You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Gary Smith <ga...@primeexalia.com> on 2004/02/18 15:59:56 UTC
RE: [Suspected SPAM] Re: This doesn't get picked up
Did you restart the SA daemon?
-----Original Message-----
From: Danie Marais [mailto:danie.marais@attix5.com]
Sent: Wednesday, February 18, 2004 5:17 AM
To: jennifer; spamassassin-users@incubator.apache.org
Subject: [Suspected SPAM] Re: This doesn't get picked up
Thanks for that, Jennifer
I see how this is supposed to work, but I have placed the weeds.cf file
in
/etc/mail/spamassassin and made sure it has read access for everybody.
I then ran
spamassassin < mymessage.eml > result.txt
And the rules were not applied. I have attached the message if you want
to
verify. Maybe it's just me being stupid, but my other rulesets like
backhair and chickenpox applied in the same fashion work just fine.
Danie
----- Original Message -----
From: "jennifer" <je...@emtinc.net>
To: "'Danie Marais'" <da...@attix5.com>;
<sp...@incubator.apache.org>
Sent: Tuesday, February 17, 2004 4:27 PM
Subject: RE: This doesn't get picked up
>
> > Hi,
> >
> > I got a spam message yesterday with the following text
> >
> > "Discover the new winning sexual erection pill!
> > This medication picks up where Viagra stops."
> >
> > But 'viagra' was not picked up. However, when I look at the
> > message source
> > I see this:
> >
> > <html>
> > <body>
> > Disco<eqkolpb>ver the n</nyvakro>ew winning
> > sexual
> >  erection pil
> > l!<br>
> > This
> > medication pi
> > cks
> >  up where Via&#
> > 103ra
> >  stops.<br><br>
> > Only $3 PER DOSE
> > <br><br>
> > <a
> > href="http://www.cnbroastca
> > st.com
> > /c2/index.php?AFF_ID=&#
> > 100m5&#
> > 54">
> > Get your free
> >  prescriptio
> > 0 NO&
> > #87!</a>
> > <br><br><br>
> > .
> > .
> > .
> >
> >
> >
> >
> > Is there a simple way of catching this apprach?
>
> The Weeds Set (not weeds2)
>
> http://www.emtinc.net/spamhammers.htm
>
> Jennifer
>
> >
> > Danie Marais
> >
> >
RE: This doesn't get picked up
Posted by jennifer <je...@emtinc.net>.
>
> I though about making it optional, but it is at the end of the text it
> checks for. It is like saying
> "match rule X and then there can be a ; at the end or not"
> I'd rather just say
> "match rule X"
Good point, ...my bad!
My brain is seriously rebelling against multitasking today. What's that
i see? ...is it?...yes! an ileocecal valve!?
Coke o'clock.
Jennifer
>
> Regards,
>
> Danie Marais
> CTO, Attix5
> danie.marais@attix5.com
> www.attix5.com
> +27 21 880 2323 (Tel)
> +27 21 880 2324 (Fax)
> ----- Original Message -----
> From: "jennifer" <je...@emtinc.net>
> To: "'Danie Marais'" <da...@attix5.com>; "'Gary Smith'"
> <ga...@primeexalia.com>; <sp...@incubator.apache.org>
> Sent: Wednesday, February 18, 2004 6:05 PM
> Subject: RE: This doesn't get picked up
>
>
> >
> > >
> > > Yes, I did restart the daemon. I checked using spamassassin,
> > > not spamc
> > > anyway, so restart of the daemon is not necessary.
> > >
> > > However, I modified the rules a bit. Seems that when you
> > > remove the ';'
> > > from the rules it works. I didn't see any ;'s in the mail
> > > that was slipping
> > > through.
> > >
> > > Perhaps that was the problem?
> >
> > yes, that was the problem, Danie. Don't remove the ";", make them
> > optional. (at least that is what i would suggest, so that it still
> > catches the other form as well.) I'll do the same for the
> distribution
> > set.
> >
> > thanks,
> > Jennifer
> >
> > >
> > > Regards,
> > > Danie Marais
> > > ----- Original Message -----
> > > From: "Gary Smith" <ga...@primeexalia.com>
> > > To: "Danie Marais" <da...@attix5.com>; "jennifer"
> > > <je...@emtinc.net>; <sp...@incubator.apache.org>
> > > Sent: Wednesday, February 18, 2004 4:59 PM
> > > Subject: RE: [Suspected SPAM] Re: This doesn't get picked up
> > >
> > >
> > > > Did you restart the SA daemon?
