Re: In subject how to detect a word in an EVAL string?

2011-11-22 Thread Sergio
Thank you Benny, I will use this command next time. Sergio By the way your links are very accurate, that are the spammers that sent the email, with my new rule they are On Tue, Nov 22, 2011 at 3:42 AM, Benny Pedersen wrote: > On Mon, 21 Nov 2011 22:32:42 +0100, Karsten Bräckelmann wrote: > >>

Re: Sought rules revisited

2011-11-22 Thread Mynabbler
Mynabbler wrote: > > Is it just me, or is the last sought_rules update November 9th? > Sorry about the double posts... It was posted using Nabble, which returned 500 errors, and yet still posted the message. Oops. -- View this message in context: http://old.nabble.com/Sought-rules-revisited-t

Re: Negative score spamassassin

2011-11-22 Thread Karsten Bräckelmann
On Tue, 2011-11-22 at 09:26 -0500, Bowie Bailey wrote: > On 11/22/2011 3:25 AM, ercibrest wrote: > > X-Spam-Status: No, score=-3.9 required=6.0 tests=BAYES_00,FROM_12LTRDOM, > > RDNS_NONE,TVD_SPACE_RATIO,TVD_SPACE_RATIO_MINFP shortcircuit=no > > autolearn=ham version=3.3.2 ^

Sought rules revisited

2011-11-22 Thread Mynabbler
Is it just me, or is the last sought_rules update November 9th? And it is not like an update is available: $ sa-update --gpgkey 6C6191E3 -D --channel sought.rules.yerp.org dbg: channel: attempting channel sought.rules.yerp.org [...] dbg: channel: current version is 3301199767, new version is 3301

Sought rules revisited

2011-11-22 Thread Mynabbler
Is it just me, or is the last sought_rules update November 9th? And it is not like an update is available: $ sa-update --gpgkey 6C6191E3 -D --channel sought.rules.yerp.org dbg: channel: attempting channel sought.rules.yerp.org ... dbg: channel: current version is 3301199767, new version is 330119

Sought rules revisited

2011-11-22 Thread Mynabbler
Is it just me, or is the last sought_rules update November 9th? And it is not like an update is available: # sa-update --gpgkey 6C6191E3 -D --channel sought.rules.yerp.org dbg: channel: attempting channel sought.rules.yerp.org ... dbg: channel: current version is 3301199767, new version is 330119

Sought rules revisited

2011-11-22 Thread Mynabbler
Is it just me, or is the last sought_rules update November 9th? And it is not like an update is available: # sa-update --gpgkey 6C6191E3 -D --channel sought.rules.yerp.org dbg: channel: attempting channel sought.rules.yerp.org ... dbg: channel: current version is 3301199767, new version is 330119

Re: Negative score spamassassin

2011-11-22 Thread Bowie Bailey
On 11/22/2011 3:25 AM, ercibrest wrote: > need to see the rule hits for the negative scores.. > > also I don't see any RBL, URIBL, pyzor or razor scores in there, have you > disabled network tests? these are really valuable - just make sure you > only choose a couple of the RBL's (see > http://wik

Re: In subject how to detect a word in an EVAL string?

2011-11-22 Thread Benny Pedersen
On Mon, 21 Nov 2011 22:32:42 +0100, Karsten Bräckelmann wrote: =?iso-8859-1?B?LlZlbnRhIGRlIENBTkFTVEFTIE5BVklERdFBUyAtIHB1YmyhY2kgZGFk?= Not "eval", but encoded -- in this case even necessary, rather than an attempt at obfuscation, because it contains non ASCII letters. yep its base64 enco

Re: Negative score spamassassin

2011-11-22 Thread ercibrest
Darxus wrote: > > On 11/21, ercibrest wrote: >> Maybe there is a problem of configuration because all of my emails come >> from >> the same IP. From internet, email send to my domain is receive from my >> provider and then, the provider relay mails to my mailscanner 's server. > > Add that IP

Re: Negative score spamassassin

2011-11-22 Thread ercibrest
need to see the rule hits for the negative scores.. also I don't see any RBL, URIBL, pyzor or razor scores in there, have you disabled network tests? these are really valuable - just make sure you only choose a couple of the RBL's (see http://wiki.mailscanner.info/doku.php?id=maq:index#getting