Re: Worm filter text

2003-09-29 Thread Allie Martin
Neal Laugman, [NL] wrote:

AM My mailserver, MDaemon uses spam assassin technology, in
AM combination with blacklist checking and a Bayesian filtering
AM mechanism.

NL I will investigate MDaemon http://www.altn.com/ further. They offer
NL an interesting package. Do you run this commercially?

No. I run it privately. I have two domains, the mail for which I manage
with it. It's admittedly expensive if you wish to use the anti-spam
features which are available only via a pro license.

-- 
 -= allie_M =- | List Moderator
PGPKeys: http://www.ac-martin.com/pgpkeys.html
_ 


pgp0.pgp
Description: PGP signature

Current version is 2.00 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html

Re: Worm filter text

2003-09-29 Thread Michael Thompson
Hello Neal,

On Sat, 27 Sep 2003, at 11:17:50 [GMT -0800] (which was 20:17 in my
TimeZone) you wrote:




NL Hi,

NL Here are the two text files I have cobbled together that will stop
NL most of the swen worms. Still getting one or two a minute and none got
NL through in the last 8 hours since I went off-line last night.

NL There are two selective download filters: form and to. Originator.txt and
NL addressee.txt are the external files you would use respectively.

NL My apologies to the list for trying to upload a zip file yesterday; I
NL now understand attachments are not allowed here.


I have'nt seen one since training POPFile, then deleting those
messages on the server.

-- 
Best regards,
 Michael

http://www.thompsonmike.co.uk/
PGP KeyID := 0xA9547E32
  

Smokey the Bear says, Strip mining prevents forest fires! 


pgp0.pgp
Description: PGP signature

Current version is 2.00.6 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html

Re[2]: Worm filter text

2003-09-28 Thread Neal Laugman
Saturday, September 27, 2003, 8:40:58 PM, Thomas wrote:

TF Why don't you just use @advisor? Same goes for @bulletin and
TF @news etc.
snip
 @yahoo.com
TF You'll definitely get false-postives when reading this very mailing
TF list.

We do the best we can. No one else has been willing to share what they
have been using and there are people like me who have a very serious
problem to deal with.

TF Same (a lot of false positives) will be true for your addressee list.
TF I think you just stored the domains of the email addresses with which
TF the worm arrived on your computer. Of course you have a very high
TF probability that a new infected mail is caught, but the probability of
TF false-postives is far too high for my taste.

Of course you may choose to use what you will or not use it at all.

TF If you think otherwise, try this as a filtering string for the kill
TF filter: @. You will not receive a single infected mail.

Definitely a constructive suggestion. I am surely not the expert that
you apparently are. Thank you for your help.




Current version is 2.00 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re: Worm filter text

2003-09-28 Thread Thomas Fernandez
Hello Neal,

On Sat, 27 Sep 2003 23:39:36 -0800 GMT (28/09/2003, 14:39 +0700 GMT),
Neal Laugman wrote:

 We do the best we can. No one else has been willing to share what they
 have been using and there are people like me who have a very serious
 problem to deal with.

mid:[EMAIL PROTECTED] deals with the problem and
offers an easy solution. If you have questions or doubts after reading
that whole thread, kindly advise.

 Definitely a constructive suggestion. I am surely not the expert that
 you apparently are. Thank you for your help.

I was defnitely trying to help you. Forgot the smiley at the last
joke, though. I thought it was obvious, but hey, people are different.

-- 

Cheers,
Thomas.

Moderator der deutschen The Bat! Beginner Liste.

Take notice: when this sign is under water the road is impassable.

Message reply created with The Bat! 2.00.18
under Chinese Windows 98 4.10 Build  A 
using a Pentium P4 1.7 GHz, 128MB RAM




Current version is 2.00 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re[2]: Worm filter text

2003-09-28 Thread Neal Laugman
Hi Thomas,

TF I was defnitely trying to help you. Forgot the smiley at the last
TF joke, though. I thought it was obvious, but hey, people are different.

Yes - I suppose I took it wrong. Please accept my apologies. No harm
:o) The worm thing really has me wound up. Just trying to make a
contribution and am relatively new to the list. Haven't had much time
for my Delphi newsgroups lately and I have a need to post g. Have a
good weekend.

-- 
Neal

Using The Bat! v2.00.18 on Windows 2000 Service Pack 3



Current version is 2.00 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re: Worm filter text

2003-09-28 Thread Edgar
Hello Neal,

Saturday, September 27, 2003, 10:20:19 PM, you wrote:

E And  only  the  mails  that  match  with both (so From AND to) will be
E deleted?

