The autowhitelist is in a binary database format. You can't safely use a text
editor on it. You can use the tools/check_whitelist script to get a nice clean
dump of the AWL contents. Actually, you'll need to either get the current CVS
version or apply the following quick patch:
diff -u -r1.6 -r1.7
--- tools/check_whitelist 1 May 2002 18:42:29 -0000 1.6
+++ tools/check_whitelist 11 May 2002 18:18:17 -0000 1.7
@@ -14,6 +14,6 @@
{
my $t = $h{"$key|totscore"};
my $v = $h{$key};
- if(defined($t)) { printf "%-40.40s -> % 2.1f %s\n",$key,$t/$v,"($t/$v)"; };
+ if(defined($t)) { printf "% 8.1f %15s -- %s\n",$t/$v,"($t/$v)",$key; };
}
untie %h;
After patching, run the following:
tools/check_whitelist > addresses
Then, use your favorite text editor to edit the "addresses" file, trim it down
to list just those addresses you want to remove from the AWL. Also, and this is
important, insert 2 blank lines at the top of the file.
Now, run:
spamassassin -R < addresses
That should remove all those addresses from your AWL.
C
Rob Reid wrote:
RR> Today I got spam, obvious spam, in my inbox that normally would have gone in my
RR> spam folder but didn't because it was whitelisted. I checked my
RR> ~/.spamassassin/auto-whitelist.db with strings | less and sure enough the
RR> spammer's address was there, along with a couple of other obvious spammer
RR> addresses.
RR>
RR> I've never communicated with these spammers before, so I don't know how they
RR> got into my autowhitelist. All I can think of is that this department was hit
RR> by the Klez worm, so for about a week I was getting a lot of mail with forged
RR> headers, some of it purportedly from dept. members, all going into my inbox.
RR>
RR> Can somebody with a better understanding of the autowhitelister tell me how to
RR> prevent this from happening again, and how to edit out the existing infection?
RR> Can emacs safely edit db files?
RR>
RR> Thanks
RR>
RR>
_______________________________________________________________
Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: [EMAIL PROTECTED]
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
