Advanced
Mailing List Archive

Mailing List Archive

  1. Home >
  2. SpamAssassin>
  3. users
This doesn't get picked up
danie.marais at attix5
Feb 17, 2004, 12:26 AM
Post #1 of 9 (1215 views)
Permalink
Hi,

I got a spam message yesterday with the following text

"Discover the new winning sexual erection pill!
This medication picks up where Viagra stops."

But 'viagra' was not picked up. However, when I look at the message source
I see this:

<html>
<body>
Disco<eqkolpb>ver the n</nyvakro>ew winning &#115&#101&#120&#117&#97&#108
&#32&#101&#114&#101&#99&#116&#105&#111&#110&#32&#112&#105&#108&#108!<br>
This
&#109&#101&#100&#105&#99&#97&#116&#105&#111&#110&#32&#112&#105&#99&#107&#115
&#32&#117&#112&#32&#119&#104&#101&#114&#101&#32&#86&#105&#97&#103&#114&#97
&#32&#115&#116&#111&#112&#115.<br><br>
&#79&#110&#108&#121&#32&#36&#51&#32&#80&#69&#82&#32&#68&#79&#83&#69
<br><br>
<a
href="http://www.&#99&#110&#98&#114&#111&#97&#115&#116&#99&#97&#115&#116.com
/c2/index&#46&#112&#104&#112&#63&#65&#70&#70&#95&#73&#68&#61&#100&#109&#53&#
54">
&#71&#101&#116&#32&#121&#111&#117&#114&#32&#102&#114&#101&#101
&#32&#112&#114&#101&#115&#99&#114&#105&#112&#116&#105&#111&#110&#32&#78&#79&
#87&#33</a>
<br><br><br>
.
.
.




Is there a simple way of catching this apprach?

Danie Marais
RE: This doesn't get picked up [ In reply to ]
gary at primeexalia
Feb 17, 2004, 12:50 AM
Post #2 of 9 (1202 views)
Permalink
A little light but mine marked it as spam. I use a default 4.5 instead
of 5 for this server. But the only reason it was pushed over the edge
was because of Jennifer's blackhair list. I'm thinking of raising the
value for the LOCAL_DRUGS_MALDYSFUNCTION_OBFU up some though to see what
the impact might be. The only thing that I've seen hit that rule has
been spam.

X-Spam-Status: Yes, hits=4.6 required=4.5 tests=HTML_50_60,HTML_MESSAGE,

HTTP_ENTITIES_HOST,J_BACKHAIR_12,LOCAL_DRUGS_MALDYSFUNCTION_OBFU,
LOCAL_DRUGS_MALEDYSFUNCTION autolearn=no version=2.63
X-Spam-Report:
* 0.1 HTML_MESSAGE BODY: HTML included in message
* 0.1 HTML_50_60 BODY: Message is 50% to 60% HTML
* 1.0 J_BACKHAIR_12 BODY: 1 letters - Unsightly html tag - 2
letters
* 1.9 HTTP_ENTITIES_HOST URI: URI obscured with character
entities
* 0.5 LOCAL_DRUGS_MALDYSFUNCTION_OBFU
LOCAL_DRUGS_MALDYSFUNCTION_OBFU
* 1.0 LOCAL_DRUGS_MALEDYSFUNCTION LOCAL_DRUGS_MALEDYSFUNCTION


Just my feedback,


Gary Wayne Smith


-----Original Message-----
From: Danie Marais [mailto:danie.marais@attix5.com]
Sent: Monday, February 16, 2004 11:27 PM
To: spamassassin-users@incubator.apache.org
Subject: [Suspected SPAM] This doesn't get picked up
RE: This doesn't get picked up [ In reply to ]
andrew at bluetongue
Feb 17, 2004, 7:19 AM
Post #3 of 9 (1204 views)
Permalink
There are a number of ways to check this - I received the same email and
it was picked up today using the weeds.cf from

http://www.emtinc.net/includes/weeds.cf

More information is at http://www.emtinc.net/spamhammers.htm

I recommend using backhair.cf, weeds.cf and chickenpox.cf - these have
assisted us greatly just even having installed these today - stops a lot
of the funky html tag comments :-)

