[({Spam?})] RE: [({Spam?})] FH_DATE_PAST_20XX 3.38
dcurtis at sbschools.net
dcurtis at sbschools.net
Thu Jan 7 18:51:41 GMT 2010
Can't seem to catch one yet but just as an example I have
spam.assassin.prefs.conf setup with score MISSING_SUBJECT 0.00 and as
you see the output below it is ignoring this scoring also.
root at sbmail incoming]# cat D51536E64FD |spamassassin
[24866] warn: pyzor: check failed: internal error
Received: from localhost by sbmail.sbschools.net
with SpamAssassin (version 3.2.5);
Thu, 07 Jan 2010 13:48:16 -0500
Subject: [SPAM]
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
sbmail.sbschools.net
X-Spam-Level: *****************************************
X-Spam-Status: Yes, score=41.5 required=5.0 tests=FUZZY_VLIUM,HEAD_LONG,
J_BACKHAIR_12,J_CHICKENPOX_13,J_CHICKENPOX_14,J_CHICKENPOX_18,J_CHICKENP
OX_21,
J_CHICKENPOX_210,J_CHICKENPOX_23,J_CHICKENPOX_24,J_CHICKENPOX_25,
J_CHICKENPOX_26,J_CHICKENPOX_27,J_CHICKENPOX_31,J_CHICKENPOX_32,
J_CHICKENPOX_33,J_CHICKENPOX_34,J_CHICKENPOX_36,J_CHICKENPOX_37,
J_CHICKENPOX_41,J_CHICKENPOX_42,J_CHICKENPOX_43,J_CHICKENPOX_44,
J_CHICKENPOX_45,J_CHICKENPOX_51,J_CHICKENPOX_52,J_CHICKENPOX_55,
J_CHICKENPOX_61,J_CHICKENPOX_62,J_CHICKENPOX_63,J_CHICKENPOX_64,
J_CHICKENPOX_65,J_CHICKENPOX_71,J_CHICKENPOX_73,J_CHICKENPOX_82,
J_CHICKENPOX_83,J_CHICKENPOX_84,J_CHICKENPOX_92,MISSING_DATE,MISSING_HB_
SEP,
MISSING_HEADERS,MISSING_MID,MISSING_SUBJECT,NO_HEADERS_MESSAGE,NO_RECEIV
ED,
NO_RELAYS,NULL_IN_BODY,SARE_HTML_USL_OBFU,SARE_UNI,SARE_URI_EQUALS,
TVD_SPACE_RATIO,UNRESOLVED_TEMPLATE autolearn=disabled
version=3.2.5
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4B462C70.A88C41DD"
This is a multi-part message in MIME format.
------------=_4B462C70.A88C41DD
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "sbmail.sbschools.net",
has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: wireless">NGReading this on a mobile device? Try our
optimized
mobile version here:NL<a
href=3D"http://r.smartbrief.com/resp/tXiAdcxlksuRlyBoajcekIalFZkt">http:
=N<//r.smartbrief.com/resp/tXiAdcxlksuRlyBoajcekIalFZkt</a></p>NL<table
cellspacing=3D"0" cellpadding=3D"0" border=3D"0" width=3D"728"
id=3D=N "master">N<tr>NL<td><table
style=3D"border-bottom:2px solid #FFFFFF;" cellpadding=3D"0"
cel=N+lspacing=3D"0"
border=3D"0" width=3D"100%">N<tr>NL<td
style=3D"font-family:verdana;font-size:10px;font-weight:bold;text-trans=
NLform:uppercase;padding-left:5px;color:#666666;">January
7, 2010</td><td ali=N gn=3D"right">NL<table
style=3D"font-family:Verdana;text-transform:uppercase;font-size:10px=NE;
font-weight:bold;"
cellpadding=3D"0" cellspacing=3D"1" border=3D"0">N<tr>NL<td
class=3D"viral"
style=3D"padding:4px 13px 4px 13px;" bgcolor=3D"#23305d=NL"><a
target=3D"_blank"
href=3D"http://r.smartbrief.com/resp/tXiAdcxlksuRlzc=NLsajcekIalNtwj?for
mat=3Dstandard"style=3D"color:#FFFFFF;text-decoration:none=NL;"class=3D"
viral">Sign
up</a></td><td class=3D"viral" style=3D"padding:4px =NL13px 4px
13px;" bgcolor=3D"#23305d"><a
target=3D"_blank"
href=3D"http://r.s=NLmartbrief.com/resp/tXiAdcxlksuRlzfgajcekIalOdHC?for
mat=3Dstandard"style=3D"=NLcolor:#FFFFFF;text-decoration:none;"class=3D"
viral">Forward</a></td><td
cla=NLss=3D"viral" style=3D"padding:4px 13px 4px 13px;"
bgcolor=3D"#23305d"><a
ta=NLrget=3D"_blank"
href=3D"http://r.smartbrief.com/resp/tXiAdcxlksuRlzhUajcekI=NLalQipD?for
mat=3Dstandard"style=3D"color:#FFFFFF;text-decoration:none;"class=NL=3D"
