 |
|
 |
|
Next: Source
|
| Author |
Message |
External

Since: Oct 05, 2003 Posts: 33
|
(Msg. 61) Posted: Wed Oct 08, 2003 6:47 pm
Post subject: Re: Another SWEN coming in every hour [Login to view extended thread Info.] Archived from groups: alt>comp>anti-virus (more info?)
|
|
|
Hi Gabriele!
"Gabriele Neukam" <Gabriele.Spamfighter.Neukam DeleteThis @t-online.de> wrote in message
news:bm1f3a$6f8$03$2@news.t-online.com...
> On that special day, Jan Il, (janilacno@spam.thatsallfolks) said...
>
> > Return-Path: <lamontc21 DeleteThis @cox.net>
> > Received: from bqok ([68.2.29.228]) by fed1mtao05.cox.net
> > (InterMail vM.5.01.06.05 201-253-122-130-105-20030824) with
SMTP
> > id <20031008055437.RIYQ10143.fed1mtao05.cox.net@bqok>;
> > Wed, 8 Oct 2003 01:54:37 -0400
>
> The Return-Path is "lamontc21@cox.net", the mail came over the IP number
> 68.2.29.228
>
> A whois search can give you more details
>
> Suchbegriff: 68.2.29.228
> Adresse: whois.arin.netSuchergebnis:
>
>
> OrgName: Cox Communications Inc.
> OrgID: CXA
> Address: 1400 Lake Hearn Drive
> City: Atlanta
> StateProv: GA
> PostalCode: 30319
> Country: US
> NetRange: 68.0.0.0 - 68.15.255.255
> CIDR: 68.0.0.0/12
> NetName: COX-ATLANTA
> NetHandle: NET-68-0-0-0-1
> Parent: NET-68-0-0-0-0
> NetType: Direct Allocation
> NameServer: NS.COX.NET
> NameServer: NS.WEST.COX.NET
> NameServer: NS.EAST.COX.NET
> Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
> RegDate: 2001-11-12
> Updated: 2002-08-21
> TechHandle: IC146-ARIN
> TechName: Cox Communications, Inc
> TechPhone: +1-404-269-7626
> TechEmail: abuse DeleteThis @cox.net
> OrgAbuseHandle: IC146-ARIN
> OrgAbuseName: Cox Communications, Inc
> OrgAbusePhone: +1-404-269-7626
> OrgAbuseEmail: abuse DeleteThis @cox.net
> OrgTechHandle: SHACK-ARIN
> OrgTechName: Shackelford, Scott
> OrgTechPhone: +1-404-269-7626
> OrgTechEmail: scott.shackelford DeleteThis @cox.com
> OrgTechHandle: WILLI-ARIN
> OrgTechName: Williams, Matt
> OrgTechPhone: +1-404-269-7626
> OrgTechEmail: matt.williams DeleteThis @cox.com
> OrgName: Cox Communications Inc.
> OrgID: CXA
> Address: 1400 Lake Hearn Drive
> City: Atlanta
> StateProv: GA
> PostalCode: 30319
> Country: US
> NetRange: 68.2.0.0 - 68.3.255.255
> CIDR: 68.2.0.0/15
> NetName: PHRDC-68-2-0-0
> NetHandle: NET-68-2-0-0-1
> Parent: NET-68-0-0-0-1
> NetType: Reassigned
> Comment:
> RegDate: 2002-05-15
> Updated: 2003-02-07
> OrgAbuseHandle: IC146-ARIN
> OrgAbuseName: Cox Communications, Inc
> OrgAbusePhone: +1-404-269-7626
> OrgAbuseEmail: abuse DeleteThis @cox.net
> OrgTechHandle: SHACK-ARIN
> OrgTechName: Shackelford, Scott
> OrgTechPhone: +1-404-269-7626
> OrgTechEmail: scott.shackelford DeleteThis @cox.com
> OrgTechHandle: WILLI-ARIN
> OrgTechName: Williams, Matt
> OrgTechPhone: +1-404-269-7626
> OrgTechEmail: matt.williams DeleteThis @cox.com
>
> Again this was a mail from a Cox iser to another Cox user. I am afraid
> this is the weak point; somehow the filter doesn't work on seemingly
> internal mail. Maybe your provider has got an idea how to catch those
> special cases.
> Also, you can forward the infected mail *without* attachment to
> abuse DeleteThis @cox.net and ask the abuse support to have the owner of the
> infected machine clean it or remove it from the internet. I hope they
> will do that; my own ISP has a close-to-zero-tolerance with spammers and
> virus spreaders. They give one warning, then they disable the mail. >
>
> Gabriele Neukam
>
> Gabriele.Spamfighter.Neukam DeleteThis @t-online.de
Thank you for the breakdown, and I will send the message to the abuse site,
and also to Cox. It does seem that they have been able to curtail some of
the messages, as I have only had a few come through in the last couple of
days (I can view my account from my webmail before I open my OE).
Thank you very much for all your time and help, Gabriele, I really do
appreciate all the information. Although tedious and frustrating, this has
been an extremely educational experience for me, and I have learned a great
deal from all the input and information that all you folks here have
provided on this issue. It has helped me broaden my thinking and research
techniques, as well as troubleshooting areas, which I am sure will come in
very handy in the times ahead. I have also learned about other programs that
can help control these types of problems, and how they work. This is what I
came to this newsgroup for, and I am very glad to see this is what I'm able
to find.
Jan
>
>
> --
> Because of Swen, my address is changed.
> Please contact Gabriele.Spamfighter.Neukam DeleteThis @t-online.de
> Wegen Swen musste ich meine Adresse veraendern.
> Bitte an Gabriele.Spamfighter.Neukam DeleteThis @t-online.de schreiben >> Stay informed about: Another SWEN coming in every hour |
|
| Back to top |
|
 |  |
External

