You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Jeff Portwine <jd...@veritime.com> on 2006/02/03 18:10:16 UTC
spamassissin filter very broken
Hello... I am a complete newbie with Spamassassin, so I hope you will all bear with me. The job of fixing our spam filter has fallen on me, as the person who used to handle everything relating to our mail server recently left my company.
We're running spamassassin 3.0.2 with perl 5.8.4, and exim 3.35 on Debian.
In the last 3 weeks or so , we have started receiving a ton of spam, especially a lot of pharmeceutical adds and some other random nonsense. However, Spamassassin isn't completely broken.. it is actually catching some spam but it's letting a lot go. When I look at the headers in the spam, I see SA is assigning rediculously low scores to the ones that are getting through but normal scores to the ones it's stopping. Some of the spam that is getting through is actually receving negative scores, which as I understand it shouldn't even be possible unless the spam is whitelisted somehow.
Here are the SA related headers for a couple of spams that are getting through:
X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at veritime.com
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on mail2
X-Spam-Level: *
X-Spam-Status: No, score=1.8 required=4.9 tests=BAYES_50,HTML_80_90,
HTML_MESSAGE,PORN_URL_SEX,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,
UPPERCASE_25_50 autolearn=no version=3.0.2
X-Spam-Veritime: Valid
X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at veritime.com
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on mail2
X-Spam-Level:
X-Spam-Status: No, score=-2.6 required=4.9 tests=BAYES_00 autolearn=ham
version=3.0.2
X-Spam-Veritime: Valid
As opposed to this one which is a spam message that SA caught:
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on mail2
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.2 required=4.9 tests=BAYES_99,DIGEST_MULTIPLE,
DRUGS_ERECTILE,DRUG_DOSAGE,DRUG_ED_CAPS,HELO_DYNAMIC_IPADDR,
HTML_FONT_BIG,HTML_FONT_SIZE_LARGE,HTML_MESSAGE,HTML_SHOUTING5,
INVALID_DATE,PYZOR_CHECK,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,
UPPERCASE_25_50 autolearn=spam version=3.0.2
X-Spam-Veritime: Valid
X-Spam-Veritime-Spam: True
The first thing I did when I was looking at this was to run spamassassin -lint to see if it was parsing the configuration file properly and it gave me:
config: SpamAssassin failed to parse line, skipping: use_terse_report 0
config: SpamAssassin failed to parse line, skipping: auto_learn 1
lint: 2 issues detected. please rerun with debug enabled for more information.
When I looked these up, I found that they were deprecated options from version 2.6x. At some point SA must have been updated with a apt-get update or something and the configuration file was not updated along with it. I'm not sure if this is the cause of the problem though, since it appears that SA was updated about a year ago and we've only been having problems with spam for the last few weeks.
At this point i'm considering just wiping out spamassassin and reinstalling it fresh and having it relearn all of the spam that we have been saving for a while but it seems there must be a better solution.
Does anybody have any ideas on what could be wrong and how I can fix this? I'm being barraged by spam complaints from our users and spamassassin isn't trivial to jump right into without knowing something more about how it works. I've been googling and looking through docs and not coming up with the answer. Any help is very much appreciated.
Thanks,
Jeff
jdport@veritime.com
Re: spamassissin filter very broken
Posted by Chris Purves <ch...@northfolk.ca>.
On Saturday 04 February 2006 01:10, Jeff Portwine wrote:
> Hello... I am a complete newbie with Spamassassin, so I hope you will all
> bear with me. The job of fixing our spam filter has fallen on me, as the
> person who used to handle everything relating to our mail server recently
> left my company.
>
> We're running spamassassin 3.0.2 with perl 5.8.4, and exim 3.35 on Debian.
>
I run spamassassin 3.1 on Debian Sarge. You can pin the spamassassin package
in apt to testing and keep everything else as stable. Also, the sa-exim
makes plugging spamassassin into exim very easy.
--
Good day, eh.
Chris
Re: spamassissin filter very broken
Posted by Jim Maul <jm...@elih.org>.
> Hello... I am a complete newbie with Spamassassin, so I hope you will all
> bear with me. The job of fixing our spam filter has fallen on me, as the
> person who used to handle everything relating to our mail server recently
> left my company.
>
> We're running spamassassin 3.0.2 with perl 5.8.4, and exim 3.35 on Debian.
>
> In the last 3 weeks or so , we have started receiving a ton of spam,
> especially a lot of pharmeceutical adds and some other random nonsense.
