Re: Stock spam in images

I'm having marvelous luck with FuzzyOCR - but the spammers are learning too. When I first started using it just a couple of months ago, it really whacked the image-based spam. You could see why when "gocr file.gif" returned nice text that was easy to match against. However, now is a different mat

Re: Score=x ?

That's an amavis thing, but I presume it means there is no score (ie: SA did not completely analyze the message, so no score was computed). This could mean message was not fed to spamassassin (due to hard whitelist or bypass_spam_checks), or amavis timed-out the spamassassin process (which is very

What's the best method to use SA?

Hello. I have used SA using with procmail. and clamav + sendmail(libmilter) against virus. But I have found that other related solutions like http://www.mailscanner.info/ or http://www.amavis.org/. I don't know what's the difference or better between SA using procmail or above solutions. m

Re: Score=x ?

Matt Kettler wrote: That's an amavis thing, but I presume it means there is no score (ie: SA did not completely analyze the message, so no score was computed). This could mean message was not fed to spamassassin (due to hard whitelist or bypass_spam_checks), or amavis timed-out the spamassassin

Re: Score=x ?

On Tue, Oct 03, 2006 at 10:59:40PM -0500, M.Lewis wrote: > I've seen a couple of mails come through lately with score=x. Perhaps > there have been some coming in all along like that and I haven't noticed it. > > What does score=x mean? > X-Spam-Status: No, score=x tagged_above=-999 required=5 tes

Score=x ?

I've seen a couple of mails come through lately with score=x. Perhaps there have been some coming in all along like that and I haven't noticed it. What does score=x mean? Thanks, Mike X-Virus-Scanned: amavisd-new at cajuninc.com X-Spam-Score: - X-Spam-Level: X-Spam-Status: No, score=x tagge

HELO test rule-writing questions

Hi all, I'm trying to write some SA rules for additional tests on the connecting mailserver's SMTP HELO string, and I have some questions about how to do it. Should I send them to this list or to the dev list? Assuming it's this list, one of the things I'm trying to do is assign a modest sco

Re: pyzor timeout

Fletcher Mattox wrote: > Hi, > > How does one decrease the default Pyzor timeout of five seconds? > (without editing the source code :) ) > Read the docs for the pyzor plugin: http://spamassassin.apache.org/full/3.1.x/dist/doc/Mail_SpamAssassin_Plugin_Pyzor.html As Stuart already pointed out

Re: Delete all emails tagged by SA.

Shahzad Abid wrote: Dear Ed Kasky Thanks for such a nice suggetion and guidance currently I am using qtrap for my Qmail Server. Is there any other tool available ? Shahzad Abid You obviously haven't read the information on qmail-scanner. If you add the ST patch to qmail-scanner, you can

Re: Spamassassin Rules

Are there rules that should catch this type of Spam? Do not I need change some configuration info? Am I doing something wrong? Yes. And probably yes. If you don't have network rules enabled you should enable them. The URIBL-type rules will probably catch the vast majority of this junk. Mo

Re: rulesdujour

#Ronan McGlue wrote: > can someone give me a listing of the latest timestamps regarding their > rulesdujour updates? > I've just noticed that none of the files have been updated on my > machine since mid augaust... surely this isn't normal... > > thanks > > Ronan > I just updated antidrug this past

Re: FuzzyOCR seems to not like gif and png

There are newer versions of FuzzyOCR that probably fix or at least get around this.  A lot of image spam mails have broken images in them, and this messes up a lot of stuff.  The latest versions use ImageMagic.  This is reputedly hard to install on many systems.  But if you can get it instal

Re: perl hogging my memory?

Woot!! Thank you Justin and the rest of the Wiki crew for putting that up! I was getting tired of writing the "Are you using sa-blacklist.cf?" email over, and over again. Justin Mason wrote: > have you looked at > http://wiki.apache.org/spamassassin/OutOfMemoryProblems ? > note especially the 'He

Spamassassin Rules

Lately, I am getting lots of similar emails that I want caught as Spam but are not. These are like: Subject: Pharmacy -- where the word pharmacy is missed spelled in many different methods. Subject: ... My Name Subject: ... My home address I send these to Bayes for learni

Re: Delete all emails tagged by SA.

Not sure about Qmail - I use procmail as our MDA... At 12:49 PM Tuesday, 10/3/2006, Shahzad Abid wrote -=> Dear Ed Kasky Thanks for such a nice suggetion and guidance currently I am using qtrap for my Qmail Server. Is there any other tool available ? Shahzad Abid Ed Kasky > At 09:15 AM Tuesd

Re: pyzor timeout

On Tue, October 3, 2006 20:55, Fletcher Mattox wrote: > How does one decrease the default Pyzor timeout of five seconds? > (without editing the source code :) ) perldoc Mail::SpamAssassin::Plugin::Pyzor -- "This message was sent using 100% recycled spam mails."

