amavisd

2006-11-17 Thread Maccie Roux
Hi there. I'm getting the following in my maillog, can someone please help me: postfix/qmgr[25394]: warning: connect to transport smtp-amavis: Connection refused Thanks Maccie Roux [EMAIL PROTECTED]

Re: amavisd

2006-11-17 Thread Leander Koornneef
On 17-nov-2006, at 9:26, Maccie Roux wrote: Hi there. I'm getting the following in my maillog, can someone please help me: postfix/qmgr[25394]: warning: connect to transport smtp-amavis: Connection refused Well, that is about as clear as a warning can get. What don't you understand

Re: amavisd

2006-11-17 Thread Matthias Haegele
Leander Koornneef schrieb: On 17-nov-2006, at 9:26, Maccie Roux wrote: Hi there. I'm getting the following in my maillog, can someone please help me: postfix/qmgr[25394]: warning: connect to transport smtp-amavis: Connection refused Well, that is about as clear as a warning can get.

RE: FuzzyOCR question

2006-11-17 Thread Giampaolo Tomassoni
I'm brainstorming here tonight and I'm curious of something. When you're using FuzzyOCR, is it called for every message that goes through SA, or just ones with gif attachments? FuzzyOcr is invoked on every image on a message whenever the message itself doesn't reach a score

Re: MailScanner not using /usr/share/spamassassin?

2006-11-17 Thread Martin Hepworth
Peter H. Lemieux wrote: OK, I've ransacked mailing lists for over an hour now and have yet to find an answer to this question. Until a couple of months ago I was running SA 2.64 under MailScanner 4.36.4, both installed from RPMs on a RedHat 7.3 system. I've been migrating to a CentOS 4.4

bayes before spamassassin?

2006-11-17 Thread jeaspam
Hi List It is possible that each incoming mail goes first to bayes and later to spamassassin? Do you think that this procedure is good? __ (Incoming mail) -- | (bayes) |(yes)(delete it) | it's spam?

Re: amavisd

2006-11-17 Thread Mark Martinec
postfix/qmgr[25394]: warning: connect to transport smtp-amavis: Connection refused Well, that is about as clear as a warning can get. What don't you understand about it? Is amavisd running, are you able to connect? Any typos in your config? This warning is not about amavisd daemon

Re: Thoughts on using DCC

2006-11-17 Thread Magnus Holmgren
On Friday 17 November 2006 02:44, Chris wrote: On Thursday 16 November 2006 9:21 am, Magnus Holmgren wrote: So basically you're right and I haven't added anything. What I can add is that I don't use DCC myself, for precisely the aforementioned reason, i.e. that it requires to much fiddling

Re: Rules Du Jour briken?

2006-11-17 Thread twofers
Being as the link http://www.exit0.us/index.php?pagename=RulesDuJour is still down, could someone that uses Rules Du Jour take a look at this other link to some Rules Du Jour stuff and let me know if you think this site contains valid info / process or not for installing RDJ? Am I just

Re: amavisd

2006-11-17 Thread Matthias Haegele
Mark Martinec schrieb: postfix/qmgr[25394]: warning: connect to transport smtp-amavis: Connection refused Well, that is about as clear as a warning can get. What don't you understand about it? Is amavisd running, are you able to connect? Any typos in your config? This warning is not about

Re: bayes_seen on MySQL, growing and growing

2006-11-17 Thread Paolo Cravero
Jim Maul wrote: I dont use mysql with SA, but you should be able to use truncate instead of delete. It may very well be faster with all those rows. From MySQL 4.x manual: For InnoDB, TRUNCATE TABLE is mapped to DELETE, so there is no difference. We're using InnoDB rather than MyISAM, so

MIMEHeader question

2006-11-17 Thread Jeremy Fairbrass
Hi all, I have a question about the MIMEHeader plugin: if I have multiple mimeheader rules, are they all checked against the same part in a multipart message? So let me give an example: Let's say an email has 2 separate mime header sections (perhaps one is TXT and the other is HTML, or perhap

Re: Spam surge tied to SpamThru Trojan botnet

2006-11-17 Thread Justin Mason
Peter H. Lemieux writes: From this article at eWeek: http://www.eweek.com/print_article2/0,1217,a=194218,00.asp The recent surge in e-mail spam hawking penny stocks and penis enlargement pills is the handiwork of Russian hackers running a botnet powered by tens of thousands of hijacked

