RE: SpamAssassin Coach - Outlook/Thunderbird Plugin

2006-08-31 Thread Michael Scheidell
Did uninstall, outlook 2002, sp3, spamassassin coach buttons still on menu. Can't get rid of them.

RE: SpamAssassin Coach - Outlook/Thunderbird Plugin

2006-08-31 Thread Michael Scheidell
XP sp2, outlook 2002, sp2. Upon leaving outlook, get "ok disconnection" popup.

RE: SpamAssassin Coach - Outlook/Thunderbird Plugin

2006-08-31 Thread Michael Scheidell
> -Original Message- > From: Will Duff [mailto:[EMAIL PROTECTED] > Sent: Thursday, August 31, 2006 8:10 PM > To: users@spamassassin.apache.org > Subject: SpamAssassin Coach - Outlook/Thunderbird Plugin > > > Hi everyone, > > I've been working with SpamAssassin for the course of > Googl

Re: SPF_SOFTFAIL but there's no SPF record

2006-08-31 Thread Jason Haar
Daryl C. W. O'Shea wrote: > This happens when DNS queries timeout as the plugin defaults to > SOFTFAIL per the recommendation of the then current draft. I'm not > sure what the current experimental RFC says about it, but regardless, > we really need to assume that the domain isn't publishing SPF r

Re: SPF_SOFTFAIL but there's no SPF record

2006-08-31 Thread Daryl C. W. O'Shea
On 8/31/2006 11:33 AM, Rosenbaum, Larry M. wrote: SpamAssassin version 3.1.4 running on Perl version 5.8.7(and 5.8.5) Any idea why a message with the following headers: X-Envelope-From: <[EMAIL PROTECTED]> Received: from mail.ans.org (mail.ans.org [206.222.45.53]) by emroute1.ornl.gov (P

Re: SpamAssassin Coach - Outlook/Thunderbird Plugin

2006-08-31 Thread Rick Macdougall
Will Duff wrote: Hi everyone, I've been working with SpamAssassin for the course of Google's Summer of Code to create 'SpamAssassin Coach' - an add-in available for Mozilla Thunderbird and Microsoft Outlook. The purpose of the add-in is to allow users to report spam and ham to SpamAssassin righ

Re: Hacked E-Trade Phishing Site

2006-08-31 Thread Chris
On Thursday 31 August 2006 7:54 pm, David B Funk wrote: > On Wed, 30 Aug 2006, jdow wrote: > > From: "Evan Platt" <[EMAIL PROTECTED]> > > > > > At 04:02 PM 8/30/2006, you wrote: > > >>Check at the top of this E-trade Phishing site: > > >> > > >>http://196.1.161.115/e/t/user/login/ > > > > > > I get

Re: The grey hats are at it in force

2006-08-31 Thread Bob McClure Jr
On Thu, Aug 31, 2006 at 08:20:58PM -0400, Gino Cerullo wrote: > On 31-Aug-06, at 8:08 PM, Chris wrote: > > >This is even better than the last one: > > > >http://194-144-135-77.du.xdsl.is/~ingi/.change/index.php? > >MfcISAPICommand=ChangeFPP > > Who are these masked avengers? ;-) > > -- > Gino C

Re: Hacked E-Trade Phishing Site

2006-08-31 Thread David B Funk
On Wed, 30 Aug 2006, jdow wrote: > From: "Evan Platt" <[EMAIL PROTECTED]> > > > At 04:02 PM 8/30/2006, you wrote: > >>Check at the top of this E-trade Phishing site: > >> > >>http://196.1.161.115/e/t/user/login/ > > > > I get it but I don't get it. I could understand if it was an image, > > but th

SpamAssassin Coach - Outlook/Thunderbird Plugin

2006-08-31 Thread Will Duff
Hi everyone, I've been working with SpamAssassin for the course of Google's Summer of Code to create 'SpamAssassin Coach' - an add-in available for Mozilla Thunderbird and Microsoft Outlook. The purpose of the add-in is to allow users to report spam and ham to SpamAssassin right from their inbox

