Spam filter in O2k?

P

Puddin' Man

Little desktop, W2k sp4, Outlook 2000, DSL, etc.

Due to the apparent dereliction of my ISP (ATT), I need to apply a spam
filter to my Email client (O2k).

Would like to have Email containing the text string "Replica Watches"
diverted to a junk folder or "Deleted Items".

This is practical?

Thx,
Puddin'

"Take Yo' Hand Out My Pocket (I Ain't Got Nothing What Belongs To You)!"
- Rice Miller, who probably never even _heard_ of Paulson, Bernanke, etc
 
D

Diane Poremsky [MVP]

Why aren't you impressed with Rules Wizard? It is the most obvious way to
do what you want- create a rule that looks for those words and delete the
message if one is found. Otherwise, Outlook doesn't offer another method -
you'll need to use an antispam program.

--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
(e-mail address removed)

EMO - a weekly newsletter about Outlook and Exchange:
(e-mail address removed)

You can access this newsgroup by visiting
http://www.microsoft.com/office/community/en-us/default.mspx or point your
newsreader to msnews.microsoft.com.
 
V

VanguardLH

Puddin' Man said:
Little desktop, W2k sp4, Outlook 2000, DSL, etc.

Due to the apparent dereliction of my ISP (ATT), I need to apply a spam
filter to my Email client (O2k).

Would like to have Email containing the text string "Replica Watches"
diverted to a junk folder or "Deleted Items".

This is practical?

Thx,
Puddin'

"Take Yo' Hand Out My Pocket (I Ain't Got Nothing What Belongs To You)!"
- Rice Miller, who probably never even _heard_ of Paulson, Bernanke, etc

(2nd repost on Microsoft's NNTP server. 1st didn't show up after 12
hours. Ignore if duplicated on your NNTP server.)

And just how were you unimpressed that a blacklist rule based on strings
in the Subject couldn't get rid of messages that had those strings in
the Subject header?

Personally I don't see searching on strings in the Subject header is
going to be very effective at getting rid of spam. After all, the
spammer wants you to read their e-mail so they are unlikely to use a
Subject that cues the recipient that the e-mail is spam. Instead it'll
be something like "Hey, take a look at this" or "Important status
regarding your account". Identifying spam by its Subject header is only
marginally more useful than checking their bogus e-mail address which is
a worthless method. Detect by e-mail address is worthless. Detect by
Subject is nearly worthless. What if they ISO encode the Subject
header? Your ASCII string won't match. What if they substitute
look-alike characters, like 1 for small-case L, or 0 (zero) for O (oh),
or $ for S, or trademark symbol for R or upper-case a with umlat for an
"a"? Are you going to check for all those permutations? With regex it
wouldn't be that difficult but Microsoft doesn't embrace regular
expressions (too Unix-like for their taste).

Get some anti-spam software. Don't know your budget so don't know if
you're only interested in freebies or payware. Freebies include
SpamPal, SpamBayes, Spamhilator, and several others. Payware includes
SpamBully, Mailwasher, and several others. There is also SpamNet
(renamed to Cloudmark's Desktop) and some other voting schemes but the
problem with those is that you end up voting on spam to help others not
see it, so you have to poll at longer intervals hoping others already
got the spam and voted on it. I've used SpamPal in the past but have
gotten so few spams leaking past the email provider's filter that I
discontinued using it. It equalled or surpassed many freebie and
payware products. I've tried Spamhilator and it looks interesting but
it actually requires a lot of tweaking over time to condition it
properly to work with your e-mails to avoid LOTS of false positives.
SpamBayes and many others are just Bayesian filters and SpamPal has that
with a plug-in but incorporates several other methods of detecting spam;
however, DNSBLs (public blacklists) is its primary method of detecting
known spam sources.
 
P

Puddin' Man

Why aren't you impressed with Rules Wizard? It is the most obvious way to
do what you want- create a rule that looks for those words and delete the
message if one is found.

It will scan the message -body- for "Replica Watches" and delete the
message?

I saw nothing in the Rules Help relating to scan of the message body.

Would appreciate any tips on how to define a rule that will scan the
message body for a user-defined spam-string.
Otherwise, Outlook doesn't offer another method -
you'll need to use an antispam program.

I only need something that works.

S-o-m-e-t-h-i-n-g T-h-a-t W-o-r-k-s!

Thx,
P

"Take Yo' Hand Out My Pocket (I Ain't Got Nothing What Belongs To You)!"
- Rice Miller, who probably never even _heard_ of GW Bush, Paulson, etc
 
P

Puddin' Man

So, you can't see the "with specific words in the message body" condition?

I missed it. Eyes are not what they used to be. Thanks.

So I use the wizard to create a rule: if "Replica Watches" found,
delete message. Rule active.

I had saved the last spam from days ago. So, I forward it to
myself to test.

And it failed. Left the forwarded spam with "Replica Watches"
in the inbox.

But wait! If I copy, paste into an editor, "Replica Watches" becomes:

Re ubx pl cmb ic gop a ygp Wa nuk tch snt es

So the garbage-spamsters are doing some kind of coding.