 No - this is an OR condition: if one does not do it, the second
 will. I have the sender filter first, then the addressee. I also have
 some Subject items I forgot to mention which would be yet a third
 Selective download filter:

 It was also pointed out to me by Ken that AOL and Yahoo are in the
 list. Delete these if it is a problem.

Yes,  and not only from this list but also from people in your address
book.

Maybe  you can at a fourth filter with names of people in your address
book  and  the TBUDL@ in it. If it is in the not in the message and it
will fit one of the other criteria then it is deleted.

-- 
Cheers,
 Edgar


Communicating with TB! v2.00.6, Windows XP 5.1.2600 Service Pack 1


Gravity is a myth, the Earth sucks.





Current version is 2.00 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re[2]: Worm filter text

2003-09-28 Thread Neal Laugman
Sunday, September 28, 2003, 12:46:09 AM, Edgar wrote:

 It was also pointed out to me by Ken that AOL and Yahoo are in the
 list. Delete these if it is a problem.

E Yes,  and not only from this list but also from people in your address
E book.

E Maybe  you can at a fourth filter with names of people in your address
E book  and  the TBUDL@ in it. If it is in the not in the message and it
E will fit one of the other criteria then it is deleted.

I see.  I'll work on this tomorrow. I realize my approach is brute
force and I will see if I can refine it with your suggestion. When
you are drowning, you don't really care if you are wet ;) Thanks.

-- 
Neal

Using The Bat! v2.00.18 on Windows 2000 Service Pack 3



Current version is 2.00 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re: Worm filter text

2003-09-28 Thread ken green
Neal Laugman wrote:
 We do the best we can. No one else has been willing to share what they
 have been using and there are people like me who have a very serious
 problem to deal with.


This is true - I think a lot of people are trying.  Honestly, I've been
a bit disappointed to how willing some people are on this list to
provide detailed step-by-step instructions for some things, yet there is
very little *SPECIFIC* help in regards to filtering/dealing with spam
(my apologies if I've missed it - but I have looked).

In fact, it seems that much of the SPECIFIC spam filter help has been
pointing out your errors, Neal.  So I thank you for doing it wrong... ;)

-- 
 Ken Green
 Using The Bat! v1.62r on Windows 2000 5.0 Build 2195 Service Pack 4



Current version is 2.00 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re[2]: Worm filter text

2003-09-28 Thread Joseph N.
   On Sunday, September 28, 2003, ken green wrote in
mid:[EMAIL PROTECTED]:

kg a bit disappointed to how willing some people are on this list to
kg provide detailed step-by-step instructions for some things, yet
kg there is very little *SPECIFIC* help in regards to
kg filtering/dealing with spam

ken,

fwiw, my filters at the client level have proven mostly ineffective.
my current strategy, which is working fairly well, is to filter at the
server level by size (my mail service has such a filter). the wormy
mail that gets through not only gets snared by my AV, but it also gets
caught--more than 90% anyway--by my spam filters. so the residual
text-based filters that i have, which did not work so well to begin
with, are not even being used as a practical matter. the point of all
this is that that the lack of helpful responses here may be more a
function of the lack of helpful material with which to respond than it
is a lack of willingness to share specifics.

-- 
JN



Current version is 2.00 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re: Worm filter text

2003-09-28 Thread Urban
Saturday, September 27, 2003, Neal Laugman wrote:

 @advisor.com
 @advisor.microsoft.com 
 @advisor.microsoft.net 
 @advisor.ms.com 
 @advisor.ms.net 
 @advisor.msdn.com 
 @advisor.msdn.net 
 @advisor.msn.com 
 @advisor.msn.net 

I never used the selective download feature, but if I understand it
correctly you could use a regular expression like
\@(.*\.)?m(icrosoft|s((d?)n)?)\.(com|net)
to catch all those microsoft/ms/msn/msdn lines all at once.

-- 
Urban

Queen Victoria was the longest queen. She sat on a thorn for 63 years.
She was a moral woman who practiced virtue. Her death was the final
event which ended her reign.


Current version is 2.00 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re: Worm filter text

2003-09-28 Thread Julian Beach (Lists)
On Sunday, September 28, 2003, 8:39:36 AM, Neal Laugman wrote:

 We do the best we can. No one else has been willing to share what they
 have been using and there are people like me who have a very serious
 problem to deal with.

