Pyzor not working?

2008-08-01 Thread Jake Maul
Howdy all, Have I gone insane or has Pyzor stopped working? My last successful hit was yesterday ~7am GMT-7. mail:~# cat /etc/spamassassin/.pyzor/servers 82.94.255.100:24441 --- mail:~# pyzor --homedir=/etc/spamassassin/ ping Traceback (most recent call last): File "/usr/bin/pyzo

Re: simple drug spam not flagged

2008-08-01 Thread Jake Maul
Okay, got some samples online to look at: http://66.213.231.82/spam/sample1.txt http://66.213.231.82/spam/sample2.txt http://66.213.231.82/spam/sample3.txt http://66.213.231.82/spam/sample4.txt http://66.213.231.82/spam/sample5.txt http://66.213.231.82/spam/sample6.txt http://66.213.231.82/spam/sa

Re: simple drug spam not flagged

2008-08-01 Thread Chris
On Thursday 31 July 2008 11:58 pm, Jake Maul wrote: > Greetings, > > I've recently been getting more simple drug-related spam that has no > real obfuscation and often doesn't get flagged with anything other > than HTML_MESSAGE (0.0) and BAYES_XX (generally 50-99). > > A few sample Subject lines: >

RE: autolearn=yes but sa-learn dump magic shows no new spam

2008-08-01 Thread Brett Millett
As you can see from the response I just posted, I'm not using MySQL for bayes (albeit, maybe I should be, that seems very convenient.) >You do not need to include the X-Spam-* header fields as they are >stripped before learning. Thanks. I'll pull those out. -Original Message- From: Duan

RE: autolearn=yes but sa-learn dump magic shows no new spam

2008-08-01 Thread Brett Millett
Great guess! I was running as root before (sudo.) Here are the results when I run the command as the site-wide user. sa-learn --dump magic 0.000 0 3 0 non-token data: bayes db version 0.000 0329 0 non-token data: nspam 0.000 0

Re: autolearn=yes but sa-learn dump magic shows no new spam

2008-08-01 Thread Duane Hill
On Fri, 1 Aug 2008, Brett Millett wrote: I've been googling quite a bit today to find the answer to what I'm seeing that is happening on my mail server. However, I just can't seem to find a definitive answer. When looking at my mail logs I see a number of autolearn=spam, however when I run "sa-l

Re: autolearn=yes but sa-learn dump magic shows no new spam

2008-08-01 Thread Karsten Bräckelmann
On Fri, 2008-08-01 at 15:28 -0600, Brett Millett wrote: > Hi, > > I've been googling quite a bit today to find the answer to what I'm > seeing that is happening on my mail server. However, I just can't seem > to find a definitive answer. When looking at my mail logs I see a number > of autolearn=s

autolearn=yes but sa-learn dump magic shows no new spam

2008-08-01 Thread Brett Millett
Hi, I've been googling quite a bit today to find the answer to what I'm seeing that is happening on my mail server. However, I just can't seem to find a definitive answer. When looking at my mail logs I see a number of autolearn=spam, however when I run "sa-learn --dump magic" nspam does not incre

Re: Rule to block link to *.zip *.exe *.scr ...

2008-08-01 Thread John Hardin
On Fri, 1 Aug 2008, Rejaine Monteiro wrote: note: i'm not talking about block *attached* files .. (my qmail-scanner already do this..) Oops. I misread your question then. i need a rule to targed as spam e-mail with *links to* dangerous files.. Here's what I use: uri EXECUTABLE

Re: Rule to block link to *.zip *.exe *.scr ...

2008-08-01 Thread Rejaine Monteiro
OK.. Sorry for my bad english ... Thank you for the tip..! Karsten Bräckelmann escreveu: On Fri, 2008-08-01 at 15:01 -0300, Rejaine Monteiro wrote: note: i'm not talking about block *attached* files .. (my qmail-scanner already do this..) i need a rule to targed as spam e-mail with

Re: Rule to block link to *.zip *.exe *.scr ...

2008-08-01 Thread Karsten Bräckelmann
On Fri, 2008-08-01 at 15:01 -0300, Rejaine Monteiro wrote: > note: i'm not talking about block *attached* files .. (my > qmail-scanner already do this..) > i need a rule to targed as spam e-mail with *links to* dangerous files.. Yes, I did understand that, and that's exactly what I discusse

Re: Rule to block link to *.zip *.exe *.scr ...