Andrew

> -----Original Message-----
> From: Danie Marais [mailto:danie.marais@attix5.com]
> Sent: Tuesday, 17 February 2004 6:27 PM
> To: spamassassin-users@incubator.apache.org
> Subject: This doesn't get picked up
>
>
> Hi,
>
> I got a spam message yesterday with the following text
>
> "Discover the new winning sexual erection pill!
> This medication picks up where Viagra stops."
>
> But 'viagra' was not picked up. However, when I look at the
> message source I see this:
>
> <html>
> <body>
> Disco<eqkolpb>ver the n</nyvakro>ew winning
> &#115&#101&#120&#117&#97&#108
> &#32&#101&#114&#101&#99&#116&#105&#111&#110&#32&#112&#105&#108
> &#108!<br>
> This
> &#109&#101&#100&#105&#99&#97&#116&#105&#111&#110&#32&#112&#105
> &#99&#107&#115
> &#32&#117&#112&#32&#119&#104&#101&#114&#101&#32&#86&#105&#97&#
> 103&#114&#97
> &#32&#115&#116&#111&#112&#115.<br><br>
> &#79&#110&#108&#121&#32&#36&#51&#32&#80&#69&#82&#32&#68&#79&#83&#69
> <br><br>
> <a
> href="http://www.&#99&#110&#98&#114&#111&#97&#115&#116&#99&#97
> &#115&#116.com
> /c2/index&#46&#112&#104&#112&#63&#65&#70&#70&#95&#73&#68&#61&#
> 100&#109&#53&#
> 54"> &#71&#101&#116&#32&#121&#111&#117&#114&#32&#102&#114&#101&#101
> &#32&#112&#114&#101&#115&#99&#114&#105&#112&#116&#105&#111&#11
> 0&#32&#78&#79&
> #87&#33</a>
> <br><br><br>
> .
> .
> .
>
>
>
>
> Is there a simple way of catching this apprach?
>
> Danie Marais
>

Attached Files:

RE: This doesn't get picked up [ In reply to ]
jennifer at emtinc
Feb 17, 2004, 7:27 AM
Post #4 of 9 (1198 views)
Permalink
> Hi,
>
> I got a spam message yesterday with the following text
>
> "Discover the new winning sexual erection pill!
> This medication picks up where Viagra stops."
>
> But 'viagra' was not picked up. However, when I look at the
> message source
> I see this:
>
> <html>
> <body>
> Disco<eqkolpb>ver the n</nyvakro>ew winning
> &#115&#101&#120&#117&#97&#108
> &#32&#101&#114&#101&#99&#116&#105&#111&#110&#32&#112&#105&#108
> &#108!<br>
> This
> &#109&#101&#100&#105&#99&#97&#116&#105&#111&#110&#32&#112&#105
> &#99&#107&#115
> &#32&#117&#112&#32&#119&#104&#101&#114&#101&#32&#86&#105&#97&#
> 103&#114&#97
> &#32&#115&#116&#111&#112&#115.<br><br>
> &#79&#110&#108&#121&#32&#36&#51&#32&#80&#69&#82&#32&#68&#79&#83&#69
> <br><br>
> <a
> href="http://www.&#99&#110&#98&#114&#111&#97&#115&#116&#99&#97
> &#115&#116.com
> /c2/index&#46&#112&#104&#112&#63&#65&#70&#70&#95&#73&#68&#61&#
> 100&#109&#53&#
> 54">
> &#71&#101&#116&#32&#121&#111&#117&#114&#32&#102&#114&#101&#101
> &#32&#112&#114&#101&#115&#99&#114&#105&#112&#116&#105&#111&#11
> 0&#32&#78&#79&
> #87&#33</a>
> <br><br><br>
> .
> .
> .
>
>
>
>
> Is there a simple way of catching this apprach?