Since: Sep 19, 2003 Posts: 1207
|
(Msg. 62) Posted: Wed Oct 08, 2003 8:13 pm
Post subject: Re: Another SWEN coming in every hour [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
|
|
|
"Jan Il" <janilacno.RemoveThis@spam.thatsallfolks> wrote in message news:oIQgb.47842$gv5.5759@fed1read05...
>...and it downloaded in spite of the Rules in place that says,
> any message with an attachment, delete from server.
How is OE supposed to determine whether or not the e-mail
has an attachment without downloading and looking at it? It
looks to me like this rule will cause all e-mail messages that
make it to this rule to be downloaded. This rule thwarts the
effects of its own action (if you didn't want it downloaded).
It would first download the message, find that it indeed does
have an attachment, then delete it from the server.
Unless you have the option checked elsewhere to leave
a copy on the server, downloaded e-mails are deleted
anyway ~ so this rule does nothing at all except thwart
any other rules where the action is to "not download" or
"delete from server" previous to any request to download.
It is beginning to look as if you didn't simplify as I had
previously thought that you had. The rule that you just
mentioned is in error. You must not use data which is
not in the header to effect an action of "delete from
server", or "do not download", because it is self defeating. >> Stay informed about: Another SWEN coming in every hour |
|
| Back to top |
|
 |  |
External

Since: Oct 05, 2003 Posts: 33
|
(Msg. 63) Posted: Wed Oct 08, 2003 8:13 pm
Post subject: Re: Another SWEN coming in every hour [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
|
|
|
Hi Rafters,
"FromTheRafters" <!0000@nomad.fake> wrote in message
news:vo9aco7jjhjs1a@corp.supernews.com...
>
> "Jan Il" <janilacno.DeleteThis@spam.thatsallfolks> wrote in message
news:oIQgb.47842$gv5.5759@fed1read05...
>
> >...and it downloaded in spite of the Rules in place that says,
> > any message with an attachment, delete from server.
>
> How is OE supposed to determine whether or not the e-mail
> has an attachment without downloading and looking at it? It
> looks to me like this rule will cause all e-mail messages that
> make it to this rule to be downloaded. This rule thwarts the
> effects of its own action (if you didn't want it downloaded).
> It would first download the message, find that it indeed does
> have an attachment, then delete it from the server.
And...you're asking 'me' how OE is supposed to determine this?? Hey,
remember me, I am the learnee here <vbg>
However, if it is indeed true, and I am not doubting you, just asking, that
the message must first be downloaded for the Rule to apply, then why does MS
provide for this action 'delete from server'. It is somewhat misleading in
it's inference by terminology that the message would indeed be deleted from
the server level at the point of contact by the Rule criteria. Being a
novice at all this, and not that familiar with all the workings of how the
programming works to seek out and determine if a message meets specific
criteria for the Rule action to act on, or at what point in the loading
process....well...I am sorta lost on this concept.
> Unless you have the option checked elsewhere to leave
> a copy on the server, downloaded e-mails are deleted
> anyway ~ so this rule does nothing at all except thwart
> any other rules where the action is to "not download" or
> "delete from server" previous to any request to download.
No Rafters, I don't have any have any options in place to provide for a copy
to be left of the server. To clarify, I only have 1, One, #1, Uno, Rule in
place at this time. It is..Rule: 'where the FROM line contains "M' or 'MS'
or Microsoft'; Action: 'delete from server'. I have tied to keep it as
basic and simple as I can. There are no other Rules above or below this one
and only Rule, so there should not be anything that can interfere with this
only Rule as far as I have been able to derive.
> It is beginning to look as if you didn't simplify as I had
> previously thought that you had. The rule that you just
> mentioned is in error. You must not use data which is
> not in the header to effect an action of "delete from
> server", or "do not download", because it is self defeating.
I am sorry for the confusion on my part to be more clear. But, would you
please clarify a bit more on this statement. I thought that I had referred
to the correct criteria data in the headers in the FROM line. However, if
this is not the case, then what have I left out or entered incorrectly? I
would truly appreciate it if you would explain this concept and where my
thinking is in error. I truly apologize for being so very dense on this,
but, the inference of the Rule options and what you are saying as
to the 'delete from server' is somewhat confusing. In what way is
it self-defeating?
>
Thank you,
Jan >> Stay informed about: Another SWEN coming in every hour |
|
| Back to top |
|
 |  |
External

Since: Jan 19, 2006 Posts: 282
|
(Msg. 64) Posted: Wed Oct 08, 2003 11:11 pm
Post subject: Re: Another SWEN coming in every hour [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
|
|
|
On Wed, 8 Oct 2003 13:08:22 -0700, "Jan Il"
<janilacno DeleteThis @spam.thatsallfolks> wrote:
>Now, this is interesting. Do I understand that you are saying that, even
>though I have just the one Rule at this point, that a Rule I might have
>created at some point earlier could still have some residual effect to
>somehow over ride the only existing Rule criteria?
You said in another recent post "Dave...I have set various Rules..."
Do you have one rule or more than one? Surely you can't be just
relying on this one rule to stop swen?
Jim. >> Stay informed about: Another SWEN coming in every hour |
|
| Back to top |
|
 |  |
External

