[({Spam?})] RE: [({Spam?})] FH_DATE_PAST_20XX 3.38

dcurtis at sbschools.net dcurtis at sbschools.net
Thu Jan 7 18:51:41 GMT 2010


Can't seem to catch one yet but just as an example I have
spam.assassin.prefs.conf setup with score MISSING_SUBJECT 0.00 and as
you see the output below it is ignoring this scoring also.


root at sbmail incoming]# cat D51536E64FD |spamassassin
[24866] warn: pyzor: check failed: internal error
Received: from localhost by sbmail.sbschools.net
	with SpamAssassin (version 3.2.5);
	Thu, 07 Jan 2010 13:48:16 -0500
Subject: [SPAM] 
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
sbmail.sbschools.net
X-Spam-Level: *****************************************
X-Spam-Status: Yes, score=41.5 required=5.0 tests=FUZZY_VLIUM,HEAD_LONG,
	
J_BACKHAIR_12,J_CHICKENPOX_13,J_CHICKENPOX_14,J_CHICKENPOX_18,J_CHICKENP
OX_21,
	
J_CHICKENPOX_210,J_CHICKENPOX_23,J_CHICKENPOX_24,J_CHICKENPOX_25,
	J_CHICKENPOX_26,J_CHICKENPOX_27,J_CHICKENPOX_31,J_CHICKENPOX_32,
	J_CHICKENPOX_33,J_CHICKENPOX_34,J_CHICKENPOX_36,J_CHICKENPOX_37,
	J_CHICKENPOX_41,J_CHICKENPOX_42,J_CHICKENPOX_43,J_CHICKENPOX_44,
	J_CHICKENPOX_45,J_CHICKENPOX_51,J_CHICKENPOX_52,J_CHICKENPOX_55,
	J_CHICKENPOX_61,J_CHICKENPOX_62,J_CHICKENPOX_63,J_CHICKENPOX_64,
	J_CHICKENPOX_65,J_CHICKENPOX_71,J_CHICKENPOX_73,J_CHICKENPOX_82,
	
J_CHICKENPOX_83,J_CHICKENPOX_84,J_CHICKENPOX_92,MISSING_DATE,MISSING_HB_
SEP,
	
MISSING_HEADERS,MISSING_MID,MISSING_SUBJECT,NO_HEADERS_MESSAGE,NO_RECEIV
ED,
	
NO_RELAYS,NULL_IN_BODY,SARE_HTML_USL_OBFU,SARE_UNI,SARE_URI_EQUALS,
	TVD_SPACE_RATIO,UNRESOLVED_TEMPLATE autolearn=disabled
version=3.2.5
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4B462C70.A88C41DD"

This is a multi-part message in MIME format.

------------=_4B462C70.A88C41DD
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

Spam detection software, running on the system "sbmail.sbschools.net",
has
identified this incoming email as possible spam.  The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email.  If you have any questions, see
the administrator of that system for details.

Content preview:  wireless">NGReading this on a mobile device? Try our
optimized
   mobile version here:NL<a
href=3D"http://r.smartbrief.com/resp/tXiAdcxlksuRlyBoajcekIalFZkt">http:
=N<//r.smartbrief.com/resp/tXiAdcxlksuRlyBoajcekIalFZkt</a></p>NL<table
   cellspacing=3D"0" cellpadding=3D"0" border=3D"0" width=3D"728"
id=3D=N "master">N<tr>NL<td><table
   style=3D"border-bottom:2px solid #FFFFFF;" cellpadding=3D"0"
cel=N+lspacing=3D"0"
   border=3D"0" width=3D"100%">N<tr>NL<td
style=3D"font-family:verdana;font-size:10px;font-weight:bold;text-trans=
NLform:uppercase;padding-left:5px;color:#666666;">January
   7, 2010</td><td ali=N gn=3D"right">NL<table
style=3D"font-family:Verdana;text-transform:uppercase;font-size:10px=NE;
font-weight:bold;"
   cellpadding=3D"0" cellspacing=3D"1" border=3D"0">N<tr>NL<td
class=3D"viral"
   style=3D"padding:4px 13px 4px 13px;" bgcolor=3D"#23305d=NL"><a
target=3D"_blank"
 