Re: The grey hats are at it in force

2006-08-31 Thread Gino Cerullo
On 31-Aug-06, at 8:08 PM, Chris wrote: This is even better than the last one: http://194-144-135-77.du.xdsl.is/~ingi/.change/index.php? MfcISAPICommand=ChangeFPP Who are these masked avengers? ;-) -- Gino Cerullo Pixel Point Studios 21 Chesham Drive Toronto, ON M3M 1W6 416-247-7740

The grey hats are at it in force

2006-08-31 Thread Chris
This is even better than the last one: http://194-144-135-77.du.xdsl.is/~ingi/.change/index.php?MfcISAPICommand=ChangeFPP -- Chris 19:05:21 up 14 days, 1:48, 1 user, load average: 0.18, 0.28, 0.35 pgpp50MUc7VqD.pgp Description: PGP signature

Re: Spammed by Non-delivery-report? (someone is using my email to spam)

2006-08-31 Thread Rick Macdougall
John D. Hardin wrote: On Fri, 1 Sep 2006, Christian Purnomo wrote: I am having so much trouble at present that some people are using my email address to send their spam messages, in return I get hundreds and hundres of non-delivery email + other misc reply such as out of office. The first thi

Re: Spammed by Non-delivery-report? (someone is using my email to spam)

2006-08-31 Thread Gino Cerullo
On 31-Aug-06, at 7:18 PM, Christian Purnomo wrote: Hi Gurus, I am having so much trouble at present that some people are using my email address to send their spam messages, in return I get hundreds and hundres of non-delivery email + other misc reply such as out of office. How would I be

Re: Spammed by Non-delivery-report? (someone is using my email to spam)

2006-08-31 Thread John D. Hardin
On Fri, 1 Sep 2006, Christian Purnomo wrote: > I am having so much trouble at present that some people are using my > email address to send their spam messages, in return I get hundreds and > hundres of non-delivery email + other misc reply such as out of office. The first thing you should consid

Re: Spammed by Non-delivery-report? (someone is using my email to spam)

2006-08-31 Thread Gino Cerullo
On 31-Aug-06, at 7:18 PM, Christian Purnomo wrote: Hi Gurus, I am having so much trouble at present that some people are using my email address to send their spam messages, in return I get hundreds and hundres of non-delivery email + other misc reply such as out of office. How would I be

Spammed by Non-delivery-report? (someone is using my email to spam)

2006-08-31 Thread Christian Purnomo
Hi Gurus, I am having so much trouble at present that some people are using my email address to send their spam messages, in return I get hundreds and hundres of non-delivery email + other misc reply such as out of office. How would I be able to use spamassassin to help me with this? would sa-lea

Re: Please sanity check these ideas for rules.

2006-08-31 Thread John D. Hardin
On Thu, 31 Aug 2006, David B Funk wrote: > My MTAs started bouncing all hotmail. ;() This is a bad thing? :) -- John Hardin KA7OHZICQ#15735746http://www.impsec.org/~jhardin/ [EMAIL PROTECTED]FALaholic #11174pgpk -a [EMAIL PROTECTED] key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C

Re: Very big auto-whitelist file

2006-08-31 Thread Kris Deugau
Stéphane LEPREVOST wrote: As you noticed, I get worried very very very late... But in fact I wasn't in charge of spamassassin when we first saw this growth, that's why I'm back on the problem only now... I guess I'll pay more attention to this now ;D It became a problem for me with a 10G hard

Re: Please sanity check these ideas for rules.

2006-08-31 Thread Michael W Cocke
On 31 Aug 2006 20:39:47 -, you wrote: >On Thu, 31 Aug 2006, Michael W Cocke wrote: > >> I've got every ruleset & blacklist available and I'm still getting >> buried - the bayes poison in all of the recent spam has wrecked that. >> Does anyone see a reason why I can't assume messages with blan

Re: Please sanity check these ideas for rules.

