Spam Filter

**mickalo** · 11-26-2006 01:38 PM

Hello,

we have been working on cutting down our spam this past week, and thanks to all the great info provided on this forum, have reduced it greatly.

I recall a thread regard this new spam coming through, with the subject:
SomeNameHere wrote: , IE: Debra Wrote: which seems to still getting through. But can seem to find that thread that addressed this issue.

If someone knows how to caught this type of spam, would appreciate a rule or filter to caught these types.

TIA,
Mickalo

**serversphere** · 11-26-2006 02:39 PM

Add a rule to local.cf if you are using spamassassin:

Code:

header    WROTESPAM     Subject =~ /^wrote\:/i
score     WROTESPAM     9.000

Note that the spaces in-between are tabs. Afterward I would install a stocks ruleset and image rules so you can reduce the score or eliminate this. hope that helps!

**mickalo** · 11-26-2006 02:53 PM

Originally Posted by webtiva

Add a rule to local.cf if you are using spamassassin:

Code:

header    WROTESPAM     Subject =~ /^wrote\:/i
score     WROTESPAM     9.000

Note that the spaces in-between are tabs. Afterward I would install a stocks ruleset and image rules so you can reduce the score or eliminate this. hope that helps!

thx's webtiva, we'll add this and see what happens, much appreciated.

where can one get these "stock rulesets" from. We already implemented the image rules which seem to be working great .... so far!!

Mickalo

**serversphere** · 11-26-2006 03:01 PM

We use 70_sare_stocks from http://www.rulesemporium.com/rules.htm

If you implement Rules Du Jour it will make your life much easier! Highly recommended.

**mickalo** · 11-26-2006 03:29 PM

Originally Posted by webtiva

We use 70_sare_stocks from http://www.rulesemporium.com/rules.htm

If you implement Rules Du Jour it will make your life much easier! Highly recommended.

again, much appreciated

I tried to get that "Rules Du Jour" auto setup, but the link that was posted here to that earlier on this forum seems to be a dead link or incorrect. Do you happen to have that correct link for this setup ?

Thx's
Mickalo

**serversphere** · 11-26-2006 03:50 PM

A decent auto installer is located here, or you can check out their how to page here.

I also highly recommend Chirpy's MailScanner setup here, which includes it. For $35 they install Mailscanner with clamAV; they set up SA, Vipul's Razor and DCC; plus they install a WHM front end for you and your hosting customers. WELL worth the cost!

**mickalo** · 11-26-2006 04:05 PM

Originally Posted by webtiva

A decent auto installer is located here, or you can check out their how to page here.

I also highly recommend Chirpy's MailScanner setup here, which includes it. For $35 they install Mailscanner with clamAV; they set up SA, Vipul's Razor and DCC; plus they install a WHM front end for you and your hosting customers. WELL worth the cost!

Much appreciate all the info, you've been a big help

I've been strongly considering having Chirpy do his setup w/MailScanner package, on our server, but just abit concerned about the load I've read alot about that this MailScanner can put on the server.

we only run about 45 domains on our server, with approx., 3-4000 emails daily and about 100 POP accounts. We do run 1GB mem., and average about 30-40% CPU usage daily, which I think the server should be able to handle. Gonna think about a bit more tho.

Again, appreciate you info,
Mickalo

P.S. to any one that may use the autoinstaller, they must edit two configurations settings, 1)location of spamassassin folder and 2) path to restart spam
this is for the Cpanel install.

**secretreal** · 11-26-2006 05:53 PM

Originally Posted by webtiva

Add a rule to local.cf if you are using spamassassin:

Code:

header    WROTESPAM     Subject =~ /^wrote\:/i
score     WROTESPAM     9.000

Note that the spaces in-between are tabs. Afterward I would install a stocks ruleset and image rules so you can reduce the score or eliminate this. hope that helps!

it doesnt effect :S

i use mailscanner should i do different think ?

**secretreal** · 11-27-2006 08:34 AM

can anybody give advise about this

**serversphere** · 11-27-2006 03:29 PM

After adding that rule, restart exim and MailScanner and check again. I use MailScanner as well...

**asmithjr** · 11-27-2006 05:27 PM

Where did you put the rule?
local.cf ??

**Sash** · 11-28-2006 02:58 AM

Messages that contain "Name wrote:" are still getting by. Any advice?

I added the code to /etc/mail/spamassassin/local.cf

Thanks,
Mike

**Adrnalnrsh** · 11-28-2006 03:23 AM

Not working for me either, using Chirpy's MailScanner installation.

**intonet** · 11-28-2006 04:09 AM

I'm trying to capture these damned "xxx wrote:" e-mail as well.

I've added a rule to the global local.cf file, which as you can see from the following header extract it is picking up. What it's not doing though is marking it as SPAM. I've set the score to 6.0 in the rule...

X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on
xeon.intonet-technology.co.uk
X-Spam-Level: **
X-Spam-Status: No, score=2.5 required=5.0 tests=BAYES_00,LOCAL_WROTE_RULE
autolearn=no version=3.1.7

Any ideas folks?

- Tim

**cbwass** · 11-28-2006 05:54 AM

You can stop them getting through using etc/antivirus.exim.

Find:

if error_message and $header_from: contains "Mailer-Daemon@"
then
# looks like a real error message - just ignore it
finish
endif

#Than right under it put:

if $header_subject: contains "wrote"
then
seen finish
endif

It should look like this.

if error_message and $header_from: contains "Mailer-Daemon@"
then
# looks like a real error message - just ignore it
finish
endif

if $header_subject: contains "wrote"
then
seen finish
endif

LinkBack

Thread Tools

Spam Filter

Account Level Spam filter redirect to Spam Box

Spam filter

Spam filter

Spam filter & Spam Assassin

Spam Filter and $