Spam Help

[Allen]

Can someone help me with this problem. I have set up
lots of rules that will deal with all the spam that I'm
getting (i.e. Free laptops, sex creams, ect), bt I still
get them in my in box. I have set up rules to catch all
these names in the subject line and you would think that
if Outlook encounters any or all the words in my rule,
they would be blocked. But that's not happening, is
there something else I need to do to stop all this spam
from getting through?
Using Outlook 2002 on a windows upgrade XP from 98.
Thanks for any help.

 

[Vanguardx]

Can someone help me with this problem. I have set up
lots of rules that will deal with all the spam that I'm
getting (i.e. Free laptops, sex creams, ect), bt I still
get them in my in box. I have set up rules to catch all
these names in the subject line and you would think that
if Outlook encounters any or all the words in my rule,
they would be blocked. But that's not happening, is
there something else I need to do to stop all this spam
from getting through?
Using Outlook 2002 on a windows upgrade XP from 98.
Thanks for any help.

Without seeing how your rules are defined, the most likely cause is that
you don't have the rules defined correctly, are not using the "stop
processing more rules" clause when appropriate within a rule, or have
the rules in the wrong order.

Sounds like you are doing a lot of work which will cause lots of false
positives. Just get some anti-spam software to do the work for you.
SpamPal and all its plug-ins are free (are are NOT trialware, demoware,
crippleware, bannerware, or other crapware). It runs as a local proxy
that is compatible with any POP3/SMTP e-mail client that you may choose
to use.

 

[Guest]

Sorry, but how can I not be inputting my rules wrong when
after right clicking on the message, I then check all the
boxes that Outlook brings up that would apply to that
message and any others that will follow. I'm also using
Norton internet security with it's anti spam program and
things are still getting through.
I still need help?

 

[Vanguardx]

"(e-mail address removed)"

Sorry, but how can I not be inputting my rules wrong when
after right clicking on the message, I then check all the
boxes that Outlook brings up that would apply to that
message and any others that will follow. I'm also using
Norton internet security with it's anti spam program and
things are still getting through.
I still need help?

You'll need to go into the Rules Wizard to see what rule(s) were
actually defined, their order, and what clauses they use. You're asking
us to analyze unknown rules (to us) that you have. Go into the Rules
Wizard to see what really got defined for each rule and their order. Be
aware that Outlook is known to be flaky on running rules on the first
mail poll since it loaded. When you schedule mail polls every N
minutes, the zeroeth minute is included (i.e., there is an immediate
mail poll when Outlook loads), but Outlook really isn't fully ready to
perform a mail poll, but it does the mail poll anyway and neglects to
exercise the rules against those messages received in that immediate
first mail poll. The rules run okay on subsequent scheduled mail polls,
or if you disable scheduling of mail polls and initiate them manually
yourself (by hitting F9 or using the menus).

I've tried Norton's anti-spam solutions. They aren't effective. When I
define my rules to first trigger on Norton-tagged spam and then followed
by a rule to trigger on SpamPal-tagged spam, I got about 2 to 4 spams
per week that Norton would tag and all the rest of the 30 to 60 spams
that Norton missed got detected by SpamPal. So Norton was so
ineffective that there is no point in enabling its anti-spam component
(if included in a suite) and waste the time to process a rule looking
for Norton's tag. How much spam a particular product detects depends on
what type of spam you specifically experience and whether or not the
anti-spam product is geared to detect that specific spam, so experiences
vary as to the usefulness of anti-spam products. I tried both Norton's
and SpamPal and found Norton to be trivial in detecting what spam was
targeted at *me*. For me, Norton was ineffective at detecting spam and
SpamPal has proven better than many of the paid-for anti-spam products.
It's hard to beat free when it works great and is often better than the
commercial products.

 

[Lanwench [MVP - Exchange]]

I personally prefer SpamBayes. It doesn't install a potentially clunky local
proxy....works quite well, and is also free.

 

[Vanguardx]

"Lanwench [MVP - Exchange]"

I personally prefer SpamBayes. It doesn't install a potentially
clunky local proxy....works quite well, and is also free.

Not quite true from what I read of SpamBayes at
http://spambayes.sourceforge.net/. It can be used as an Outlook plug-in
or as a local proxy just like SpamPal. As an Outlook plug-in, that is
the only e-mail client you can use it with. As a local proxy, any
e-mail client can use it. So your claim that SpamPal is a clunky local
proxy also applies to SpamBayes when it is used as a local proxy
(because you don't want to use a plug-in to Outlook or you use more
e-mail clients than just Outlook). Personally I don't see using a
plug-in (to only one e-mail client) as less a clunky solution than using
a proxy. Since SpamBayes is *only* providing Bayesian filtering then
its options are far fewer than what you get with SpamPal and its
plug-ins, so SpamBayes smaller number of configurable settings probably
fits well into a single tab page in Outlook's options.

