I had the same problem.
Uirbl was catching lots of false positives. And the bomb expression
didn't honor the whitelist. So I got lot of false positives.
Additionalty I used the bombre file from ASSP and found out that it is
much to sensitve. There are some rules which blocked legitimate PDF
files.
Check all setting in ASSP and have a look at your bombre (and at the
whitelist - my was empty for some reason and I had to put the backup
instead)
Matti
EA> AVBytes:=10000
EA> AddConfidenceHeader:=1
EA> AddCustomHeader:=X-SMSMSE-SCL: 9
EA> AddIntendedForHeader:=1
EA> AddRBLHeader:=1
EA> AddRWLHeader:=1
EA> AddRegexHeader:=
EA> AddSPFHeader:=1
EA> AddScoringHeader:=1
EA> AddSpamHeader:=1
EA> AddSpamProbHeader:=1
EA> AddSpamReasonHeader:=1
EA> AddURIBLHeader:=1
EA> AsADaemon:=1
EA> AsAService:=
EA> AttachmentError:=500 These attachments are not allowed -- Compress
EA> before mailing.
EA> AvClamdBufSize:=7500
EA> AvClamdLocal:=1
EA> AvClamdPort:=/var/clamd
EA> AvDbs:=main.db,daily.db
EA> AvError:=500 Mail appears infected with '$infection' -- disinfect and
resend.
EA> AvPath:=
EA> Avlocal:=1
EA>
BadAttachL1:=ad[ep]|asx|ba[st]|chm|cmd|com|cpl|crt|dbx|exe|hlp|ht[ab]|in[fs]|isp|js|jse|lnk|md[abez]|mht|ms[cipt]|nch|pcd|pif|prf|reg|sc[frt]|sh[bs]|vb|vb[es]|wms|ws[cfh]
EA> BadAttachL2:=
EA> BadAttachL3:=zip|url
EA> BayesianLog:=1
EA> BlockExes:=1
EA> BlockNPExes:=1
EA> BlockUuencoded:=
EA> BlockWLExes:=1
EA> BounceSenders:=postmaster|mailer-daemon
EA> ChangeRoot:=
EA> ClamAVBytes:=100000
EA> CleanDelayDBInterval:=3600
EA> Confidence:=0.8
EA> ConnectionLog:=
EA> DEBUG:=
EA> DebugSPF:=
EA> DelayAddHeader:=1
EA> DelayEmbargoTime:=5
EA> DelayError:=451 4.7.1 Please try again later
EA> DelayExpireOnSpam:=1
EA> DelayExpiryTime:=36
EA> DelayLog:=1
EA> DelayNormalizeVERPs:=1
EA> DelaySL:=
EA> DelayUseNetblocks:=1
EA> DelayWL:=
EA> DelayWaitTime:=28
EA> DoBayesian:=1
EA> DoBombHeaderRe:=1
EA> DoBombRe:=1
EA> DoBombSenderRe:=0
EA> DoDomainCheck:=1
EA> DoExtremeNP:=
EA> DoExtremeWL:=
EA> DoFakedLocalHelo:=1
EA> DoFakedNP:=
EA> DoFakedWL:=
EA> DoInvalidFormatHelo:=1
EA> DoInvalidPTR:=1
EA> DoLDAP:=
EA> DoNoSpoofing:=
EA> DoNoValidLocalSender:=0
EA> DoNotCollectBounces:=1
EA> DoNotCollectRed:=1
EA> DoPenalty:=1
EA> DoPenaltyMessage:=
EA> DoRBLCache:=1
EA> DoRFC822:=
EA> DoRelayLocalDomainOnly:=1
EA> DoReversed:=1
EA> DoScriptRe:=0
EA> DoTestRe:=
EA> DoURIBLCache:=1
EA> DoValidFormatHelo:=0
EA> EmailAdminReportsTo:[EMAIL PROTECTED]
EA> EmailErrorsModifyWhite:=1
EA> EmailErrorsReply:=1
EA> EmailErrorsTo:=
EA> EmailFrom:=<[EMAIL PROTECTED]>
EA> EmailHam:=assp-notspam
EA> EmailHelp:=assp-help
EA> EmailInterfaceOk:=1
EA> EmailNoNPRemove:=1
EA> EmailNoWhiteToRed:=
EA> EmailRedlistAdd:=assp-red
EA> EmailRedlistRemove:=assp-notred
EA> EmailRedlistReply:=1