Since: Oct 05, 2003 Posts: 33
|
(Msg. 65) Posted: Wed Oct 08, 2003 11:11 pm
Post subject: Re: Another SWEN coming in every hour [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
|
|
|
Jim,
"James Egan" <jegan RemoveThis @jegan.com> wrote in message
news:8g29ov48u02ccovnr0j7e0b8j62ondl9pt@4ax.com...
> On Wed, 8 Oct 2003 13:08:22 -0700, "Jan Il"
> <janilacno RemoveThis @spam.thatsallfolks> wrote:
>
> >Now, this is interesting. Do I understand that you are saying that, even
> >though I have just the one Rule at this point, that a Rule I might have
> >created at some point earlier could still have some residual effect to
> >somehow over ride the only existing Rule criteria?
>
> You said in another recent post "Dave...I have set various Rules..."
Yes, I did say that, and this statement was made in order to explain
that I have experimented with various Rules, trying various types of Rules,
actions, criteria, to see which ones did and did not work. *But*, I have
also stated in numerous posts in this thread that I have only one Rule in
place at a time. It is really the only way I can test how each acts or
reacts to the different messages. The one that is now in place is the most
basic, clear, straight forward. Rule: 'where the FROM line contains 'M' or
'MS'
or 'Microsoft', Action: 'delete from server'. It does not involve any 'stop
processing' as the action 'delete from server' does not even allow you to
select 'stop processing other rules', as it is grayed out.
> Do you have one rule or more than one? Surely you can't be just
> relying on this one rule to stop swen?
> Jim.
Yeppers...I surely am relying on this one Rule to stop the majority of the
Swen...and it *does*
do what it is supposed to do with all the Swen messages that fit the
criteria, *expect* for
certain types of the messages that are being allowed to be downloaded around
it, even though they do meet the Rule criteria. I don't believe that it is
the Rule that is the failure...but, something in the makeup of these
particular messages that is allowing them to circumvent the Rule criteria. I
said early on, that something in these messages was different, and with the
help of others like yourself here, I am beginning to see where this 'worm
hole' may be.
Why am I bothering to keep looking through the keyhole, first eating the
cookie that says "Shrink Me', then the one that does the opposite, when
there are simpler solutions at my finger tips? Simple... I'm curious. I'm
a
researcher. And, if something this vicious is able to force itself into my
inbox, then I want to know how and why. If it is somehow something that is
a result of a shortfall on the part of my ISP, or MS programming of their
security data with all the new gar'bage these days, or even myself,
well...then I want to know. While I can't do anything about MS...I can sure
present the facts to my ISP. But, that is what it will take...facts..not
just a theory. It is the facts that I am after.
I know this thread is long, and there's a lot of different input and
information on various levels and such, and I am truly sorry if my replies
to specific questions or suggestions to individual responders may seem to
confuse, I am trying to address the specifics in as detailed and clear a
manner as I can as it applies. As I am yours.  And, like you, there are
a lot who have not yet experienced this particular problem, or who don't
even have OE, but, are open minded and trying to look at all aspects of
what/where/how this could be happening, and offering suggestions or
information based upon their experience.
Thank you Jim, for your time and input, I really do appreciate it.
Jan
>
>
> >> Stay informed about: Another SWEN coming in every hour |
|
| Back to top |
|
 |  |
External

Since: Jan 19, 2006 Posts: 282
|
(Msg. 66) Posted: Thu Oct 09, 2003 10:57 am
Post subject: Re: Another SWEN coming in every hour [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
|
|
|
On Thu, 09 Oct 2003 02:18:13 -0700, Bart Bailey <Bartman.DeleteThis@invalid.biz>
wrote:
>>>Mailwasher allows for a partial DL with the first 20 lines as minimum.
>>
>>If it's a minimum, how do you to increase it?
>
>It can be set from 20 up to 800 lines
Is that in the registered version only? I can't see an editable
setting in the free version.
Maybe it's a registry setting?
Jim. >> Stay informed about: Another SWEN coming in every hour |
|
| Back to top |
|
 |  |
External

Since: Oct 08, 2003 Posts: 4
|
(Msg. 67) Posted: Thu Oct 09, 2003 11:55 am
Post subject: Re: Another SWEN coming in every hour [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
|
|
|
Jan Il wrote / skrev:
>>How is OE supposed to determine whether or not the e-mail
>>has an attachment without downloading and looking at it? It
>>looks to me like this rule will cause all e-mail messages that
>>make it to this rule to be downloaded. This rule thwarts the
>>effects of its own action (if you didn't want it downloaded).
>>It would first download the message, find that it indeed does
>>have an attachment, then delete it from the server.
Small email-school
An email-program can choose between 3 things basically in regards to how
they get information about an emailmessage from the server.
1. simply getting the size of the message (usually this is done by
sending the LIST-command which returns a lista of all message-ids along
with their size.
2. getting just the header of the message. This is the part that
contains information about subject, from, to date etc. Optionally one
can get additional lines along with the header (this is what I use in my
filter for MMM3, download for each message 25 lines along with the header).
3. get the entire message.
Now as for attachments. If doing 2 the email-program will know whether
the message has any attachments because it will contain a line like:
"Content-Type: multipart/"
The thing to consider when setting your email-client to automatically
delete all messages containing attachments is that it will delete
HTML-format emails, and also emails with signatures produced by some
Microsoft programs.
- Veronica Loell >> Stay informed about: Another SWEN coming in every hour |
|
| Back to top |
|
 |  |
External