I don't just use Outlook for e-mail. I've found Outlook is just too
flaky to leave it running all the time. Microsoft has yet to fix the
problem of it leaving behind a remnant process in memory when you
supposedly exit Outlook which will interfere not only with subsequent
loads of Outlook but can screw up other applications. It is also a bit
of a pig for memory even when its GUI window is minimized when it is
left running continuously so it can monitor for new e-mails. Perhaps in
OL2003 there is now an option to show a tray icon for it but in prior
versions you needed to use a registry hack to get OL2002 to use a tray
icon (instead of consuming space in the taskbar with a button). Because
leaving Outlook running all the time to have it monitor for new e-mails
is a bit too much for resources, I prefer to leave an e-mail monitor
utility loaded that will tell me when there are new e-mails. I use
Magic Mail Monitor (http://mmm3.sourceforge.net) which also has
filtering rules. That way, I can leave Magic loaded, have its tray icon
tell me when there are new messages, and use its filtering rules to
eliminate spam at the mail server. Magic goes through SpamPal just like
Outlook so spam gets tagged. Once tagged, a rule in Magic deletes that
suspect message from the mail server (but it has a logfile telling you
which messages got removed by a server-delete rule so you can check for
false positives).

SpamPal's primary detection is in using DNSBLs (DNS blacklists of known
spam sources) so you only need to have Magic download the headers.
Bayes-based filters require that the entire message get downloaded. I
haven't kept a running history of false positives but my recollection is
that I've had 2 false positives since last February. I probably get 2
to 3 per week that leak past SpamPal and all the plug-ins. I'm not a
fanatic and that few is so little nuisance to delete that it is a
non-issue. I don't like getting spam but am not so extreme about it
that a couple a week will make me go ballistic. I'd rather get a couple
spam a week then lose good e-mails as false positives. The tighter you
choke your e-mail pipe to get rid of spam the more likely some good
e-mails won't get through.

While Bayesian filtering is nice, I've found it less reliable and less
robust than using DNSBLs. But make sure you tailor which blacklists you
use, if you are allowed to select them. I won't use SPEWS because they
are too agressive and unresponsive to false records (i.e., they are too
much of vigilantes). I was using SORBS until they incorporated the
SPEWS list. Right now I use the SpamHaus SBL + XBL lists, Composite
Blocking List, ORDB, SpamCop, NJABL, and blitzed.org (although I might
drop blitzed). When I used to download the entire message (i.e., when I
used Outlook alone so the entire message got yanked), the Bayesian
filter, even after training, didn't catch as much spam as using the
blacklists. Also, in Spampal, its Bayesian plug-in will learn from
SpamPal (using its blacklists) and from other plug-ins; that is, if any
of them tag a message as spam then the Bayesian plug-in also updates its
database (i.e., SpamPal and other plug-ins also help train the Bayesian
plug-in). You should also use a Bayes filter that expires unused words
after awhile to eliminate the noise in your database (because those
words are no longer really a part of your e-mail reportoire anymore to
be representative of your good e-mails). The Bayesian plug-in for
SpamPal expires the noise but I don't know about SpamBayes.

SpamPal also has its HTML-Modify plug-in to handle HTML-formatted
e-mails. It will, by default, eradicate linked images from
HTML-formatted e-mails which can be used as web bugs or beacons (you can
also configure it to eradicate all images). It will also remove many
nasties from HTML-formatted e-mails (although some of its functions
duplicate using the Restricted Sites security zone for e-mail). One
handy feature is the counting and weighting of bogus HTML tags that
spammers will use to have the reader see those words (because they are
invalid so they don't get rendered) and most filters, Bayes or
otherwise, tend to skip the words with the angle brackets for HTML tags.
The more of these bogus HTML tags that are present the more weight they
are given and you can configure the threshold at which point the message
becomes too spammy from the use of all the bogus HTML tags. For
HTML-formatted e-mails (i.e., excluding text-only e-mails), I've found
HTML-Modify has detected more spam e-mails than the Bayesian filter.
With the Quarantine plug-in, you get a plain-text version of any e-mail
that got tagged as spam, so if you have a rule to [permanently] delete
any spam-tagged messages then you can still go look in the text-only
quarantine archive in case there was a false positive and you need to
see what that message contained (I had to write my own batch file to
auto-expire old quarantine archives and schedule it in Task Scheduler
since that feature is missing from the plug-in). I actually like to
report spam when I have the time and inclination so I need a safe
text-only copy to use when reporting the spam. There is a URL plug-in
that looks for known spam sources for any URLs in the message. While
the spammer will use bogus headers to hide from where they squeezed
their turd to end up in your mailbox, eventually they need to provide
something to get you to buy their shinola. It might be a telephone
number but most likely it will be a link to their web site which then
identifies them so the URL plug-in can detect the URL is a known spam
source. The RegEx plug-in lets you define rules for detecting
undesirable messages using regular expressions that are beyond the
capabilities of the rules in your e-mail client. With SpamPal and the
plug-ins that I use (HTML-Modify, Bayesian, URL-body, and Quarantine), I
haven't yet needed to use the RegEx plug-in. The other have been so
thoroughly effective at detecting spam that I haven't had a need to add
more detection capability.