Re: MIMEHeader question

2006-11-17 Thread Justin Mason
Jeremy Fairbrass writes: Hi all, I have a question about the MIMEHeader plugin: if I have multiple mimeheader rules, are they all checked against the same part in a multipart message? So let me give an example: Let's say an email has 2 separate mime header sections (perhaps one is TXT

amavisd

2006-11-17 Thread Maccie Roux
Hi all. My spam is being block with amavis but it does not send it to my junk mail box. Here is my amavisd.conf file: # $timestamp_fmt_mysql = 1; # if using MySQL *and* msgs.time_iso is TIMESTAMP; # defaults to 0, which is good for non-MySQL or if msgs.time_iso is CHAR(16) $virus_admin

Re: bayes before spamassassin?

2006-11-17 Thread Matt Kettler
[EMAIL PROTECTED] wrote: Hi List It is possible that each incoming mail goes first to bayes and later to spamassassin? Do you think that this procedure is good? __ (Incoming mail) -- | (bayes) |(yes)(delete it)

Re: Spam surge tied to SpamThru Trojan botnet

2006-11-17 Thread Chris
On Thursday 16 November 2006 10:59 pm, Steve Lake wrote: Oh joy. So what do we do about this? Are they going to try and bust these guys? Or can't they touch them? At 08:16 PM 11/16/2006 -0500, Peter H. Lemieux wrote: From this article at eWeek:

Re: amavisd

2006-11-17 Thread Leander Koornneef
On 17-nov-2006, at 12:59, Maccie Roux wrote: Hi all. My spam is being block with amavis but it does not send it to my junk mail box. Here is my amavisd.conf file: # $timestamp_fmt_mysql = 1; # if using MySQL *and* msgs.time_iso is TIMESTAMP; # defaults to 0, which is good for non-MySQL

amavisd

2006-11-17 Thread Maccie Roux
Can someone please help me with this message in my maillog. ClamAV-clamd av-scanner FAILED: Too many retries to talk to /var/spool/amavisd/clamd.sock (Can't connect to UNIX socket /var/spool/amavisd/clamd.sock: Connection refused) Thanks Maccie Roux [EMAIL PROTECTED]

Re: bayes before spamassassin?

2006-11-17 Thread Justin Mason
Matt Kettler writes: [EMAIL PROTECTED] wrote: Hi List It is possible that each incoming mail goes first to bayes and later to spamassassin? Do you think that this procedure is good? __ (Incoming mail) -- | (bayes)

Hi !

2006-11-17 Thread Cristi Tudose
Hi .. I am new to this list. I need some help. I have installed qmail with qmail-scan, spamassassin and clamav. The installation was going well. The clamav and spamassassin is running under qscand user. The mails what came with virus attachment, the attachment is deleted by the clamav.

RE: amavisd

2006-11-17 Thread Giampaolo Tomassoni
Can someone please help me with this message in my maillog. ClamAV-clamd av-scanner FAILED: Too many retries to talk to /var/spool/amavisd/clamd.sock (Can't connect to UNIX socket /var/spool/amavisd/clamd.sock: Connection refused) Your clamd is not running OR it is not listening on

Re: bayes before spamassassin?

2006-11-17 Thread jeaspam
I mean, I want the sa-learn examine the message before the spamassassin and then goes to spamassassin The reasons for that: -I think the incoming mail maybe a spam, but this is relative because the concept to spam for an user is not equal to another one ( I have many users on my domain ) -At

bayes?

2006-11-17 Thread Netlink Tech
Hello, It seems bayes is not working properly for me. I have sendmail/MailScanner/Spamassassin setup for my users. MailScanner version 4.56.8 Spamassassin version 3.1.3 autolearn is on -- sa-learn --dump magic 0.000 0 3 0 non-token data:

Re: bayes before spamassassin?

2006-11-17 Thread Matt Kettler
[EMAIL PROTECTED] wrote: I mean, I want the sa-learn examine the message before the spamassassin and then goes to spamassassin snip -If the sa-learn determine it's spam the message will be deleted But there's the problem. sa-learn doesn't determine if a message is spam or not. In

Re: RelayChecker 0.3

2006-11-17 Thread Michael Alan Dorman
On Thu, 16 Nov 2006 17:56:21 -0800 Derek Harding [EMAIL PROTECTED] wrote: On Sun, 2006-11-12 at 17:26 -0800, John Rudd wrote: http://people.ucsc.edu/~jrudd/spamassassin/RelayChecker.tar I've been running this for a few days now and am finding it to be pretty effective, especially against

failed to run FUZZY_OCR test, skipping:

2006-11-17 Thread Frank Bures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Since upgrading my FuzzyOcr from version 2.3b to version 3.4.2 I am seeing these entries in the logs: spamd[27790]: rules: failed to run FUZZY_OCR test, skipping: spamd[27790]: Insecure dependency in require while running with -T switch at

Re: bayes?