> However, Spamassassin isn't completely broken.. it is actually catching
> some spam but it's letting a lot go. When I look at the headers in the
> spam, I see SA is assigning rediculously low scores to the ones that are
> getting through but normal scores to the ones it's stopping. Some of
> the spam that is getting through is actually receving negative scores,
> which as I understand it shouldn't even be possible unless the spam is
> whitelisted somehow.
>
> Here are the SA related headers for a couple of spams that are getting
> through:
> X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at veritime.com
> X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on mail2
> X-Spam-Level: *
> X-Spam-Status: No, score=1.8 required=4.9 tests=BAYES_50,HTML_80_90,
> HTML_MESSAGE,PORN_URL_SEX,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,
> UPPERCASE_25_50 autolearn=no version=3.0.2
> X-Spam-Veritime: Valid
>
Your bayes database appears to be misidentifying somewhat. Most likely
trained incorrectly (autolearn or manual or maybe both).
> X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at veritime.com
> X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on mail2
> X-Spam-Level:
> X-Spam-Status: No, score=-2.6 required=4.9 tests=BAYES_00 autolearn=ham
> version=3.0.2
> X-Spam-Veritime: Valid
>
Yes, your bayes database is very broken. I'd wipe it out and start
fresh.. One of the problems appears to be that your autolearn thresholds
need to be adjusted. A message scoring only BAYES_00 should NOT be
autolearned. Ive set my autolearn threshold for ham to a small negative
number. You may want to do the same to prevent things like this from
happening.
> As opposed to this one which is a spam message that SA caught:
> X-Spam-Flag: YES
> X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on mail2
> X-Spam-Level: *************
> X-Spam-Status: Yes, score=13.2 required=4.9
> tests=BAYES_99,DIGEST_MULTIPLE,
> DRUGS_ERECTILE,DRUG_DOSAGE,DRUG_ED_CAPS,HELO_DYNAMIC_IPADDR,
> HTML_FONT_BIG,HTML_FONT_SIZE_LARGE,HTML_MESSAGE,HTML_SHOUTING5,
> INVALID_DATE,PYZOR_CHECK,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,
> UPPERCASE_25_50 autolearn=spam version=3.0.2
> X-Spam-Veritime: Valid
> X-Spam-Veritime-Spam: True
>
>
>
> The first thing I did when I was looking at this was to run spamassassin
> -lint to see if it was parsing the configuration file properly and it gave
> me:
>
> config: SpamAssassin failed to parse line, skipping: use_terse_report
> 0
> config: SpamAssassin failed to parse line, skipping: auto_learn
> 1
> lint: 2 issues detected. please rerun with debug enabled for more
> information.
>
> When I looked these up, I found that they were deprecated options from
> version 2.6x. At some point SA must have been updated with a apt-get
> update or something and the configuration file was not updated along with
> it. I'm not sure if this is the cause of the problem though, since it
> appears that SA was updated about a year ago and we've only been having
> problems with spam for the last few weeks.
>
Yeah i'd fix the syntax but i dont believe that is causing the problems
you are seeing.
> At this point i'm considering just wiping out spamassassin and
> reinstalling it fresh and having it relearn all of the spam that we have
> been saving for a while but it seems there must be a better solution.
>
There is. You dont need to completely wipe the SA install. I'd just wipe
the bayes files and start learning again. If you choose to leave
autolearning on, make sure you adjust your thresholds. Mine are at:
bayes_auto_learn_threshold_nonspam -0.1
bayes_auto_learn_threshold_spam 10.0
> Does anybody have any ideas on what could be wrong and how I can fix this?
> I'm being barraged by spam complaints from our users and spamassassin
> isn't trivial to jump right into without knowing something more about how
> it works. I've been googling and looking through docs and not coming up
> with the answer. Any help is very much appreciated.
>
Are you using all network tests? I see some razor hits in there which is
good, but no surbl www.surbl.org or anything like that.
Most of my spams look something like:
X-Spam-Status: Yes, hits=16.1 required=5.0 tests=BAYES_99,HTML_70_80,
HTML_MESSAGE,JP_URI_RBL,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,
SPAMCOP_URI_RBL autolearn=no version=2.64
X-Spam-Status: Yes, hits=29.2 required=5.0 tests=AB_URI_RBL,BAYES_99,
CLICK_BELOW,HTML_FONTCOLOR_BLUE,HTML_FONTCOLOR_RED,
HTML_FONTCOLOR_UNSAFE,HTML_FONT_BIG,HTML_LINK_CLICK_HERE,HTML_MESSAGE,
JP_URI_RBL,ONLINE_PHARMACY,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,
SPAMCOP_URI_RBL,UPPERCASE_25_50,VIAGRA,WS_URI_RBL autolearn=no
version=2.64
My average spam score is somewhere around 18 with a max of 42.3 (my
highest yet). You may also want to try using some sare rules
http://www.rulesemporium.com/ to try to boost the scores.