By using Magic with its rules and letting SpamPal mark which messages
are spam and WITHOUT having to download the entire message to detect the
spam, mail polls are quick, easy on resources and bandwidth, and
automatically delete it off the server so I never even have to bother
with it in Outlook. Of course, if your mail provider has server-side
anti-spam filtering and lets you define rules for your mailbox then
definitely include them, too, unless you have a need or desire to handle
spam locally.

With SpamPal you get the Bayesian filtering, but you also get a lot more
than just this one method for detecting spam. I wanted more than just
Bayes filtering to stop spam. Maybe that's all you need. I haven't
compared the system requirements of SpamBayes versus SpamPal (and its
plug-ins). With SpamPal you get a forum to ask questions to other users
and the authors are always present. SpamBayes has no user forum (just a
problem report messageboard) so you'll need to visit a general newsgroup
for help. When I went hunting around and trialed several anti-spam
solutions over a two month period, I looked at SpamPal, SpamBayes (which
is probably more featured now than when I looked at it), Mailwasher,
Norton Anti-Spam, and several others. I choose SpamPal. It's hard to
beat free, especially when it beats the commercial products. However,
you need to choose a product that you will actually use and know how to
use so it becomes an effective product.

If you want the support of a commercial product (rather than use
SpamPal's forum) and a product that comes in a pretty package, you can
get SpamPal as a commercial version called SpamSpector ("SpamSpector is
a state of the art anti-spam software based on SpamPal technology",
http://www.spamspector.com). They got permission from SpamPal's author
(but the plug-in authors have some gripes although the plug-ins work
just fine) to reuse their code rather than starting from scratch. In
fact, the screen shots shown at http://www.spamspector.com/download.html
are for SpamPal (other than the install wizard screen). They added some
additional features over SpamPal and its plug-ins. One is a P2P plug-in
that uses peer servers to record spam to let other users know that a
message is spam, something like what SpamNet does (i.e., you report the
message as spam to the shared server and then all other SpamSpector
users using that feature will also know that message is spam). Although
there is supposed to be an Outlook plug-in, I believe that is mostly for
convenience in configuring the SpamPal proxy. SpamSpector makes it
easier to install for those that need hand-holding during the install
and automatic configuration of their e-mail client(s) rather than having
to do the e-mail account configurations manually. For a free SpamPal, I
could afford the time to read the documentation to figure out how to
configure my e-mail clients and ask in their forum for help rather than
pay for a commercial version of SpamPal.

SpamBayes presents just one method of detecting spam. Spampal along
with all its plug-ins provides an entire suite of mechanisms to detect
spam.

 

[Lanwench [MVP - Exchange]]

Vanguardx wrote:

My goodness, what a novel! I can see this is a topic you take quite
seriously.

"Lanwench [MVP - Exchange]"

I personally prefer SpamBayes. It doesn't install a potentially
clunky local proxy....works quite well, and is also free.

Not quite true from what I read of SpamBayes at
http://spambayes.sourceforge.net/. It can be used as an Outlook
plug-in or as a local proxy just like SpamPal. As an Outlook
plug-in, that is the only e-mail client you can use it with.

I don't use the proxy feature, and Outlook is all I would consider using
for mail anyway, and all I will support for my clients besides OWA. ;-)

As a
local proxy, any e-mail client can use it. So your claim that
SpamPal is a clunky local proxy also applies to SpamBayes when it is
used as a local proxy (because you don't want to use a plug-in to
Outlook or you use more e-mail clients than just Outlook).
Personally I don't see using a plug-in (to only one e-mail client) as
less a clunky solution than using a proxy.

Well, I have had no problems using SpamBayes without a proxy. Don't get me
wrong - I used SpamPal quite some time ago and had no complaints with it. I
just prefer SpamBayes. A lot easier on my end users, too.

