Re: Useful filter to catch those blank spam+pdf

2007-08-02 Thread Martin Schuster
Hello Aubrey,

 Just thought I would share this in case anyone
 else finds useful. I am getting a large amount of
 spam with just a PDF attachment (a worm) and a
 blank email

 here is a bit of regex that catches them


Somehow your solution did not work here. Just tried another way with
some messages here, and it seems to work:

--
Condition:

Text [match] ^$
AND Message source [match] \d{10}.pdf
--

^$ is the regex for empty string and \d{10}.pdf catches the
attachments that (at least at the moment) always have a 10 digit
number at the end of the filename.

Here's the filter for pasting:

 TB! Message Filter 
beginFilter
UID: [ADB1D37C.01C7C88C.6ED986D8.5693C83F]
Name: Uncatched\20Spam
Filter: {\0D\0A\20`4`2`^$\0D\0A0`6`2`/5Cd{10}.pdf\0D\0A}
SetMemo Text blankPDF\0D\0A
MoveMessage folder \5C\5C\5C$JUNK$
SetColour 2031922646
IsActive
Ignore
endFilter


What do you think? I am not the most experienced when it comes to
regex, so maybe some guru might want to have a look at it?

-- 
Martin
TB! 3.99.3 on Windows XP 5.1 Service Pack 2



Current version is 3.99 | 'Using TBUDL' information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re[2]: Useful filter to catch those blank spam+pdf

2007-08-02 Thread Jim Kyle
On Thursday, August 2, 2007, at 4:12:06 AM, Martin Schuster wrote:

 Just tried another way with some messages here, and it seems to work

I modified this slightly to catch the newer *.zip stock spams, and it
missed a few, so I made an even more drastic change:

 TB! Message Filter 
beginFilter
UID: [7EBEA000.01C7D515.6990CCD5.54269A30]
Name: Uncaught\20Spam
Filter: {\0D\0A\20`4`2`^$\0D\0A0`16`0`2\0D\0A}
SetMemo Text blank\0D\0A
MarkRead
MoveMessage folder \5C\5C\5C$JUNK$
IsActive
Ignore
endFilter

Note that this will catch ALL messages with empty text plus attachments of
any sort. Seems to be doing the job for me, but best check the Junk folder
before wiping it just in case some wanted mail gets trapped...

I pasted it into Common Folder Incoming, as the last filter in the chain,
and applied to all my active accounts.

-- 
Jim Kyle

Using The Bat! v3.85.03 on Windows 98 4.10 Build  A 
with AntiSpamSniper Version 2.5.0.2



Current version is 3.99 | 'Using TBUDL' information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re[3]: Useful filter to catch those blank spam+pdf

2007-08-02 Thread rich gregory
JK I modified this slightly to catch the newer *.zip stock spams, and it
JK missed a few, so I made an even more drastic change:

JK  TB! Message Filter 
JK beginFilter
JK UID: [7EBEA000.01C7D515.6990CCD5.54269A30]
JK Name: Uncaught\20Spam
JK Filter: {\0D\0A\20`4`2`^$\0D\0A0`16`0`2\0D\0A}
JK SetMemo Text blank\0D\0A
JK MarkRead
JK MoveMessage folder \5C\5C\5C$JUNK$
JK IsActive
JK Ignore
JK endFilter

JK Note that this will catch ALL messages with empty text plus attachments of
JK any sort. Seems to be doing the job for me, but best check the Junk folder
JK before wiping it just in case some wanted mail gets trapped...

JK I pasted it into Common Folder Incoming, as the last filter in the chain,
JK and applied to all my active accounts.


Will this filter work under TB! v 2.12 if I paste it into my Sorting
Office?



-- 
Beautiful Butterfly Displays
http://FramedButterflyArt.com

Random tagline:
Artificial Intelligence is no match for Natural Stupidity.



Current version is 3.99 | 'Using TBUDL' information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re[4]: Useful filter to catch those blank spam+pdf

2007-08-02 Thread Jim Kyle
On Thursday, August 2, 2007, at 4:21:13 PM, rich gregory wrote:

 Will this filter work under TB! v 2.12 if I paste it into my Sorting
 Office?

I don't know, not having used TB! before version 3...

-- 
Jim Kyle

Using The Bat! v3.85.03 on Windows 98 4.10 Build  A 
with AntiSpamSniper Version 2.5.0.2



Current version is 3.99 | 'Using TBUDL' information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re: Useful filter to catch those blank spam+pdf

2007-08-02 Thread Roelof Otten
Hallo rich,

On Thu, 2 Aug 2007 17:21:13 -0400GMT (2-8-2007, 23:21 +0200, where I
live), you wrote:

RG Will this filter work under TB! v 2.12 if I paste it into my Sorting
RG Office?

You could've tried it instead of asking. :-)
I think that the filter won't even paste in your sorting office v3 has
a different filter structure than v1/v2.

-- 
Groetjes, Roelof

WinErr 007: System price error - Inadequate money spent on hardware
http://www.voormijalleen.nl/
The Bat! 3.99.8
Windows XP 5.1 Build 2600 Service Pack 2
2 pop3 accounts
OTFE enabled
P4 3GHz
2 GB RAM


pgpIzJrFatFFY.pgp
Description: PGP signature

Current version is 3.99 | 'Using TBUDL' information:
http://www.silverstones.com/thebat/TBUDLInfo.html

Re[2]: Useful filter to catch those blank spam+pdf

2007-08-02 Thread rich gregory
RG Will this filter work under TB! v 2.12 if I paste it into my Sorting
RG Office?

