) Probably some stupid questions, but I'm having trouble finding documentation to exp

RE: Re[2]: [SAtalk] Simple newbie question

> -Original Message- > From: Robert Menschel [mailto:[EMAIL PROTECTED] > Sent: Thursday, January 08, 2004 10:40 PM > To: Steve Thomas > Cc: John Fleming; [EMAIL PROTECTED] > Subject: Re[2]: [SAtalk] Simple newbie question > > > Hello Steve, > > Thursday, January 8, 2004, 11:25:20 AM, y

Re: [SAtalk] rule set order?

Attach a prefix to the filename, such as: 10_bigevil.cf 20_popcornonly.cf 30_weedsonly.cf 40_backhair.cf 50_local.cf Ryan Moore -- Perigee.net Corporation 704-849-8355 (sales) 704-849-8017 (tech) www.perigee.net Douglas Kirkland wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I have a

[SAtalk] rule set order?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I have added some more rules sets like BigEvil.cf, popcornonly.cf, weedsonly.cf, backhair.cf. I want to make sure that my local.cf is read last. If I understand how SA works it is the last rule set that set the score. So how do I make sure th

RE: [SAtalk] backhair hits on an attachment

On Fri, 2004-01-09 at 11:39, Gary Funck wrote: > > > From: Lindsay Snider > > Sent: Friday, January 09, 2004 8:03 AM > > > > > > I'm running pbw dated 2003-11-13. Backhair recently hit hard on a piece > > of ham. The rules matched on an uuencoded pdf attachment. Does anyone > > have any insigh

RE: [SAtalk] Another for BigEvil...

Sorry I stayed up to late. reject_unknown_sender_domain is what you want... Need more caffinee... smtpd_sender_restrictions = permit_mynetworks, reject_unknown_sender_domain, <-- This one reject_non_fqdn_sender -Original Message- From: [EMAIL PROTECTED] on behalf

RE: [SAtalk] Another for BigEvil...

Rubin, The header has this line... Received: from morpheus.thatitguy.com [216.204.165.33] by localhost with POP3 (fetchmail-6.2.4) for [EMAIL PROTECTED] (single-drop); Fri, 09 Jan 2004 11:25:38 -0500 (EST) Try making this change to your /etc/postfix/main.cf file: smtpd_recipient_restrictio

RE: [SAtalk] how to filter the MS Update virus?

In postfix I use the body.regexp for the body checks. file: /etc/postfix/main.cf body_checks = regexp:/etc/postfix/body_checks.regexp Contents (only three in there at this time) /^RSLxwtYBDB6FCv8ybBcS0zp9VU5of3K4BXuwyehTM0RI9IrSjVuwP94xfn0wgOjouKWzGXHVk3qg$/ DISCARD Keep your viruses (sobig.

Re: [SAtalk] Re: Fresh WhoIs data (emails, phones, etc.) on sale!

Yay. Yet another a-hole blatantly disregarding the various WHOIS directorys' terms of use and raping it for marketing purposes. Gee, I can't wait to get three more copies of the same spam for every domain I own... On Fri, Jan 09, 2004 at 09:46:41AM -0800, Matt Van Gordon is rumored to have sai

RE: [SAtalk] Re: Fresh WhoIs data (emails, phones, etc.) on sale!

Is someone SPAMming the SA-Talk list or did this message get sent prematurely to the list?? -Joe K. --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced branch

Re: [SAtalk] Trouble with whitelist_from_rcvd

On Friday 09 January 2004 11:37 am, Brett Simpson wrote: > Here's what I have in my user_prefs... > trusted_networks 207.156.7. > whitelist_from_rcvd [EMAIL PROTECTED] > ns2b.hillsboroughcounty.org I found that if I set the trusted_networks to something other network so that spamassassin treats m

[SAtalk] Re: Fresh WhoIs data (emails, phones, etc.) on sale!