Since: Sep 19, 2003 Posts: 1207
|
(Msg. 68) Posted: Thu Oct 09, 2003 12:54 pm
Post subject: Re: Another SWEN coming in every hour [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
|
|
|
"Jan Il" <janilacno.RemoveThis@spam.thatsallfolks> wrote in message news:zw3hb.49304$gv5.27537@fed1read05...
> Hi Rafters,
>
> "FromTheRafters" <!0000@nomad.fake> wrote in message
> news:vo9aco7jjhjs1a@corp.supernews.com...
> >
> > "Jan Il" <janilacno.RemoveThis@spam.thatsallfolks> wrote in message
> news:oIQgb.47842$gv5.5759@fed1read05...
> >
> > >...and it downloaded in spite of the Rules in place that says,
> > > any message with an attachment, delete from server.
> >
> > How is OE supposed to determine whether or not the e-mail
> > has an attachment without downloading and looking at it? It
> > looks to me like this rule will cause all e-mail messages that
> > make it to this rule to be downloaded. This rule thwarts the
> > effects of its own action (if you didn't want it downloaded).
> > It would first download the message, find that it indeed does
> > have an attachment, then delete it from the server.
>
> And...you're asking 'me' how OE is supposed to determine this?? Hey,
> remember me, I am the learnee here <vbg>
It was a rhetorical question <g>.
....and I don't think any of us here are done learning. :O)
> However, if it is indeed true, and I am not doubting you, just asking, that
> the message must first be downloaded for the Rule to apply, then why does MS
> provide for this action 'delete from server'.
I used to use OE's multiple identities to sort my e-mails. Any e-mails
I received would be downloaded but a copy left on the server so that
any for my mother could be later downloaded to her computer sitting
downstairs (she can't go upstairs). My main identity (on this computer)
could apply rules to delete from the server any e-mails to me, while still
retaining hers on the server. That way I could use her computer to get
her e-mail to her (her OE also left a copy on the server). My *other*
identity on the upstairs computer would be used to purge the server
of any collected e-mails.
The point here is that "delete from server" is not equivalent
to "do not download", and even so ~ Microsoft's allowing
you to choose an impossible scenario is typical Microsoft
behavior.
> It is somewhat misleading in it's inference by terminology that the
> message would indeed be deleted from the server level at the point
> of contact by the Rule criteria.
If it is deleted from the server, it will not be accessible via webmail
or through another computer using the same account. That is not to
say that it hasn't already been downloaded to the current client.
But, the e-mail body having met the criteria for the "do not
download" action is indeed, as you say, a little bit like having
the "do not open" instructions on the *inside* of the box.
People familiar with programming are quite used to the way
computers follow instructions even though they themselves
see those instructions as illogical. Perhaps they should have
programmed in a "greying out" of the "do not download"
action when it is determined that the criteria required it being
downloaded.
> Being a
> novice at all this, and not that familiar with all the workings of how the
> programming works to seek out and determine if a message meets specific
> criteria for the Rule action to act on, or at what point in the loading
> process....well...I am sorta lost on this concept.
I think the e-mail filter rules work on the message in two basic
parts - the header - and the body. The "attachment" or "inline
content" of the message is only a part of the body (rfc822).
The server has information about file size, and probably can
reference that information by its internal "Message ID" string.
The filter can determine file size (by querying the server), and
can parse the downloaded header (for string matching), or part
of the body (for HTML or MIME clues), or download the whole
thing.
> > Unless you have the option checked elsewhere to leave
> > a copy on the server, downloaded e-mails are deleted
> > anyway ~ so this rule does nothing at all except thwart
> > any other rules where the action is to "not download" or
> > "delete from server" previous to any request to download.
>
> No Rafters, I don't have any have any options in place to provide for a copy
> to be left of the server.
So then downloading implies deletion from the server anyway,
its default setting.
> To clarify, I only have 1, One, #1, Uno, Rule in
> place at this time.
One *compound* rule, but lets not quibble. ;o)
> It is..Rule: 'where the FROM line contains "M' or 'MS'
> or Microsoft'; Action: 'delete from server'. I have tied to keep it as
> basic and simple as I can. There are no other Rules above or below this one
> and only Rule, so there should not be anything that can interfere with this
> only Rule as far as I have been able to derive.
Okay, you just threw me off with that "attachment" and "delete"
post. This does seem simple enough. Just out of curiosity, have
you tried this?
Apply this rule after the message arrives
Where the From line contains 'M' or 'MS' or 'Microsoft'
Do not Download it from the server
followed by:
Apply this rule after the message arrives
Where the From line contains 'M' or 'MS' or 'Microsoft'
Delete it from server
> > It is beginning to look as if you didn't simplify as I had
> > previously thought that you had. The rule that you just
> > mentioned is in error. You must not use data which is
> > not in the header to effect an action of "delete from
> > server", or "do not download", because it is self defeating.
>
> I am sorry for the confusion on my part to be more clear. But, would you
> please clarify a bit more on this statement. I thought that I had referred
> to the correct criteria data in the headers in the FROM line.
You did, I was referring to the if "attachment" then "delete" rule
you mentioned.
> However, if
> this is not the case, then what have I left out or entered incorrectly? I
> would truly appreciate it if you would explain this concept and where my
> thinking is in error. I truly apologize for being so very dense on this,
> but, the inference of the Rule options and what you are saying as
> to the 'delete from server' is somewhat confusing. In what way is
> it self-defeating?
I misunderstood which "one rule" you were referring to.
My error. >> Stay informed about: Another SWEN coming in every hour |
|
| Back to top |
|
 |  |
External

Since: Jan 19, 2006 Posts: 282
|
(Msg. 69) Posted: Thu Oct 09, 2003 4:49 pm
Post subject: Re: Another SWEN coming in every hour [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
|
|
|
On Thu, 09 Oct 2003 07:02:00 -0700, Bart Bailey <Bartman DeleteThis @invalid.biz>
wrote:
>>Here's an example of one I just got which is just short of 50 lines
>>into the body text before the HTML tag.
>
>I think it's my header filter on the word "Microsoft"
>that's getting those.
I've got other rules which catch them so it's not a problem. I was
just trying to figure out how to extend the body download.
Regarding the registry, the free version has prefs in the same place
as you posted except under eCOSM\MailWasher instead of
FireTrust\MailWasher Pro
The "Lines to download" setting wasn't there but I tried adding it in
to see if it did anything but unfortunately it didn't. Looks like you
have to pay for the privilege.
Jim. >> Stay informed about: Another SWEN coming in every hour |
|
| Back to top |
|
 |  |
External

Since: Oct 08, 2003 Posts: 4
|
(Msg. 70) Posted: Thu Oct 09, 2003 6:07 pm
Post subject: Re: Another SWEN coming in every hour [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
|
|
|
|
|
| Back to top |
|
 |  |
External