2006-08-31 Thread hamann . w
>> >> I've got every ruleset & blacklist available and I'm still getting >> buried - the bayes poison in all of the recent spam has wrecked that. >> Does anyone see a reason why I can't assume messages with blank >> subjects are junk? Also, I've got an idea about maybe doing an >> nslookup on the

RE: Very big auto-whitelist file

2006-08-31 Thread Stéphane LEPREVOST
Thanks Kris for this usefull tool, I'll try it tommorow (and thanks to Roger too who noticed the existence of your tool) As you noticed, I get worried very very very late... But in fact I wasn't in charge of spamassassin when we first saw this growth, that's why I'm back on the problem only now..

spamd and SQL

2006-08-31 Thread Fábio Gomes
Hi list, Recently I faced a problem with my network where my e-mail servers couldn't contact my MySQL server. Because of that communication error, the incoming messages passed through without being scanned by spamd. Reading the sql/README I found the following information:

RE: Very big auto-whitelist file

2006-08-31 Thread Stéphane LEPREVOST
Thanks Logan, it was a good idea to check the du -k : 696046 auto-whitelist Looks like the file is half used in fact... Regarding the volume, I have about 4 messages by day including spam, and if I remember well, I thing this file has never been cleared... Stephane -Message d'origin

Re: Very big auto-whitelist file

2006-08-31 Thread Kris Deugau
Roger Taranto wrote: There's an additional tool to run after you run check_whitelist. It's called trim_whitelist, and it compacts the db file. I can't remember where I found it, but you should be able to google for it. It should reduce the size of your db file quite a bit. That would be the

Re: File mode set incorrectly

2006-08-31 Thread Theo Van Dinter
On Thu, Aug 31, 2006 at 12:32:37PM -0700, Albert Poon wrote: > I know I don't need setting 0777 on them, and 0666 is fine for me. But for > the auto_whitelist, I can't set to 0666, it only turns to 0640. What version are you running? There were some issues with AWL perms until it was fixed in 3.

Re: File mode set incorrectly

2006-08-31 Thread Albert Poon
I know I don't need setting 0777 on them, and 0666 is fine for me. But for the auto_whitelist, I can't set to 0666, it only turns to 0640. Magnus Holmgren wrote: > > On Thursday 31 August 2006 14:30, Albert Poon took the opportunity to say: >> If so whats the point of these options? > > You m

RE: source SENDER authentication ? (as opposed to SPF HOST authentication)

2006-08-31 Thread David B Funk
On Wed, 30 Aug 2006, SM wrote: > At 10:55 30-08-2006, Michael Grey wrote: > >I like Michel Vaillancourt's idea - if it has to be done. > > There are milters and MTAs that can do that. It's not a good idea as > it can cause a denial of service. Also you risk getting blacklisted. When you run one

Re: source SENDER authentication ? (as opposed to SPF HOST authentication)

2006-08-31 Thread David B Funk
On Thu, 31 Aug 2006, Benny Pedersen wrote: > On Wed, August 30, 2006 19:37, Michel Vaillancourt wrote: > > to carve it... you actually open an SMTP conversation with > > ... trap that "5xx" return, and you know its a bogus sender. > > The plug-in adds 2 points to the score. > > Get a "25

Re: Please sanity check these ideas for rules.

2006-08-31 Thread David B Funk
On Thu, 31 Aug 2006, Michael W Cocke wrote: > I've got every ruleset & blacklist available and I'm still getting > buried - the bayes poison in all of the recent spam has wrecked that. > Does anyone see a reason why I can't assume messages with blank > subjects are junk? maybe add a point for mis

Re: Very big auto-whitelist file

2006-08-31 Thread Roger Taranto
On Thu, 2006-08-31 at 09:00, Stéphane LEPREVOST wrote: > A little question about AWL : I have an auto_whitelist how looks VERY > HUGE to me : > -rw---1 root root 1241124864 Aug 31 17:51 > auto-whitelist > > Do you think a 1.2 Gb AWL file is NORMAL ? > > I don't think so and plan

Re: Please sanity check these ideas for rules.

2006-08-31 Thread Rob Anderson
>>> Michael W Cocke <[EMAIL PROTECTED]> 08/31/06 12:55PM >>> I've got every ruleset & blacklist available and I'm still getting buried - the bayes poison in all of the recent spam has wrecked that. Does anyone see a reason why I can't assume messages with blank subjects are junk? Also, I've got an

Re: Please sanity check these ideas for rules.

2006-08-31 Thread Matthias Keller
Michael W Cocke wrote: I've got every ruleset & blacklist available and I'm still getting buried - the bayes poison in all of the recent spam has wrecked that. Does anyone see a reason why I can't assume messages with blank subjects are junk? Ask all my friends who regularly send me emails with

Please sanity check these ideas for rules.

