Re: Blacklist for spam-words

2010-09-17 Thread franc
OK, i updated it with cpan after uninstalling. But i had to change something in amavis-new, according to: http://o-o-s.de/?p=2735 And now my sa-config is in /etc/mail/spamassassin. Before, it was one level higher, which is really not important. -- View this message in context: http://old.n

Re: injected headers are triggering dns whitelists

2010-09-17 Thread Benny Pedersen
On fre 17 sep 2010 16:55:11 CEST, Lawren Quigley-Jones wrote I'm running SpamAssassin on ubuntu hardy: spamassassin 3.2.4-1ubuntu1.2 is this a joke ? :) -- xpoint http://www.unicom.com/pw/reply-to-harmful.html

Re: injected headers are triggering dns whitelists

2010-09-17 Thread Sergey Tsabolov ( aka linuxman )
στις 17/09/2010 09:21 μμ, O/H Neil Lazarow έγραψε: Sergey Tsabolov ( aka linuxman ) wrote: στις 17/09/2010 05:55 μμ, O/H Lawren Quigley-Jones έγραψε: I've been repeatedly running into problems where dns white-lists have been causing false negatives in spam. Valid looking headers are being

Re: Yahoo HTML Base64 Attachments

2010-09-17 Thread John Hardin
On Fri, 17 Sep 2010, Joseph Brennan wrote: On fre 17 sep 2010 00:30:27 CEST, Chris Owen wrote > 1) From yahoo.com > 2) Have a HTML attachment > 3) Are base64 encoded The html includes something like this, inside a comment. It's really over a hundred escaped characters: document.write(u

Re: Yahoo HTML Base64 Attachments

2010-09-17 Thread Joseph Brennan
On fre 17 sep 2010 00:30:27 CEST, Chris Owen wrote 1) From yahoo.com 2) Have a HTML attachment 3) Are base64 encoded The html includes something like this, inside a comment. It's really over a hundred escaped characters: document.write(unescape("%3C%53%43%52%49%50%54%20%4C and I think

Re: Yahoo HTML Base64 Attachments

2010-09-17 Thread Chris Owen
On Sep 17, 2010, at 2:27 PM, Joseph Brennan wrote: > They're not really from Yahoo. No DKIM, no Newman property. That's > a fake header. Looks like I missed the real header. All the better I guess though. Makes catching these even easier. Chris -- --

Re: Yahoo HTML Base64 Attachments

2010-09-17 Thread Joseph Brennan
--On Thursday, September 16, 2010 17:30 -0500 Chris Owen wrote: We're seeing a lot of what I assume are exploit files coming from yahoo.com. They are all base64 encoded HTML attachments with a bunch of javascript in them. http://pastebin.com/ZSmW0kwW They're not really from Yahoo. No

Re: injected headers are triggering dns whitelists

2010-09-17 Thread Sergey Tsabolov ( aka linuxman )
στις 17/09/2010 05:55 μμ, O/H Lawren Quigley-Jones έγραψε: I've been repeatedly running into problems where dns white-lists have been causing false negatives in spam. Valid looking headers are being injected at the beginning of emails which are tripping dns whitelists (see below). As a result

Re: injected headers are triggering dns whitelists

2010-09-17 Thread Bowie Bailey
On 9/17/2010 10:55 AM, Lawren Quigley-Jones wrote: > I've been repeatedly running into problems where dns white-lists have > been causing false negatives in spam. Valid looking headers are being > injected at the beginning of emails which are tripping dns whitelists > (see below). As a result I'

Re: The most amazing spam ...

2010-09-17 Thread Per Jessen
Giles Coochey wrote: > On Thu, September 16, 2010 15:57, Martin Gregorie wrote: >> On Thu, 2010-09-16 at 13:36 +0200, Giles Coochey wrote: >>> On Thu, September 16, 2010 13:28, Martin Gregorie wrote: >>> > On Thu, 2010-09-16 at 07:28 +0200, Per Jessen wrote: >>> >> http://public.jessen.ch/files/ma

injected headers are triggering dns whitelists

2010-09-17 Thread Lawren Quigley-Jones
I've been repeatedly running into problems where dns white-lists have been causing false negatives in spam. Valid looking headers are being injected at the beginning of emails which are tripping dns whitelists (see below). As a result I've been slowly disabling dns whitelist rules: score HABE

RE: Spamassassing not doing DNSBL lookup

2010-09-17 Thread John Hardin
On Fri, 17 Sep 2010, Milind Patil wrote: I run spamassassin via MailScanner and in the MailScanner I have enabled the DNSBL check. Ah, okay. I'm not familiar with MailScanner so I can't offer any advice. Perhaps someone else can, or if there's a MailScanner list you might be able to ask the

Re: New plugin: DecodeShortURLs

2010-09-17 Thread RW
On Fri, 17 Sep 2010 14:11:41 +0100 Steve Freegard wrote: > Hi All, > > Recently I've been getting a bit of filter-bleed from a bunch of > spams injected via Hotmail/Yahoo that contain shortened URLs e.g. > bit.ly/foo that upon closer inspection would have been rejected with > a high score if the

Re: New plugin: DecodeShortURLs

2010-09-17 Thread Steve Freegard
On 17/09/10 14:33, Jari Fredriksson wrote: It has a typo. describe URIBL_SHORT... The rule name is wrong, should be SHORT_URIBL Didn't you --lint it? ;) Doh! - fixed. Regards, Steve.