Since: Oct 05, 2003 Posts: 33
|
(Msg. 71) Posted: Thu Oct 09, 2003 9:39 pm
Post subject: Re: Another SWEN coming in every hour [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
|
|
|
Hi Rafters!
"FromTheRafters" <!0000@nomad.fake> wrote in message
news:vob515jfuukc7b@corp.supernews.com...
>
> "Jan Il" <janilacno.DeleteThis@spam.thatsallfolks> wrote in message
news:zw3hb.49304$gv5.27537@fed1read05...
> > Hi Rafters,
> >
> > "FromTheRafters" <!0000@nomad.fake> wrote in message
> > news:vo9aco7jjhjs1a@corp.supernews.com...
> > >
> > > "Jan Il" <janilacno.DeleteThis@spam.thatsallfolks> wrote in message
> > news:oIQgb.47842$gv5.5759@fed1read05...
> > >
> > > >...and it downloaded in spite of the Rules in place that says,
> > > > any message with an attachment, delete from server.
> > >
> > > How is OE supposed to determine whether or not the e-mail
> > > has an attachment without downloading and looking at it? It
> > > looks to me like this rule will cause all e-mail messages that
> > > make it to this rule to be downloaded. This rule thwarts the
> > > effects of its own action (if you didn't want it downloaded).
> > > It would first download the message, find that it indeed does
> > > have an attachment, then delete it from the server.
> >
> > And...you're asking 'me' how OE is supposed to determine this?? Hey,
> > remember me, I am the learnee here <vbg>
> It was a rhetorical question <g>.
> ...and I don't think any of us here are done learning. :O)
Yeah...tell me about it!  ))
>
> > However, if it is indeed true, and I am not doubting you, just asking,
that
> > the message must first be downloaded for the Rule to apply, then why
does MS
> > provide for this action 'delete from server'.
>
> I used to use OE's multiple identities to sort my e-mails. Any e-mails
> I received would be downloaded but a copy left on the server so that
> any for my mother could be later downloaded to her computer sitting
> downstairs (she can't go upstairs). My main identity (on this computer)
> could apply rules to delete from the server any e-mails to me, while still
> retaining hers on the server. That way I could use her computer to get
> her e-mail to her (her OE also left a copy on the server). My *other*
> identity on the upstairs computer would be used to purge the server
> of any collected e-mails.
Well...I can see your need to do so, but, I am the only one who uses my
computer, so for me it is not necessary to keep anything saved on the server
I don't need. The only time I might do this is if I am accessing my account
from the webmail from work or away from home, and may have reply or draft
that I want to save for later. But, that is a very rare case, and surely
does not include spam and Swen type visitors. 'Less I want a new sample. <g>
> The point here is that "delete from server" is not equivalent
> to "do not download", and even so ~ Microsoft's allowing
> you to choose an impossible scenario is typical Microsoft
> behavior.
Oh..?? Well...I am beginning to see this as I go through the various Rules
and how they seem to relate to the different messages. It would seem that it
gives you a variety of choices, but, they don't all work as the wording in
the setups would suggest.
>
> > It is somewhat misleading in it's inference by terminology that the
> > message would indeed be deleted from the server level at the point
> > of contact by the Rule criteria.
>
> If it is deleted from the server, it will not be accessible via webmail
> or through another computer using the same account. That is not to
> say that it hasn't already been downloaded to the current client.
>
> But, the e-mail body having met the criteria for the "do not
> download" action is indeed, as you say, a little bit like having
> the "do not open" instructions on the *inside* of the box.
True, and if indeed, as you, and a few others have said, that the message
*must* be downloaded before the Rule criteria can be applied, then the
'delete from server' action is a totally useless and misleading option.
> People familiar with programming are quite used to the way
> computers follow instructions even though they themselves
> see those instructions as illogical. Perhaps they should have
> programmed in a "greying out" of the "do not download"
> action when it is determined that the criteria required it being
> downloaded.
While the more experienced may well be knowledgeable of how the programming
is designed, and knows the holes that extemporaneous or even irrelevant
actions or Rules are presented, the majority, like myself, will simply that
these at face value and expect them to work accordingly. This can lead to
frustration, confusion and perhaps even the spread of these things as a
result.
Actually, upon reviewing the information presented here on this issue, I can
see that it would be better to let the message download and then deal with
it. At least that way you know that the action is actually taking place, as
you can see if the message is in the delete box, or if in the inbox, and you
can then delete it.
>
> > Being a
> > novice at all this, and not that familiar with all the workings of how
the
> > programming works to seek out and determine if a message meets specific
> > criteria for the Rule action to act on, or at what point in the loading
> > process....well...I am sorta lost on this concept.
>
> I think the e-mail filter rules work on the message in two basic
> parts - the header - and the body. The "attachment" or "inline
> content" of the message is only a part of the body (rfc822).
> The server has information about file size, and probably can
> reference that information by its internal "Message ID" string.
>
> The filter can determine file size (by querying the server), and
> can parse the downloaded header (for string matching), or part
> of the body (for HTML or MIME clues), or download the whole
> thing.
This could be true, but, with a good many of the samples that I have seen,
especially lately, there does not seem to be a whole lot of consistency in
the messages, as to working, size, headers, body, they are changing all the
time. It is like living in an apartment building where one tenant has
roaches. They stray into your apt, and you spray or bomb to get rid of them.
They go somewhere else, then, in a while, they are back at your place, they
just make the rounds of the safest host at the time. But, unless the whole
building is bombed, they will not go away. Even then, you can bring home 1
in a paper bag, or a bag of potatoes, etc, and then...it all starts over
again. All you can do is try to put out the Roach Motels, sprays, bait, etc.
and hope that they will be kept to a minimum. But, they do, and will come
back, no matter how clean 'you' are.
>
> > > Unless you have the option checked elsewhere to leave
> > > a copy on the server, downloaded e-mails are deleted
> > > anyway ~ so this rule does nothing at all except thwart
> > > any other rules where the action is to "not download" or
> > > "delete from server" previous to any request to download.
> >
> > No Rafters, I don't have any have any options in place to provide for a
copy
> > to be left of the server.
>
> So then downloading implies deletion from the server anyway,
> its default setting.
>
> > To clarify, I only have 1, One, #1, Uno, Rule in
> > place at this time.
>
> One *compound* rule, but lets not quibble. ;o)
Why stop now!! I'm just now beginning to understand what the peach fuzz
you're talking about..sheesh...I'm on a roll!!...  ))
>
> > It is..Rule: 'where the FROM line contains "M' or 'MS'
> > or Microsoft'; Action: 'delete from server'. I have tied to keep it as
> > basic and simple as I can. There are no other Rules above or below this
one
> > and only Rule, so there should not be anything that can interfere with
this
> > only Rule as far as I have been able to derive.
>
> Okay, you just threw me off with that "attachment" and "delete"
> post. This does seem simple enough. Just out of curiosity, have
> you tried this?
As this thread (tome) has progressed, I have been trying various types and
combinations of Rules and actions along the way, but, always only one at a
time. Thus, yes, I can see that you may be reading more than one Rule from
post to post...but...you really must try to keep up...
> Apply this rule after the message arrives
> Where the From line contains 'M' or 'MS' or 'Microsoft'
> Do not Download it from the server
>
> followed by:
>
> Apply this rule after the message arrives
> Where the From line contains 'M' or 'MS' or 'Microsoft'
> Delete it from server
'k...now, I have a really great opportunity here to test your suggestion. I
will be going out of town on Sat. and won't be able to access my e-mail,
and I will set the Rules and actions exactly as you have suggested. By the
time I return home a next Friday, there should be some significant data to
research how well it has/hasn't worked on these particular messages.
I'll post back, if you'll check back. Deal?? I mean, there will be no point
to post back to thin air.
> > > It is beginning to look as if you didn't simplify as I had
> > > previously thought that you had. The rule that you just
> > > mentioned is in error. You must not use data which is
> > > not in the header to effect an action of "delete from
> > > server", or "do not download", because it is self defeating.
> >
> > I am sorry for the confusion on my part to be more clear. But, would you
> > please clarify a bit more on this statement. I thought that I had
referred
> > to the correct criteria data in the headers in the FROM line.
>
> You did, I was referring to the if "attachment" then "delete" rule
> you mentioned.
Oh...that one...that was like..a while ago....>
> > However, if
> > this is not the case, then what have I left out or entered incorrectly?
I
> > would truly appreciate it if you would explain this concept and where my
> > thinking is in error. I truly apologize for being so very dense on
this,
> > but, the inference of the Rule options and what you are saying as
> > to the 'delete from server' is somewhat confusing. In what way is
> > it self-defeating?
>
> I misunderstood which "one rule" you were referring to.
> My error.
s'ok. One really does seem to be the loneliest number. But ..it's
fall...days are longer....threads get longer....understandable. <g>
>
> >> Stay informed about: Another SWEN coming in every hour |
|
| Back to top |
|
 |  |
External