The Weeds Set (not weeds2)

http://www.emtinc.net/spamhammers.htm

Jennifer

>
> Danie Marais
>
>
Re: This doesn't get picked up [ In reply to ]
danie.marais at attix5
Feb 18, 2004, 6:17 AM
Post #5 of 9 (1202 views)
Permalink
Thanks for that, Jennifer

I see how this is supposed to work, but I have placed the weeds.cf file in
/etc/mail/spamassassin and made sure it has read access for everybody.

I then ran
spamassassin < mymessage.eml > result.txt

And the rules were not applied. I have attached the message if you want to
verify. Maybe it's just me being stupid, but my other rulesets like
backhair and chickenpox applied in the same fashion work just fine.

Danie
----- Original Message -----
From: "jennifer" <jennifer@emtinc.net>
To: "'Danie Marais'" <danie.marais@attix5.com>;
<spamassassin-users@incubator.apache.org>
Sent: Tuesday, February 17, 2004 4:27 PM
Subject: RE: This doesn't get picked up


>
> > Hi,
> >
> > I got a spam message yesterday with the following text
> >
> > "Discover the new winning sexual erection pill!
> > This medication picks up where Viagra stops."
> >
> > But 'viagra' was not picked up. However, when I look at the
> > message source
> > I see this:
> >
> > <html>
> > <body>
> > Disco<eqkolpb>ver the n</nyvakro>ew winning
> > &#115&#101&#120&#117&#97&#108
> > &#32&#101&#114&#101&#99&#116&#105&#111&#110&#32&#112&#105&#108
> > &#108!<br>
> > This
> > &#109&#101&#100&#105&#99&#97&#116&#105&#111&#110&#32&#112&#105
> > &#99&#107&#115
> > &#32&#117&#112&#32&#119&#104&#101&#114&#101&#32&#86&#105&#97&#
> > 103&#114&#97
> > &#32&#115&#116&#111&#112&#115.<br><br>
> > &#79&#110&#108&#121&#32&#36&#51&#32&#80&#69&#82&#32&#68&#79&#83&#69
> > <br><br>
> > <a
> > href="http://www.&#99&#110&#98&#114&#111&#97&#115&#116&#99&#97
> > &#115&#116.com
> > /c2/index&#46&#112&#104&#112&#63&#65&#70&#70&#95&#73&#68&#61&#
> > 100&#109&#53&#
> > 54">
> > &#71&#101&#116&#32&#121&#111&#117&#114&#32&#102&#114&#101&#101
> > &#32&#112&#114&#101&#115&#99&#114&#105&#112&#116&#105&#111&#11
> > 0&#32&#78&#79&
> > #87&#33</a>
> > <br><br><br>
> > .
> > .
> > .
> >
> >
> >
> >
> > Is there a simple way of catching this apprach?
>
> The Weeds Set (not weeds2)
>
> http://www.emtinc.net/spamhammers.htm
>
> Jennifer
>
> >
> > Danie Marais
> >
> >

Attached Files:

Re: This doesn't get picked up [ In reply to ]
danie.marais at attix5
Feb 18, 2004, 8:34 AM
Post #6 of 9 (1199 views)
Permalink
Yes, I did restart the daemon. I checked using spamassassin, not spamc
anyway, so restart of the daemon is not necessary.

However, I modified the rules a bit. Seems that when you remove the ';'
from the rules it works. I didn't see any ;'s in the mail that was slipping
through.

Perhaps that was the problem?