> > > >
> > > > -----Original Message-----
> > > > From: Danie Marais [mailto:danie.marais@attix5.com]
> > > > Sent: Wednesday, February 18, 2004 5:17 AM
> > > > To: jennifer; spamassassin-users@incubator.apache.org
> > > > Subject: [Suspected SPAM] Re: This doesn't get picked up
> > > >
> > > > Thanks for that, Jennifer
> > > >
> > > > I see how this is supposed to work, but I have placed the
> > > weeds.cf file
> > > > in
> > > > /etc/mail/spamassassin and made sure it has read access for
> > > everybody.
> > > >
> > > > I then ran
> > > > spamassassin < mymessage.eml > result.txt
> > > >
> > > > And the rules were not applied. I have attached the
> > > message if you want
> > > > to
> > > > verify. Maybe it's just me being stupid, but my other
> rulesets like
> > > > backhair and chickenpox applied in the same fashion
> work just fine.
> > > >
> > > > Danie
> > > > ----- Original Message -----
> > > > From: "jennifer" <je...@emtinc.net>
> > > > To: "'Danie Marais'" <da...@attix5.com>;
> > > > <sp...@incubator.apache.org>
> > > > Sent: Tuesday, February 17, 2004 4:27 PM
> > > > Subject: RE: This doesn't get picked up
> > > >
> > > >
> > > > >
> > > > > > Hi,
> > > > > >
> > > > > > I got a spam message yesterday with the following text
> > > > > >
> > > > > > "Discover the new winning sexual erection pill!
> > > > > > This medication picks up where Viagra stops."
> > > > > >
> > > > > > But 'viagra' was not picked up. However, when I look at the
> > > > > > message source
> > > > > > I see this:
> > > > > >
> > > > > > <html>
> > > > > > <body>
> > > > > > Disco<eqkolpb>ver the n</nyvakro>ew winning
> > > > > > sexual
> > > > > >
>  erection pil
> > > > > > l!<br>
> > > > > > This
> > > > > >
> medication pi
> > > > > > cks
> > > > > >
>  up where Via&#
> > > > > > 103ra
> > > > > >  stops.<br><br>
> > > > > >
> > >
> Only $3 PER DOSE
> > > > > > <br><br>
> > > > > > <a
> > > > > >
> href="http://www.cnbroastca
> > > > > > st.com
> > > > > >
> /c2/index.php?AFF_ID=&#
> > > > > > 100m5&#
> > > > > > 54">
> > > > > >
> Get your free
> > > > > >
>  prescriptio
> > > > > > 0 NO&
> > > > > > #87!</a>
> > > > > > <br><br><br>
> > > > > > .
> > > > > > .
> > > > > > .
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > Is there a simple way of catching this apprach?
> > > > >
> > > > > The Weeds Set (not weeds2)
> > > > >
> > > > > http://www.emtinc.net/spamhammers.htm
> > > > >
> > > > > Jennifer
> > > > >
> > > > > >
> > > > > > Danie Marais
> > > > > >
> > > > > >
> > >
> > >
> >
> >
>
>
Re: This doesn't get picked up
Posted by Danie Marais <da...@attix5.com>.
I though about making it optional, but it is at the end of the text it
checks for. It is like saying
"match rule X and then there can be a ; at the end or not"
I'd rather just say
"match rule X"
Regards,
Danie Marais
CTO, Attix5
danie.marais@attix5.com
www.attix5.com
+27 21 880 2323 (Tel)
+27 21 880 2324 (Fax)
----- Original Message -----
From: "jennifer" <je...@emtinc.net>
To: "'Danie Marais'" <da...@attix5.com>; "'Gary Smith'"
<ga...@primeexalia.com>; <sp...@incubator.apache.org>
Sent: Wednesday, February 18, 2004 6:05 PM
Subject: RE: This doesn't get picked up
>
> >
> > Yes, I did restart the daemon. I checked using spamassassin,
> > not spamc
> > anyway, so restart of the daemon is not necessary.
> >
> > However, I modified the rules a bit. Seems that when you
> > remove the ';'
> > from the rules it works. I didn't see any ;'s in the mail
> > that was slipping
> > through.
> >
> > Perhaps that was the problem?
>
> yes, that was the problem, Danie. Don't remove the ";", make them
> optional. (at least that is what i would suggest, so that it still
> catches the other form as well.) I'll do the same for the distribution
> set.
>
> thanks,
> Jennifer
>
> >
> > Regards,
> > Danie Marais
> > ----- Original Message -----
> > From: "Gary Smith" <ga...@primeexalia.com>
> > To: "Danie Marais" <da...@attix5.com>; "jennifer"
> > <je...@emtinc.net>; <sp...@incubator.apache.org>
> > Sent: Wednesday, February 18, 2004 4:59 PM
> > Subject: RE: [Suspected SPAM] Re: This doesn't get picked up
> >
> >
> > > Did you restart the SA daemon?