2006-08-31 Thread Michael W Cocke
I've got every ruleset & blacklist available and I'm still getting buried - the bayes poison in all of the recent spam has wrecked that. Does anyone see a reason why I can't assume messages with blank subjects are junk? Also, I've got an idea about maybe doing an nslookup on the envelope sender do

Re: Language settings score

2006-08-31 Thread John D. Hardin
On Thu, 31 Aug 2006, Paul Tenfjord wrote: > In Norway there is strict law rules concerning sending spam, which in fact > works very well. Therefor we have no Norwegian incoming spam. > I was wondering if there is a feature that lowers the score for mails that is > in the Norwegian language.

Re: RBL and blackholes.us.

2006-08-31 Thread John D. Hardin
On Thu, 31 Aug 2006, Xueron Nee wrote: > Dear John D. Hardin, > > aha, that sounds reasonable :) > > But the fact is that some server blocked me, but it should accepted. My > users complained about this and made me so agonising I suggest you contact the admin of that mailserver and ask th

Re: catching fake usernames?

2006-08-31 Thread John D. Hardin
On Thu, 31 Aug 2006, Matt Kettler wrote: > milter-greylist, while designed for greylisting, has > grown to have a quite flexible ACL system. Using it you could > "whitelist" all your local IPs that legitamately generate mail with your > domain, then follow it up by blacklisting anything else that

Re: Very big auto-whitelist file

2006-08-31 Thread Logan Shaw
On Thu, 31 Aug 2006, St?phane LEPREVOST wrote: A little question about AWL : I have an auto_whitelist how looks VERY HUGE to me : -rw---1 root root 1241124864 Aug 31 17:51 auto-whitelist Do you think a 1.2 Gb AWL file is NORMAL ? You might try typing "du -k auto-whitelist". It

Re: Discourage broken content

2006-08-31 Thread Kris Deugau
John Andersen wrote: Mailscanner ... or any other mail-handling software... has no business changing content. ... unless you explicitly configure it to do so. (ATTN: AVG for Windows POP3/SMTP interface/hook authors, This Means You! Among others.) -kgd

RE: RBL and blackholes.us.

2006-08-31 Thread Herb Martin
> Dear John D. Hardin, > > aha, that sounds reasonable :) > > But the fact is that some server blocked me, but it should > accepted. My > users complained about this and made me so agonising That is entirely the option of that "server's admins"; to refuse YOUR email. I may not agree with

Very big auto-whitelist file

2006-08-31 Thread Stéphane LEPREVOST
A little question about AWL : I have an auto_whitelist how looks VERY HUGE to me : -rw---    1 root root 1241124864 Aug 31 17:51 auto-whitelist   Do you think a 1.2 Gb AWL file is NORMAL ?   I don't think so and plan to use check_whitelist tool to clean it, something like : ch

SPF_SOFTFAIL but there's no SPF record

2006-08-31 Thread Rosenbaum, Larry M.
SpamAssassin version 3.1.4 running on Perl version 5.8.7(and 5.8.5) Any idea why a message with the following headers: X-Envelope-From: <[EMAIL PROTECTED]> Received: from mail.ans.org (mail.ans.org [206.222.45.53]) by emroute1.ornl.gov (PMDF V6.2-1x9 #31038) with ESMTP id <[EMAIL PROTECTE

Re: RBL and blackholes.us.

2006-08-31 Thread Xueron Nee
Dear John D. Hardin, aha, that sounds reasonable :) But the fact is that some server blocked me, but it should accepted. My users complained about this and made me so agonising Thanks for your helo anyway. John D. Hardin wrote: > On Thu, 31 Aug 2006, Xueron Nee wrote: > > > Seems that th

Re: RBL and blackholes.us.

2006-08-31 Thread John D. Hardin
On Thu, 31 Aug 2006, Xueron Nee wrote: > Seems that there are too many email servers use these dns based > lists incorrectly ... Not necessarily. An email admin has to make the conscious decision "I don't want to accept any email from China" in order to use that RBL in the first place. I did pre

Re: File mode set incorrectly

2006-08-31 Thread Magnus Holmgren
On Thursday 31 August 2006 14:30, Albert Poon took the opportunity to say: > If so whats the point of these options? You might want to set group or others permissions differently depending on how you run SpamAssassin (per-user or global) and whether users have their own primary group or belong t

Re: RBL and blackholes.us.