Regards,
Danie Marais
----- Original Message -----
From: "Gary Smith" <gary@primeexalia.com>
To: "Danie Marais" <danie.marais@attix5.com>; "jennifer"
<jennifer@emtinc.net>; <spamassassin-users@incubator.apache.org>
Sent: Wednesday, February 18, 2004 4:59 PM
Subject: RE: [Suspected SPAM] Re: This doesn't get picked up


> Did you restart the SA daemon?
>
> -----Original Message-----
> From: Danie Marais [mailto:danie.marais@attix5.com]
> Sent: Wednesday, February 18, 2004 5:17 AM
> To: jennifer; spamassassin-users@incubator.apache.org
> Subject: [Suspected SPAM] Re: This doesn't get picked up
>
> Thanks for that, Jennifer
>
> I see how this is supposed to work, but I have placed the weeds.cf file
> in
> /etc/mail/spamassassin and made sure it has read access for everybody.
>
> I then ran
> spamassassin < mymessage.eml > result.txt
>
> And the rules were not applied. I have attached the message if you want
> to
> verify. Maybe it's just me being stupid, but my other rulesets like
> backhair and chickenpox applied in the same fashion work just fine.
>
> Danie
> ----- Original Message -----
> From: "jennifer" <jennifer@emtinc.net>
> To: "'Danie Marais'" <danie.marais@attix5.com>;
> <spamassassin-users@incubator.apache.org>
> Sent: Tuesday, February 17, 2004 4:27 PM
> Subject: RE: This doesn't get picked up
>
>
> >
> > > Hi,
> > >
> > > I got a spam message yesterday with the following text
> > >
> > > "Discover the new winning sexual erection pill!
> > > This medication picks up where Viagra stops."
> > >
> > > But 'viagra' was not picked up. However, when I look at the
> > > message source
> > > I see this:
> > >
> > > <html>
> > > <body>
> > > Disco<eqkolpb>ver the n</nyvakro>ew winning
> > > &#115&#101&#120&#117&#97&#108
> > > &#32&#101&#114&#101&#99&#116&#105&#111&#110&#32&#112&#105&#108
> > > &#108!<br>
> > > This
> > > &#109&#101&#100&#105&#99&#97&#116&#105&#111&#110&#32&#112&#105
> > > &#99&#107&#115
> > > &#32&#117&#112&#32&#119&#104&#101&#114&#101&#32&#86&#105&#97&#
> > > 103&#114&#97
> > > &#32&#115&#116&#111&#112&#115.<br><br>
> > > &#79&#110&#108&#121&#32&#36&#51&#32&#80&#69&#82&#32&#68&#79&#83&#69
> > > <br><br>
> > > <a
> > > href="http://www.&#99&#110&#98&#114&#111&#97&#115&#116&#99&#97
> > > &#115&#116.com
> > > /c2/index&#46&#112&#104&#112&#63&#65&#70&#70&#95&#73&#68&#61&#
> > > 100&#109&#53&#
> > > 54">
> > > &#71&#101&#116&#32&#121&#111&#117&#114&#32&#102&#114&#101&#101
> > > &#32&#112&#114&#101&#115&#99&#114&#105&#112&#116&#105&#111&#11
> > > 0&#32&#78&#79&
> > > #87&#33</a>
> > > <br><br><br>
> > > .
> > > .
> > > .
> > >
> > >
> > >
> > >
> > > Is there a simple way of catching this apprach?
> >
> > The Weeds Set (not weeds2)
> >
> > http://www.emtinc.net/spamhammers.htm
> >
> > Jennifer
> >
> > >
> > > Danie Marais
> > >
> > >
RE: This doesn't get picked up [ In reply to ]
jennifer at emtinc
Feb 18, 2004, 9:05 AM
Post #7 of 9 (1195 views)
Permalink
>
> Yes, I did restart the daemon. I checked using spamassassin,
> not spamc
> anyway, so restart of the daemon is not necessary.
>
> However, I modified the rules a bit. Seems that when you
> remove the ';'
> from the rules it works. I didn't see any ;'s in the mail
> that was slipping
> through.
>
> Perhaps that was the problem?

yes, that was the problem, Danie. Don't remove the ";", make them
optional. (at least that is what i would suggest, so that it still
catches the other form as well.) I'll do the same for the distribution
set.