2006-11-17 Thread Matt Kettler
Netlink Tech wrote: Hello, It seems bayes is not working properly for me. I have sendmail/MailScanner/Spamassassin setup for my users. MailScanner version 4.56.8 Spamassassin version 3.1.3 autolearn is on -- sa-learn --dump magic The last journal sync being 0

Re: Hi !

2006-11-17 Thread Magnus Holmgren
On Friday 17 November 2006 13:52, Cristi Tudose wrote: Hi .. One tip for the future: Hi ! is not a good subject line. I have installed qmail with qmail-scan, spamassassin and clamav. The installation was going well. The clamav and spamassassin is running under qscand user. The mails what

RE: Hi !

2006-11-17 Thread twofers
What else do you have in your local.cf? Wes Cristi Tudose [EMAIL PROTECTED] wrote: v\:* {behavior:url(#default#VML);} o\:* {behavior:url(#default#VML);} w\:* {behavior:url(#default#VML);} .shape {behavior:url(#default#VML);} HI .. I never tried with 5

Re: MIMEHeader question

2006-11-17 Thread Jeremy Fairbrass
Justin Mason [EMAIL PROTECTED] wrote in message news:[EMAIL PROTECTED] Jeremy Fairbrass writes: Hi all, I have a question about the MIMEHeader plugin: if I have multiple mimeheader rules, are they all checked against the same part in a multipart message? So let me give an example:

Re: RelayChecker 0.3

2006-11-17 Thread John Rudd
Michael Alan Dorman wrote: On Thu, 16 Nov 2006 17:56:21 -0800 Derek Harding [EMAIL PROTECTED] wrote: On Sun, 2006-11-12 at 17:26 -0800, John Rudd wrote: http://people.ucsc.edu/~jrudd/spamassassin/RelayChecker.tar I've been running this for a few days now and am finding it to be pretty

Re: MIMEHeader question

2006-11-17 Thread Theo Van Dinter
On Fri, Nov 17, 2006 at 03:46:28PM +0100, Jeremy Fairbrass wrote: mimeheader __RULE1 Content-Type =~ /image\/gif/ mimeheader __RULE2 Content-Transfer-Encoding =~ /quoted-printable/ meta MY_META_RULE (RULE1 RULE2) Okay - so you're saying that the two mimeheader rules will actually

Ignoring outgoing mail

2006-11-17 Thread Jack L. Stone
I have looked through the SA list archives for any method to make SA ignore outgoing emails but nothing found that helped. I'm using the flag that I thought helped do this when I load the scanner spamass-milter: -i 127.0.0.1 (plus a few more IPs) I do not see any flages on spamd to help with this

Re: Bayes failure on hi, it's Somebody spam

2006-11-17 Thread Bart Schaefer
On 11/16/06, Jon Trulson [EMAIL PROTECTED] wrote: Hmm, that has not been my experience at all... Bayes (99) is still catching every one for me. In this instance, SpamAssassin is running after POP download from gmail, so I'm only seeing the samples that have already made it

Re: RelayChecker 0.3

2006-11-17 Thread Stuart Johnston
John Rudd wrote: Stuart Johnston wrote: Peter H. Lemieux wrote: Billy Huddleston wrote: Reverse DNS is a must. I'm surprised at how many people still haven't got that yet in the IT world.. (Consultants mostly..) It's not uncommon outside the industrialized world. Last few days I got a few

Re: Thoughts on using DCC

2006-11-17 Thread Anthony Peacock
Hi, Magnus Holmgren wrote: On Thursday 16 November 2006 12:59, Anthony Peacock wrote: I realise that DCC is not a direct indicator of spamminess but an indicator of bulkiness. And I also realise that the correct answer to my question is 'it depends on your local needs'... Given that what are

RE: amavisd

2006-11-17 Thread Gary V
Can someone please help me with this message in my maillog. ClamAV-clamd av-scanner FAILED: Too many retries to talk to /var/spool/amavisd/clamd.sock (Can't connect to UNIX socket /var/spool/amavisd/clamd.sock: Connection refused) Your clamd is not running OR it is not listening on