Note: I've raised the scores of BAYES_ tests slightly on my system so that
BAYES_99 alone is enough to push a message into spam territory. I would
not recommend doing this unless you are absolutely sure that your bayes
database is extremely accurate (and maybe not even then, but hey, its my
system ;) )
-Jim
Re: spamassissin filter very broken
Posted by Loren Wilton <lw...@earthlink.net>.
Despite the message subject I wouldn't say your SA install is *very* broken,
only unmaintained and somewhat broken. One would expect that an
unmaintained filter would let more spam through with time. SPam patterns
change as the spammers get better at avoiding old blocks, so we have to
invent new blocks.
What I see from your headers is that you don't seem to have any third party
rules such as from RulesEmporium, and it looks like your Bayes database is
at least partially messed up - it rated that second spam as pure ham, and
was completely unsure in the first case.
I'd suggest the following:
1. Upgrade to 3.1 or 3.0.5.
2. If you have auto-learning enabled, adjust the ham threshold downward.
3. Blow away the bayes database and start over.
4. Get some SARE rules and perhaps some of the old standards like
chickenpox, which still work pretty well.
With Bayes, I'd recommend turning off auto-leanring initially and
hand-feeding it the required 200+ ham and ideally about a thousand spam so
it gets a good start in life. Then you can turn auto-learning back on
reasonably safely.
Also check your trusted networks and internal networks settings. I don't
see problems in what you posted, but these have been a problem for a great
many people, and their importance isn't sufficiently empahsised in the
install documentation.
Loren
Re: spamassissin filter very broken
Posted by Jeff Portwine <jd...@veritime.com>.
Well I just did a sa-learn --clear
and then sa-learn --ham
and sa-learn --spam
on ~5000-6000 spam and ham messages... will find out Monday morning when I
come back in and look at my mailbox if that helped any.
I appreciate the responses from everybody.
-Jeff
jdport@veritime.com
----- Original Message -----
From: "Gary V" <mr...@hotmail.com>
To: <us...@spamassassin.apache.org>
Sent: Friday, February 03, 2006 5:38 PM
Subject: Re: spamassissin filter very broken
>>>>
>>>>We're running spamassassin 3.0.2 with perl 5.8.4, and exim 3.35 on
>>>>Debian.
>>>>
>>
>>><<jdow>> Don't wipe out SA, necessarily. It's not time to do that yet.
>>>But it is time to update to 3.0.5, at least. 3.0.2 has a DoS
>>>vulnerability.
>>>
>>
>><<Gary V>>That's not an option unless you get away from Debian packages.
>
> Clarification; 3.0.5 is not an option, but if one is willing to run a
> mixed system, 3.1 is available in etch/testing.
>
> Gary V
>
> _________________________________________________________________
> Is your PC infected? Get a FREE online computer virus scan from McAfee®
> Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963
>
>
Re: spamassissin filter very broken
Posted by Gary V <mr...@hotmail.com>.
>>>
>>>We're running spamassassin 3.0.2 with perl 5.8.4, and exim 3.35 on
>>>Debian.
>>>
>
>><<jdow>> Don't wipe out SA, necessarily. It's not time to do that yet.
>>But it is time to update to 3.0.5, at least. 3.0.2 has a DoS
>>vulnerability.
>>
>
><<Gary V>>That's not an option unless you get away from Debian packages.
Clarification; 3.0.5 is not an option, but if one is willing to run a mixed
system, 3.1 is available in etch/testing.
Gary V
_________________________________________________________________
Is your PC infected? Get a FREE online computer virus scan from McAfeeŽ
Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963
Re: spamassissin filter very broken
Posted by Gary V <mr...@hotmail.com>.
>>
>>We're running spamassassin 3.0.2 with perl 5.8.4, and exim 3.35 on Debian.
>>
><<jdow>> Don't wipe out SA, necessarily. It's not time to do that yet.
>But it is time to update to 3.0.5, at least. 3.0.2 has a DoS vulnerability.