Re: [Devel-spam] {Spam?} ascii art spam and possible solution

On Tue, October 3, 2006 21:44, John D. Hardin wrote: >> Surely all you need to do is write a rule which gives > combined with /\s(?:\S\S\s\s){7}/ maybe? tripwire.cf -- "This message was sent using 100% recycled spam mails."

Re: Moderator: User needs to be unsubscribed...

>... >To: users@spamassassin.apache.org >From: Evan Platt <[EMAIL PROTECTED]> >Subject: Moderator: User needs to be unsubscribed... >... > >For every post, I'm getting: > >Subject: Autoreply from [EMAIL PROTECTED] (was Re:perl hogging >my memory? ) >Errors-To: <[EMAIL PROTECTED]> >Reply-To: <[EMAI

RE: pyzor timeout

Hi, How does one decrease the default Pyzor timeout of five seconds? (without editing the source code :) ) Thanks Fletcher You might also get better response from the server at 82.94.255.100:24441 If you would like to try, edit your /path/to/.pyzor/servers file and replace the existing serve

Re: Delete all emails tagged by SA.

Dear Ed Kasky Thanks for such a nice suggetion and guidance currently I am using qtrap for my Qmail Server. Is there any other tool available ? Shahzad Abid Ed Kasky > At 09:15 AM Tuesday, 10/3/2006, Shahzad Abid wrote -=> >>I have SpamAssassin version 3.1.5 running on Perl version 5.8.5 on FC

Moderator: User needs to be unsubscribed...

For every post, I'm getting: Subject: Autoreply from [EMAIL PROTECTED] (was Re:perl hogging my memory? ) Errors-To: <[EMAIL PROTECTED]> Reply-To: <[EMAIL PROTECTED]> Message-Id: <[EMAIL PROTECTED]> Bonjour, Je suis en conges jusqu'au 23 octobre, pour toute demande veuillez contacter notre su

Re: SpamAssassin question

On Tue, 3 Oct 2006, Justin Mason wrote: > Loren Wilton writes: > > > > I *think* they may have implemented counting rules fairly recently; but I'm > > not sure if that patch was ever released. > > yep, "tflags multiple" support, in 3.2.0. Woohoo! -- John Hardin KA7OHZICQ#15735746http

Re: perl hogging my memory?

At 11:56 AM 10/3/2006, you wrote: have you looked at http://wiki.apache.org/spamassassin/OutOfMemoryProblems ? note especially the 'Heavyweight custom rules' section. Thanks much.. That was more or less it total 23996 56 70_sare_adult.cf48 70_sare_genlsubj3.cf 8

RE: pyzor timeout

Hi, How does one decrease the default Pyzor timeout of five seconds? (without editing the source code :) ) Thanks Fletcher You might also get better response from the server at 82.94.255.100:24441 If you would like to try, edit your /path/to/.pyzor/servers file and replace the existing serve

Re: [Devel-spam] {Spam?} ascii art spam and possible solution

On Tue, 3 Oct 2006, Randal, Phil wrote: > Surely all you need to do is write a rule which gives > > style="FONT-SIZE: 4px" > > (or a range of small font sizes) a biggish score? > > ah ustymm al td ep vhag > > su ga zeee ok yk ch eq jrg ymp > > fd vj tg yc

Re: pyzor timeout

Fletcher Mattox wrote: Hi, How does one decrease the default Pyzor timeout of five seconds? (without editing the source code :) ) The Pyzor SpamAssassin plugin documentation seems to mention a pyzor_timeout option. Daryl

Re: pyzor timeout

Fletcher Mattox wrote: Hi, How does one decrease the default Pyzor timeout of five seconds? (without editing the source code :) ) pyzor_timeout 1

Re: perl hogging my memory?

have you looked at http://wiki.apache.org/spamassassin/OutOfMemoryProblems ? note especially the 'Heavyweight custom rules' section. --j. Evan Platt writes: > Ok, I've googled and obviously I'm not finding the right solution.. > But had to reinstall spamassassin on my os/x 10.4 box. > > Follow

pyzor timeout

Hi, How does one decrease the default Pyzor timeout of five seconds? (without editing the source code :) ) Thanks Fletcher

perl hogging my memory?

Ok, I've googled and obviously I'm not finding the right solution.. But had to reinstall spamassassin on my os/x 10.4 box. Followed http://developer.apple.com/server/fighting_spam.html . But, my system is running out of memory, and it looks like Perl / spamassassin is the cause . I've omitted

Re: Message Vs Batch mode processing ..