2006-08-31 Thread Xueron Nee
Dear Matt Kettler, Thanks for your kindly help :) Seems that there are too many email servers use these dns based lists incorrectly ... Matt Kettler wrote: > Xueron Nee wrote: > > Hi All: > > > > These days, I found that many outbond messages of my server were blocked > > by blackholes.us. I c

Re: File mode set incorrectly

2006-08-31 Thread Albert Poon
If so whats the point of these options? Are you meaning its the design of the ports collection or SA itself? Magnus Holmgren wrote: > > On Thursday 31 August 2006 05:33, Albert Poon took the opportunity to say: >> My box is FreeBSD 6.1-I386 and my SA is installed from ports. (MIMEDefang >> + >>

Re: SPF Failing for this list mail

2006-08-31 Thread Matt Kettler
Ramprasad wrote: > Hi, > One mail for this list got into my quarantine. I was surprised since I > had spf_whitelist 'ed spamassassin.apache.org > > I went thru the logs , got this > > > Aug 30 03:20:27 rs14 MailScanner[25502]: Message 747B1441F1.64958 from > 209.237.227.199 (de

Re: RBL and blackholes.us.

2006-08-31 Thread Matt Kettler
Xueron Nee wrote: > Hi All: > > These days, I found that many outbond messages of my server were blocked > by blackholes.us. I checked all my IPs and found so many of them listed > in this list. > > There are many email servers use the list as rbl straitly, Although it > says: "Blackholes.us does n

Re: Language settings score

2006-08-31 Thread Graham Murray
Paul Tenfjord <[EMAIL PROTECTED]> writes: > In Norway there is strict law rules concerning sending spam, which > in fact works very well. Therefor we have no Norwegian incoming > spam. I was wondering if there is a feature that lowers the score > for mails that is in the Norwegian language. The

Re: source SENDER authentication ? (as opposed to SPF HOST authentication)

2006-08-31 Thread Justin Mason
Benny Pedersen writes: > On Wed, August 30, 2006 19:44, Justin Mason wrote: > > list -- as the forged source of the spam. The end result for us end > > users, is a massive increase in "spam blowback", which is what we've > > seen since those MTAs implemented it. :( > > spf solves that Well, it

Re: Language settings score

2006-08-31 Thread Benny Pedersen
On Thu, August 31, 2006 10:19, Paul Tenfjord wrote: > The way I understand ok_languages, it allows or disallows the given languages. > What we need is something so that we can set the score to -100 if the mail is > written in Norwegian. > > Score no_language -100 or something like that. > > Hope yo

Language settings score

2006-08-31 Thread Paul Tenfjord
Hello all. In Norway there is strict law rules concerning sending spam, which in fact works very well. Therefor we have no Norwegian incoming spam. I was wondering if there is a feature that lowers the score for mails that is in the Norwegian language. The way I understand ok_languages, it a

Re: RBL and blackholes.us.

2006-08-31 Thread Duncan Hill
On Thursday 31 August 2006 08:49, Xueron Nee wrote: > I don't know why njabl.org alse use these data. > > http://njabl.org/cgi-bin/lookup.cgi?query=220.181.13.1 > > 220.181.13.1 is listed in blackholes.njabl.org: China blocked by > china.blackholes.us Don't have an IP address in Chinese netspace.

Re: RBL and blackholes.us.

2006-08-31 Thread Xueron Nee
Dear Yet Another Ninja, Thanks for your help. The problem is that, our outbond message were rejected directly according to this list. I don't know why njabl.org alse use these data. http://njabl.org/cgi-bin/lookup.cgi?query=220.181.13.1 220.181.13.1 is listed in blackholes.njabl.org: China bl

Re: RBL and blackholes.us.

2006-08-31 Thread Xueron Nee
Dear John Andersen, Thanks for your help. I can only find a contact email address on its page: [EMAIL PROTECTED] and I had wrote to him sereral time. But there were no any reply. All my IPs are used for email service as we are the bigest ESP in China. I checked these IPs and only get: "Listed by