Re: RelayChecker 0.3

2006-11-17 Thread Stuart Johnston
Michael Alan Dorman wrote: On Thu, 16 Nov 2006 17:56:21 -0800 Derek Harding [EMAIL PROTECTED] wrote: On Sun, 2006-11-12 at 17:26 -0800, John Rudd wrote: http://people.ucsc.edu/~jrudd/spamassassin/RelayChecker.tar I've been running this for a few days now and am finding it to be pretty

email appears to que all the time - sendmail,spamssassin,amavis-new

2006-11-17 Thread Patrick Sherrill
I seem to be getting significant delays in delivery (queue times are set to 15m). I am currently using amavis-new to hook SA with sendmail (tx and rx queue). What would be the best approach to minimizing delays beyond more RAM. TIA Pat... [EMAIL PROTECTED] CocoNet Corporation SW Florida's

New Spam

2006-11-17 Thread Billy Huddleston
I'm getting some new spam coming through.. It's ASCII art (using nothing but numbers) and spells out TORA.08 and nothing else.. It looks to be coming from a Bot-Net.. Anyone seen this? Thanks, Billy

Re: New Spam

2006-11-17 Thread James Galvin
Hi Billy, I got one of these for the first time just 15 minutes ago. TORA.08 as well. James Billy Huddleston wrote: I'm getting some new spam coming through.. It's ASCII art (using nothing but numbers) and spells out TORA.08 and nothing else.. It looks to be coming from a Bot-Net..

Funny spamd failure... (Maybe SARE/rules-du-jour related?)

2006-11-17 Thread Steve [Spamassasin]
The other night my default gentoo RulesDuJour for Spamassassin acquired new Adult and General rule-sets from SARE. Thereafter spamd refused all connections and subsequently received mail was not spam filtered. Issuing '/etc/init.d/spamd restart' as root resolved the situation... but I don't want

I've got TORA.08 spelled with numbers?

2006-11-17 Thread Jeff Moss
I'm getting a bunch of spams this morning that have TORA.08 spelled out with numbers like this. 4216775 0611576 215556 7 3308011 3258576 6 7 5 153 85 2 7 3 8 3 6 50 4 1 2 7 0 5

Re: New Spam

2006-11-17 Thread Evan Platt
At 07:40 AM 11/17/2006, you wrote: I'm getting some new spam coming through.. It's ASCII art (using nothing but numbers) and spells out TORA.08 and nothing else.. It looks to be coming from a Bot-Net.. Anyone seen this? Thanks, Billy Just got 2 also to 2 different e-mail addresses.

RE: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Suhas Ingale \(QualiSpace\)
Even I have started getting it. Have any one cracked any rules for this? Warm Regards, Suhas System Administrator QualiSpace - A QuantumPages Enterprise An ICANN Accredited Domain Registrar === Tel India: +91 (22) 6792 - 1480 Tel US: +1 (614) 827 - 1224 Fax India: +91

Re: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Evan Platt
At 07:44 AM 11/17/2006, you wrote: I'm getting a bunch of spams this morning that have TORA.08 spelled out with numbers like this. 4216775 0611576 215556 7 3308011 3258576 6 7 5 153 85 2 7 3 8 3 6 50

Re: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Dan McCullough
Hey I got the same thing. On 11/17/06, Evan Platt [EMAIL PROTECTED] wrote: At 07:44 AM 11/17/2006, you wrote: I'm getting a bunch of spams this morning that have TORA.08 spelled out with numbers like this. 4216775 0611576 215556 7 3308011 3258576 6 7 5

Re: email appears to que all the time - sendmail,spamssassin,amavis-new

2006-11-17 Thread Stuart Johnston
Patrick Sherrill wrote: I seem to be getting significant delays in delivery (queue times are set to 15m). I am currently using amavis-new to hook SA with sendmail (tx and rx queue). What would be the best approach to minimizing delays beyond more RAM. Reject more messages with (good)

Re: New Spam

2006-11-17 Thread Michel R Vaillancourt
Evan Platt wrote: At 07:40 AM 11/17/2006, you wrote: I'm getting some new spam coming through.. It's ASCII art (using nothing but numbers) and spells out TORA.08 and nothing else.. It looks to be coming from a Bot-Net.. Anyone seen this? Thanks, Billy Just got 2 also to 2 different e-mail

Re: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Billy Huddleston
So, here is a question... Why spam everyone with TORA.08, I don't even know what the heck that means!!! - Original Message - From: Evan Platt [EMAIL PROTECTED] To: users@spamassassin.apache.org Sent: Friday, November 17, 2006 10:48 AM Subject: Re: I've got TORA.08 spelled with

RE: Funny spamd failure... (Maybe SARE/rules-du-jour related?)