>
That's not an option unless you get away from Debian packages. Installing by
more than one method will cause problems, so it would be best to stick with
the Debian package. The Debian package has been patched for the said DOS
vulnerability. On a Debian box, if a given Perl program is installed using
apt, then the same program is installed from source (or CPAN), the one
installed from source will be found first. If a user now wants to upgrade to
a new version using apt, it will be ignored, but in the case of
SpamAssassin, the rules and configuration files would not be ignored. This
is guaranteed to kill SpamAssassin and leave the user bewildered. A user
would then have to manually search and destroy the version installed via
source in order to get the Debian package noticed and functional. The trick
would be to know which files/directories you can rename/remove and which
ones you can't. In my experience on Debian (not true on all distros), in the
case of SpamAssassin, all that is needed is to rename the offending
SpamAssassin.pm file. Other distros may also require removal/renaming of the
directory containing the standard rules files of the offending install and
it would also need to be determined if there is more than one directory
containing the config files, and if so, which one is being used.
Gary V
_________________________________________________________________
Dont just search. Find. Check out the new MSN Search!
http://search.msn.click-url.com/go/onm00200636ave/direct/01/
Re: spamassissin filter very broken
Posted by jdow <jd...@earthlink.net>.
From: "Jeff Portwine" <jd...@veritime.com>
Hello... I am a complete newbie with Spamassassin, so I hope you will all bear with me.
The job of fixing our spam filter has fallen on me, as the person who used to handle
everything relating to our mail server recently left my company.
We're running spamassassin 3.0.2 with perl 5.8.4, and exim 3.35 on Debian.
In the last 3 weeks or so , we have started receiving a ton of spam, especially a lot of
pharmeceutical adds and some other random nonsense. However, Spamassassin isn't
completely broken.. it is actually catching some spam but it's letting a lot go. When I
look at the headers in the spam, I see SA is assigning rediculously low scores to the ones
that are getting through but normal scores to the ones it's stopping. Some of the spam
that is getting through is actually receving negative scores, which as I understand it
shouldn't even be possible unless the spam is whitelisted somehow.
Here are the SA related headers for a couple of spams that are getting through:
X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at veritime.com
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on mail2
<<jdow>> establishes what is running as 3.0.2. This hints at several
issues. <see below>
X-Spam-Level: *
X-Spam-Status: No, score=1.8 required=4.9 tests=BAYES_50,HTML_80_90,
HTML_MESSAGE,PORN_URL_SEX,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,
UPPERCASE_25_50 autolearn=no version=3.0.2
X-Spam-Veritime: Valid
X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at veritime.com
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on mail2
X-Spam-Level:
X-Spam-Status: No, score=-2.6 required=4.9 tests=BAYES_00 autolearn=ham
version=3.0.2
X-Spam-Veritime: Valid
As opposed to this one which is a spam message that SA caught:
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on mail2
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.2 required=4.9 tests=BAYES_99,DIGEST_MULTIPLE,
DRUGS_ERECTILE,DRUG_DOSAGE,DRUG_ED_CAPS,HELO_DYNAMIC_IPADDR,
HTML_FONT_BIG,HTML_FONT_SIZE_LARGE,HTML_MESSAGE,HTML_SHOUTING5,
INVALID_DATE,PYZOR_CHECK,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,
UPPERCASE_25_50 autolearn=spam version=3.0.2
X-Spam-Veritime: Valid
X-Spam-Veritime-Spam: True
The first thing I did when I was looking at this was to run spamassassin -lint to see if
it was parsing the configuration file properly and it gave me:
config: SpamAssassin failed to parse line, skipping: use_terse_report 0
config: SpamAssassin failed to parse line, skipping: auto_learn 1
lint: 2 issues detected. please rerun with debug enabled for more information.
When I looked these up, I found that they were deprecated options from version 2.6x. At
some point SA must have been updated with a apt-get update or
<<jdow>> apt-get screwed you. <see below>
something and the configuration file was not updated along with it. I'm not sure if
this is the cause of the problem though, since it appears that SA was updated about a year
ago and we've only been having problems with spam for the last few weeks.
At this point i'm considering just wiping out spamassassin and reinstalling it fresh and
having it relearn all of the spam that we have been saving for a while but it seems there
must be a better solution.
<<jdow>> Don't wipe out SA, necessarily. It's not time to do that yet.
But it is time to update to 3.0.5, at least. 3.0.2 has a DoS vulnerability.
That said you also need to clear the Bayes databases, simply remove all
the "bayes_*" files. In most installs that use per user Bayes and rules
that's the $HOME/.spamassassin/bayes_* files for each user on the system.
What happened is that to move from 2.64 to 3.x the Bayes database needs
to be upgraded. There is a process that needs to be followed to make this
work correctly. It was apparently not followed. So now the Bayes database
is hopelessly messed up, I suspect. A start for it is the easiest solution.
You also probably want to update your SARE rules, if any. They are different
for 2.x and 3.x.
{^_^}
RE: spamassissin filter very broken
Posted by Gary V <mr...@hotmail.com>.