2008-08-01 Thread Rejaine Monteiro
note: i'm not talking about block *attached* files .. (my qmail-scanner already do this..) i need a rule to targed as spam e-mail with *links to* dangerous files.. Karsten Bräckelmann escreveu: On Fri, 2008-08-01 at 14:40 -0300, Rejaine Monteiro wrote: Hi all How can I create a gen

Re: Rule to block link to *.zip *.exe *.scr ...

2008-08-01 Thread Karsten Bräckelmann
On Fri, 2008-08-01 at 14:40 -0300, Rejaine Monteiro wrote: > Hi all > > How can I create a generic rule to block any e-mail with links to > dangerous files ? Easy, just ask those folks related to tools in your mail processing chain that actually can block mail. SA does not. SA tags mail, it does

RE: Solution for Disaster spam?

2008-08-01 Thread James Pratt
> -Original Message- > From: Michelle Konzack [mailto:[EMAIL PROTECTED] > Sent: Friday, August 01, 2008 1:29 PM > To: users@spamassassin.apache.org > Subject: Re: Solution for Disaster spam? > > Am 2008-08-01 07:07:59, schrieb Micha? J?czalik: > > On Sun, 27 Jul 2008, Robert Nicholson wrot

Rule to block link to *.zip *.exe *.scr ...

2008-08-01 Thread Rejaine Monteiro
Hi all How can I create a generic rule to block any e-mail with links to dangerous files ? Like http://.zip or http://***.exe or ***.doc.exe etc...

SA getting stuck on a message

2008-08-01 Thread Munroe Sollog
I have only seen this happen on Cron messages generated by our apt-cacher. I am running a Debian Lenny machine with: SpamAssassin version 3.2.5 running on Perl version 5.10.0 I am calling spamassassin through amavid-new 2.6.0 I have pastebinned my debug output, I'm not sure what else whould be

Re: Solution for Disaster spam?

2008-08-01 Thread Michelle Konzack
Am 2008-08-01 07:07:59, schrieb Micha? J?czalik: > On Sun, 27 Jul 2008, Robert Nicholson wrote: > > >What have people been using to curtail some of the new disaster spam > >that's quite common now? > > Well, indeed it was clamav that helped me. After upgrading to most recent > version, 95% of t

Re: simple drug spam not flagged

2008-08-01 Thread Jake Maul
On Fri, Aug 1, 2008 at 6:07 AM, Karsten Bräckelmann <[EMAIL PROTECTED]> wrote: > On Thu, 2008-07-31 at 21:58 -0700, Jake Maul wrote: >> Greetings, >> >> I've recently been getting more simple drug-related spam that has no >> real obfuscation and often doesn't get flagged with anything other >> than

Re: simple drug spam not flagged

2008-08-01 Thread Jake Maul
On Fri, Aug 1, 2008 at 6:42 AM, Richard Frovarp <[EMAIL PROTECTED]> wrote: > Jake Maul wrote: >> >> Greetings, >> >> I've recently been getting more simple drug-related spam that has no >> real obfuscation and often doesn't get flagged with anything other >> than HTML_MESSAGE (0.0) and BAYES_XX (ge

Re: simple drug spam not flagged

2008-08-01 Thread Jake Maul
On Fri, Aug 1, 2008 at 12:53 AM, Matus UHLAR - fantomas <[EMAIL PROTECTED]> wrote: > On 31.07.08 21:58, Jake Maul wrote: >> I've recently been getting more simple drug-related spam that has no >> real obfuscation and often doesn't get flagged with anything other >> than HTML_MESSAGE (0.0) and BAYES

Re: simple drug spam not flagged

2008-08-01 Thread Richard Frovarp
Jake Maul wrote: Greetings, I've recently been getting more simple drug-related spam that has no real obfuscation and often doesn't get flagged with anything other than HTML_MESSAGE (0.0) and BAYES_XX (generally 50-99). A few sample Subject lines: Subject: Use Generik Viagra and forget about y

Re: simple drug spam not flagged

2008-08-01 Thread Karsten Bräckelmann
On Thu, 2008-07-31 at 21:58 -0700, Jake Maul wrote: > Greetings, > > I've recently been getting more simple drug-related spam that has no > real obfuscation and often doesn't get flagged with anything other > than HTML_MESSAGE (0.0) and BAYES_XX (generally 50-99). > > A few sample Subject lines:

Re: simple drug spam not flagged

2008-08-01 Thread Matus UHLAR - fantomas
On 31.07.08 21:58, Jake Maul wrote: > I've recently been getting more simple drug-related spam that has no > real obfuscation and often doesn't get flagged with anything other > than HTML_MESSAGE (0.0) and BAYES_XX (generally 50-99). [...] > Subject: Use Generik Viagra and forget about your sexual