Topic: Foreign Email - Spam / Virus

[Olsen]

cc_skavenger,  

Thanks for posting those .cf files!  I have installed them into my spamassassin directory.  I will let everyone know if this has worked for our situation also.

Thanks again.

[Olsen]

Nope, that did not work......

I click on the link on each .cf file on your site and copied the text.
I then opened up a blank doc on the server and pasted the text, saved as sober-p.cf (as well as saving the rest of the files also in the same manner)
restarted spamassassin....

I just got an email with the subject:
Tuerkei in die EU

This is a typical sober email.

Any suggestions?

BTW I put the files in /etc/mail/spamassassin as directed.

[Olsen]

OK....It may have been a problem with the spamassassin restart,
I was installing a couple of other .cf files and had restarted spamassassin a couple of times.  One must have hung up because when I checked the status, it was stopped.  I started the spamd service and it SHOULD work because I saw that subject in the sober-p.cf file......

[cc_skavenger]

It is working great here.  The boss isn't cursing my name anymore....

[Olsen]

I am getting frustrated with spamd.  

I start it and it starts ok.  I check the status to make sure it is running, and it says its running.  A minute later, I check the status to make sure it is still running (because I am a little obsessive) and it says spamd stopped.  ANYONE KNOW WHY it keeps stopping?  I am not doing anything that would stop it, Is there a script that is running to stop it?  

I am running spamassassin 3.0.1-3 with an auto update script

[cc_skavenger]

I know this is a pain, but I would uninstall it and reinstall it.  I seemed to have been having a problem with older versions not completely uninstalling or being overwritten when I did an upgrade.

Just a thought...

[Olsen]

A pain...it was....

I uninstalled the perl module, spamassassin, sme-spamfilter, spamassassin tools, usa script.....

Then i installed using the script i downloaded from swerts.  

It installed fine, but when I go to check the status of spamd....it is stopped.

Pulling my hair out.....running out of ideas.

There has to be a script shutting spamd down.  When I look at the message log, there is nothing in there telling me that spamd is shutting down.

[cc_skavenger]

ok, lets try this...

Restart spamassassin and immediately do a top.  In top, press shift and the letter m to see what processes are using the most memory.  Watch this, are there any processes that are hogging memory?  

Btw, what are the specs on the system you are using?

[Olsen]

I may have figured it out.

Everytime I tried to
[me@myserver]# /etc/rc.d/init.d/spamassassin restart
Shutting down spamd:                   [ FAILED ]
Starting spamd:                        [   OK   ]

but then when I would check the status, it would say:
stopped


So I tried removing all the custom .cf files thinking maybe one of them had a bug in it or there was a problem with the script.  Sure enough, I was able to keep the spamd process running.

Weird though, I cannot use the restart command, I have to use "stop" then "start" and things work fine.

Now that I have spamd Running, it should be filtering through the German and Sober crap and getting rid of it.....but it is not.  So I think I have other problems.  

Anyone have any thoughts?

[Olsen]

I did the top....did the shift+m

I am running a backup of the server (since 10:30pm) last night.....I know, I know I shouldnt be doing all of these changes during a backup, however, The president has climbed up my butt and will remain there until I get this resolved.  

So the tapeware process and spamd are top the list along with snort, squid, and clamd.

[cc_skavenger]

There was a lot of crap stuck in the queue,in my situation; it took a little bit before it stopped coming through...

[Olsen]

Just got another....

Here is what the header is....The spam score should be higher....shouldnt it?

Received: (qmail 1507 invoked by alias); 19 May 2005 22:05:10 -0000
Delivered-To: MY EMAIL
Received: (qmail 1498 invoked from network); 19 May 2005 22:05:01 -0000
X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on server.myserver.com
Received: from rbalvie.com (user-0c6t0bs.cable.mindspring.com [24.110.129.124])
  by server.myserver.com ([xxx.xxx.x.xxx])
  with SMTP via TCP; 19 May 2005 22:05:00 -0000
From: yosefa1@juno.com
To: Recipient@myserver.com
Date: Thu, 19 May 2005 22:01:05 UTC
Subject: Tuerkei in die EU
Importance: Normal
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
MIME-Version: 1.0
Message-ID: <95bae.66da0a5425@juno.com>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"
X-Spam-Checker-Version: SpamAssassin 3.0.3 (2005-04-27) on server.myserver.com
X-Spam-Status: No, score=3.9 required=5.0 tests=BAYES_00,DCC_CHECK,
   FORGED_JUNO_RCVD,PYZOR_CHECK,RAZOR2_CF_RANGE_51_100 autolearn=no
   version=3.0.3
X-Spam-Level: ***

[funkusmunkus]

I think you need at least 512M ram for SA to be affective, does that meet your current specs ??
cc_skavenger  another thing to check out is this site http://www.mailscanner.info/
I'm told it works rather well

[Olsen]

We have 1GB of ram running on the machine.

It appears that Spam assassin is getting a couple of these emails because I can go into the ;junkmail folders of users and see some of these german emails, but it is still allowing alot of these emails through.  I want to find a way to reject all emails with any of those subject lines included in all of the .cf files.  OR increase the score it gives to above 10.  I currently have our SpamAss, set at 7.

I appreciate all the help given so far, as I am frustrated beyond belief.  I feel as if our server is the only one not working using these .cf files.

I have gone to SARE's site and looked at some of their .cf files and installed some too.

One strange thing is after I loaded all of cc_skavenger's .cf files, I did a spamassassin --lint  AND spamassassin --lint -D
Both came up with 121 errors.....

I dont know if that is contributing to the ineffectiveness of the scripts.

[kruhm]

@I click on the link on each .cf file on your site and copied the text.
I don't think you can just copy and paste it into a file. The word wrapping may be killing SA because it's not understanding the file.

Try creating the file, then transfering it onto the sme.