antispamsniper.com Forum Index antispamsniper.com
The reliable anti-spam protection
 
 FAQFAQ   SearchSearch     ProfileProfile   Log inLog in   RegisterRegister 

Black rule - not deleting from sever

 
Post new topic   Reply to topic    antispamsniper.com Forum Index -> AntispamSniper for TheBat!
View previous topic :: View next topic  
Author Message
Hefty Hippie



Joined: 08 Aug 2006
Posts: 12

PostPosted: Fri Aug 17, 2007 11:19 am    Post subject: Black rule - not deleting from sever Reply with quote

Hi,

I have a correctly configured black rule to catch mails with a certain word in the subject line.

ASS log shows relevant mails are being caught by the black rule but they are ending up in the junk folder.
Shouldn't these be deleted from server rather than arriving on my PC?

I usually use top option in ASS filtering mode (by headers then on client) but have tried second option (by headers on server) too - it doesn't seem to make any difference.

Any clues please?

EDIT - Sorry, forgot to add that I'm using the latest full version.
Back to top
View user's profile Send private message
vetaltm
Author


Joined: 05 Feb 2006
Posts: 748

PostPosted: Fri Aug 17, 2007 6:28 pm    Post subject: Reply with quote

Looks like the plug-in doesn't check the headers before downloading messages. Please check the following parameters on Servers tab:
- The account settings in plug-in must have the same domain name, user name and password as in TheBat Account Properties.
- Check the port numbers on POP3 and IMAP pages. If your server uses non-standard ports, the plug-in is unable to determine the account settings automatically.
- The option "Check-up the accounts automatically, on receiving new mail" must be turned on.

Try to run checking headers from the plug-in's toolbar (press the button "Delete spam"). If the accounts settings are specified properly, the plug-in must connect to the server, filter messages by headers and display a window with the progress of this operation. If this test works properly, but the procedure is not started automatically on downloading new mail, try to turn off some of the network filtering applications: popup blockers, antivirus, firewall etc. There are applications that don't allow the plug-in to filter the mail protocols. In this case you can either resolve the conflict by turning off an application that blocks the plug-in's hooks, or execute checking headers manually from the plug-in's toolbar.
Back to top
View user's profile Send private message Send e-mail
Hefty Hippie



Joined: 08 Aug 2006
Posts: 12

PostPosted: Sat Aug 18, 2007 11:48 am    Post subject: Reply with quote

Thanks V,

It's looking like my Zone Alarm Pro is causing the problem but all attempts to solve it have failed thus far.

Running ASS manually results in perfect connection to all servers and deletion from server of a test SPAM mail - verified in ASS log, shown as deleted from server.
However, next time TB checks for mail the very same test SPAM email arrives in my inbox.

TB has got full access (loopback etc) according to ZAP settings but, just to be sure, I added expert rules to cover loopback and ports 40000 through 41000 - sadly no difference.

I'll do some more digging as time allows and report back if I have any success.

Thanks again.
Back to top
View user's profile Send private message
Hefty Hippie



Joined: 08 Aug 2006
Posts: 12

PostPosted: Tue Aug 28, 2007 4:35 pm    Post subject: Reply with quote

No luck solving this, V, so I've given up for now - ASS' client-side filtering is more than good enough to cope with most of my requirements.

I set up full logging in ZAP to see if I could spot where ASS was being blocked but couldn't find anything, all connections from TB were allowed.
I also checked with Port Explorer and everything looks fine in there too.

Anyway, on a different tack, could you tell me if it's possible to filter mails by the number of recipients in the 'CC' field even where some of those recipients may be white-listed (in address book)?

You see, some of my less enlightened contacts have the habit of 'CCing' jokes and so forth to many email addresses. This is bad enough from a security point of view but things get worse when one of the recipients uses 'Reply to all'.

I suspect the answer will be one of your magic regular expressions but complicated ones are a bit beyond me. Wink

Any pointers or suggestions please?

Thanks in advance.
Back to top
View user's profile Send private message
vetaltm
Author


Joined: 05 Feb 2006
Posts: 748

PostPosted: Tue Aug 28, 2007 8:27 pm    Post subject: Reply with quote

Hefty Hippie wrote:
No luck solving this, V, so I've given up for now - ASS' client-side filtering is more than good enough to cope with most of my requirements.

I set up full logging in ZAP to see if I could spot where ASS was being blocked but couldn't find anything, all connections from TB were allowed.
I also checked with Port Explorer and everything looks fine in there too.