2006-11-17 Thread Giampaolo Tomassoni
The other night my default gentoo RulesDuJour for Spamassassin acquired new Adult and General rule-sets from SARE. Thereafter spamd refused all connections and subsequently received mail was not spam filtered. Issuing '/etc/init.d/spamd restart' as root resolved the situation... but I

Re: I've got TORA.08 spelled with numbers?

2006-11-17 Thread snowcrash+spamassassin
I'm getting a bunch of spams this morning that have TORA.08 spelled out with numbers like this. lordy, lordy! i'm just *SURE* i'm missing the whole point of this sort of spam ... ... but WHY do these spammers even bother with this sort of stuff? even if it *does* temporarily get past

Re: RelayChecker 0.3

2006-11-17 Thread John Rudd
Stuart Johnston wrote: Michael Alan Dorman wrote: On Thu, 16 Nov 2006 17:56:21 -0800 Derek Harding [EMAIL PROTECTED] wrote: On Sun, 2006-11-12 at 17:26 -0800, John Rudd wrote: http://people.ucsc.edu/~jrudd/spamassassin/RelayChecker.tar I've been running this for a few days now and am

Re: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Stuart Johnston
Evan Platt wrote: At 07:44 AM 11/17/2006, you wrote: I'm getting a bunch of spams this morning that have TORA.08 spelled out with numbers like this. 4216775 0611576 215556 7 3308011 3258576 6 7 5 153 85 2 7 3 8 3

RE: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Giampaolo Tomassoni
So, here is a question... Why spam everyone with TORA.08, I don't even know what the heck that means!!! I guess it is a (japanese?) nickname. Maybe the nickname of the bot/worm/virus maker? It is possible that this advertising is targeted to spammers, not to real customers: it looks like

RE: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Giampaolo Tomassoni
From: Stuart Johnston [mailto:[EMAIL PROTECTED] Evan Platt wrote: At 07:44 AM 11/17/2006, you wrote: I'm getting a bunch of spams this morning that have TORA.08 spelled out with numbers like this. 4216775 0611576 215556 7 3308011 3258576 6 7 5

Re: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Nigel Frankcom
On Fri, 17 Nov 2006 09:03:54 -0700, [EMAIL PROTECTED] wrote: | Wasn't there a stock image spam with TORA.TORA or something? | | AH HA! It is not a url, its a stock symbol! | | http://finance.yahoo.com/q?s=TORA.OB Trading up 4.5%! Geez... At a rough guess that would be 'salt' money.

Re: Real fix for stock spams - pick up a pen

2006-11-17 Thread Bookworm
Coffey, Neal wrote: Bookworm wrote: Pick up a pen, and write to your local congressman, or even to the SEC, and insist that they penalize those companies who are being pimped and pumped through spam emails. Why should they? The companies being advertised in the stock spams aren't

Re: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Justin Mason
this seems to catch them: header __MAILER_OL_6626 X-Mailer =~ /^Microsoft Outlook, Build 10\.0\.6626$/ header __MOLE_2962 X-MimeOLE =~ /^Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2962$/ meta JM_TORA_XM (__MAILER_OL_6626 __MOLE_2962) --j. Billy Huddleston writes: So, here is a

RE: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Suhas Ingale \(QualiSpace\)
Lol Warm Regards, Suhas System Administrator QualiSpace - A QuantumPages Enterprise An ICANN Accredited Domain Registrar === Tel India: +91 (22) 6792 - 1480 Tel US: +1 (614) 827 - 1224 Fax India: +91 (22) 2530 - 3166 URL: http://www.qualispace.com

Re: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Nigel Frankcom
On Fri, 17 Nov 2006 17:09:21 +0100, Giampaolo Tomassoni [EMAIL PROTECTED] wrote: From: Stuart Johnston [mailto:[EMAIL PROTECTED] Evan Platt wrote: At 07:44 AM 11/17/2006, you wrote: I'm getting a bunch of spams this morning that have TORA.08 spelled out with numbers like this.

