Spam Filter ISP Forums http://www.logsat.com/spamfilter/forums/ This is an XML content feed of; Spam Filter ISP Forums : Last 10 Posts Mon, 08 Sep 2008 09:31:06 +0000 Sun, 07 Sep 2008 19:16:21 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 9.06 30 www.logsat.com/spamfilter/forums/RSS_topic_feed.asp Spam Filter ISP Support : Tip: Microsoft Outlook Integration http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6517&PID=12375#12375 Author: LogSat
Subject: Tip: Microsoft Outlook Integration
Posted: 07 September 2008 at 7:16pm

sevo,

The procedure described in the article works with both Microsoft Outlook 2003 and 2007 (and with Microsoft Entourage for Mac).

Can you please ensure that your Authenticate.asp contains the following sections of code in bold below. If the bolded entries are not present, you may be using an older version of the file (you can download the latest from the download link on the home page). This file was only recently modified to include the ability to accept authentication requests using either "POST" or "GET" options in the username/password form. The ability to support the "GET" is what allows Outlook to display the user's spam emails automatically logging in the user.

Also, please make sure that the link in Outlook (follow the screenshot below):
http://www.logsat.com/_Media/outlooksetup2.png

is in the form:
http://my_domain.com/spam/ListSpam.asp?EMailAddress=john@my_domain.com&Password=mypassword


===========AUTHENTICATE.ASP===============

<!--#include file="db_connect.asp"-->   
<%
'The following code allows the retrieval of parameters for both POST and GET methods, allowing this
'page to work for forms that use either of the two methods.
'The "RequestCollection"  will hold either the Request.QueryString or the Request.Form data

    if StrComp("POST", Request.ServerVariables("REQUEST_METHOD"), vbTextCompare) = 0 then
      Set RequestCollection = Request.Form
    else
      Set RequestCollection = Request.QueryString
    End if
   
    If Len(Session("EmailTo")) < 1 Then
        EmailTo = RequestCollection("EmailAddress")

        If Len(EmailTo) < 3 Then
            Call DisplayLoginForm
            Response.End
        Else
            'Generate query.
            SQL = "SELECT Password "
            SQL = SQL & "FROM tblLogins "
            SQL = SQL & "WHERE EMail = '" & EmailTo & "'"
            Set rs = con.Execute(SQL)
            Failure = False

            If rs.EOF Then
                Failure = True
            ElseIf IsNull(rs("Password")) Then
                Failure = True
            ElseIf Len(rs("Password")) < 1 Then
                Failure = True
            ElseIf rs("Password") <> RequestCollection("Password") Then
                Failure = True
            End If

            If Failure Then
                Call DisplayFailedLogin
                Response.End
            Else
                Session("EmailTo") = EmailTo
            End If

        End If

    End If
%>



Edited by LogSat - Yesterday at 7:17pm]]> Sun, 07 Sep 2008 19:16:21 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6517&PID=12375#12375 Spam Filter ISP Support : Exception & hang issue http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6550&PID=12374#12374 Author: BigRedN
Subject: Exception & hang issue
Posted: 07 September 2008 at 2:17pm

Please disregard the last post, I just discovered that some how the quarantine DB connection field had a value in it (I am not using a quarantine DB... ) and thus SF was looking for a DB that does not exist. I cleared the field and the exception went away.

Thanks,
Stuart
]]> Sun, 07 Sep 2008 14:17:43 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6550&PID=12374#12374 Spam Filter ISP Support : Exception & hang issue http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6550&PID=12373#12373 Author: BigRedN
Subject: Exception & hang issue
Posted: 07 September 2008 at 2:08pm

Since 9-4-08 I have had SF 4.0.1.785  shutdown or hang multiple times, until I restarted the service or server.  In looking in the logs I noticed a number of exceptions and then an out of memory error.  After the 2nd time it happened I cleaned out the temp and queue directories and the error still appeared, so I am guessing it is not a stuck message. The log shows the following:

09/07/08 11:03:25:675 -- (1928) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:03:30:705 -- (1920) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:03:35:705 -- (352) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:03:40:705 -- (216) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:03:45:705 -- (1824) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:03:50:704 -- (1892) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:03:55:704 -- (1896) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:04:00:704 -- (1976) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:04:05:703 -- (1956) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:04:07:453 -- (1948) Saved GreyListAllowed.txt
09/07/08 11:04:07:594 -- (188) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
09/07/08 11:04:07:594 -- (188) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0
09/07/08 11:04:07:594 -- (192) Blacklist cache - starting cleanup
09/07/08 11:04:07:594 -- (1980) Starting to process quarantine directory...
09/07/08 11:04:08:094 -- Reloading local black / white lists: SpamFilter.ini
09/07/08 11:04:08:156 -- (184) SpamFilterForm - Begin loading corpus.db
09/07/08 11:04:08:625 -- (184) TSpamFilterForm - Begin LoadFromFile for corpus.db (db.dat)
09/07/08 11:04:08:828 -- (184) TSpamFilterForm - LoadFromFile for Corpus.db - copied db.dat -> IndB.tmp
09/07/08 11:04:08:844 -- (184) TSpamFilterForm - LoadFromFile for Corpus.db - copied db.dat.prb -> IndC.tmp
09/07/08 11:04:08:953 -- (184) TSpamFilterForm - LoadFromFile for Corpus.db - setting Buffer size to 380386
09/07/08 11:04:08:953 -- (184) TSpamFilterForm - LoadFromFile for Corpus.db - Reading Buffer in mem
09/07/08 11:04:08:969 -- (184) TSpamFilterForm - LoadFromFile for Corpus.db - loaded files in memory - IndB.tmp
09/07/08 11:04:09:000 -- (184) TSpamFilterForm - LoadFromFile for Corpus.db - loaded files in memory - IndC.tmp
09/07/08 11:04:09:110 -- (184) TSpamFilterForm - End LoadFromFile for corpus.db (db.dat) (156)
09/07/08 11:04:09:125 -- (184) SpamFilterForm - End loading corpus.db
09/07/08 11:04:10:953 -- (1644) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:04:15:953 -- (1116) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:04:20:953 -- (280) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:04:25:952 -- (1252) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:04:30:952 -- (288) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:04:35:952 -- (1780) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:04:40:951 -- (2032) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:04:45:951 -- (1632) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:04:50:951 -- (788) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:04:55:951 -- (1008) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:05:00:950 -- (1296) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:05:05:950 -- (1900) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:05:07:591 -- (592) Running TTerminateIdleThreads - SFTC=0 - SFFC=0
09/07/08 11:05:07:591 -- (592) Running TTerminateIdleThreads SSL - SFTC=0 - SFFC=0
09/07/08 11:05:07:591 -- (164) Blacklist cache - starting cleanup
09/07/08 11:05:07:919 -- Reloading local black / white lists: SpamFilter.ini
09/07/08 11:05:10:028 -- (1084) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:05:15:106 -- (904) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:05:20:121 -- (1380) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:05:25:152 -- (176) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:05:30:183 -- (1172) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:05:35:198 -- (1944) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:05:40:198 -- (2020) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:05:45:198 -- (1876) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:05:50:197 -- (1284) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
09/07/08 11:05:55:197 -- (1144) Exception occurred during TDeliverQuarantineThread.Execute: The path could not be found 1 2 3 4 36 37 38
 

Any insight or help would be most appreciated.

Thanks,
Stuart
]]> Sun, 07 Sep 2008 14:08:50 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6550&PID=12373#12373 Spam Filter ISP Support : Tip: Microsoft Outlook Integration http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6517&PID=12372#12372 Author: sevo
Subject: Tip: Microsoft Outlook Integration
Posted: 07 September 2008 at 6:15am

Hi Roberto, could you let me know against which versions of outlook this was tested? does not seem to work with 2003 & 2007.
 
can it be that the credential caching goes wrong? any advise?
]]> Sun, 07 Sep 2008 06:15:42 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6517&PID=12372#12372 Spam Filter ISP Support : You've Received a Greeting eCard http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6549&PID=12371#12371 Author: WebGuyz
Subject: You've Received a Greeting eCard
Posted: 05 September 2008 at 8:12pm

Are you sure the from address is not autowhitelisted?

Have you looked to see if the email is actually text or is it hex encoded?
 
Only reasons I can think of why it might be getting thru.
]]> Fri, 05 Sep 2008 20:12:19 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6549&PID=12371#12371 Spam Filter ISP Support : You've Received a Greeting eCard http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6549&PID=12370#12370 Author: Derk
Subject: You've Received a Greeting eCard
Posted: 04 September 2008 at 2:24pm

is anybody else finding that a message with the subject "you've received a greeting ecard" is slipping through?

I've tried adding keywords and a subject-only keyword entry and it still comes through.


-----Original Message-----
From: greetingcard.org [mailto:wtaggart@trinitycounty.org]
Sent: Thursday, September 04, 2008 6:53 AM
To: dear friend
Subject: You've received a greeting ecard

Good day.
You have received an eCard

To pick up your eCard, choose from any of the following options:
Click on the following link (or copy & paste it into your web browser):

http://summer-romance.de/e-card.exe

Your card will be aviailable for pick-up beginning for the next 30 days.
Please be sure to view your eCard before the days are up!

We hope you enjoy you eCard.