thanks,
Jennifer

>
> Regards,
> Danie Marais
> ----- Original Message -----
> From: "Gary Smith" <gary@primeexalia.com>
> To: "Danie Marais" <danie.marais@attix5.com>; "jennifer"
> <jennifer@emtinc.net>; <spamassassin-users@incubator.apache.org>
> Sent: Wednesday, February 18, 2004 4:59 PM
> Subject: RE: [Suspected SPAM] Re: This doesn't get picked up
>
>
> > Did you restart the SA daemon?
> >
> > -----Original Message-----
> > From: Danie Marais [mailto:danie.marais@attix5.com]
> > Sent: Wednesday, February 18, 2004 5:17 AM
> > To: jennifer; spamassassin-users@incubator.apache.org
> > Subject: [Suspected SPAM] Re: This doesn't get picked up
> >
> > Thanks for that, Jennifer
> >
> > I see how this is supposed to work, but I have placed the
> weeds.cf file
> > in
> > /etc/mail/spamassassin and made sure it has read access for
> everybody.
> >
> > I then ran
> > spamassassin < mymessage.eml > result.txt
> >
> > And the rules were not applied. I have attached the
> message if you want
> > to
> > verify. Maybe it's just me being stupid, but my other rulesets like
> > backhair and chickenpox applied in the same fashion work just fine.
> >
> > Danie
> > ----- Original Message -----
> > From: "jennifer" <jennifer@emtinc.net>
> > To: "'Danie Marais'" <danie.marais@attix5.com>;
> > <spamassassin-users@incubator.apache.org>
> > Sent: Tuesday, February 17, 2004 4:27 PM
> > Subject: RE: This doesn't get picked up
> >
> >
> > >
> > > > Hi,
> > > >
> > > > I got a spam message yesterday with the following text
> > > >
> > > > "Discover the new winning sexual erection pill!
> > > > This medication picks up where Viagra stops."
> > > >
> > > > But 'viagra' was not picked up. However, when I look at the
> > > > message source
> > > > I see this:
> > > >
> > > > <html>
> > > > <body>
> > > > Disco<eqkolpb>ver the n</nyvakro>ew winning
> > > > &#115&#101&#120&#117&#97&#108
> > > > &#32&#101&#114&#101&#99&#116&#105&#111&#110&#32&#112&#105&#108
> > > > &#108!<br>
> > > > This
> > > > &#109&#101&#100&#105&#99&#97&#116&#105&#111&#110&#32&#112&#105
> > > > &#99&#107&#115
> > > > &#32&#117&#112&#32&#119&#104&#101&#114&#101&#32&#86&#105&#97&#
> > > > 103&#114&#97
> > > > &#32&#115&#116&#111&#112&#115.<br><br>
> > > >
> &#79&#110&#108&#121&#32&#36&#51&#32&#80&#69&#82&#32&#68&#79&#83&#69
> > > > <br><br>
> > > > <a
> > > > href="http://www.&#99&#110&#98&#114&#111&#97&#115&#116&#99&#97
> > > > &#115&#116.com
> > > > /c2/index&#46&#112&#104&#112&#63&#65&#70&#70&#95&#73&#68&#61&#
> > > > 100&#109&#53&#
> > > > 54">
> > > > &#71&#101&#116&#32&#121&#111&#117&#114&#32&#102&#114&#101&#101
> > > > &#32&#112&#114&#101&#115&#99&#114&#105&#112&#116&#105&#111&#11
> > > > 0&#32&#78&#79&
> > > > #87&#33</a>
> > > > <br><br><br>
> > > > .
> > > > .
> > > > .
> > > >
> > > >
> > > >
> > > >
> > > > Is there a simple way of catching this apprach?
> > >
> > > The Weeds Set (not weeds2)
> > >
> > > http://www.emtinc.net/spamhammers.htm
> > >
> > > Jennifer
> > >
> > > >
> > > > Danie Marais
> > > >
> > > >
>
>
Re: This doesn't get picked up [ In reply to ]
danie.marais at attix5
Feb 18, 2004, 9:11 AM
Post #8 of 9 (1201 views)
Permalink
I though about making it optional, but it is at the end of the text it
checks for. It is like saying
"match rule X and then there can be a ; at the end or not"
I'd rather just say
"match rule X"

