On Wed, 2009-10-21 at 18:59 +0200, Lars Ebeling wrote:
> I am running SA 3.2.5 on HP-UX 11.11. I am using postfix as MTA.
>
> http://pastebin.com/m612529a7
>
> The interface is configured in master.cf
It's 42K, so check that you don't have a size limit.
When I scan it I get:
X-Spam-Report:
* 2.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
bl.spamcop.net
* [Blocked - see <http://www.spamcop.net/bl.shtml?75.209.5.48>]
* 0.5 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
* [75.209.5.48 listed in zen.spamhaus.org]
* 2.9 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
* 2.0 RCVD_IN_BRBL_RELAY RBL: received via a relay rated as poor by
* Barracuda
* [75.209.5.48 listed in b.barracudacentral.org]
* 4.2 HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname
(Split
* IP)
* 3.7 FH_HELO_ALMOST_IP Helo is almost an IP addr.
* 0.0 RELAY_US Relayed through United States
* 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
* 1.3 RAZOR2_CF_RANGE_E4_100 Razor2 gives engine 4 confidence level of
* 100%
* [cf: 100]
* 1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level
* above 50%
* [cf: 100]
* 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
* [cf: 100]
* 0.1 RDNS_DYNAMIC Delivered to trusted network by host with
* dynamic-looking rDNS
* 1.5 JM_SOUGHT_3 Body contains frequently-spammed text patterns
* 0.5 BOTNET_OTHER BOTNET_OTHER
And it also is caught by clamav:
$ clamscan lars.vir
lars.vir: Sanesecurity.Malware.8825.UNOFFICIAL FOUND
>
>
> Regards
>
> Lars
>
> ----- Original Message -----
> From: "Kevin Parris" <kpar...@ed.sc.gov>
> To: <users@spamassassin.apache.org>
> Sent: Wednesday, October 21, 2009 5:46 PM
> Subject: Re: Mail not scanned
>
>
> In this situation I believe Spock would say "Insufficient Data" . . .
>
> What o/s are you running? What is your mail handling software? How does
> that mail handling software interface to SpamAssassin? Are you sure the
> items were not scanned, or are you simply bothered that they were not marked
> as spam by the scan? Have you placed a complete sample with all headers on
> pastebin and given us the link to that so we can evaluate the message?
>
> >>> "Lars Ebeling" <lars.ebel...@leopg9.no-ip.org> 10/21/09 11:40 AM >>>
> Why aren't mail from "United Parcel Service" scanned?
>
> The last 24 hours have i got about 20 of them and none scanned.
>
>