Since: Oct 05, 2003 Posts: 33
|
(Msg. 72) Posted: Thu Oct 09, 2003 9:54 pm
Post subject: Re: Another SWEN coming in every hour [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
|
|
|
Hi Veronica!
"Veronica Loell" <lista-nospam DeleteThis @nakawe.se> wrote in message
news:bm3bfq$79e$1@green.tninet.se...
> Jan Il wrote / skrev:
> >>How is OE supposed to determine whether or not the e-mail
> >>has an attachment without downloading and looking at it? It
> >>looks to me like this rule will cause all e-mail messages that
> >>make it to this rule to be downloaded. This rule thwarts the
> >>effects of its own action (if you didn't want it downloaded).
> >>It would first download the message, find that it indeed does
> >>have an attachment, then delete it from the server.
>
> Small email-school
Do they have one of these for the humans that have to use them?? <vbg>
> An email-program can choose between 3 things basically in regards to how
> they get information about an email message from the server.
>
> 1. simply getting the size of the message (usually this is done by
> sending the LIST-command which returns a list of all message-ids along
> with their size.
> 2. getting just the header of the message. This is the part that
> contains information about subject, from, to date etc. Optionally one
> can get additional lines along with the header (this is what I use in my
> filter for MMM3, download for each message 25 lines along with the
header).
> 3. get the entire message.
>
> Now as for attachments. If doing 2 the email-program will know whether
> the message has any attachments because it will contain a line like:
> "Content-Type: multipart/"
>
> The thing to consider when setting your email-client to automatically
> delete all messages containing attachments is that it will delete
> HTML-format emails, and also emails with signatures produced by some
> Microsoft programs.
>
> - Veronica Loell
I will certainly look further into this further when I return home, as I am
off to attend a PowerPoint conference for a week on Sat., and I am looking
forward to seeing what I have in the minnow bucket when I get back. The one
thing that confuses me is that the majority of the Swen messages seem to
have website type bodies, and not much separate text. I mean, I have done
this myself, created the body of an e-mail message in Word and then copied
it to the body of an OE e-mail to send. So...how can these rules determine
which HTML is the virus, and which are a legitimate e-mails in which someone
has copied some Word or other word processor text into the body of their
e-mail body? I am just asking, as I am truly curious how the HTML can be
determined as friend or foe...or can it?
Thank you for all your time and assistance, and information. I really
appreciate it.
Jan
> >> Stay informed about: Another SWEN coming in every hour |
|
| Back to top |
|
 |  |
External

Since: Jan 19, 2006 Posts: 282
|
(Msg. 73) Posted: Fri Oct 10, 2003 12:18 am
Post subject: Re: Another SWEN coming in every hour [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
|
|
|
On Thu, 09 Oct 2003 18:07:46 +0200, Veronica Loell
<lista-nospam.TakeThisOut@nakawe.se> wrote:
>James Egan wrote / skrev:
>[...]
>> to see if it did anything but unfortunately it didn't. Looks like you
>> have to pay for the privilege.
>>
>>
>> Jim.
>>
>
>Or use an open source tool that is really free instead...
Yes. mmm seems to do what I want better than (free version) mailwasher
so I'll be running with it.
Thanks
Jim. >> Stay informed about: Another SWEN coming in every hour |
|
| Back to top |
|
 |  |
External