> > >
> > > -----Original Message-----
> > > From: Danie Marais [mailto:danie.marais@attix5.com]
> > > Sent: Wednesday, February 18, 2004 5:17 AM
> > > To: jennifer; spamassassin-users@incubator.apache.org
> > > Subject: [Suspected SPAM] Re: This doesn't get picked up
> > >
> > > Thanks for that, Jennifer
> > >
> > > I see how this is supposed to work, but I have placed the
> > weeds.cf file
> > > in
> > > /etc/mail/spamassassin and made sure it has read access for
> > everybody.
> > >
> > > I then ran
> > > spamassassin < mymessage.eml > result.txt
> > >
> > > And the rules were not applied. I have attached the
> > message if you want
> > > to
> > > verify. Maybe it's just me being stupid, but my other rulesets like
> > > backhair and chickenpox applied in the same fashion work just fine.
> > >
> > > Danie
> > > ----- Original Message -----
> > > From: "jennifer" <je...@emtinc.net>
> > > To: "'Danie Marais'" <da...@attix5.com>;
> > > <sp...@incubator.apache.org>
> > > Sent: Tuesday, February 17, 2004 4:27 PM
> > > Subject: RE: This doesn't get picked up
> > >
> > >
> > > >
> > > > > Hi,
> > > > >
> > > > > I got a spam message yesterday with the following text
> > > > >
> > > > > "Discover the new winning sexual erection pill!
> > > > > This medication picks up where Viagra stops."
> > > > >
> > > > > But 'viagra' was not picked up. However, when I look at the
> > > > > message source
> > > > > I see this:
> > > > >
> > > > > <html>
> > > > > <body>
> > > > > Disco<eqkolpb>ver the n</nyvakro>ew winning
> > > > > sexual
> > > > >  erection pil
> > > > > l!<br>
> > > > > This
> > > > > medication pi
> > > > > cks
> > > > >  up where Via&#
> > > > > 103ra
> > > > >  stops.<br><br>
> > > > >
> > Only $3 PER DOSE
> > > > > <br><br>
> > > > > <a
> > > > > href="http://www.cnbroastca
> > > > > st.com
> > > > > /c2/index.php?AFF_ID=&#
> > > > > 100m5&#
> > > > > 54">
> > > > > Get your free
> > > > >  prescriptio
> > > > > 0 NO&
> > > > > #87!</a>
> > > > > <br><br><br>
> > > > > .
> > > > > .
> > > > > .
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > Is there a simple way of catching this apprach?
> > > >
> > > > The Weeds Set (not weeds2)
> > > >
> > > > http://www.emtinc.net/spamhammers.htm
> > > >
> > > > Jennifer
> > > >
> > > > >
> > > > > Danie Marais
> > > > >
> > > > >
> >
> >
>
>
RE: This doesn't get picked up
Posted by jennifer <je...@emtinc.net>.
>
> Yes, I did restart the daemon. I checked using spamassassin,
> not spamc
> anyway, so restart of the daemon is not necessary.
>
> However, I modified the rules a bit. Seems that when you
> remove the ';'
> from the rules it works. I didn't see any ;'s in the mail
> that was slipping
> through.
>
> Perhaps that was the problem?
yes, that was the problem, Danie. Don't remove the ";", make them
optional. (at least that is what i would suggest, so that it still
catches the other form as well.) I'll do the same for the distribution
set.
thanks,
Jennifer
>
> Regards,
> Danie Marais
> ----- Original Message -----
> From: "Gary Smith" <ga...@primeexalia.com>
> To: "Danie Marais" <da...@attix5.com>; "jennifer"
> <je...@emtinc.net>; <sp...@incubator.apache.org>
> Sent: Wednesday, February 18, 2004 4:59 PM
> Subject: RE: [Suspected SPAM] Re: This doesn't get picked up
>
>
> > Did you restart the SA daemon?
> >
> > -----Original Message-----
> > From: Danie Marais [mailto:danie.marais@attix5.com]
> > Sent: Wednesday, February 18, 2004 5:17 AM
> > To: jennifer; spamassassin-users@incubator.apache.org
> > Subject: [Suspected SPAM] Re: This doesn't get picked up
> >
> > Thanks for that, Jennifer
> >
> > I see how this is supposed to work, but I have placed the
> weeds.cf file
> > in
> > /etc/mail/spamassassin and made sure it has read access for
> everybody.
> >
> > I then ran
> > spamassassin < mymessage.eml > result.txt
> >
> > And the rules were not applied. I have attached the
> message if you want
> > to
> > verify. Maybe it's just me being stupid, but my other rulesets like
> > backhair and chickenpox applied in the same fashion work just fine.