Should I try, create a rule for such code? Think it'd do any
good?

Or should I pursue program above?


Thx,
P

"Take Yo' Hand Out My Pocket (I Ain't Got Nothing What Belongs To You)!"
- Rice Miller, who probably never even _heard_ of GW Bush, Paulson, etc
 
D

Diane Poremsky [MVP]

You'll need to use a 3rd party tool, trying to create a rule to catch all
the funky spellings and embedded code is impossible.

--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
(e-mail address removed)

EMO - a weekly newsletter about Outlook and Exchange:
(e-mail address removed)

You can access this newsgroup by visiting
http://www.microsoft.com/office/community/en-us/default.mspx or point your
newsreader to msnews.microsoft.com.
 
D

Diane Poremsky [MVP]

Rules don't support wild cards. you could use 'body contains wa and tch' -
but it only works if the message has the word broken like that - if the
spammer switches to wat and ch, you'll need another rule.

--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
(e-mail address removed)

EMO - a weekly newsletter about Outlook and Exchange:
(e-mail address removed)

You can access this newsgroup by visiting
http://www.microsoft.com/office/community/en-us/default.mspx or point your
newsreader to msnews.microsoft.com.
 
D

Diane Poremsky [MVP]

it's been around for years, so it should work with win2k. I'd certainly try
version 1.0.4 - from their windows page: "The Outlook addin is an
application of the SpamBayes project. To our knowledge, the current version
of the plug-in should work with Windows 98 and above and Outlook 2000 or
above."

--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
(e-mail address removed)

EMO - a weekly newsletter about Outlook and Exchange:
(e-mail address removed)

You can access this newsgroup by visiting
http://www.microsoft.com/office/community/en-us/default.mspx or point your
newsreader to msnews.microsoft.com.
 
J

John

Puddin' Man said:
Put "impossible" in context.

Let's assume Outlook lets you do that and your genius idea below works fine.
Spammers then switch to:

Reub xplcmb ic gop a ygp Wa nuk tch s ntes
Regbl pl idx ic yss a osj Wa vrq tch ch qes
R eqko pl dqp ic vre a ivm Wa oyl tchsxnes
Rep lw pl wik ic fub a fvq Wa uxj tch i b mes
Re kgc pl wdn ic qvd a dbr Wa ggo t ch c jye s

Whatcha gonna do now? Create another genius rule? Great. Spammers then
change it to something else. Does the word 'impossible' start to make sense
now?
Here are samples from 5 different "Replica Watch" spams:

Re ubx pl cmb ic gop a ygp Wa nuk tch snt es
Re gbl pl idx ic yss a osj Wa vrq tch chq es
Re qko pl dqp ic vre a ivm Wa oyl tch sxn es
Re plw pl wik ic fub a fvq Wa uxj tch ibm es
Re kgc pl wdn ic qvd a dbr Wa ggo tch cjy es

What makes you think spammers can't and won't change them?
 
P

Puddin' Man

Let's assume Outlook lets you do that and your genius idea below works fine.
Spammers then switch to:

Reub xplcmb ic gop a ygp Wa nuk tch s ntes
Regbl pl idx ic yss a osj Wa vrq tch ch qes
R eqko pl dqp ic vre a ivm Wa oyl tchsxnes
Rep lw pl wik ic fub a fvq Wa uxj tch i b mes
Re kgc pl wdn ic qvd a dbr Wa ggo t ch c jye s

No genius. Just programming. Parsing a string.
Whatcha gonna do now? Create another genius rule? Great. Spammers then
change it to something else. Does the word 'impossible' start to make sense
now?


What makes you think spammers can't and won't change them?

Never had such a thought. Strange that you did.

If I received repetitive-pattern spam that bothered me over a
certain period of time, I would, indeed, create a new "rule" for it.
If "rules" were robust enough to allow such.

That's not to say that the spammers couldn't change codings often
enough to frustrate po' me.

But spammers aren't (ahem) genii, and they do repeat patterns, etc.

The issue for me is flexibility in programming in O2k. As a partial
defense.

P

"Take Yo' Hand Out My Pocket (I Ain't Got Nothing What Belongs To You)!"
- Rice Miller, who probably never even _heard_ of GW Bush, Paulson, etc
 
J

John

Puddin' Man said:
If I received repetitive-pattern spam that bothered me over a
certain period of time, I would, indeed, create a new "rule" for it.
If "rules" were robust enough to allow such.

Usually by the time we got a new rule setup, spammers have moved on to
different subject lines. I've given up on subject/message body blocking.
It's a lot easier and quicker to delete junk that got thru the filter.
 
D

Diane Poremsky [MVP]

No genius. Just programming. Parsing a string.

That would be fine, if outlook 2000 supported rules that used wildcards. It
doesn't. Later versions also don't but they do include a bayes-based filter
that is updated monthly by microsoft and most spam is captured by it.

--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
(e-mail address removed)

EMO - a weekly newsletter about Outlook and Exchange:
(e-mail address removed)

You can access this newsgroup by visiting
http://www.microsoft.com/office/community/en-us/default.mspx or point your
newsreader to msnews.microsoft.com.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads


Top