EA> EmailRedlistTo:=
EA> EmailSenderOK:=
EA> EmailSpam:=assp-spam
EA> EmailVirusReportsTo:[EMAIL PROTECTED]
EA> EmailWhitelistAdd:=assp-white
EA> EmailWhitelistRemove:=assp-notwhite
EA> EmailWhitelistReply:=1
EA> EmailWhitelistTo:=
EA> EnableDelaying:=1
EA> EnableFloatingMenu:=
EA> EnableHTTPCompression:=1
EA> EnableSRS:=
EA> EnforceAuth:=
EA> ErrorMaxBytes:=40000
EA> ExtremeExpiration:=10
EA> ForceRBLCache:=1
EA>
GoodAttach:=ai|asc|bhx|dat|doc|eps|gif|htm|html|ics|jpg|jpeg|hqx|pdf|ppt|rar|rpt|rtf|snp|txt|xls|zip
EA> GreetingWaitTime:=1
EA> HeaderMaxBytes:=10000
EA> HeaderMaxLength:=100000
EA> HeaderMaxRelay:=
EA> HeloMismatch:=
EA> InternalAddresses:=
EA> KeepWhitelistedSpam:=
EA> LDAPFail:=
EA> LDAPFilter:=
EA> LDAPHost:=
EA> LDAPLog:=
EA> LDAPLogin:=
EA> LDAPPassword:=
EA> LDAPRoot:=
EA> LocalAddressesAccept:=
EA> LocalAddressesValid:=
EA> LocalAddresses_Flat:=file:flat/assp_local_email
EA> LocalPolicySPF:=v=spf1 a/24 mx/24 ptr ~all
EA> LogRollDays:=7
EA> MaillogTailBytes:=25000
EA> MaillogTailJump:=
EA> MaillogTailWrapColumn:=80
EA> MaintenanceLog:=1
EA> MaxBytes:=4000
EA> MaxErrors:=10
EA> MaxFiles:=6000
EA> MaxWhitelistDays:=90
EA> MsgRelay:=
EA> MsgVerifyLineLength:=1000
EA> NoExternalSpamProb:=
EA> NoHaiku:=
EA> NoMaillog:=
EA> NoRelaying:=530 Relaying not allowed
EA> NoValidRecipient:=550 5.1.1 User unknown: EMAILADDRESS
EA> NoValidRecipientSleepTime:=15
EA> NonSpamLog:=2
EA> NotGreedyWhitelist:=
EA> OrderedTieHashSize:=5000
EA> OutgoingBufSize:=102400
EA> PenaltyDuration:=60
EA> PenaltyError:=
EA> PenaltyExpiration:=360
EA> PenaltyExtreme:=150
EA> PenaltyLimit:=50
EA> PenaltyLog:=1
EA> PenaltyMessageLimit:=50
EA> PenaltyUseNetblocks:=
EA> PopB4SMTPFile:=
EA> PopB4SMTPMerak:=
EA> RBLCacheRefresh:=72
EA> RBLError:=550 5.7.1 Blacklisted by RBLLISTED
EA> RBLFailLog:=3
EA> RBLLog:=1
EA> RBLNeutral:=
EA> RBLNonFatal:=1
EA>
RBLServiceProvider:=zen.spamhaus.org|list.dsbl.org|dul.dnsbl.sorbs.net|bl.spamcop.net
EA> RBLUseNetblocks:=1
EA> RBLWL:=
EA> RBLmaxhits:=1
EA> RBLmaxreplies:=4
EA> RBLmaxtime:=10
EA> RBLsocktime:=3
EA> RWLLog:=
EA>
RWLServiceProvider:=query.bondedsender.org|exemptions.ahbl.org|iadb.isipp.com|hul.habeas.com
EA> RWLmaxreplies:=1
EA> RWLmaxtime:=10
EA> RWLminhits:=1
EA> RamSaver:=
EA> RegExLength:=40
EA> RelayLocalDomainOnly:=530 5.1.8 Sender domain unknown, relaying denied
EA> RestartEvery:=0
EA> SPFError:=550 5.7.1 failed SPF: SPFRESULT
EA> SPFFailLog:=3
EA> SPFLog:=
EA> SPFNP:=
EA> SPFWL:=
EA> SPFneutral:=
EA> SPFsoftfail:=
EA> SRSAliasDomain:=thisdomain.com
EA> SRSFailLog:=3
EA> SRSHashLength:=4
EA> SRSSecretKey:=
EA> SRSTimestampMaxAge:=21
EA> SRSValidateBounce:=1
EA> SaveStatsEvery:=5
EA> ScanLocal:=
EA> ScanLog:=1
EA> ScanNP:=
EA> ScanWL:=1
EA> SenderInvalidError:=554 5.7.7 REASON .