On Tue, Oct 03, 2006 at 08:59:08PM +1300, Adam Bogacki wrote: > Thanks for the advice Theo .. I've registered with razor and am > now reporting spam regularly and saving to folder 'Spam'. :) > However, I'm a bit frustrated having to do this 'message by message' with > downloads averaging around 1

FuzzyOCR seems to not like gif and png

I have SA 3.1.4 and FuzzyOCR 2.3b installed…I keep getting these messages in the log whenever I test any gif and png samples…   [2006-10-03 11:24:33] Unexpected error in pipe to external programs.   Please check that all helper programs are installed and in the correc

Re: Q. about spam directed towards highest MX Record?

On Fri, 29 Sep 2006, Rob McEwen (PowerView Systems) wrote: Jon Trulson said: Hehe, that is an old spammer trick... Our secondary MX is pretty much 100% spam. I implemented greylisting on the secondary which reduced spam through it by about 99% :) The secondary does not do spam scanning, it's s

Re: Delete all emails tagged by SA.

At 09:15 AM Tuesday, 10/3/2006, Shahzad Abid wrote -=> I have SpamAssassin version 3.1.5 running on Perl version 5.8.5 on FC3. I want to delete all emails tagged by SA as spam. So what's stopping you? Do know however that SA will not "process" your mail in any way - all it is intended to d

Delete all emails tagged by SA.

Dear All I have SpamAssassin version 3.1.5 running on Perl version 5.8.5 on FC3. I want to delete all emails tagged by SA as spam. Shahzad Abid

Re: SpamAssassin question

Loren Wilton writes: > You can't do what you want in 2.6x, at least without writing an eval rule in > perl. > > I *think* they may have implemented counting rules fairly recently; but I'm > not sure if that patch was ever released. yep, "tflags multiple" support, in 3.2.0. --j.

RE: SpamAssassin question

John W Mickevich wrote: > Hello, > > I am relatively new to SpamAssassin and I hope I am asking this > question via the appropriate channel. If not, please let me know. > I have been receiving spam email that is not getting caught by > SpamAssassin and want to add a rule to catch it. These part

RE: SpamAssassin question

Time for you to start using uribls.   For SA 2.64 you'll need spamcopuri ( http://sourceforge.net/projects/spamcopuri/ ), and then check www.surbl.org for usage instructions.   Better to upgrade to SA 3.1.5.   http://www.rulesemporium.com/cgi-bin/uribl.cgi returns this for thelevelgroup.net:

Re: SpamAssassin question

You can't do what you want in 2.6x, at least without writing an eval rule in perl.   I *think* they may have implemented counting rules fairly recently; but I'm not sure if that patch was ever released.   In any case, you should be able to use network tests and SURBL in 2.64 and that will i

SpamAssassin question

  Hello,   I am relatively new to SpamAssassin and I hope I am asking this question via the appropriate channel.  If not, please let me know. I have been receiving spam email that is not getting caught by SpamAssassin and want to add a rule to catch it.  These particular spam emails hav

RE: rulesdujour

#Ronan McGlue wrote: > can someone give me a listing of the latest timestamps regarding their > rulesdujour updates? > I've just noticed that none of the files have been updated on my > machine since mid augaust... surely this isn't normal... No, it's fairly normal. SARE_STOCKS is the only one th

rulesdujour

can someone give me a listing of the latest timestamps regarding their rulesdujour updates? I've just noticed that none of the files have been updated on my machine since mid augaust... surely this isn't normal... thanks Ronan -- Ronan McGlue Analyst / Programmer CMC Systems Group Queens Uni

Re: Non-blocklisted embedded URLs are getting hits on URIBL_AB_SURBL and URIBL_PH_SURBL in SpamAssassin 3.1.5

thanks Jeff! here's the new FAQ entry: http://wiki.apache.org/spamassassin/OpenDnsAndUribls feel free to modify, guys. --j. Jeff Chan writes: > If it helps, here's what I wrote for the SURBL FAQ: > > http://www.surbl.org/faq.html#opendns > > > I'm using OpenDNS and getting wrong answers to

RE: Stock spam in images

For Debian Users I've found the follow link, a step by step guide in order to implement FuzzyOCR and ImageInfo with spamassassin. http://www200.pair.com/mecham/spam/image_spam.html Andrea

Message Vs Batch mode processing ..

Thanks for the advice Theo .. I've registered with razor and am now reporting spam regularly and saving to folder 'Spam'. However, I'm a bit frustrated having to do this 'message by message' with downloads averaging around 1-200. I am impressed that Sylpheed-Claws-GTK2 (with SA & ClamAV plugins)

Re: Non-blocklisted embedded URLs are getting hits on URIBL_AB_SURBL and URIBL_PH_SURBL in SpamAssassin 3.1.5

If it helps, here's what I wrote for the SURBL FAQ: http://www.surbl.org/faq.html#opendns I'm using OpenDNS and getting wrong answers to SURBL DNS queries OpenDNS is a service that changes the responses to some DNS queries in order to prevent users from visiting spam, phishing, etc., sites. I