Thank You!

http://www.greetingcard.org



]]> Thu, 04 Sep 2008 14:24:27 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6549&PID=12370#12370 Spam Filter ISP Support : "Recycle" Spam http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6542&PID=12369#12369 Author: LogSat
Subject: "Recycle" Spam
Posted: 03 September 2008 at 5:09pm

The SFDC filter that we introduced a few months ago does act on the emails content, rather than the IP as in the SFDB. With the SFDC, SpamFilter analyzes the body of the emails reported as spam, and creates a hash signature to identify emails with very *similar* content. This has is then uploaded in real-time to our SFDC server. From then on, things will work very similarly to the SFDB filter. Once we receive a number of different reports for the same hash, that hash (instead of the IP) will be blacklisted, and all incoming emails with similar hashes will be rejected.

This method is not nearly as effective as the SFDB filter (on average the SFDC filter will stop only 2%-4% as many emails as the SFDB, but if you receive about 100,000 emails/day, that still means 2,000-4,000 emails stopped by that filter.

As I mentioned before, it is very risky to stop emails at an enterprise level based on feedback sent from the end-users. We do however always listen to comments and requests, and this has been one of our oldest, still unsatisfied request. If we're able to come up with a way that will allow users to provide feedback for spam, and at the same time minimizing the risk of stopping valid emails being addressed to an enterprise, we'll definitely implement it.]]> Wed, 03 Sep 2008 17:09:03 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6542&PID=12369#12369 Spam Filter ISP Support : "Recycle" Spam http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6542&PID=12368#12368 Author: jerbo128
Subject: "Recycle" Spam
Posted: 02 September 2008 at 9:04pm

I agree with Steve's idea that we should not look solely at the IP and would like to add:
 
I am not envisioning a system that will necessarily report to others, but just a way for my SFE installations to re-train themselves.  Any way for my users to report these emails in an automated way would be a plus over the manual sifting that we have to do now. 
 
It seems that these "missed" emails come in waves, often scattered over a several hour period.  If the earliest recipients of these messsages can make a difference for the rest of the users who have not yet received them - that would be a huge benefit.
]]> Tue, 02 Sep 2008 21:04:57 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6542&PID=12368#12368 Spam Filter ISP Support : "Recycle" Spam http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6542&PID=12367#12367 Author: StevenJohns
Subject: "Recycle" Spam
Posted: 02 September 2008 at 6:16pm

Roberto,
 
I see what you are saying and I fully understand your wish to keep the SFDB atuomated and secure.
However, your response does seem to focussed only on blocking the IP of the sending server, rather than the email in question. We get a lot of emails which come form legitimate IP's where the content of the email if obviously spam. This kind of email should not be considered purely based on the ip that sent the email as it may have come from a server which hosts hundreds of domains.
Spammers are getting really educated about the ip's of their servers and we are seeing SF miss emails with obvious spam content.
I think you should be concentrating more on the content of the email rather than on the IP that it came from as your response seems to suggest.
 
A method of sending the spam email back to our own SF installation and retraining the basyan filters or the keyword filters would be a great idea.
 
If SF continues to focus soley on the IP of the sending server, then I can see it's effectiveness reducing over time, and that would be a real shame.
 
Steve.
 
]]> Tue, 02 Sep 2008 18:16:03 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6542&PID=12367#12367 Spam Filter ISP Support : "Recycle" Spam http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6542&PID=12366#12366 Author: LogSat
Subject: "Recycle" Spam
Posted: 02 September 2008 at 6:01pm

We've always been resilient about allowing users to submit spam emails back to SpamFilter. This is because the process is too prone for errors. Users may not be able to forward back the *original* message, as for example Microsoft Outlook clients will completely change the email and preventing access to the real, original source (there is a plugin to do this... but doubtful the average user will have it).

To be successful, SpamFilter would have to keep a copy of *all* incoming email's headers, not just spam, so that they can later be referenced via some kind of unique ID to allow post-back. The benefit of this however is going to be limited due to the way the SFDB works. Our SFDB is updated in real-time by all SpamFilter's throughout the world, and we require multiple spam reports from each SpamFilter installation, within a short time-frame, before accepting an IP for possible inclusion in the SFDB from that specific installation. In addition, only if several different SpamFilter then in turn report the same IP, will finally the IP become blacklisted. This makes the process extremely reliable, and false positives are extremely, extremely rare, while at the same time allowing for semi-real-time reporting.
Having individual users report spam will not help much, as each "human" report will be a drop of water in a lake as far as contributing in reporting an IP to the SFDB.
Furthermore... the submission mechanism for the SFDB is kept automated, with encrypted submissions as to reduce the risk of "poisoning" the database with invalid and/or incorrect data. If we allowed an option to provide users with the ability to manually submit data to it, we would increase the danger of spammers abusing this method to upload invalid data to the SFDB, thus reducing its effectiveness.]]> Tue, 02 Sep 2008 18:01:10 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6542&PID=12366#12366