RO You could've tried it instead of asking. :-)
RO I think that the filter won't even paste in your sorting office v3 has
RO a different filter structure than v1/v2.


I /did/ paste it into my sorting office but I looked thru the different
screens of that filter and couldn't find any actions for it to perform.
I don't trust my knowledge of this to be sure I didn't miss something.





-- 
Beautiful Butterfly Displays
http://FramedButterflyArt.com

Random tagline:
Communism doesn't work because people like to own stuff.   - Frank Zappa



Current version is 3.99 | 'Using TBUDL' information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re[3]: Useful filter to catch those blank spam+pdf

2007-08-02 Thread Jim Kyle
On Thursday, August 2, 2007, at 6:46:56 PM, rich gregory wrote:

 I looked thru the different screens of that filter and couldn't find any
 actions for it to perform.

There are two conditions: Text match ^$ and Message(attributes) is with
attachments. The actions are: Set memo blank, Mark the message as read, and
Move to folder \\\Junk.

I don't know whether these are available in the older version of the
sorting office.

I did discover, since my earlier posting, that I have to copy the filter to
Incoming of each account to be sure of catching all of the spam messages.
I suspect that one of my other common filters was trapping some of them.

-- 
Jim Kyle

Using The Bat! v3.85.03 on Windows 98 4.10 Build  A 
with AntiSpamSniper Version 2.5.0.2



Current version is 3.99 | 'Using TBUDL' information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re: Useful filter to catch those blank spam+pdf

2007-08-01 Thread alists
Hello Aubrey,

Used to be that you could paste the text of a filter in, now I
can't find the option at all. How do we do it in the new version?

Thanks!

A  TB! Message Filter 
A beginFilter
A UID: [FD469CA0.01C7C58C.1608C81C.1E42DC91]
A Name: New\20filter
A Filter:
A 
{\0D\0A\20`6`2`-+[0-9]+/5Cr/5Cn(?:[a-zA-Z/5C-]+:\20[^/5Cr]+/5Cr/5Cn)+(?:/5Cr/5Cn){1,}-+[0-9]+/5Cr/5Cn(?:[a-zA-Z/5C-]+:\20[^/5Cr]+/5Cr/5Cn)*Content-Type:\20application/2Fpdf;\0D\0A}
A SetMemo Text blankPDF\0D\0A
A IsActive
A Ignore
A endFilter


-- 

Best regards,
 alistsmailto:[EMAIL PROTECTED]



Current version is 3.99 | 'Using TBUDL' information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re: Useful filter to catch those blank spam+pdf

2007-08-01 Thread Mark Partous

Hello,

Wednesday, August 1, 2007, 8:36:20 AM, you wrote:

awc Used to be that you could paste the text of a filter in, now I
awc can't find the option at all. How do we do it in the new version?

Whith focus on the heading of the set of rules where you want the new
rule to reside:

Edit, Paste or simply
Ctrl-V

Not that it has caught anything yet.

When pasted, I get a rule saying:
Message Source match -+[0-9]+\r\n(?:[a-zA-Z\-]+: 
[^\r]+\r\n)+(?:\r\n){1,}-+[0-9]+\r\n(?:[a-zA-Z\-]+: [^\r]+\r\n)*Content-Type: 
application/pdf;

and an action: Set memo.


-- 
Best Wishes,
Mark
using The Bat! 3.99.8





Current version is 3.99 | 'Using TBUDL' information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Useful filter to catch those blank spam+pdf

2007-07-13 Thread Aubrey
Dear Bats

Just thought I would share this in case anyone
else finds useful. I am getting a large amount of
spam with just a PDF attachment (a worm) and a
blank email

here is a bit of regex that catches them

Message Source *matches* -+[0-9]+\r\n(?:[a-zA-Z\-]+: 
[^\r]+\r\n)+(?:\r\n){1,}-+[0-9]+\r\n(?:[a-zA-Z\-]+: [^\r]+\r\n)*Content-Type: 
application/pdf;

(detects blank messages with a pdf attachment)

As an alternative the filter copy is

 TB! Message Filter 
beginFilter
UID: [FD469CA0.01C7C58C.1608C81C.1E42DC91]
Name: New\20filter
Filter: 
{\0D\0A\20`6`2`-+[0-9]+/5Cr/5Cn(?:[a-zA-Z/5C-]+:\20[^/5Cr]+/5Cr/5Cn)+(?:/5Cr/5Cn){1,}-+[0-9]+/5Cr/5Cn(?:[a-zA-Z/5C-]+:\20[^/5Cr]+/5Cr/5Cn)*Content-Type:\20application/2Fpdf;\0D\0A}
SetMemo Text blankPDF\0D\0A
IsActive
Ignore
endFilter

 --
Aubrey



Windows : Windows XP Service Pack 2 Build 2600
Bat Version 3.51.10



Current version is 3.99 | 'Using TBUDL' information:
http://www.silverstones.com/thebat/TBUDLInfo.html