EA> SepChar:=
EA> SessionLog:=1
EA> Showmaxreplies:=
EA> SpamError:=500 Mail appears to be unsolicited -- send error reports to
EA> [EMAIL PROTECTED]
EA> SpamVirusLog:=6
EA> SysLogFac:=mail
EA> TestRelayLocalDomainOnly:=1
EA> URIBLCCTLDS:=file:data/lists/URIBLCCTLDS.txt
EA> URIBLCacheRefresh:=240
EA> URIBLError:=550 5.7.1 Blacklisted by URIBLNAME Contact the postmaster
EA> of this domain for resolution. This attempt has been logged.
EA> URIBLFailLog:=3
EA> URIBLLog:=
EA> URIBLNoObfuscated:=1
EA> URIBLPolicyError:=550 5.7.1 Message rejected by domain policy. Contact
EA> the postmaster of this domain for resolution. This attempt has been
EA> logged.
EA> URIBLServiceProvider:=black.uribl.com|grey.uribl.com
EA> URIBLmaxdomains:=15
EA> URIBLmaxhits:=1
EA> URIBLmaxreplies:=2
EA> URIBLmaxtime:=12
EA> URIBLmaxuris:=200
EA> URIBLsocktime:=2
EA> URIBLwhitelist:=
EA> UpdateWhitelist:=3600
EA> UseAvClamd:=1
EA> UseLocalTime:=1
EA> UseSubjectsAsMaillogNames:=
EA> UuencodedError:=554 5.7.1 This mail is uuencoded and will be blocked.
EA> ValidLogic:=2
EA> ValidateLog:=1
EA> ValidateMaxURI:=1
EA> ValidateRBL:=1
EA> ValidateRWL:=
EA> ValidateSPF:=1
EA> ValidateSenderLog:=1
EA> ValidateURIBL:=1
EA> ValidateUserLog:=1
EA> WhiteExpiration:=30
EA> WhitelistLocalFromOnly:=1
EA> WhitelistLocalOnly:=1
EA> WhitelistOnly:=
EA> abValencePB:=5
EA> acceptAllMail:=127.0.0.1
EA> allowAdminConnectionsFrom:=
EA> asspLog:=1
EA> base:=/usr/local/assp
EA> baysConfidence:=0.7
EA> baysNonSpamLog:=4
EA> baysSpamLog:=3
EA> baysSpamLovers:=file:flat/bayesian
EA> baysTestMode:=
EA> baysValencePB:=5
EA> blDomainLog:=3
EA> blSpamLovers:=
EA> blTestMode:=
EA> blValencePB:=5
EA> blackListedDomains:=file:files/blackdomains.txt
EA> blackRe:=
EA> blackValencePB:=5
EA>
bombCharSets:=BIG5|CHINESEBIG|GB2312|KS_C_5601|KOI8-R|EUC-KR|ISO-2022-JP|ISO-2022-KR|ISO-2022-CN|WINDOWS-1251|WINDOWS-1250|CP1251
EA> bombError:=554 5.7.1 Your message was rejected because it appears to
EA> be part of a spam bomb -- .
EA> bombErrorReason:=1
EA>
bombHeaderRe:=\d+\s+(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+\d\d\d\d\s+\d\d:\d\d(:\d\d)?\s+[+\-]\d\d(?!00|30|45)\d\d
EA> bombRe:=file:files/bombre.txt
EA> bombReLocal:=
EA> bombReNP:=
EA> bombReRelay:=1
EA> bombReWL:=
EA> bombSenderRe:=
EA> bombSpamLovers:=file:flat/bombre
EA> bombTestMode:=
EA> bombValencePB:=5
EA> ccAddresses:=
EA> ccAddressesAll:=
EA> ccAddressesMode:=
EA> ccArchivAddresses:=
EA> ccArchivAddressesRec:=
EA> ccArchivModeRec:=
EA> contentOnlyRe:=
EA> correctednotspam:=errors/notspam
EA> correctedspam:=errors/spam
EA> deValencePB:=5
