<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1106" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><SPAN class=818494119-25052004><FONT face=Arial color=#0000ff
size=2>Rob,</FONT></SPAN></DIV>
<DIV><SPAN class=818494119-25052004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=818494119-25052004><FONT face=Arial color=#0000ff size=2>Check
out the Spamassassin Rules Emporium (SARE), <A
href="http://www.rulesemporium.com/">http://www.rulesemporium.com/</A></FONT></SPAN></DIV>
<DIV><SPAN class=818494119-25052004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=818494119-25052004><FONT face=Arial color=#0000ff size=2>The
antidrug.cf might be a good set of rules to implement. I use quite a few
of these rules. Usually to add them just download them then drop them in
/etc/mail/spamassassin/ which is the same location as your local.cf file.
I use local.cf quite a bit to add my custom rules.</FONT></SPAN></DIV>
<DIV><SPAN class=818494119-25052004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=818494119-25052004><FONT face=Arial color=#0000ff
size=2>Thanks,</FONT></SPAN></DIV>
<DIV><SPAN class=818494119-25052004><FONT face=Arial color=#0000ff
size=2>Chase</FONT></SPAN></DIV>
<BLOCKQUOTE>
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma
size=2>-----Original Message-----<BR><B>From:</B> Rob
[mailto:rob@THEHOSTMASTERS.COM]<BR><B>Sent:</B> Tuesday, May 25, 2004 3:06
PM<BR><B>To:</B> MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Re:
[MAILSCANNER] SPam getting through....<BR><BR></FONT></DIV>
<DIV><FONT face=Arial size=2>I just have these additions in the
/etc/Mailscanner/spam.assassin.prefs file</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>#Jan 15 2003<BR>#for all that habeas crap
vigra email crap!<BR>score HABEAS_SWE -3.0</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>#Jan 16 2003<BR>#for those emails with random
words in it....<BR>describe UDES_BUY01 Another buy
scam<BR>full UDES_BUY01 /Genierc and Sepur
Viarga|Cilais or \(Spuer Vagira\)|Genierc Virgaa/i<BR>score
UDES_BUY01 10</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>And i am using the bigevil file
too...</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Other than that , that's it....</FONT></DIV>
<DIV><BR>Rob....</DIV>
<DIV> </DIV>
<DIV><BR> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=Chase.Casanova@rdu.com
href="mailto:Chase.Casanova@rdu.com">Casanova, Chase</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=MAILSCANNER@JISCMAIL.AC.UK
href="mailto:MAILSCANNER@JISCMAIL.AC.UK">MAILSCANNER@JISCMAIL.AC.UK</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Tuesday, May 25, 2004 1:09
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: SPam getting
through....</DIV>
<DIV><BR></DIV>
<DIV><SPAN class=244170617-25052004><FONT face=Arial color=#0000ff
size=2>Rob,</FONT></SPAN></DIV>
<DIV><SPAN class=244170617-25052004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=244170617-25052004><FONT face=Arial color=#0000ff size=2>I
don't think that ou have to worry too much about timeouts if that is all
that you have for this month. MailScanner should have put a
Spamassassin Timeout message in the header had that been the case.
This one you're more likely dealing with a spamassassin rule problem or lack
of a rule that would have caught this spam. Are you using any rules
outside of the ones that installed with spamassassin?</FONT></SPAN></DIV>
<DIV><SPAN class=244170617-25052004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=244170617-25052004><FONT face=Arial color=#0000ff
size=2>-Chase</FONT></SPAN></DIV>
<BLOCKQUOTE>
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma
size=2>-----Original Message-----<BR><B>From:</B> Rob
[mailto:rob@THEHOSTMASTERS.COM]<BR><B>Sent:</B> Tuesday, May 25, 2004
12:49 PM<BR><B>To:</B> MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Re:
[MAILSCANNER] SPam getting through....<BR><BR></FONT></DIV>
<DIV><FONT face=Arial size=2>Since May 23 I have 635 of the
below....</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>May 25 12:38:01 mx3 MailScanner[22500]:
SpamAssassin timed out and was killed, consecutive failure 1 of 20 <BR>May
25 12:43:16 mx3 MailScanner[22495]: SpamAssassin timed out and was killed,
consecutive failure 1 of 20</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Anything I should be looking at..... I did
notice some in the past , but since it always said 1 of 20 rather than 10
or so of 20 I did not pay too much attention to it... does this mean line
in the log file that says this means that an email got
through?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Thanks..</FONT></DIV>
<DIV><BR>Rob....</DIV>
<DIV> </DIV>
<DIV><BR> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=damian@WORKGROUPSOLUTIONS.COM
href="mailto:damian@WORKGROUPSOLUTIONS.COM">Damian Mendoza</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A
title=MAILSCANNER@JISCMAIL.AC.UK
href="mailto:MAILSCANNER@JISCMAIL.AC.UK">MAILSCANNER@JISCMAIL.AC.UK</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Tuesday, May 25, 2004 12:00
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: SPam getting
through....</DIV>
<DIV><BR></DIV>
<DIV dir=ltr align=left><SPAN class=101100816-25052004><FONT face=Arial
color=#0000ff size=2>look for spamassassin timed out messages in the log