Re: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Billy Huddleston
Will that not get legit mail from someone sending via Microsoft Outlook ? - Original Message - From: Justin Mason [EMAIL PROTECTED] To: Billy Huddleston [EMAIL PROTECTED] Cc: users@spamassassin.apache.org Sent: Friday, November 17, 2006 11:10 AM Subject: Re: I've got TORA.08 spelled

Re: I've got TORA.08 spelled with numbers?

2006-11-17 Thread qqqq
| | | | http://finance.yahoo.com/q?s=TORA.OB | | Trading up 4.5%! | | Geez... | | At a rough guess that would be 'salt' money. So when someone does | click on it/look it up they see rising stock and buy. Check it again | in a few days. | | Nigel Hey...there is money to be made! Let's all

Re: Real fix for stock spams - pick up a pen

2006-11-17 Thread Bookworm
Robert Braver wrote: On Thursday, November 16, 2006, 8:00:09 PM, Michael Scheidell wrote: MS It was $500, and the law changed to make it impossible to collect MS anymore. MS Before, it was a 'first strike' and you owe $500. Now you have to 'opt MS out' (they can still send you one) Opt-out

RE: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Suhas Ingale \(QualiSpace\)
Is this safe to try? Warm Regards, Suhas System Administrator QualiSpace - A QuantumPages Enterprise An ICANN Accredited Domain Registrar === Tel India: +91 (22) 6792 - 1480 Tel US: +1 (614) 827 - 1224 Fax India: +91 (22) 2530 - 3166 URL: http://www.qualispace.com

Re: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Ray Anderson
Wouldn't a better solution to be check the e-mail for NOT having any alpha chars? All numbers seems like a no-brainer to me, but I'm fairly new at this. :) Something like Body ~= /[^a-zA-A]/ ? Cheers, -=Ray Justin Mason wrote: this seems to catch them: header __MAILER_OL_6626

Re: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Ken A
Ray Anderson wrote: Wouldn't a better solution to be check the e-mail for NOT having any alpha chars? All numbers seems like a no-brainer to me, but I'm fairly new at this. :) Something like Body ~= /[^a-zA-A]/ ? Too many false positives with that one. You'd need to be sure you

RE: New Spam

2006-11-17 Thread Darren Cockburn
TORA TECHNOLOGIES (TORA.OB) ??? - Darren. -Original Message- From: Bob McClure Jr [mailto:[EMAIL PROTECTED] Sent: Friday, November 17, 2006 11:18 AM To: users@spamassassin.apache.org Subject: Re: New Spam On Fri, Nov 17, 2006 at 10:40:17AM -0500, Billy Huddleston wrote: I'm getting

Re: Funny spamd failure... (Maybe SARE/rules-du-jour related?)

2006-11-17 Thread Peter H. Lemieux
Giampaolo Tomassoni wrote: # Check for amavis termination while [[ ! -z ${PIDS} ]]; do sleep 1 PIDS=$( /sbin/pidof ${AMV_NM} ) done In cases like this I usually just put the sleep command in the init script like this: ... case $1 in

procmail and virtual domain

2006-11-17 Thread jeaspam
Hi list I have postfix with a virtual domain, where I have to create a .procmailrc file for procmail? ( I have to create a file or a directory? ) How to configure a system wide? Thanks JeAn __ LLama Gratis a

image exception with FuzzyOCR??

2006-11-17 Thread Thiago LPS
Hello everybody... there is a way to do a exception to some image that isn't a SPAM... but the FuzzyOCR thinks that it is a spam image?? i really dont want to disable the Hashdb...

RE: Funny spamd failure... (Maybe SARE/rules-du-jour related?)

2006-11-17 Thread Giampaolo Tomassoni
From: Peter H. Lemieux [mailto:[EMAIL PROTECTED] Giampaolo Tomassoni wrote: # Check for amavis termination while [[ ! -z ${PIDS} ]]; do sleep 1 PIDS=$( /sbin/pidof ${AMV_NM} ) done In cases like this I usually just put the sleep

Re: I've got TORA.08 spelled with numbers? - Tora Acquires www.makeup.com

2006-11-17 Thread qqqq
http://biz.yahoo.com/iw/061020/0175176.html TORA TECHNOLOGIES INC. Robert E. Rook - President Contact: Contacts: Tora Technologies Inc. Robert E. Rook President 1-866-347-5057

Re: Funny spamd failure... (Maybe SARE/rules-du-jour related?)