Since SpamBayes is *only*

providing Bayesian filtering then its options are far fewer than what
you get with SpamPal and its plug-ins, so SpamBayes smaller number of
configurable settings probably fits well into a single tab page in
Outlook's options.

Bayesian rocks.

I don't just use Outlook for e-mail. I've found Outlook is just too
flaky to leave it running all the time.

I do - and so do all my clients.

Microsoft has yet to fix the
problem of it leaving behind a remnant process in memory when you
supposedly exit Outlook

Yep - but note that this doesn't happen regularly to me or any client of
mine not using PocketPC or fax software.

which will interfere not only with subsequent
loads of Outlook but can screw up other applications. It is also a
bit of a pig for memory even when its GUI window is minimized when it
is left running continuously so it can monitor for new e-mails.
Perhaps in OL2003 there is now an option to show a tray icon for it
Yes...

but in prior versions you needed to use a registry hack to get OL2002
to use a tray icon (instead of consuming space in the taskbar with a
button).

Or use a third party app like Outlock.

Because leaving Outlook running all the time to have it
monitor for new e-mails is a bit too much for resources, I prefer to
leave an e-mail monitor utility loaded that will tell me when there
are new e-mails.

I'm glad you have a good solution worked out for yourself. My clients rely
heavily on Outlook for far more than mail. In an office with more than a
handful of people, I use antispam software on the server level (or use a
third party cleaning/relay service) to keep it coming in at all.

I use Magic Mail Monitor
(http://mmm3.sourceforge.net) which also has filtering rules. That
way, I can leave Magic loaded, have its tray icon tell me when there
are new messages, and use its filtering rules to eliminate spam at
the mail server. Magic goes through SpamPal just like Outlook so
spam gets tagged. Once tagged, a rule in Magic deletes that suspect
message from the mail server (but it has a logfile telling you which
messages got removed by a server-delete rule so you can check for
false positives).

SpamPal's primary detection is in using DNSBLs (DNS blacklists of
known spam sources) so you only need to have Magic download the
headers.

Those are losing popularity due to the overzealousness of most who
administer them. Have you ever tried to get an innocent server or IP off

Bayes-based filters require that the entire message get
downloaded. I haven't kept a running history of false positives but
my recollection is that I've had 2 false positives since last
February. I probably get 2 to 3 per week that leak past SpamPal and
all the plug-ins.

I'm not a fanatic

Due to the length of this post, may I good-naturedly suggest that this is
perhaps a case of protesting too much? <g>

<snip>

 

[Vanguardx]

"Lanwench [MVP - Exchange]"

Vanguardx wrote:

My goodness, what a novel! I can see this is a topic you take quite
seriously.

What I'd really like to find out is the effectiveness of SpamBayes
against *just* the Bayesian plug-in for SpamPal. It could be that one
of them is much better than the other but I haven't found any
independent comparisons and testing of them yet. The same population of
test e-mails (good and bad) would have to be used for both starting from
a pristine state. A feature comparison would be handy, too.

Since SpamPal already has a Bayes filter and I have seen that it does
work (once trained) and since SpamPal includes many more spam detection
mechanisms, I figure that even if their Bayesian plug-in was a little
less effective than SpamBayes then I'd still stick with SpamPal and its
Bayesian plug-in. But if the Bayesian plug-in in SpamPal sucked in
comparison to SpamBayes then I'd seriously consider replacing SpamPal's
Bayesian plug-in with SpamBays (as yet another proxy because of me using
e-mail clients besides Outlook so the plug-in wouldn't work for me).

SpamPal is great but it's not like I have any stake in that software.
If something is superior to SpamPal and/or its plug-ins then it's
something that I'll check out. It's just that Bayesian filtering is
just one way to detect spam, and I like having a multitude of ways to
flush those turds from my mailbox, especially if all those detection
methods are rolled into one product.

If SpamBayes proved to be far superior to SpamPal's Bayesian plug-in,
and because I use more than e-mail client than just Outlook (I use Magic
and Outlook Express, too) which obviates using the SpamBayes plug-in so
I would have to use the SpamBayes proxy, I'd have to configure yet
another proxy in the chain between my e-mail clients and my ISP's mail
server along with the inherent reduction of stability. For my ISP's
mail account, my e-mail client just goes through SpamPal. For my
freebie Yahoo Mail accounts, my e-mail client goes through SpamPal which
goes through YahooPOPs, so adding yet another proxy for SpamBayes starts
to get a bit too much configuration and management than I care for. I
like effective, but I also like easy and lazy.