Connect. Communicate. Collaborate. Securely.

Home » Kerio User Forums » Kerio Connect » Spam help please
  •  
shaggie16

Messages: 99
Karma: 0
Send a private message to this user
Hi, can I pick all your brains out there?

One of our customers is having trouble with spam filtering. Messages are coming through with images in the message body, so I am not surprised that they do not trip the spam filters.

However, the subject line of these messages certainly contains words that you would think would definitely get caught by the filter, so can anyone tell me why they are not?

The relevant parts of the log are below, and as you can see, even if I lowered the block score it would have no effect.

Help?

[18/Sep/2007 15:18:43][41999872] {spam} SpamAssassin result string for message file /Volumes/Mail/Store/queue/21/46efde3e-00024938.eml, time 2.68s: No, -1.309,5,AWL: 0.063,BAYES_00: -1.665,FORGED_RCVD_HELO: 0.135,HOT_NASTY: 0.157,HTML_MESSAGE: 0.001

[18/Sep/2007 15:18:43][41999872] {spam} Spam Filter: SpamAssassin check finished, adding score -1.31

[18/Sep/2007 15:18:43][41999872] {spam} Spam Filter: Custom spam rules check finished, adding score 0.00
  •  
shaggie16

Messages: 99
Karma: 0
Send a private message to this user
  •  
Pavel Dobry (Kerio)

Messages: 5245
Karma: 251
Send a private message to this user
shaggie16 wrote on Tue, 18 September 2007 16:25


However, the subject line of these messages certainly contains words that you would think would definitely get caught by the filter, so can anyone tell me why they are not?


Are you sure? Why do you think so?
Quote:


The relevant parts of the log are below, and as you can see, even if I lowered the block score it would have no effect.

Help?

[18/Sep/2007 15:18:43][41999872] {spam} SpamAssassin result string for message file /Volumes/Mail/Store/queue/21/46efde3e-00024938.eml, time 2.68s: No, -1.309,5,AWL: 0.063,BAYES_00: -1.665,FORGED_RCVD_HELO: 0.135,HOT_NASTY: 0.157,HTML_MESSAGE: 0.001

[18/Sep/2007 15:18:43][41999872] {spam} Spam Filter: SpamAssassin check finished, adding score -1.31

[18/Sep/2007 15:18:43][41999872] {spam} Spam Filter: Custom spam rules check finished, adding score 0.00


Bayes database in Spam Filter is learned that similar (or same ) messages are not a spam - that's why it gets BAYES_00 negative score. The solution is to train Bayes with these emails by Spam button and improve filter efficiency.

[Updated on: Fri, 21 September 2007 10:36]

  •  
shaggie16

Messages: 99
Karma: 0
Send a private message to this user
HI Pavel and any others,

Thanks for the feedback.
The Bayes filter has been well and truly trained, can it become poisoned?

As for the subject, I had wanted to refrain from posting it, bus seeing as you asked why I think it contains words that should be blocked, the subject is:

Massive cocks spearing eager young sluts. See these dick sluts take a pounding and get fucked every way possible.

My apologies for having to post that.

  •  
sedell

Messages: 1168
Karma: 1
Send a private message to this user
shaggie16 wrote on Fri, 21 September 2007 04:39

The Bayes filter has been well and truly trained, can it become poisoned?


Yes it can, in a matter of speaking. I haven't run into problems with mail as bad as what you received, but I've run into situations where users flag mail as spam because they are too lazy to unsubscribe from newsletters, or other mail from companies they do business with. They mark the message as spam, everyone else starts getting the newsletter marked as spam, so they mark it as not spam, then the original user gets the next newsletter and marks it as spam, and so on.

Unfortunately, with a global bayes database, it only takes one or two users classifying mail inappropriately to cause problems for everyone else.

Scott
  •  
shaggie16

Messages: 99
Karma: 0
Send a private message to this user
Cheers Scott

Is there a way to clear the Bayes filter and start training from scratch?

Thanks
  •  
sgongola

Messages: 109
Karma: 0
Send a private message to this user
Is there a way to control who is able to mark an item as spam or notspam? I can probably accomplish this by having some users setup as pop instead of imap but was hoping for better control over the spam designation directly from IMPA.

Thank You
sol
  •  
freakinvibe

Messages: 1554
Karma: 62
Send a private message to this user
shaggie16 wrote on Fri, 21 September 2007 14:37

Cheers Scott

Is there a way to clear the Bayes filter and start training from scratch?

Thanks

You can stop KMS and then delete (or better move away) the contents of the following directory:

C:\Program Files\Kerio\MailServer\store\spamassassin\bayes

This is on a Windows machine. Linux/Apple boxes have similar folders.

When you start KMS again, it will build the DB from scratch.

Dexion AG - The Blackberry Specialists in Switzerland
https://dexionag.ch
Previous Topic: Address on bounce messages
Next Topic: deleted
Goto Forum:
  


Disclaimer:
Kerio discussion forums are intended for open communication between forum members and may contain information and material posted by members which may be useful in learning about Kerio products. The discussion forums are not intended to provide technical support for any specific product. Any information implied or expressed in the discussion forums is that of the posting member. Kerio is in no way responsible for the information posted in the forums, or its accuracy. Kerio employees may participate in the discussions, but their postings do not represent an offical position of the company on any issues raised or discussed. Kerio reserves the right to monitor and maintain the forums to promote free and accurate exchange of information.

Current Time: Fri Nov 24 06:53:31 CET 2017

Total time taken to generate the page: 0.00468 seconds
.:: Contact :: Home ::.
Powered by: FUDforum 3.0.4.