Regards,

Danie Marais
CTO, Attix5
danie.marais@attix5.com
www.attix5.com
+27 21 880 2323 (Tel)
+27 21 880 2324 (Fax)
----- Original Message -----
From: "jennifer" <jennifer@emtinc.net>
To: "'Danie Marais'" <danie.marais@attix5.com>; "'Gary Smith'"
<gary@primeexalia.com>; <spamassassin-users@incubator.apache.org>
Sent: Wednesday, February 18, 2004 6:05 PM
Subject: RE: This doesn't get picked up


>
> >
> > Yes, I did restart the daemon. I checked using spamassassin,
> > not spamc
> > anyway, so restart of the daemon is not necessary.
> >
> > However, I modified the rules a bit. Seems that when you
> > remove the ';'
> > from the rules it works. I didn't see any ;'s in the mail
> > that was slipping
> > through.
> >
> > Perhaps that was the problem?
>
> yes, that was the problem, Danie. Don't remove the ";", make them
> optional. (at least that is what i would suggest, so that it still
> catches the other form as well.) I'll do the same for the distribution
> set.
>
> thanks,
> Jennifer
>
> >
> > Regards,
> > Danie Marais
> > ----- Original Message -----
> > From: "Gary Smith" <gary@primeexalia.com>
> > To: "Danie Marais" <danie.marais@attix5.com>; "jennifer"
> > <jennifer@emtinc.net>; <spamassassin-users@incubator.apache.org>
> > Sent: Wednesday, February 18, 2004 4:59 PM
> > Subject: RE: [Suspected SPAM] Re: This doesn't get picked up
> >
> >
> > > Did you restart the SA daemon?
> > >
> > > -----Original Message-----
> > > From: Danie Marais [mailto:danie.marais@attix5.com]
> > > Sent: Wednesday, February 18, 2004 5:17 AM
> > > To: jennifer; spamassassin-users@incubator.apache.org
> > > Subject: [Suspected SPAM] Re: This doesn't get picked up
> > >
> > > Thanks for that, Jennifer
> > >
> > > I see how this is supposed to work, but I have placed the
> > weeds.cf file
> > > in
> > > /etc/mail/spamassassin and made sure it has read access for
> > everybody.
> > >
> > > I then ran
> > > spamassassin < mymessage.eml > result.txt
> > >
> > > And the rules were not applied. I have attached the
> > message if you want
> > > to
> > > verify. Maybe it's just me being stupid, but my other rulesets like
> > > backhair and chickenpox applied in the same fashion work just fine.
> > >
> > > Danie
> > > ----- Original Message -----
> > > From: "jennifer" <jennifer@emtinc.net>
> > > To: "'Danie Marais'" <danie.marais@attix5.com>;
> > > <spamassassin-users@incubator.apache.org>
> > > Sent: Tuesday, February 17, 2004 4:27 PM
> > > Subject: RE: This doesn't get picked up
> > >
> > >
> > > >
> > > > > Hi,
> > > > >
> > > > > I got a spam message yesterday with the following text
> > > > >
> > > > > "Discover the new winning sexual erection pill!
> > > > > This medication picks up where Viagra stops."
> > > > >
> > > > > But 'viagra' was not picked up. However, when I look at the
> > > > > message source
> > > > > I see this:
> > > > >
> > > > > <html>
> > > > > <body>
> > > > > Disco<eqkolpb>ver the n</nyvakro>ew winning
> > > > > &#115&#101&#120&#117&#97&#108
> > > > > &#32&#101&#114&#101&#99&#116&#105&#111&#110&#32&#112&#105&#108
> > > > > &#108!<br>
> > > > > This
> > > > > &#109&#101&#100&#105&#99&#97&#116&#105&#111&#110&#32&#112&#105
> > > > > &#99&#107&#115
> > > > > &#32&#117&#112&#32&#119&#104&#101&#114&#101&#32&#86&#105&#97&#
> > > > > 103&#114&#97
> > > > > &#32&#115&#116&#111&#112&#115.<br><br>
> > > > >
> > &#79&#110&#108&#121&#32&#36&#51&#32&#80&#69&#82&#32&#68&#79&#83&#69
> > > > > <br><br>
> > > > > <a
> > > > > href="http://www.&#99&#110&#98&#114&#111&#97&#115&#116&#99&#97
> > > > > &#115&#116.com
> > > > > /c2/index&#46&#112&#104&#112&#63&#65&#70&#70&#95&#73&#68&#61&#
> > > > > 100&#109&#53&#
> > > > > 54">
> > > > > &#71&#101&#116&#32&#121&#111&#117&#114&#32&#102&#114&#101&#101
> > > > > &#32&#112&#114&#101&#115&#99&#114&#105&#112&#116&#105&#111&#11
> > > > > 0&#32&#78&#79&
> > > > > #87&#33</a>
> > > > > <br><br><br>
> > > > > .
> > > > > .
> > > > > .
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > Is there a simple way of catching this apprach?
> > > >
> > > > The Weeds Set (not weeds2)
> > > >
> > > > http://www.emtinc.net/spamhammers.htm
> > > >
> > > > Jennifer
> > > >
> > > > >
> > > > > Danie Marais
> > > > >
> > > > >
> >
> >
>
>
RE: This doesn't get picked up [ In reply to ]
jennifer at emtinc
Feb 18, 2004, 9:18 AM
Post #9 of 9 (1207 views)
Permalink
>
> I though about making it optional, but it is at the end of the text it
> checks for. It is like saying
> "match rule X and then there can be a ; at the end or not"
> I'd rather just say
> "match rule X"