viral">Archive</a></td><td
class=3D"viral" style=3D"padding:4px 13px 4p=NLx 13px;"
bgcolor=3D"#23305d"><a
target=3D"_blank"
href=3D"http://r.smartbri=NLef.com/resp/tXiAdcxlksuRlzkIajcekIalTHwq?for
mat=3Dstandard"style=3D"color:#=N?FFFFFF;text-decoration:none;"class=3D"
viral">Advertise</a></td>N</tr></table>N</td>N</tr></table>NL<table
style=3D"border-top:1px solid #999999;border-bottom:1px solid
#99999=ND9;"
cellpadding=3D"0" cellspacing=3D"0" border=3D"0" [...]
Content analysis details: (41.5 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
0.0 MISSING_MID Missing Message-Id: header
0.0 MISSING_DATE Missing Date: header
3.3 UNRESOLVED_TEMPLATE Headers contain an unresolved template
-0.0 NO_RELAYS Informational: message was not relayed via
SMTP
2.5 MISSING_HB_SEP Missing blank line between message header
and body
2.5 HEAD_LONG Message headers are very long
1.6 MISSING_HEADERS Missing To: header
0.6 J_CHICKENPOX_65 BODY: 6alpha-pock-5alpha
0.6 J_CHICKENPOX_37 BODY: 3alpha-pock-7alpha
0.6 J_CHICKENPOX_32 BODY: 3alpha-pock-2alpha
0.6 J_CHICKENPOX_83 BODY: 8alpha-pock-3alpha
0.6 J_CHICKENPOX_41 BODY: 4alpha-pock-1alpha
0.6 J_CHICKENPOX_34 BODY: 3alpha-pock-4alpha
0.6 J_CHICKENPOX_92 BODY: 9alpha-pock-2alpha
0.6 J_CHICKENPOX_55 BODY: 5alpha-pock-5alpha
0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha
0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha
0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha
0.6 J_CHICKENPOX_18 BODY: 1alpha-pock-8alpha
0.6 J_CHICKENPOX_27 BODY: 2alpha-pock-7alpha
0.6 J_CHICKENPOX_33 BODY: 3alpha-pock-3alpha
0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha
0.6 J_CHICKENPOX_82 BODY: 8alpha-pock-2alpha
0.6 J_CHICKENPOX_25 BODY: 2alpha-pock-5alpha
0.6 J_CHICKENPOX_23 BODY: 2alpha-pock-3alpha
0.6 J_CHICKENPOX_14 BODY: 1alpha-pock-4alpha
0.6 J_CHICKENPOX_44 BODY: 4alpha-pock-4alpha
0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha
0.6 J_CHICKENPOX_21 BODY: 2alpha-pock-1alpha
0.6 J_CHICKENPOX_210 BODY: 2alpha-pock-10alpha
0.6 J_CHICKENPOX_51 BODY: 5alpha-pock-1alpha
0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha
0.6 J_CHICKENPOX_43 BODY: 4alpha-pock-3alpha
0.0 FUZZY_VLIUM BODY: Attempt to obfuscate words in spam
0.6 J_CHICKENPOX_36 BODY: 3alpha-pock-6alpha
0.6 J_CHICKENPOX_62 BODY: 6alpha-pock-2alpha
0.6 J_CHICKENPOX_52 BODY: 5alpha-pock-2alpha
0.6 J_CHICKENPOX_13 BODY: 1alpha-pock-3alpha
0.6 J_CHICKENPOX_24 BODY: 2alpha-pock-4alpha
0.6 J_CHICKENPOX_45 BODY: 4alpha-pock-5alpha
0.6 J_CHICKENPOX_84 BODY: 8alpha-pock-4alpha
0.6 J_CHICKENPOX_26 BODY: 2alpha-pock-6alpha
0.6 J_CHICKENPOX_31 BODY: 3alpha-pock-1alpha
1.7 SARE_URI_EQUALS URI: Trying to hide the real URL with IE
parsing bug
2.9 TVD_SPACE_RATIO BODY: TVD_SPACE_RATIO
0.6 SARE_UNI RAW: SARE_UNI
1.7 SARE_HTML_USL_OBFU RAW: Message body has very strange HTML
sequence
1.0 J_BACKHAIR_12 RAW: 1 alpha-tag-2 alpha
1.5 NULL_IN_BODY FULL: Message has NUL (ASCII 0) byte in
message
1.3 MISSING_SUBJECT Missing Subject: header
-0.0 NO_RECEIVED Informational: message has no Received
headers
0.0 NO_HEADERS_MESSAGE Message appears to be missing most RFC-822
headers
------------=_4B462C70.A88C41DD
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Steve
Campbell
Sent: Thursday, January 07, 2010 1:12 PM
To: MailScanner discussion
Subject: Re: [({Spam?})] FH_DATE_PAST_20XX 3.38
dcurtis at sbschools.net wrote:
> This is what I get with sa-compile
> [18553] info: generic: base extraction starting. this can take a
> while...
> [18553] info: generic: extracting from rules of type body_0
> 100%
>
[=======================================================================
>
========================================================================
> =================] 60.41 rules/sec 00m27s DONE
> 100%
>
[=======================================================================
>
========================================================================
> =================] 98.06 bases/sec 00m29s DONE
> [18553] info: body_0: 2296 base strings extracted in 57 seconds
> [18553] info: generic: extracting from rules of type body_500
> 100%
>
[=======================================================================
>
========================================================================
> =================] 58.35 rules/sec 00m00s DONE
> 100%
>
[=======================================================================
>
========================================================================
> =================] 3300.00 bases/sec 00m00s DONE
> [18553] info: body_500: 2 base strings extracted in 0 seconds
> cd /tmp/.spamassassin18553wyuHD5tmp
> cd Mail-SpamAssassin-CompiledRegexps-body_0
> re2c -i -b -o scanner1.c scanner1.re
> Can't exec "re2c": No such file or directory at /usr/bin/sa-compile
line
> 287, <$fh> line 2935.
> command failed! at /usr/bin/sa-compile line 288, <$fh> line 2935
>
>
> Ran with sa-compile -D -p /etc/MailScanner/spam.assassin.pref.conf got
a
> ton more info but still failed with:
> cd /tmp/.spamassassin20497d8jsCxtmp
> cd Mail-SpamAssassin-CompiledRegexps-body_0
> re2c -i -b -o scanner1.c scanner1.re
> Can't exec "re2c": No such file or directory at /usr/bin/sa-compile
line
> 287, <$fh> line 2935.
> command failed! at /usr/bin/sa-compile line 288, <$fh> line 2935.
>
> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Doc
> Schneider
> Sent: Thursday, January 07, 2010 12:31 PM
> To: MailScanner discussion
> Subject: Re: [({Spam?})] FH_DATE_PAST_20XX 3.38
>
> dcurtis at sbschools.net wrote:
>
>> Deleted the cache file and still getting the 3.38 score.
>>
>
> run sa-compile since it sounds like you're running compiled rules.
>
>
>
I figured I'd check and see what's on my machine. I zeroed out the rule
in my spam.assassin.pref.conf file the other day and mine seems OK. The
funny thing is I checked for re2c on my machine, and I only see the
header rpm file from rpmforge, but no rpm is installed.
Just my pennies in case it matters or helps.
Steve Campbell
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!
______________________________________________________________
______________________________________________________________
This email may contain information protected under the Family
Educational Rights and Privacy Act (FERPA) or the Health Insurance
Portability and Accountability Act (HIPAA). If this email contains
confidential and/or privileged health or student information and you
are not entitled to access such information under FERPA or HIPAA,
federal regulations require that you destroy this email without
reviewing it and you may not forward it to anyone.
--
This message has been scanned for viruses and
dangerous content by MailScanner, ClamAV and Bitdefender and is
believed to be clean.
More information about the MailScanner
mailing list