files</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=101100816-25052004><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=101100816-25052004><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=101100816-25052004><FONT face=Arial
color=#0000ff size=2>Damian</FONT></SPAN></DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> MailScanner mailing list
[mailto:MAILSCANNER@JISCMAIL.AC.UK] <B>On Behalf Of
</B>Rob<BR><B>Sent:</B> Tuesday, May 25, 2004 8:56 AM<BR><B>To:</B> <A
href="mailto:MAILSCANNER@JISCMAIL.AC.UK">MAILSCANNER@JISCMAIL.AC.UK</A><BR><B>Subject:</B>
SPam getting through....<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV><FONT face=Arial size=2>I seem to be getting allot of spam in the
last 2 weeks, here is an example of headers from a popular one... it
seems like it was not even scanned for spam or that mailscanner did not
see it as spam at all??</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I am using SA 2.63 and MS
4.28.6-1</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Any help appreciated....</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Thanks...</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Return-Path: <<A
href="mailto:unoalia@clickforadate.com">unoalia@clickforadate.com</A>><BR>Received:
from clickforadate.com ([222.65.41.83])<BR> by
localhost.localdomain (8.12.11/8.12.5) with SMTP id
i4P8klDQ013184;<BR> Tue, 25 May 2004 04:46:59 -0400<BR>Message-ID:
<<A
href="mailto:883e01c44248$5c25dbc0$38c986cf@unoalia">883e01c44248$5c25dbc0$38c986cf@unoalia</A>><BR>From:
"garrett lovato" <<A
href="mailto:unoalia@clickforadate.com">unoalia@clickforadate.com</A>><BR>To:
"adrian hurl" <<A
href="mailto:candi@stupidguytalk.org">candi@stupidguytalk.org</A>><BR>Cc:
"quinn alston" <<A
href="mailto:rob@stupidguytalk.org">rob@stupidguytalk.org</A>>,<BR>
"victor jacoby" <<A
href="mailto:adult-jokes@stupidguytalk.org">adult-jokes@stupidguytalk.org</A>><BR>Subject:
Ppbykdbg your prescripti0n source<BR>Date: Tue, 25 May 2004 01:06:42
-1000<BR>MIME-Version: 1.0<BR>Content-Type:
text/plain;<BR> charset="us-ascii"<BR>Content-Transfer-Encoding:
7bit<BR>X-MSMail-Priority: Normal<BR>X-Mailer: Microsoft Outlook Express
5.00.2919.6700<BR>X-MimeOLE: Produced By Microsoft MimeOLE
V5.00.2919.6700<BR>X-MailScanner-Information: Please contact <A
href="mailto:info@thehostmasters.com">info@thehostmasters.com</A> for
more info<BR>X-MailScanner: Found to be clean<BR>X-MailScanner-From: <A
href="mailto:unoalia@clickforadate.com">unoalia@clickforadate.com</A><BR>X-UIDL:
#,A"!RS)#!53("!>S+"!</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>hexdigtoint nrl-mag
nesheiwa </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV><FONT face=Arial size=2>
<DIV><BR>We are your your convenient, safe and private online source for
FDA<BR>a`p`p`roved pharmacy prescriptions. <BR></DIV>
<DIV> </DIV>
<DIV>---------------------------------------------------------------------------</DIV>
<DIV>the rest was cut, no need to see crude...</DIV></FONT><FONT
face=Arial size=2>
<DIV> </DIV>
<DIV><BR></FONT> </DIV>-------------------------- MailScanner list
----------------------<BR>To leave, send leave mailscanner to <A
href="mailto:jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A><BR>Before
posting, please see the Most Asked Questions at<BR><A
href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>
and the archives at<BR><A
href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A><BR>--------------------------
MailScanner list ----------------------<BR>To leave, send leave
mailscanner to <A
href="mailto:jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A><BR>Before
posting, please see the Most Asked Questions at<BR><A
href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>
and the archives at<BR><A
href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A><BR></BLOCKQUOTE>--------------------------
MailScanner list ----------------------<BR>To leave, send leave
mailscanner to <A
href="mailto:jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A><BR>Before
posting, please see the Most Asked Questions at<BR><A
href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>
and the archives at<BR><A
href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A><BR></BLOCKQUOTE>--------------------------
MailScanner list ----------------------<BR>To leave, send leave mailscanner
to <A
href="mailto:jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A><BR>Before
posting, please see the Most Asked Questions at<BR><A
href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>
and the archives at<BR><A
href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A><BR></BLOCKQUOTE>--------------------------
MailScanner list ----------------------<BR>To leave, send leave mailscanner to
<A href="mailto:jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A><BR>Before
posting, please see the Most Asked Questions at<BR><A
href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A> and
the archives at<BR><A
href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A><BR></BLOCKQUOTE></BODY></HTML>
-------------------------- MailScanner list ----------------------<br>
To leave, send leave mailscanner to <a href="mailto:jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a><br>
Before posting, please see the Most Asked Questions at<br>
<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a> and the archives at<br>
<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a><br>