Confirmed. It looks like ZAP works improperly in High security mode, because it blocks the outgoing connections if they are not allowed explicitly. To make the plug-in work properly you can set the Internet Zone Security to Medium in ZoneAlarm (Firewall | Main | Internet Zone Security). Alternatively leave the mode High for Internet Zone Security, click on Custom button in Internet Zone Security section and explicitly allow the access to outgoing TCP mail ports 110 (POP3), 25 (SMTP), 143 (IMAP) and outgoing UDP port 53 (DNS) for the Internet Zone.

Hefty Hippie wrote:

Anyway, on a different tack, could you tell me if it's possible to filter mails by the number of recipients in the 'CC' field even where some of those recipients may be white-listed (in address book)?

You see, some of my less enlightened contacts have the habit of 'CCing' jokes and so forth to many email addresses. This is bad enough from a security point of view but things get worse when one of the recipients uses 'Reply to all'.

I suspect the answer will be one of your magic regular expressions but complicated ones are a bit beyond me. Wink

Here is a black rule for blocking the messages having at least the specified number of addresses in CC field:
Code:
Header{CC} =~ (?:.*@.*){3}

The number at the end of expression (3) defines the minimum number of recipients in CC field required for blocking a message. You can change it according to your preferences.
Back to top
View user's profile Send private message Send e-mail
Hefty Hippie



Joined: 08 Aug 2006
Posts: 12

PostPosted: Thu Aug 30, 2007 10:57 am    Post subject: Reply with quote

Thanks again, vetaltm, but sadly no luck with the ZAP issue.

I've added the custom rules that you suggested and still have expert rules under program control to give TB full access. Still no signs in ZAP log to suggest any problems, still no signs of any problems showing up in Port Explorer but still no server-side filtering.

If you can think of anything else I can try then by all means suggest it but apart from that I wouldn't worry too much - client-side filtering alone works well enough.

Cheers,
Back to top
View user's profile Send private message
Hefty Hippie



Joined: 08 Aug 2006
Posts: 12

PostPosted: Sun Oct 07, 2007 2:02 am    Post subject: Reply with quote

Vetaltm,

Just FYI, I never did manage to solve this problem but it looks like you have - I updated to the latest version of the plug-in yesterday and filtering on server is working again. Cool
Back to top
View user's profile Send private message
Hefty Hippie



Joined: 08 Aug 2006
Posts: 12

PostPosted: Mon Sep 08, 2008 12:46 pm    Post subject: Reply with quote

vetaltm wrote:

Here is a black rule for blocking the messages having at least the specified number of addresses in CC field:
Code:
Header{CC} =~ (?:.*@.*){3}

The number at the end of expression (3) defines the minimum number of recipients in CC field required for blocking a message. You can change it according to your preferences.


Vetaltm,

Should "Header{To} =~ (?:.*@.*){3}" work as well?

I only ask as I've added that rule but it doesn't seem to work at all.

Please let me know,

HH

PS
Nice work with the new version!
It's working here without trauma and it seems to be much, much faster than previous versions.
Back to top
View user's profile Send private message
vetaltm
Author


Joined: 05 Feb 2006
Posts: 748

PostPosted: Mon Sep 08, 2008 2:09 pm    Post subject: Reply with quote

Hefty Hippie wrote:
vetaltm wrote:

Here is a black rule for blocking the messages having at least the specified number of addresses in CC field:
Code:
Header{CC} =~ (?:.*@.*){3}

The number at the end of expression (3) defines the minimum number of recipients in CC field required for blocking a message. You can change it according to your preferences.


Should "Header{To} =~ (?:.*@.*){3}" work as well?

I only ask as I've added that rule but it doesn't seem to work at all.

Yes, the rule above recognizes the messages having 3 or more addresses in To: header. Make sure you are adding the rule properly:
- Add new rule
- Add new RegExp condition
- Enter (?:.*@.*){3} as expression
- Enter To in "To header" field

It is possible to check the new rule using "Testing mode" in plug-in.
Back to top
View user's profile Send private message Send e-mail
Hefty Hippie



Joined: 08 Aug 2006
Posts: 12

PostPosted: Mon Sep 08, 2008 2:41 pm    Post subject: Reply with quote

Cheers V,

I'd set the rule in previous version of ASS and it seemed to have been imported in to new version OK.

However, just to be safe, I've just binned old, imported rules and made new rules in accord with your instructions above. I'll shout back if there are problems.

Many thanks for the quick reply.

HH
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    antispamsniper.com Forum Index -> AntispamSniper for TheBat! All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Powered by phpBB © 2001, 2005 phpBB Group