EA> defaultLocalHost:=
EA> delaySpamLovers:=file:flat/delay
EA> delaydb:=delay
EA> denySMTPConnectionsFrom:=file:files/denysmtp.txt
EA> denySMTPnoLog:=
EA> denySenderRe:=
EA> dlValencePB:=5
EA> dnsbl:=
EA> erValencePB:=5
EA> exportExtremeFile:=file:pb/exportedextreme.txt
EA> extAttachLog:=5
EA> fhTestMode:=
EA> fhValencePB:=50
EA> fileLogging:=
EA> flValencePB:=10
EA> flsTestMode:=
EA> forgedHeloLog:=6
EA> freqNonSpam:=1
EA> freqSpam:=1
EA> greylist:=greylist
EA> griplist:=griplist
EA> heloBlacklistIgnore:=
EA> hlSpamLovers:=file:flat/helo
EA> hlTestMode:=
EA> hlValencePB:=5
EA> iaValencePB:=25
EA> ifValencePB:=150
EA> ihTestMode:=
EA> ihValencePB:=15
EA> ilValencePB:=25
EA> incomingOkMail:=
EA>
invalidFormatHeloRe:=\d+\.\d+\.\d+\.\d+$|^[^\.]+\.?$|\d{1,3}(\.|-|x)\d{1,3}(\.|-|x)\d{1,3}|dynamic|ddns|dns\.org$
EA> invalidPTRRe:=file:files/invalidptr.txt
EA> irValencePB:=1
EA> isSpamLovers:=
EA> isTestMode:=1
EA> ispgreyvalue:=
EA> ispip:=file:files/nodelay.txt
EA> ldLDAP:=
EA> ldLDAPFilter:=
EA> listenPort:=25
EA> listenPort2:=26
EA> localDomains:=file:flat/domains
EA> localDomainsFile:=
EA> logfile:=maillog.txt
EA> maillogExt:=.eml
EA> malformedLog:=6
EA> maxSMTPSessions:=42
EA> maxSMTPipConnects:=5
EA> maxSMTPipDuration:=60
EA> maxSMTPipExpiration:=60
EA> maxSMTPipSessions:=5
EA> meValencePB:=15
EA> mvTestMode:=
EA> mxValencePB:=10
EA> mxaSpamLovers:=file:flat/mxa
EA> mxaTestMode:=
EA> myName:=ASSP.nospam
EA> myServerRe:=file:flat/local
EA> mydb:=
EA> myhost:=
EA> mypassword:=
EA> myuser:=
EA> noBayesian:=
EA> noBombScript:=
EA> noDelay:=file:files/nodelay.txt
EA> noGreyListUpload:=
EA> noGriplistDownload:=
EA> noGriplistUpload:=
EA> noLog:=
EA> noPB:=file:files/nodelay.txt
EA> noProcessing:=
EA> noProcessingIPs:=file:files/ipnp.txt
EA> noRWL:=127.0.0.1|192.168.
EA> noSRS:=
EA> noURIBL:=
EA> nogreydownload:=
EA> nolocalDomains:=
EA> notspamlog:=notspam
EA> npAttachLog:=5
EA> npRe:=
EA> npSize:=500000
EA> originHeader:=
EA> pbSpamLovers:=
EA> pbTestMode:=
EA> pbdb:=pb/pbdb
EA> pidfile:=pid
EA> poTestMode:=
EA> processOnlyAddresses:=
EA> proxyserver:=
EA> ptValencePB:=10
EA> ptrSpamLovers:=file:flat/ptr
EA> ptrTestMode:=
EA> rblSpamLovers:=file:flat/rbl
EA> rblTestMode:=
EA> rblValencePB:=100
EA> rblnValencePB:=5
EA> redRe:=file:files/redre.txt
EA> redlistdb:=red
EA> regexLogging:=1
EA> relayHost:=
EA> relayHostFile:=
EA> relayPort:=
EA> rlValencePB:=15
EA> runAsGroup:=
EA> runAsUser:=
EA> saValencePB:=25
EA> sbTestMode:=
EA> sbValencePB:=5
EA> scriptError:=550 Your email contains html scripting code -- please
EA> resend as plain text.