href=3D"http://r.smartbrief.com/resp/tXiAdcxlksuRlzc=NLsajcekIalNtwj?for
mat=3Dstandard"style=3D"color:#FFFFFF;text-decoration:none=NL;"class=3D"
viral">Sign
   up</a></td><td class=3D"viral" style=3D"padding:4px =NL13px 4px
13px;" bgcolor=3D"#23305d"><a
   target=3D"_blank"
href=3D"http://r.s=NLmartbrief.com/resp/tXiAdcxlksuRlzfgajcekIalOdHC?for
mat=3Dstandard"style=3D"=NLcolor:#FFFFFF;text-decoration:none;"class=3D"
viral">Forward</a></td><td
   cla=NLss=3D"viral" style=3D"padding:4px 13px 4px 13px;"
bgcolor=3D"#23305d"><a
   ta=NLrget=3D"_blank"
href=3D"http://r.smartbrief.com/resp/tXiAdcxlksuRlzhUajcekI=NLalQipD?for
mat=3Dstandard"style=3D"color:#FFFFFF;text-decoration:none;"class=NL=3D"
viral">Archive</a></td><td
   class=3D"viral" style=3D"padding:4px 13px 4p=NLx 13px;"
bgcolor=3D"#23305d"><a
   target=3D"_blank"
href=3D"http://r.smartbri=NLef.com/resp/tXiAdcxlksuRlzkIajcekIalTHwq?for
mat=3Dstandard"style=3D"color:#=N?FFFFFF;text-decoration:none;"class=3D"
viral">Advertise</a></td>N</tr></table>N</td>N</tr></table>NL<table
   style=3D"border-top:1px solid #999999;border-bottom:1px solid
#99999=ND9;"
   cellpadding=3D"0" cellspacing=3D"0" border=3D"0" [...] 

Content analysis details:   (41.5 points, 5.0 required)

 pts rule name              description
---- ----------------------
--------------------------------------------------
 0.0 MISSING_MID            Missing Message-Id: header
 0.0 MISSING_DATE           Missing Date: header
 3.3 UNRESOLVED_TEMPLATE    Headers contain an unresolved template
-0.0 NO_RELAYS              Informational: message was not relayed via
SMTP
 2.5 MISSING_HB_SEP         Missing blank line between message header
and body
 2.5 HEAD_LONG              Message headers are very long
 1.6 MISSING_HEADERS        Missing To: header
 0.6 J_CHICKENPOX_65        BODY: 6alpha-pock-5alpha
 0.6 J_CHICKENPOX_37        BODY: 3alpha-pock-7alpha
 0.6 J_CHICKENPOX_32        BODY: 3alpha-pock-2alpha
 0.6 J_CHICKENPOX_83        BODY: 8alpha-pock-3alpha
 0.6 J_CHICKENPOX_41        BODY: 4alpha-pock-1alpha
 0.6 J_CHICKENPOX_34        BODY: 3alpha-pock-4alpha
 0.6 J_CHICKENPOX_92        BODY: 9alpha-pock-2alpha
 0.6 J_CHICKENPOX_55        BODY: 5alpha-pock-5alpha
 0.6 J_CHICKENPOX_63        BODY: 6alpha-pock-3alpha
 0.6 J_CHICKENPOX_61        BODY: 6alpha-pock-1alpha
 0.6 J_CHICKENPOX_42        BODY: 4alpha-pock-2alpha
 0.6 J_CHICKENPOX_18        BODY: 1alpha-pock-8alpha
 0.6 J_CHICKENPOX_27        BODY: 2alpha-pock-7alpha
 0.6 J_CHICKENPOX_33        BODY: 3alpha-pock-3alpha
 0.6 J_CHICKENPOX_71        BODY: 7alpha-pock-1alpha
 0.6 J_CHICKENPOX_82        BODY: 8alpha-pock-2alpha
 0.6 J_CHICKENPOX_25        BODY: 2alpha-pock-5alpha
 0.6 J_CHICKENPOX_23        BODY: 2alpha-pock-3alpha
 0.6 J_CHICKENPOX_14        BODY: 1alpha-pock-4alpha
 0.6 J_CHICKENPOX_44        BODY: 4alpha-pock-4alpha
 0.6 J_CHICKENPOX_73        BODY: 7alpha-pock-3alpha
 0.6 J_CHICKENPOX_21        BODY: 2alpha-pock-1alpha
 0.6 J_CHICKENPOX_210       BODY: 2alpha-pock-10alpha
 0.6 J_CHICKENPOX_51        BODY: 5alpha-pock-1alpha
 0.6 J_CHICKENPOX_64        BODY: 6alpha-pock-4alpha
 0.6 J_CHICKENPOX_43        BODY: 4alpha-pock-3alpha
 0.0 FUZZY_VLIUM            BODY: Attempt to obfuscate words in spam
 0.6 J_CHICKENPOX_36        BODY: 3alpha-pock-6alpha
 0.6 J_CHICKENPOX_62        BODY: 6alpha-pock-2alpha
 0.6 J_CHICKENPOX_52        BODY: 5alpha-pock-2alpha
 0.6 J_CHICKENPOX_13        BODY: 1alpha-pock-3alpha
 0.6 J_CHICKENPOX_24        BODY: 2alpha-pock-4alpha
 0.6 J_CHICKENPOX_45        BODY: 4alpha-pock-5alpha
 0.6 J_CHICKENPOX_84        BODY: 8alpha-pock-4alpha
 0.6 J_CHICKENPOX_26        BODY: 2alpha-pock-6alpha
 0.6 J_CHICKENPOX_31        BODY: 3alpha-pock-1alpha
 1.7 SARE_URI_EQUALS        URI: Trying to hide the real URL with IE
parsing bug
 2.9 TVD_SPACE_RATIO        BODY: TVD_SPACE_RATIO
 0.6 SARE_UNI               RAW: SARE_UNI
 1.7 SARE_HTML_USL_OBFU     RAW: Message body has very strange HTML
sequence
 1.0 J_BACKHAIR_12          RAW: 1 alpha-tag-2 alpha
 1.5 NULL_IN_BODY           FULL: Message has NUL (ASCII 0) byte in
message
 1.3 MISSING_SUBJECT        Missing Subject: header
-0.0 NO_RECEIVED            Informational: message has no Received
headers
 0.0 NO_HEADERS_MESSAGE     Message appears to be missing most RFC-822
headers