Good point, ...my bad!

My brain is seriously rebelling against multitasking today. What's that
i see? ...is it?...yes! an ileocecal valve!?

Coke o'clock.
Jennifer

>
> Regards,
>
> Danie Marais
> CTO, Attix5
> danie.marais@attix5.com
> www.attix5.com
> +27 21 880 2323 (Tel)
> +27 21 880 2324 (Fax)
> ----- Original Message -----
> From: "jennifer" <jennifer@emtinc.net>
> To: "'Danie Marais'" <danie.marais@attix5.com>; "'Gary Smith'"
> <gary@primeexalia.com>; <spamassassin-users@incubator.apache.org>
> Sent: Wednesday, February 18, 2004 6:05 PM
> Subject: RE: This doesn't get picked up
>
>
> >
> > >
> > > Yes, I did restart the daemon. I checked using spamassassin,
> > > not spamc
> > > anyway, so restart of the daemon is not necessary.
> > >
> > > However, I modified the rules a bit. Seems that when you
> > > remove the ';'
> > > from the rules it works. I didn't see any ;'s in the mail
> > > that was slipping
> > > through.
> > >
> > > Perhaps that was the problem?
> >
> > yes, that was the problem, Danie. Don't remove the ";", make them
> > optional. (at least that is what i would suggest, so that it still
> > catches the other form as well.) I'll do the same for the
> distribution
> > set.
> >
> > thanks,
> > Jennifer
> >
> > >
> > > Regards,
> > > Danie Marais
> > > ----- Original Message -----
> > > From: "Gary Smith" <gary@primeexalia.com>
> > > To: "Danie Marais" <danie.marais@attix5.com>; "jennifer"
> > > <jennifer@emtinc.net>; <spamassassin-users@incubator.apache.org>
> > > Sent: Wednesday, February 18, 2004 4:59 PM
> > > Subject: RE: [Suspected SPAM] Re: This doesn't get picked up
> > >
> > >
> > > > Did you restart the SA daemon?
> > > >
> > > > -----Original Message-----
> > > > From: Danie Marais [mailto:danie.marais@attix5.com]
> > > > Sent: Wednesday, February 18, 2004 5:17 AM
> > > > To: jennifer; spamassassin-users@incubator.apache.org
> > > > Subject: [Suspected SPAM] Re: This doesn't get picked up
> > > >
> > > > Thanks for that, Jennifer
> > > >
> > > > I see how this is supposed to work, but I have placed the
> > > weeds.cf file
> > > > in
> > > > /etc/mail/spamassassin and made sure it has read access for
> > > everybody.
> > > >
> > > > I then ran
> > > > spamassassin < mymessage.eml > result.txt
> > > >
> > > > And the rules were not applied. I have attached the
> > > message if you want
> > > > to
> > > > verify. Maybe it's just me being stupid, but my other
