Spam Assissin Changes it's tune!!!

[Tyiell]

Fairly large problem just turned up on our Spam Assassin filter that has totally confused me, any thoguhts on what might have caused it would be appreciated!!!

 

We run a MailScanner install using ClamAV and SpamAssassin on and Ubuntu box and it has been working flawlessly for weeks, happily stopping 99% of our spam, including viagra-type adverts and any adult content.

 

Today though, it was like a switch was flicked to send it totally backwards. It is still stopping advert-based spam about jobs and banking-type spam, but it is giving all adult content a clean spam rating!! Almost like all the bad words have been set to good ones!!

 

No settings have been changed, but I was wondering if a dodgy update from the spamassassin people themselve went through?

 

Any thoughts would be good - we are now relying on basic exchange filters to stop the kids getting adverts about what Madison Ivy does with various vegetables...!!

 

Cheers!

[powdarrmonkey]

Do you use sa-update? Try running it again to fetch anything that's been pushed today.

[Tyiell]

We do, I tried it last night and this morning. It said it had run successfully, but it hasn't seemed to change anything. I just sent myself the most abusive email I could possibly come up with and I could only get it up to a 2.4 spam rating (the first spam limit is 5 on our set up!). I reebooted the server afterwards, just in case the changes weren't filtering through for whatever reason. No joy as yet!

 

Fortunately it is largely only allowing the most explicit ones through (very odd, like the definitions for sexual and abusive content are gone, but the rules for chain mail and adverts remain), and because they are so blatantly abusive, Exchange is picking most of them up...

[Tyiell]

Heres the Spam Report for a message so explicit, it I told you the subject I would probably be ejected from Edugeek forever:

 

cached not
score=-0.6335
required
-1.80  ALL_TRUSTED Passed through trusted hosts only via SMTP
-0.18  BAYES_40 Bayesian spam probability is 20 to 40%
0.00  STOX_REPLY_TYPE 1.35 TVD_RCVD_SINGLE

 

 

Is there a way of editing the ALL_TRUSTED rule? Because it looks to me like not only is Bayes a little confused with it's probablility, but the ALL_TRUSTED seems to think it is trusted in some way? It's certainly not Whitelisted...

Edited May 21, 2010 by Tyiell