------------=_4B462C70.A88C41DD
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Steve
Campbell
Sent: Thursday, January 07, 2010 1:12 PM
To: MailScanner discussion
Subject: Re: [({Spam?})] FH_DATE_PAST_20XX 3.38



dcurtis at sbschools.net wrote:
> This is what I get with sa-compile
> [18553] info: generic: base extraction starting. this can take a
> while...
> [18553] info: generic: extracting from rules of type body_0
> 100%
>
[=======================================================================
>
========================================================================
> =================]  60.41 rules/sec 00m27s DONE
> 100%
>
[=======================================================================
>
========================================================================
> =================]  98.06 bases/sec 00m29s DONE
> [18553] info: body_0: 2296 base strings extracted in 57 seconds
> [18553] info: generic: extracting from rules of type body_500
> 100%
>
[=======================================================================
>
========================================================================
> =================]  58.35 rules/sec 00m00s DONE
> 100%
>
[=======================================================================
>
========================================================================
> =================] 3300.00 bases/sec 00m00s DONE
> [18553] info: body_500: 2 base strings extracted in 0 seconds
> cd /tmp/.spamassassin18553wyuHD5tmp
> cd Mail-SpamAssassin-CompiledRegexps-body_0
> re2c -i -b -o scanner1.c scanner1.re
> Can't exec "re2c": No such file or directory at /usr/bin/sa-compile
line
> 287, <$fh> line 2935.
> command failed! at /usr/bin/sa-compile line 288, <$fh> line 2935
>
>
> Ran with sa-compile -D -p /etc/MailScanner/spam.assassin.pref.conf got
a
> ton more info but still failed with:
> cd /tmp/.spamassassin20497d8jsCxtmp
> cd Mail-SpamAssassin-CompiledRegexps-body_0
> re2c -i -b -o scanner1.c scanner1.re
> Can't exec "re2c": No such file or directory at /usr/bin/sa-compile
line
> 287, <$fh> line 2935.
> command failed! at /usr/bin/sa-compile line 288, <$fh> line 2935.
>
> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Doc
> Schneider
> Sent: Thursday, January 07, 2010 12:31 PM
> To: MailScanner discussion
> Subject: Re: [({Spam?})] FH_DATE_PAST_20XX 3.38
>
> dcurtis at sbschools.net wrote:
>   
>> Deleted the cache file and still getting the 3.38 score.
>>     
>
> run sa-compile since it sounds like you're running compiled rules.
>
>
>   
I figured I'd check and see what's on my machine. I zeroed out the rule 
in my spam.assassin.pref.conf file the other day and mine seems OK. The 
funny thing is I checked for re2c on my machine, and I only see the 
header rpm file from rpmforge, but no rpm is installed.

Just my pennies in case it matters or helps.

Steve Campbell

-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

______________________________________________________________
______________________________________________________________
This email may contain information protected under the Family 
Educational Rights and Privacy Act (FERPA) or the Health Insurance 
Portability and Accountability Act (HIPAA).  If this email contains 
confidential and/or privileged health or student information and you 
are not entitled to access such information under FERPA or HIPAA, 
federal regulations require that you destroy this email without 
reviewing it and you may not forward it to anyone.


--
This message has been scanned for viruses and
dangerous content by MailScanner, ClamAV and Bitdefender  and is
believed to be clean.



More information about the MailScanner mailing list