Since: Sep 19, 2003 Posts: 1207
|
(Msg. 74) Posted: Fri Oct 10, 2003 7:12 pm
Post subject: Re: Another SWEN coming in every hour [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
|
|
|
"Jan Il" <janilacno.DeleteThis@spam.thatsallfolks> wrote in message news:jCqhb.50819$gv5.9472@fed1read05...
> > But, the e-mail body having met the criteria for the "do not
> > download" action is indeed, as you say, a little bit like having
> > the "do not open" instructions on the *inside* of the box.
>
> True, and if indeed, as you, and a few others have said, that the message
> *must* be downloaded before the Rule criteria can be applied, then the
> 'delete from server' action is a totally useless and misleading option.
Only if from the "delete from server" you mistakenly infer that
it means that you don't want to ever see that particular message.
What it really means is that you don't want that message retained
on the server. "Do not download" would mean that you don't want
to see that message (in OE) but by not downloading ~ the default
option of deleting after downloading wont take effect either, and
the message will be retained on the server for access by another
client such as webmail. I am assuming by all of this that the wording
being used means exactly that and nothing more. The "delete from
server" action means *only* that (the message will be deleted from
the server) and implies nothing other than that ~ same goes for the
"do not download" action. I could easily be wrong on both counts,
Microsoft's wording often makes me wonder...
(hide preview pane, rather than disable preview pane, was one
such case)
> > People familiar with programming are quite used to the way
> > computers follow instructions even though they themselves
> > see those instructions as illogical. Perhaps they should have
> > programmed in a "greying out" of the "do not download"
> > action when it is determined that the criteria required it being
> > downloaded.
>
> While the more experienced may well be knowledgeable of how the programming
> is designed, and knows the holes that extemporaneous or even irrelevant
> actions or Rules are presented, the majority, like myself, will simply that
> these at face value and expect them to work accordingly. This can lead to
> frustration, confusion and perhaps even the spread of these things as a
> result.
This is exactly the point that Sugien keeps trying to make. Misunderstanding
what they are being told because those doing the telling are using specific
language unfamiliar to those being given the information. However, if those
doing the telling use words more familiar to the public, the actual information
being conveyed becomes less accurate.
> Actually, upon reviewing the information presented here on this issue, I can
> see that it would be better to let the message download and then deal with
> it. At least that way you know that the action is actually taking place, as
> you can see if the message is in the delete box, or if in the inbox, and you
> can then delete it.
That is why I suggested using the rule with an action to highlight with
red or send to folder ~ you can see the results of the matching of text
to criteria. Then you can change the action to see if the action was the
intermittent problem. Such testing would be complicated if you didn't
work with a single rule at a time though.
[snip]
> > > To clarify, I only have 1, One, #1, Uno, Rule in
> > > place at this time.
> >
> > One *compound* rule, but lets not quibble. ;o)
>
> Why stop now!! I'm just now beginning to understand what the peach fuzz
> you're talking about..sheesh...I'm on a roll!!... ))
Quibbling follows:
Three simple rules...
Rule #1 = If "From:" contains "M" then highlight as red.
Rule #2 = If "From:" contains "MS" then highlight as red.
Rule #3 = If "From:" contains "Microsoft" then highlight as red.
....could also be written as one compound rule...
If "From:" contains "M", or "MS", or "Microsoft", then highlight as red.
[snip]
> > Okay, you just threw me off with that "attachment" and "delete"
> > post. This does seem simple enough. Just out of curiosity, have
> > you tried this?
>
> As this thread (tome) has progressed, I have been trying various types and
> combinations of Rules and actions along the way, but, always only one at a
> time. Thus, yes, I can see that you may be reading more than one Rule from
> post to post...but...you really must try to keep up...
Posts don't always show up (or get read) in the same order in which
you post them, I was replying directly to the post that mentioned
"if attachment then delete from server" after you said that you had
simplified the ruleset to one rule only. I'll try to keep up to the best
of my ability. ;o)
[snip]
> 'k...now, I have a really great opportunity here to test your suggestion. I
> will be going out of town on Sat. and won't be able to access my e-mail,
> and I will set the Rules and actions exactly as you have suggested. By the
> time I return home a next Friday, there should be some significant data to
> research how well it has/hasn't worked on these particular messages.
>
> I'll post back, if you'll check back. Deal?? I mean, there will be no point
> to post back to thin air.
I will stick around for a little while longer...I promise. >> Stay informed about: Another SWEN coming in every hour |
|
| Back to top |
|
 |  |
External