2006-11-17 Thread Mark Martinec
The guy who made the script did simply test shutting and restarting the amavis/spamd daemon up and down in its own test environment, which basicly is low mail load or even no mail at all. After a while amavis is doing it's dirty job, I noticed it needs a lot of time to shut down. It takes to

RE: Funny spamd failure... (Maybe SARE/rules-du-jour related?)

2006-11-17 Thread Giampaolo Tomassoni
The guy who made the script did simply test shutting and restarting the amavis/spamd daemon up and down in its own test environment, which basicly is low mail load or even no mail at all. After a while amavis is doing it's dirty job, I noticed it needs a lot of time to shut down.

Sending Marked up mail to another address

2006-11-17 Thread Luke Shannon
I just got my system going. For the short term I would like to send all mail marked as spam to another address (not served from the box spam assassin is on). I am using sendmail/procmail/spamassissin Here is my .spamassassin.rc file. Any ideas why this won't work? When the forward rule is in

Re: procmail and virtual domain

2006-11-17 Thread karlp
On Fri, November 17, 2006 10:08 am, [EMAIL PROTECTED] wrote: Hi list I have postfix with a virtual domain, where I have to create a .procmailrc file for procmail? ( I have to create a file or a directory? ) How to configure a system wide? Thanks I recommend searching on the internet for

Re: Sending Marked up mail to another address

2006-11-17 Thread Bob McClure Jr
On Fri, Nov 17, 2006 at 01:41:03PM -0500, Luke Shannon wrote: I just got my system going. For the short term I would like to send all mail marked as spam to another address (not served from the box spam assassin is on). I am using sendmail/procmail/spamassissin Here is my .spamassassin.rc

RE: image exception with FuzzyOCR??

2006-11-17 Thread Sietse van Zanen
Ofcourse, save the image, calculate the hash and then use the fuzzy-find.pl script to delete it from the bad hash db. Next you'll have to use a little trick to get it into the good hash db, as that's not possible from the fuzzy-find.pl script. Simply make an empty word list and yank the image

Re: image exception with FuzzyOCR??

2006-11-17 Thread decoder
Sietse van Zanen wrote: Ofcourse, save the image, calculate the hash and then use the fuzzy-find.pl script to delete it from the bad hash db. Next you’ll have to use a little trick to get it into the good hash db, as that’s not possible from the fuzzy-find.pl script. Simply make an empty

RE: image exception with FuzzyOCR??

2006-11-17 Thread Sietse van Zanen
To be more exact, the procedure would be: 1. Save the image file, and the message 2. Calculate the hash and delete it from the bad hash db with the fuzzy-find.pl script 3. Create an empty wordlist, or fill it with some bogus words, that don't appear in the image 4.

Re: I've got TORA.08 spelled with numbers? - Tora Acquires www.makeup.com

2006-11-17 Thread Thiago LPS
i've got this spam too looks like a ASCI ART with TORA writed in the body of mail... :( On 11/17/06, [EMAIL PROTECTED] wrote: http://biz.yahoo.com/iw/061020/0175176.html TORA TECHNOLOGIES INC. Robert E. Rook - President Contact: Contacts: Tora Technologies Inc.

Re: I've got TORA.08 spelled with numbers? - Tora Acquires www.makeup.com

2006-11-17 Thread Rejaine Monteiro
how to block this ascii art spams?? i've got many spams with this tora.ob too... Thiago LPS escreveu: i've got this spam too looks like a ASCI ART with TORA writed in the body of mail... :( On 11/17/06, ** [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] wrote:

would SA benefit from port to Java

2006-11-17 Thread Eric A. Hall
Thinking about the GPL Java announcement some, and trying to imagine the kinds of opportunities this allows for, it occurs to me that SpamAssassin might be a natural fit for Java. I'm just thinking out loud here, not advocating anything... Would it run better? Would it be faster, have smaller

RE: New Spam

2006-11-17 Thread Chris Santerre
We've all got at least one. We've been talking about it on other lists. Either a goof or a spammer got haxored. The real question is, how soon before we see You one a free Playstation 3! spam? :-) --Chris (No, I didn't wait in line for one. )

TORA.08 rule

2006-11-17 Thread Rejaine Monteiro
Is safe to use this?? Seems to work... body ASCIISPAM /([0123456789] ){5}/i describe ASCIISPAM ASCII SPAM score ASCIISPAM 1.0

Can it get any simpler and not work?