>In the last 3 weeks or so , we have started receiving a ton of spam,
>especially a lot of pharmeceutical adds and some other random nonsense.
>However, Spamassassin isn't completely broken.. it is actually catching
>some spam but it's letting a lot go. When I look at the headers in the
>spam, I see SA is assigning rediculously low scores to the ones that are
>getting through but normal scores to the ones it's stopping. Some of the
>spam that is getting through is actually receving negative scores, which as
>I understand it shouldn't even be possible unless the spam is whitelisted
>somehow.
>
>Here are the SA related headers for a couple of spams that are getting
>through:
>X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at veritime.com
>X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on mail2
>X-Spam-Level: *
>X-Spam-Status: No, score=1.8 required=4.9 tests=BAYES_50,HTML_80_90,
> HTML_MESSAGE,PORN_URL_SEX,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,
> UPPERCASE_25_50 autolearn=no version=3.0.2
>X-Spam-Veritime: Valid
On the surface it does not appear broken. It appears this spammer is good at
what they do.
>X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at veritime.com
>X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on mail2
>X-Spam-Level:
>X-Spam-Status: No, score=-2.6 required=4.9 tests=BAYES_00 autolearn=ham
> version=3.0.2
>X-Spam-Veritime: Valid
On the surface it does not appear broken, but without a sample of the
message, it is impossible to say. It appears this spammer is very good at
what they do. This message definitely needs to be learned as spam since your
Bayes thinks it is ham, but it will take more than Bayes to get it over 4.9
points. Maybe your network test are timing out. This message fed through
spamassassin -tD < message
will check for that.
I find the DNS server used can have a big impact on network tests, and if
you are using something like your ISPs server, or your gateway/firewall, and
not a local server running a decent DNS server, that a local caching DNS
server can make a difference. I install bind9 and configure it a caching
only or forwarding server. This article (along with the bind9 manual) helps
get it installed on Debian:
http://www.falkotimme.com/howtos/perfect_setup_debian_sarge/index.php
http://www.bind9.net/manual/bind/9.2.4/Bv9ARM.html
>
>As opposed to this one which is a spam message that SA caught:
>X-Spam-Flag: YES
>X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on mail2
>X-Spam-Level: *************
>X-Spam-Status: Yes, score=13.2 required=4.9 tests=BAYES_99,DIGEST_MULTIPLE,
> DRUGS_ERECTILE,DRUG_DOSAGE,DRUG_ED_CAPS,HELO_DYNAMIC_IPADDR,
> HTML_FONT_BIG,HTML_FONT_SIZE_LARGE,HTML_MESSAGE,HTML_SHOUTING5,
> INVALID_DATE,PYZOR_CHECK,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,
> UPPERCASE_25_50 autolearn=spam version=3.0.2
>X-Spam-Veritime: Valid
>X-Spam-Veritime-Spam: True
>
>At this point i'm considering just wiping out spamassassin and
>reinstalling it fresh and having it relearn all of the spam that we have
>been saving for a while but it seems there must be a better solution.
>Jeff
Maybe your Bayes could use help, but I kinda don't think wiping out and
reinstalling SA will make any difference, because it does not appear broken
to me. Does each user have their own Bayes files? If so, you might consider
configuring a bayes_path that points to a single database that can be
written to by all users. A single database has the advantage that it is a
collective knowledge.
I find that on 3.0.x, tweaking Bayes scores can help. This is not needed on
3.1
These are personally what I use on 3.0.x (and not any of these on 3.1):
score BAYES_00 -2.500
score BAYES_05 -2.000
score BAYES_20 -1.700
score BAYES_40 -0.600
score BAYES_60 1.000
score BAYES_80 1.900
score BAYES_95 2.500
score BAYES_99 3.000
score RAZOR2_CF_RANGE_51_100 0.500
score URIBL_WS_SURBL 2.000
score URIBL_PH_SURBL 2.500
score RCVD_IN_SORBS_HTTP 1.000
score RCVD_IN_SBL 1.000
score RCVD_IN_NJABL_PROXY 1.000
score RCVD_IN_SORBS_MISC 0.500
score RCVD_IN_BL_SPAMCOP_NET 2.000
score RCVD_IN_NJABL_SPAM 2.200
score HTML_WEB_BUGS 1.500
Consider studing the additional rule sets that may be of use for the
particular type of spam you are getting.
http://www.rulesemporium.com/
All additional rules will require SpamAssassin to do more work, so be
careful and only use the ones that appear to target the spam you are having
trouble with.
Gary V
_________________________________________________________________
FREE pop-up blocking with the new MSN Toolbar get it now!
http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/