> >
> > Danie
> > ----- Original Message -----
> > From: "jennifer" <je...@emtinc.net>
> > To: "'Danie Marais'" <da...@attix5.com>;
> > <sp...@incubator.apache.org>
> > Sent: Tuesday, February 17, 2004 4:27 PM
> > Subject: RE: This doesn't get picked up
> >
> >
> > >
> > > > Hi,
> > > >
> > > > I got a spam message yesterday with the following text
> > > >
> > > > "Discover the new winning sexual erection pill!
> > > > This medication picks up where Viagra stops."
> > > >
> > > > But 'viagra' was not picked up. However, when I look at the
> > > > message source
> > > > I see this:
> > > >
> > > > <html>
> > > > <body>
> > > > Disco<eqkolpb>ver the n</nyvakro>ew winning
> > > > sexual
> > > >  erection pil
> > > > l!<br>
> > > > This
> > > > medication pi
> > > > cks
> > > >  up where Via&#
> > > > 103ra
> > > >  stops.<br><br>
> > > >
> Only $3 PER DOSE
> > > > <br><br>
> > > > <a
> > > > href="http://www.cnbroastca
> > > > st.com
> > > > /c2/index.php?AFF_ID=&#
> > > > 100m5&#
> > > > 54">
> > > > Get your free
> > > >  prescriptio
> > > > 0 NO&
> > > > #87!</a>
> > > > <br><br><br>
> > > > .
> > > > .
> > > > .
> > > >
> > > >
> > > >
> > > >
> > > > Is there a simple way of catching this apprach?
> > >
> > > The Weeds Set (not weeds2)
> > >
> > > http://www.emtinc.net/spamhammers.htm
> > >
> > > Jennifer
> > >
> > > >
> > > > Danie Marais
> > > >
> > > >
>
>
Re: This doesn't get picked up
Posted by Danie Marais <da...@attix5.com>.
Yes, I did restart the daemon. I checked using spamassassin, not spamc
anyway, so restart of the daemon is not necessary.
However, I modified the rules a bit. Seems that when you remove the ';'
from the rules it works. I didn't see any ;'s in the mail that was slipping
through.
Perhaps that was the problem?
Regards,
Danie Marais
----- Original Message -----
From: "Gary Smith" <ga...@primeexalia.com>
To: "Danie Marais" <da...@attix5.com>; "jennifer"
<je...@emtinc.net>; <sp...@incubator.apache.org>
Sent: Wednesday, February 18, 2004 4:59 PM
Subject: RE: [Suspected SPAM] Re: This doesn't get picked up
> Did you restart the SA daemon?
>
> -----Original Message-----
> From: Danie Marais [mailto:danie.marais@attix5.com]
> Sent: Wednesday, February 18, 2004 5:17 AM
> To: jennifer; spamassassin-users@incubator.apache.org
> Subject: [Suspected SPAM] Re: This doesn't get picked up
>
> Thanks for that, Jennifer
>
> I see how this is supposed to work, but I have placed the weeds.cf file
> in
> /etc/mail/spamassassin and made sure it has read access for everybody.
>
> I then ran
> spamassassin < mymessage.eml > result.txt
>
> And the rules were not applied. I have attached the message if you want
> to
> verify. Maybe it's just me being stupid, but my other rulesets like
> backhair and chickenpox applied in the same fashion work just fine.
>
> Danie
> ----- Original Message -----
> From: "jennifer" <je...@emtinc.net>
> To: "'Danie Marais'" <da...@attix5.com>;
> <sp...@incubator.apache.org>
> Sent: Tuesday, February 17, 2004 4:27 PM
> Subject: RE: This doesn't get picked up
>
>
> >
> > > Hi,
> > >
> > > I got a spam message yesterday with the following text
> > >
> > > "Discover the new winning sexual erection pill!
> > > This medication picks up where Viagra stops."
> > >
> > > But 'viagra' was not picked up. However, when I look at the
> > > message source
> > > I see this:
> > >
> > > <html>
> > > <body>
> > > Disco<eqkolpb>ver the n</nyvakro>ew winning
> > > sexual
> > >  erection pil
> > > l!<br>
> > > This
> > > medication pi
> > > cks
> > >  up where Via&#
> > > 103ra
> > >  stops.<br><br>
> > > Only $3 PER DOSE
> > > <br><br>
> > > <a
> > > href="http://www.cnbroastca
> > > st.com
> > > /c2/index.php?AFF_ID=&#
> > > 100m5&#
> > > 54">
> > > Get your free
> > >  prescriptio
> > > 0 NO&
> > > #87!</a>
> > > <br><br><br>
> > > .
> > > .
> > > .
> > >
> > >
> > >
> > >
> > > Is there a simple way of catching this apprach?
> >
> > The Weeds Set (not weeds2)
> >
> > http://www.emtinc.net/spamhammers.htm
> >
> > Jennifer
> >
> > >
> > > Danie Marais
> > >
> > >