On Saturday 16 August 2008 5:27 am, distill wrote: > I've been receiving these "msnbc.com - BREAKING NEWS" spams recently. I've > made sure that all of those spams (over 40 of them) are manually trained to > be spam. SpamAssassin does filter out those messages about 75% of the time. > However, even after this careful manual training some of those spams are > still getting through (my score threshold is now 4.4). I get the feeling > that the training doesn't have any effect. Is there something wrong or is > SpamAssassin just incapable of learning this? The msnbc spams are almost > identical to eachother with lots of words, so I would imagine this should > be an easy task. > > Also I'd like to ask about the RCVD_IN-tags: Is it possible/probable that > if there are more than one of those tags present, for example > "RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SORBS_WEB", that the message in fact could > still be ham? >
If you're running the ClamAv plug-in Steve Basford has a new set of experimental sigs for this. They can be found here: http://sanesecurity.co.uk/clamav/rogue.htm Here's Steve's whole blurb: "The new Rogue signature database contains hashes of known Rogue Anti-Virus software and also contains known Fake Videos/Codecs. Most of these files are currently being distributed via the current wave of fake CNN/Msnbc/BBC news and fake video emails (54 signatures currently)" I've downloaded and installed but haven't received any of the above since installing. If you do install don't forget to stop and restart ClamAv so that they take effect. -- Chris KeyID 0xE372A7DA98E6705C
pgp3tKMa7gJFI.pgp
Description: PGP signature