EA> scriptLog:=3
EA> scriptRe:=
EA> scriptTestMode:=
EA> scriptValencePB:=2
EA> sendAllAbuse:=
EA> sendAllDestination:=
EA> sendAllPostmaster:=
EA> sendAllSpam:=
EA> sendHamRec:=
EA> sendNoopInfo:=
EA> silent:=
EA> smtpAuthServer:=
EA> smtpDestination:=127.0.0.1:125
EA> smtpIdleTimeout:=120
EA> smtpReportServer:=
EA> spamBombLog:=6
EA> spamBucketLog:=3
EA> spamHeloLog:=6
EA> spamISLog:=6
EA> spamLovers:=postmaster|abuse
EA> spamMXALog:=3
EA> spamPBLog:=6
EA> spamPTRLog:=3
EA> spamSubject:=[ SPAM ]
EA> spamSubjectCC:=1
EA> spamSubjectSL:=1
EA> spamaddresses:=
EA> spamdb:=spamdb
EA> spamlog:=spam
EA> spamtrapaddresses:=
EA> spfSpamLovers:=file:flat/spf
EA> spfTestMode:=
EA> spfValencePB:=5
EA> spfnValencePB:=0
EA> spfsValencePB:=0
EA> srsSpamLovers:=
EA> srsTestMode:=
EA> stValencePB:=25
EA> subjectLogging:=
EA> sysLog:=
EA> sysLogIp:=127.0.0.1
EA> sysLogPort:=514
EA> testRe:=
EA> totalizeSpamStats:=
EA> uriblSpamLovers:=file:flat/uribl
EA> uriblTestMode:=
EA> uriblValencePB:=20
EA> uriblnValencePB:=10
EA> urimaxValencePB:=10
EA> useExtremeExport:=
EA> useHeloBlacklist:=0
EA> validFormatHeloRe:=
EA> vdValencePB:=20
EA> viruslog:=
EA> webAdminPassword:=nospam4me
EA> webAdminPort:=55555
EA> whiteListedDomains:=sourceforge.net
EA> whiteListedIPs:=file:files/ipwl.txt
EA> whiteRe:=
EA> whitelistdb:=whitelist
EA> wlAttachLog:=5
EA> On 2/16/07, Ethan Albone <[EMAIL PROTECTED]> wrote:
>> no it's enabled.
>>
>> I cannot see signals of RBL , Bayesian , URIBL on my logs and stats too.
>>
>> PB , delaying , bombre are working fine instead.
>>
>>
>>
>>
>> On 2/16/07, Dickson, Paul <[EMAIL PROTECTED]> wrote:
>> > This may be a stupid question, but have you checked to see that it
>> > didn't get set to off when you upgraded??
>> >
>> >
>> > Paul Dickson, MCP, MCSA, MCSE, CCSA
>> > Frederick County Government, IIT
>> > (301)-600-2399
>> >
>> > (Auto Signature)
>> > If only IT were this simple:
>> > -----------------------------------------------------
>> > Michael Bolton: You think the pet rock was a really great idea?
>> > Tom Smykowski: Sure it was. The guy made a million dollars. You know, I
>> > had an idea like that once. A long time ago.
>> > Peter Gibbons: Really, what was it, Tom?
>> > Tom Smykowski: Well, all right. It was a "Jump to Conclusions" mat. You
>> > see, it would be this mat that you would put on the floor, and it would
>> > have different conclusions written on it that you could jump to.
>> > Samir: That is a terrible terrible idea.
>> > ------------------------------------------------------
>> >
>> > -----Original Message-----
>> > From: [EMAIL PROTECTED]
>> > [mailto:[EMAIL PROTECTED] On Behalf Of Ethan
>> > Albone
>> > Sent: Friday, February 16, 2007 10:53 AM
>> > To: [email protected]
>> > Subject: [Assp-user] 1.3.0(3) and bayesian filter problem
>> >
>> > Hello
>> >
>> > after installing 1.3.0(3) all emails are bypassing (not using) the
>> > bayesian filter ...
>> > It's like there is no bayesian filter active.
>> >
>> > Anyone having my problem too ?
>> >
>> > Thanks
>> >
>> > ------------------------------------------------------------------------
>> > -
>> > Take Surveys. Earn Cash. Influence the Future of IT
>> > Join SourceForge.net's Techsay panel and you'll get the chance to share
>> > your
>> > opinions on IT & business topics through brief surveys-and earn cash
>> > http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDE
>> > V
>> > _______________________________________________
>> > Assp-user mailing list
>> > [email protected]
>> > https://lists.sourceforge.net/lists/listinfo/assp-user
>> >
>> > -------------------------------------------------------------------------
>> > Take Surveys. Earn Cash. Influence the Future of IT
>> > Join SourceForge.net's Techsay panel and you'll get the chance to share
>> > your
>> > opinions on IT & business topics through brief surveys-and earn cash
>> > http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
>> > _______________________________________________
>> > Assp-user mailing list
>> > [email protected]
>> > https://lists.sourceforge.net/lists/listinfo/assp-user
>> >
>>
EA> -------------------------------------------------------------------------
EA> Take Surveys. Earn Cash. Influence the Future of IT
EA> Join SourceForge.net's Techsay panel and you'll get the chance to share your
EA> opinions on IT & business topics through brief surveys-and earn cash
EA> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
EA> _______________________________________________
EA> Assp-user mailing list
EA> [email protected]
EA> https://lists.sourceforge.net/lists/listinfo/assp-user
--
Matti Haack - Hit Haack IT Service Gmbh
Poltlbauer Weg 4, D-94036 Passau
+49 851 50477-22 Fax: +49 851 50477-29
http://www.haack-it.de
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Assp-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-user