Since: Oct 05, 2003 Posts: 33
|
(Msg. 75) Posted: Fri Oct 10, 2003 7:49 pm
Post subject: Re: Another SWEN coming in every hour [Login to view extended thread Info.] Archived from groups: per prev. post (more info?)
|
|
|
Hi Rafters -
"FromTheRafters" <!0000@nomad.fake> wrote in message
news:voefi125ev7i8a@corp.supernews.com...
>
> "Jan Il" <janilacno RemoveThis @spam.thatsallfolks> wrote in message
news:jCqhb.50819$gv5.9472@fed1read05...
>
> > > But, the e-mail body having met the criteria for the "do not
> > > download" action is indeed, as you say, a little bit like having
> > > the "do not open" instructions on the *inside* of the box.
> >
> > True, and if indeed, as you, and a few others have said, that the
message
> > *must* be downloaded before the Rule criteria can be applied, then the
> > 'delete from server' action is a totally useless and misleading option.
>
> Only if from the "delete from server" you mistakenly infer that
> it means that you don't want to ever see that particular message.
> What it really means is that you don't want that message retained
> on the server. "Do not download" would mean that you don't want
> to see that message (in OE) but by not downloading ~ the default
> option of deleting after downloading wont take effect either, and
> the message will be retained on the server for access by another
> client such as webmail. I am assuming by all of this that the wording
> being used means exactly that and nothing more. The "delete from
> server" action means *only* that (the message will be deleted from
> the server) and implies nothing other than that ~ same goes for the
> "do not download" action.
Well, there are certain words in the English language that do have
particular meaning to some of us, even though I speak 5 languages (none
fluently, including English, my 1st language), but, when there are written
instructions presented, one would think that these words would denote the
actual meaning of the action that would happen if your chose this option. I
realize that is such a thing as Cyber-speak, Computerese, Syntax, VBA,
Esperanto, Monday Night Football, Legalese (aka, fine print), etc., but,
if they are going to market a product for the average non-expert user, they
should make sure that the wording they use is in keeping with the normally
accepted nomenclature of the language that they instructions are written
in. I should not have sit and look at each Rule and try to determine what
the peach fuzz it is *really* trying to say what selecting this Rule will
actually do.
(rant..'k..I'm done). If the action says 'delete from server', that should
mean, that as soon as the message that meets this criteria enters my
account, it should be deleted..plonked..zapped...'poof'. But, now......ya
mean it 'really' don't mean that?? And if I use the action 'don't down load'
that means it just sits out there in my account somewhere like an unwelcome
in-law that won't go away??
I could easily be wrong on both counts, Microsoft's wording often makes me
wonder...
Well..while it may make you wonder..it is driving me to picking plaster
nodes off the wall with a pair of tweezers....I'm well past the wallpaper at
this point...
>
> (hide preview pane, rather than disable preview pane, was one
> such case)
...eh....that too??
>
> > > People familiar with programming are quite used to the way
> > > computers follow instructions even though they themselves
> > > see those instructions as illogical. Perhaps they should have
> > > programmed in a "greying out" of the "do not download"
> > > action when it is determined that the criteria required it being
> > > downloaded.
> >
> > While the more experienced may well be knowledgeable of how the
programming
> > is designed, and knows the holes that extemporaneous or even irrelevant
> > actions or Rules are presented, the majority, like myself, will simply
that
> > these at face value and expect them to work accordingly. This can lead
to
> > frustration, confusion and perhaps even the spread of these things as a
> > result.
>
> This is exactly the point that Sugien keeps trying to make.
Misunderstanding
> what they are being told because those doing the telling are using
specific
> language unfamiliar to those being given the information. However, if
those
> doing the telling use words more familiar to the public, the actual
information
> being conveyed becomes less accurate.
I have been reading a lot of the other posts and responses to issue
regarding problems with all sorts of AV's, ones that work well for some, yet
not for others..and I wonder..how can this be? But, now I am beginning to
understand how this can happen. It really is not always a matter of user
ignorance per se, but, that the user is following the instructions, and
meaning of the letter of the actions/Rules, but, in fact, this is not really
what is happening. So, they 'are' doing what they think is the right thing
to do based upon the information their program is presenting to them.
I relate this somewhat, sorta, like a blind person standing at the corner of
the street after first finding, then pressing, the button to call for the
pedestrian crossing light. In some areas, there is the sound of a bird that
lets the sight impaired know when the pad light is green and they can start
across, only to find that even though the light is on, and they are given
the prompting that it is safe to cross, that the light/sound is really does
not mean that it is safe, it just means that the light is green...cross at
your own risk... ??? Perhaps not quite the proper comparison, but, you get
my drift.
>
> > Actually, upon reviewing the information presented here on this issue, I
can
> > see that it would be better to let the message download and then deal
with
> > it. At least that way you know that the action is actually taking
place, as
> > you can see if the message is in the delete box, or if in the inbox, and
you
> > can then delete it.
>
> That is why I suggested using the rule with an action to highlight with
> red or send to folder ~ you can see the results of the matching of text
> to criteria. Then you can change the action to see if the action was the
> intermittent problem. Such testing would be complicated if you didn't
> work with a single rule at a time though.
> [snip]
>
> > > > To clarify, I only have 1, One, #1, Undo, Rule in
> > > > place at this time.
> > >
> > > One *compound* rule, but lets not quibble. ;of)
> >
> > Why stop now!! I'm just now beginning to understand what the peach fuzz
> > you're talking about..sheet...I'm on a roll!!... ))
>
> Quibbling follows:
>
> Three simple rules...
>
> Rule #1 = If "From:" contains "ME" then highlight as red.
>
> Rule #2 = If "From:" contains "MS" then highlight as red.
>
> Rule #3 = If "From:" contains "Microsoft" then highlight as red.
>
> ...could also be written as one compound rule...
>
> If "From:" contains "ME", or "MS", or "Microsoft", then highlight as red.
Ohm...alright. I'll try it. Geese...now I'm color coding my
viruses...<sigh>...'key...
> [snip]
>
> > > Okay, you just threw me off with that "attachment" and "delete"
> > > post. This does seem simple enough. Just out of curiosity, have
> > > you tried this?
> >
> > As this thread (tome) has progressed, I have been trying various types
and
> > combinations of Rules and actions along the way, but, always only one at
a
> > time. Thus, yes, I can see that you may be reading more than one Rule
from
> > post to post...but...you really must try to keep up...
>
> Posts don't always show up (or get read) in the same order in which
> you post them, I was replying directly to the post that mentioned
> "if attachment then delete from server" after you said that you had
> simplified the rule to one rule only. I'll try to keep up to the best
> of my ability. ;of)
...well...'key....you're forgiven...not pardoned...just forgiven....
 )
[snip]
> > ...now, I have a really great opportunity here to test your suggestion.
I
> > will be going out of town on Sat. and won't be able to access my e-mail,
> > and I will set the Rules and actions exactly as you have suggested. By
the
> > time I return home a next Friday, there should be some significant data
to
> > research how well it has/hasn't worked on these particular messages.
> >
> > I'll post back, if you'll check back. Deal?? I mean, there will be no
point
> > to post back to thin air.
>
> I will stick around for a little while longer...I promise.
Okiedokie...then I'll layout the Rules and red color codes as you
instructed, and then report back what I find as a result when I get back.
Now.....all I have to do is layout a breadcrumb trail to find my way back
here after 8 days....whew!! On the other hand...never mind the
breadcrumbs...better make that boulders...with a big red 'AX'S on 'me!
Hang tight....I'll be back....film at 11:00...  ) >> Stay informed about: Another SWEN coming in every hour |
|
| Back to top |
|
 |  |
|
|
|