2006-11-17 Thread twofers
I'm just doing some basic testing and what I think should be tagged as spam just goes right on thru. I've added this to local.cf headerMY_RULESubject =~ /test/i describe MY_RULE There is test in the Subject score MY_RULE100 I restart spamassassin.

Re: image exception with FuzzyOCR??

2006-11-17 Thread Thiago LPS
On 11/17/06, Sietse van Zanen [EMAIL PROTECTED] wrote: To be more exact, the procedure would be: 1. Save the image file, and the message 2. Calculate the hash and delete it from the bad hash db with the fuzzy-find.pl script 3. In the body of mail marked as spam , i have the

RE: Can it get any simpler and not work?

2006-11-17 Thread Giampaolo Tomassoni
A subject like: I'm attesting your knowledge of SA would match. See? atTESTing matches. You probably would do something like Subject =~ /\wtest\w/i (\w means word boundary). Which subjects got matched? giampaolo -Original Message- From: twofers [mailto:[EMAIL PROTECTED]

Could THIS have doubled my SA Speed...

2006-11-17 Thread Rob McEwen (PowerView Systems)
RE: Could THIS have doubled my SA Speed... First, I'm using a windows Port of SA... and I use this as a helper application in addition to my own custom programmed spam filter. Along these lines, I purposely have RBL checks and URI checks disabled in SA because I do these myself. But I **do**

RE: would SA benefit from port to Java

2006-11-17 Thread Giampaolo Tomassoni
Thinking about the GPL Java announcement some, and trying to imagine the kinds of opportunities this allows for, it occurs to me that SpamAssassin might be a natural fit for Java. I'm just thinking out loud here, not advocating anything... Would it run better? Would it be faster, have

Re: would SA benefit from port to Java

2006-11-17 Thread Stuart Johnston
Giampaolo Tomassoni wrote: Thinking about the GPL Java announcement some, and trying to imagine the kinds of opportunities this allows for, it occurs to me that SpamAssassin might be a natural fit for Java. I'm just thinking out loud here, not advocating anything... Would it run better? What

Re: Rules Du Jour briken?

2006-11-17 Thread Chris Thielen
I emailed the maintainer of exit0.us asking about the wiki site. Here is what he said: Thanks for the concern Chris, I appreciate it. To make a long story short, the person that offered to host the site (Matt) no longer works at that company. So without contacting me, they removed the site.

more ascii art spam

2006-11-17 Thread Peter H. Lemieux
I just got a new one with the usual drugs displayed in larged ascii art. It was nearly unreadable, and it didn't pass my SA checks either. Peter

RE: Bayes column 'token'

2006-11-17 Thread Mark
-Original Message- From: Mark [mailto:[EMAIL PROTECTED] Sent: woensdag 15 november 2006 18:15 To: 'users@spamassassin.apache.org' Subject: RE: Bayes column 'token' Well, bayes_mysql.sql does not specify collation; so, like you said, the collation will be your MySQL server-set

Re: image exception with FuzzyOCR??

2006-11-17 Thread decoder
Thiago LPS wrote: On 11/17/06, *Sietse van Zanen* [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] wrote: To be more exact, the procedure would be: 1. Save the image file, and the message 2. Calculate the hash and delete it from the bad hash db with the

Re: Bayes column 'token'

2006-11-17 Thread Stuart Johnston
Mark wrote: -Original Message- From: Mark [mailto:[EMAIL PROTECTED] Sent: woensdag 15 november 2006 18:15 To: 'users@spamassassin.apache.org' Subject: RE: Bayes column 'token' Well, bayes_mysql.sql does not specify collation; so, like you said, the collation will be your MySQL

Re: Rules Du Jour briken?

2006-11-17 Thread twofers
Thanks Chris, Appreciate the effort. I emailed him yesterday but just with notification that the link was broken. I didn't hear back, but my request was informative, not inquisitive. Wes Chris Thielen [EMAIL PROTECTED] wrote: I emailed the maintainer of exit0.us asking about

FuzzyOcr failing 'png' tests

2006-11-17 Thread snowcrash+spamassassin
(seems like the 'action' is over here ...) i'm running SA v3.1.8-r454679, with the FuzzyOCR v3.4.2-release $SA --lint is error-free. testing the plugin with provided test messages, $SA -t -x /tmp/ocr-gif.eml $SA -t -x /tmp/ocr-jpg.eml $SA -t -x /dev/FuzzyOcr-3.4.2/samples/animated-gif.eml

  1   2   >