Guess what I found out! The banned CD really does work! My copy arrived in the mail today and so far I've changed my identity, spied on my boss, evaded my taxes, I even have a date with Brittany Spears!
Its really really great.... Mick Jagger I'm just kidding, its not Mick, really, just John.... Chris, this email doesn't seem to trigger the BASE64_ENC_TEXT rule when I do a SA -t on it anyway. But I think it may be some such trick because no matter what I do I can't get this banned CD to go away. DO you think if I buy it they will stop bugging me? Thanks again, John McGivern -----Original Message----- From: Chris Santerre [mailto:[EMAIL PROTECTED] Sent: August 20, 2003 4:06 PM To: John McGivern; Robert Menschel Cc: [EMAIL PROTECTED] Subject: RE: [SAtalk] catching the Banned CD spam! COuld it possible be the double base64 text trick again? Those tend to be goofy. I don't quite understand the darn trick myself. No one has posted a very good explanation yet. Does this spam hit the BASE64_ENC_TEXT rule? --Chris > -----Original Message----- > From: John McGivern [mailto:[EMAIL PROTECTED] > Sent: Wednesday, August 20, 2003 9:08 AM > To: Robert Menschel > Cc: [EMAIL PROTECTED] > Subject: RE: [SAtalk] catching the Banned CD spam! > > > Hey everyone! Thanks for all the responses! I was out of > the office yesterday. > > I do have the /i at the end of my rule so it looks like this: > > body RULE_NAME /bannedc|banned c/i > > so that I could catch the case as well. > > I know that phrase is in there obviously but it just won't > find it! When I do a commnd line spamassassin -t < message > it just doesn't find it. I've done a --lint and there are no > qualms there. I've also tested that the rule fires by > sending emails with banned c and bannedc in the body and my > mail server finds it just fine. > > I think I must be doing something stupid but I just can't > figure out what it is! I think I have tested everything. > > I will try some of the variations that you have all suggested > and see what spamassassin gives me. > > Thanks! > > John McGivern > > -----Original Message----- > From: Robert Menschel [mailto:[EMAIL PROTECTED] > Sent: August 18, 2003 10:09 PM > To: John McGivern > Cc: [EMAIL PROTECTED] > Subject: Re: [SAtalk] catching the Banned CD spam! > > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hello John, > > I find the following rules work well for me: > > header RM_sp_BannedCD Subject =~ /b\s?a\s?n\s?n\s?e\s?d\s?c\s?d/i > describe RM_sp_BannedCD Subject mentions the supposedly banned CD > score RM_sp_BannedCD 1.21 # 21 spam, 0 ham, Aug 12 2003 > > body RM_bp_BannedCD /b\s?a\s?n\s?n\s?e\s?d\s?c\s?d/i > describe RM_bp_BannedCD Body mentions the supposedly banned CD > score RM_bp_BannedCD 1.21 # 231 spam, 0 ham, Aug 12 2003 > > Bob Menschel > > -----BEGIN PGP SIGNATURE----- > Version: PGP 8.0 > > iQA/AwUBP0GGzZebK8E4qh1HEQKazwCeI8VFy5lB4ZCJk2R2+OJHM/Q75swAoOfi > dJ3dxl42rdxD65ogGnogk+Ib > =resJ > -----END PGP SIGNATURE----- > > > Monday, August 18, 2003, 12:44:24 PM, you wrote: > > JM> Hi everyone, > > JM> I don't know if you guys get the SPAM that advertises the > "Banned CD" I get dozens of them. Anyway, I've added a body > rule looking for the term "bannedc" or "banned c" and yet it > still doesn't > JM> catch it eventhough the text is right there! I know the > rule is working because if I email myself something with this > phrase, it gets blocked. So, how do they put actual text in > an email and it > JM> by SA? The source for the email is below. > > > > > ------------------------------------------------------- > This SF.Net email sponsored by: Free pre-built ASP.NET sites including > Data Reports, E-commerce, Portals, and Forums are available now. > Download today and enter to win an XBOX or Visual Studio .NET. > http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet > _072303_01/01 > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > > > ------------------------------------------------------- > This SF.net email is sponsored by Dice.com. > Did you know that Dice has over 25,000 tech jobs available today? From > careers in IT to Engineering to Tech Sales, Dice has tech > jobs from the > best hiring companies. http://www.dice.com/index.epl?rel_code4 > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > ------------------------------------------------------- This SF.net email is sponsored by Dice.com. Did you know that Dice has over 25,000 tech jobs available today? From careers in IT to Engineering to Tech Sales, Dice has tech jobs from the best hiring companies. http://www.dice.com/index.epl?rel_code=104 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ------------------------------------------------------- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