We are offering fresh WhoIs data on 214,000 business websites. Along with the WhoIs data comes an add-on of email addresses and phone numbers extracted directly from the contact pages of the mentioned 214,000 businesses.The WhoIs data includes all the fields provided at registration: owner/

Re: [SAtalk] DCC efficiency

On Fri, 9 Jan 2004 09:13:09 -0800 "Russell Mann" <[EMAIL PROTECTED]> wrote: > From the DCC FAQ: > --- > Can the DCC be used with SpamAssassin or other spam filters? > The DCC can be used with SpamAssassin as well as other spam > and virus filters. Note that

[SAtalk] DCC efficiency

>From the DCC FAQ: --- Can the DCC be used with SpamAssassin or other spam filters? The DCC can be used with SpamAssassin as well as other spam and virus filters. Note that it is more efficient to arrange to use a DCC client daemon such as dccm to m

RE: [SAtalk] detecting large collections of random words

OK: Here's v1.1 ## Chris Petersen Rules ## 01-09-04 ## v1.1 ## I've noticed that a lot of spams recently have been following the random-words technique, ## with very little "spam" content - often just an image or some obfuscated text. Has anyone ## given any thought to writing up a rule that det

[SAtalk] spamd dies unnaturally

Hello, I just upgraded to SA 2.61, after patching Razor2. Last night I got this message: Jan 8 00:39:39 judah spamd[17577]: razor2 check skipped: Bad file descriptor Died at /usr/local/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/Dns.pm line 401. 20 seconds later, spamd was a dead process, as e

RE: [SAtalk] backhair hits on an attachment

> From: Lindsay Snider > Sent: Friday, January 09, 2004 8:03 AM > > > I'm running pbw dated 2003-11-13. Backhair recently hit hard on a piece > of ham. The rules matched on an uuencoded pdf attachment. Does anyone > have any insight on how I might prevent these from hitting in the > future.

[SAtalk] Trouble with whitelist_from_rcvd

For the below message I'm trying to whitelist_from_rcvd so it's always ok but it's doesn't appear to be working. Here's what I have in my user_prefs... trusted_networks 207.156.7. whitelist_from_rcvd [EMAIL PROTECTED] ns2b.hillsboroughcounty.org spamassassin -D < zstmsg > out 2>&1;grep trust out

[SAtalk] Another for BigEvil...

New trick? Lots of double characters in the text. And I don't have Kaspersky anywhere... either he's a consciencous spammer and doesn't want to spread Viri around, or he's adding a bogus header to help legitimize his messages. First spam in 3 days to sneak through (out of >300)! Rubin -- Rubin

RE: [SAtalk] how to filter the MS Update virus?

Not with SA, but in proccmail, I use a canned recipe fetched off the net: In .procmailrc: # # eliminate virus mail. # MYVIRUS=virus-trap INCLUDERC=/etc/mail/procmail/virussnag.rc In virussnag.rc is located here: http://www.spamless.us/pub/procmail/virussnag.rc Leading comments: ##

Re: [SAtalk] hits over five yet not marked as spam...

Raquel Rice wrote: On Fri, 9 Jan 2004 06:57:04 -0800 Jeff Lasman <[EMAIL PROTECTED]> wrote: We're being hit by MS security update emails. I know they're not spam, but rather more accurately described as virii or worms. However, I'm wondering if anyone has a good rule that will mark these? Thank

[SAtalk] strange ignorance of local.cf by spamd, not by the spamassassin script itself

I run amavisd-new and spamassassin 2.60 (backports to Debian Woody GNU/Linux from the unstable branch) on a sever at office and at my own one at home, where I write this at now (clamav is used solely at office additionally for virus/worm scanning) with the postfix MTA (stable woody version). The p

RE: [SAtalk] Empty spam?

I've seen a number of these a few weeks ago. Mostly came in via a mail list. Alan -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Stewart, John Sent: 09 January 2004 15:43 To: [EMAIL PROTECTED] Subject: [SAtalk] Empty spam? I, as well as many others

RE: [SAtalk] Country codes

Since they rarely declare the TRUE country they're sending from, I'd probably use the blackholes.us rbls. And probably host them locally to reduce DNS lookup time. http://www.blackholes.us/docs/usage.html It only has zones for argentina, brazil, china, hong kong, japan, korea, malaysia, mexico,

[SAtalk] backhair hits on an attachment

I'm running pbw dated 2003-11-13. Backhair recently hit hard on a piece of ham. The rules matched on an uuencoded pdf attachment. Does anyone have any insight on how I might prevent these from hitting in the future. I'm not sure if all uuencoded messages are susceptible, if its pdf uuencoded mes

Re: [SAtalk] Abused REDIRECTOR URL

On Fri, 9 Jan 2004, Bill Larson wrote: > http://g.msn.com/1SUenus/CT?http://www.2026.com/F/index.html The SF archives for the list seem to be down at the moment, I just got a sourceforge error. Can someone post a link to a rule for the g.msn redirector ? =

  1   2   >