> rulesets like
> > > > backhair and chickenpox applied in the same fashion
> work just fine.
> > > >
> > > > Danie
> > > > ----- Original Message -----
> > > > From: "jennifer" <jennifer@emtinc.net>
> > > > To: "'Danie Marais'" <danie.marais@attix5.com>;
> > > > <spamassassin-users@incubator.apache.org>
> > > > Sent: Tuesday, February 17, 2004 4:27 PM
> > > > Subject: RE: This doesn't get picked up
> > > >
> > > >
> > > > >
> > > > > > Hi,
> > > > > >
> > > > > > I got a spam message yesterday with the following text
> > > > > >
> > > > > > "Discover the new winning sexual erection pill!
> > > > > > This medication picks up where Viagra stops."
> > > > > >
> > > > > > But 'viagra' was not picked up. However, when I look at the
> > > > > > message source
> > > > > > I see this:
> > > > > >
> > > > > > <html>
> > > > > > <body>
> > > > > > Disco<eqkolpb>ver the n</nyvakro>ew winning
> > > > > > &#115&#101&#120&#117&#97&#108
> > > > > >
> &#32&#101&#114&#101&#99&#116&#105&#111&#110&#32&#112&#105&#108
> > > > > > &#108!<br>
> > > > > > This
> > > > > >
> &#109&#101&#100&#105&#99&#97&#116&#105&#111&#110&#32&#112&#105
> > > > > > &#99&#107&#115
> > > > > >
> &#32&#117&#112&#32&#119&#104&#101&#114&#101&#32&#86&#105&#97&#
> > > > > > 103&#114&#97
> > > > > > &#32&#115&#116&#111&#112&#115.<br><br>
> > > > > >
> > >
> &#79&#110&#108&#121&#32&#36&#51&#32&#80&#69&#82&#32&#68&#79&#83&#69
> > > > > > <br><br>
> > > > > > <a
> > > > > >
> href="http://www.&#99&#110&#98&#114&#111&#97&#115&#116&#99&#97
> > > > > > &#115&#116.com
> > > > > >
> /c2/index&#46&#112&#104&#112&#63&#65&#70&#70&#95&#73&#68&#61&#
> > > > > > 100&#109&#53&#
> > > > > > 54">
> > > > > >
> &#71&#101&#116&#32&#121&#111&#117&#114&#32&#102&#114&#101&#101
> > > > > >
> &#32&#112&#114&#101&#115&#99&#114&#105&#112&#116&#105&#111&#11
> > > > > > 0&#32&#78&#79&
> > > > > > #87&#33</a>
> > > > > > <br><br><br>
> > > > > > .
> > > > > > .
> > > > > > .
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > Is there a simple way of catching this apprach?
> > > > >
> > > > > The Weeds Set (not weeds2)
> > > > >
> > > > > http://www.emtinc.net/spamhammers.htm
> > > > >
> > > > > Jennifer
> > > > >
> > > > > >
> > > > > > Danie Marais
> > > > > >
> > > > > >
> > >
> > >
> >
> >
>
>

©2024 GT.net. A Gossamer Threads company.
5th Floor, 455 Granville St., Vancouver, BC V6C 1T1, Canada | Legal