Re: New plugin: DecodeShortURLs

2010-09-17 Thread Jari Fredriksson
On 17.9.2010 16:11, Steve Freegard wrote: > Hi All, > > Recently I've been getting a bit of filter-bleed from a bunch of spams > injected via Hotmail/Yahoo that contain shortened URLs e.g. bit.ly/foo > that upon closer inspection would have been rejected with a high score > if the real URL had bee

Re: New plugin: DecodeShortURLs

2010-09-17 Thread Eduardo Casarero
2010/9/17 Steve Freegard > Hi All, > > Recently I've been getting a bit of filter-bleed from a bunch of spams > injected via Hotmail/Yahoo that contain shortened URLs e.g. bit.ly/foothat > upon closer inspection would have been rejected with a high score if > the real URL had been used. > > To t

New plugin: DecodeShortURLs

2010-09-17 Thread Steve Freegard
Hi All, Recently I've been getting a bit of filter-bleed from a bunch of spams injected via Hotmail/Yahoo that contain shortened URLs e.g. bit.ly/foo that upon closer inspection would have been rejected with a high score if the real URL had been used. To that end - it annoyed me enough to wr

RE: Looking for a "How To" to build Spamassassin+ClamAV mail filter

2010-09-17 Thread IT_Architect
Brent Kennedy wrote: > My setup looks something like this...I use postfix to strip the > headers in emails. That is helpful. This service will be ahead of Exchange in many instances as well. Brent Kennedy wrote: > I know there are some ISP guys on this list who would know how to > handle a cu

Re: Blacklist for spam-words

2010-09-17 Thread Dominic Benson
On 17/09/10 11:21, franc wrote: In that case, uninstalling Spamassassin from Apt (and then doing an apt-get --autoremove to clear out Perl libs installed through apt/dpkg) and re-installing with CPAN should be fine, and you'll be able to keep it up to date. I use aptitude, is this the

Re: Blacklist for spam-words

2010-09-17 Thread Sergios T.S.(aka linuxman)
στις 17/09/2010 12:55 μμ, O/H Dominic Benson έγραψε: On 17/09/10 10:42, franc wrote: I doubt if this is possible on a VPS. At least the kernel is not changeable because coming from the host and is old enough (2.6.9). I guess an update to Lucid Lynx (10.04) will be if not unpossible but problem

Re: Blacklist for spam-words

2010-09-17 Thread franc
> In that case, uninstalling Spamassassin from Apt (and then doing an > apt-get --autoremove to clear out Perl libs installed through apt/dpkg) > and re-installing with CPAN should be fine, and you'll be able to keep > it up to date. I use aptitude, is this the same then? Will this uninstall a

Re: Blacklist for spam-words

2010-09-17 Thread Dominic Benson
On 17/09/10 10:42, franc wrote: I doubt if this is possible on a VPS. At least the kernel is not changeable because coming from the host and is old enough (2.6.9). I guess an update to Lucid Lynx (10.04) will be if not unpossible but problematic. So if i use CPAN and keep my Hardy Heron, there w

Re: Blacklist for spam-words

2010-09-17 Thread franc
> > If you can, upgrade to Lucid. If you can't - and don't ever plan to > upgrade the machine to a later Ubuntu release - then you could uninstall > and then install via CPAN, but I would fairly strongly recommend against > doing that if you have any intention of upgrading it in the future. In

Re: Blacklist for spam-words

2010-09-17 Thread Dominic Benson
This is just what i noticed: there is no Ubuntu package update after the 3.2.4-ubu1 related to: http://packages.ubuntu.com/de/hardy/spamassassin But how then to update? Can i use a package for Ubuntu Maverick (10.10) or is this the absolute wrong way? If you add hardy-backports to your a

Re: Blacklist for spam-words

2010-09-17 Thread franc
Hi , in you sources.list you have 2 lines #deb http://archive.ubuntu.com/ubuntu/ hardy-backports main restricted universe multiverse #deb-src http://archive.ubuntu.com/ubuntu/ hardy-backports main restricted universe multiverse Uncomment that lines and try to apt-get update && apt-get upgrade