[sniffer] Re: Stock spam
It's interesting to see such mixed results posted. It makes me wonder what the differences are between the systems reporting high catch rates (which we also see, once a campaign has been analyzed) and low catch rates. I personally found the importance of triggered updates. I was receiving lots of stock and image spam. I had scheduled updates several times a day so I didn't think that had much to do with it. I couldn't get the Triggered update script to work until last week when I executed each line manually and found my bonehead mistake. Spam has all but disappeared. I would encourage anyone using scheduled updates, no matter how frequently, to move to a Triggered Update script Bill Green dfn Systems # This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
[sniffer] Re: How Many get through
Gary, When that happened to me, it turned out to be an expired Sniffer Subscription. I hadn't even noticed the updates were no longer successful. Check to see if your dot snf file is current. Bill Green dfn Systems - Original Message - From: Gary Stark To: Message Sniffer Community Sent: Friday, August 25, 2006 9:48 AM Subject: [sniffer] How Many get through I have a question I've been wanting to ask for awhile: How many spams do most people get leaked into their mailbox? ie they pass message sniffer? When I first started over a year ago, very few spam made it into my mailbox. But the past 6 months I get 60-80 spam emails / day into my personal box. Of course I'll see the same messages in my other mail boxes also, so it relates to a lot of deleting? Could I have something set up incorrectly? Or thresholds set to low that they are getting through? Thanks for any info! Sincerely, Gary Stark
[sniffer] Re: Lot of stock spam getting through....
I agree! I could tell Pete was burning the midnight oil by the pattern of Sniffer Updates this morning. Thanks Pete! Bill Green dfn Systems 505-622-7853 [EMAIL PROTECTED] - Original Message - From: George Thompson To: Message Sniffer Community Sent: Friday, July 07, 2006 9:18 AM Subject: [sniffer] Re: Lot of stock spam getting through Hi Pete,I've been a customer for a couple of years and usually don't have much to say via maillists. But I wanted to take a moment this morning and think you for the work you do. Keeping up with this stuff must force you to keep your nose to the grindstone. I really appreciate your work.Thanks again,George ThompsonCheif Technical OfficerLevelfield.com, Incwww.levelfield.comDBA OnlineAgency.comwww.onlineagency.combuilding the Internet one small business at a time> I had a big fight with one like that all last night -- there are some> unusual characters in the message that made it hard to filter and it> took some time to do the analysis (picking through them with a hex> editor).> > I think these are handled now (as of about 0400e this morning) as I> don't have any getting through spamtraps at the moment. I will look> into it again.> > _M> > --> Pete McNeil> Chief Scientist,> Arm Research Labs, LLC.
[sniffer] Re: Weight Gate Success? Failure?
Andrew, Comments inline: Can I be the first to point out that in your example, you're still calling ShowMe.exe and not WeightGate.exe so you will be appending to c:\ShowMe.log with every call? Yes, I've changed that to WeightGate.exe. In my excitement, I copied the line to the email before the change. Another blunder was that strange email from me to me that somehow made it to the list. Sorry. And for those new to the party, I'll explain that what Bill is doing with his modified configuration is to avoid calling InvURIBL when the current Declude weight is less than -50 or more than 10. If it's less than -50, Bill is presumably already heavily negatively weighting known ham senders and thus avoiding calling InvURIBL on messages that are ham. Likewise, it the current weight is more than 10, Bill is assuming the message is already spammy enough and doesn't want InvURIBL to run on those either. I will probably tweak these settings as I survey the results. Bill Green dfn Systems --- [This E-mail scanned for viruses by Declude EVA] # This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
[sniffer] Re: Weight Gate Success? Failure?
I've tried Pete's WeightGate with INVURIBL. Original line in Declude Global Config. INV-URIBL external weight "E:\INVURIBL\invURIBL.exe %WEIGHT% %REMOTEIP%" 5 > 0 New line INVARIANT external weight "e:\tools\ShowMe.exe -50 %WEIGHT% 10 E:\INVURIBL\invURIBL.exe %WEIGHT% %REMOTEIP%" 5 0 Account for line Wrap I have verified Invuribl is being called. I'm still confirming Spam Blocking Performance. The resulting CPU savings were no less than stunning. Bill Green dfn Systems INV-URIBL external weight "E:\INVURIBL\invURIBL.exe %WEIGHT% %REMOTEIP%" 5 > 0 INVARIANT external weight "e:\tool\ShowMe.exe -50 %WEIGHT% 10 E:\INVURIBL\invURIBL.exe %WEIGHT% %REMOTEIP%" 5 0 Account for line Wrap - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Message Sniffer Community" Sent: Tuesday, June 13, 2006 9:48 AM Subject: [sniffer] Weight Gate Success? Failure? Hello Sniffer Folks, Is anyone successfully using the WeightGate utility? Anyone having trouble with it? I've literally heard nothing so far ;-) Thanks, _M -- Pete McNeil Chief Scientist, Arm Research Labs, LLC. # This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]> --- [This E-mail scanned for viruses by Declude EVA] --- [This E-mail scanned for viruses by Declude EVA] # This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
[sniffer] ERROR message in snifferp Command Prompt window
I have started seeing this line repeated in the persistent sniffer command window. ERROR_LOGFILE: Bad Lock During Logging c:\imail\declude\sniffer\"mycode".log It looks like the error has been happening once a day for about a week. Other than the message all seems to be working well. Where should I look for the cause? Bill Green dfn Systems --- [This E-mail scanned for viruses by Declude Virus] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html