I think, perhaps, that many people on the list have abandoned trying
to filter spam using TB filters when there are many excellent
third-party spam filters available. There is so much spam around now
that it takes too long to try to keep filters up to date, and as fast
as I change the filters for new spam, the details change again.

I use Spampal, together with the Baysian plug-in, but others use
Popfile etc.  They are free, do the hard work of keeping filters
up to date, and therefore offer excellent value for money.

Julian

-- 
  Using The Bat! v2.00 on Windows XP 5.1 Build 2600 Service Pack 1




Current version is 2.00 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re[2]: Worm filter text

2003-09-28 Thread Neal Laugman
Sunday, September 28, 2003, 1:47:08 PM, Urban wrote:

U Saturday, September 27, 2003, Neal Laugman wrote:

 @advisor.com
 @advisor.microsoft.com 
 @advisor.microsoft.net 
 @advisor.ms.com 
 @advisor.ms.net 
 @advisor.msdn.com 
 @advisor.msdn.net 
 @advisor.msn.com 
 @advisor.msn.net 

U I never used the selective download feature, but if I understand it
U correctly you could use a regular expression like
U \@(.*\.)?m(icrosoft|s((d?)n)?)\.(com|net)
U to catch all those microsoft/ms/msn/msdn lines all at once.

Thanks! In the next couple of days I will try to cobble something
together. No time like the present to start learning; but remembering
is a different matter...

-- 
Neal

Using The Bat! v2.00.18 on Windows 2000 Service Pack 3



Current version is 2.00 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re[2]: Worm filter text

2003-09-28 Thread Neal Laugman
Sunday, September 28, 2003, 2:14:36 PM, Julian wrote:

JBL On Sunday, September 28, 2003, 8:39:36 AM, Neal Laugman wrote:

 We do the best we can. No one else has been willing to share what they
 have been using and there are people like me who have a very serious
 problem to deal with.

JBL I think, perhaps, that many people on the list have abandoned trying
JBL to filter spam using TB filters when there are many excellent
JBL third-party spam filters available. There is so much spam around now
JBL that it takes too long to try to keep filters up to date, and as fast
JBL as I change the filters for new spam, the details change again.

That is a very good point. I had been using Postini  McAffee provided
by the ISP, and it caught most of it. Unfortunately you would still
have to deal with it in the web interface so I abandoned it.

JBL I use Spampal, together with the Baysian plug-in, but others use
JBL Popfile etc.  They are free, do the hard work of keeping filters
JBL up to date, and therefore offer excellent value for money.

I've looked at Spampal but not in detail. Free is good too. I've
installed  Alexander's Baysian plug-in and its just starting to
work. Guess it's the techy in me that drives me to do it myself:/ It
just seems with all of the capabilities of TB one could be the master
of our plagues.

One little detail I forgot to mention to everyone about SWEN: It found
me through Opera's newsgroups when I had mistakenly posted a reply-to
address that was not *cloaked*. It was immediately harvested :( But M2
is safe in itself and things could not be better than with The Bat!
and AVG.  Thanks Julian.

-- 
Neal

Using The Bat! v2.00.18 on Windows 2000 Service Pack 3



Current version is 2.00 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re: Worm filter text

2003-09-28 Thread ken green
Joseph N. wrote:
 fwiw,

Actually worth quite a lot.  Your post made a bunch of sense.

 my filters at the client level have proven mostly ineffective.
 my current strategy, which is working fairly well, is to filter at the
 server level by size (my mail service has such a filter).

Yup.  This worked for me with the Swen.A messages since I was getting
those almost exclusively through this account (which is for lists and
such) - so setting up a size limit of 90K killed the Swen.A problem.


 the wormy mail that gets through not only gets snared by my AV, but it
 also gets caught--more than 90% anyway--by my spam filters. so the
 residual text-based filters that i have, which did not work so well to
 begin with, are not even being used as a practical matter.

Good point.  I have been reading the recommendations on this list for
anti-Spam tools.  Maybe I am asking too much of TB in this instance
(it's easy to get spoiled when a program has so many features).


 the point of all this is that that the lack of helpful responses here
 may be more a function of the lack of helpful material with which to
 respond than it is a lack of willingness to share specifics.

That makes sense.  To be perfectly honest, my post wasn't intended to be
whiny - more poking fun at Neal. ;)

The problem that I'm having with the signal strings, is if I want to
leave messages on the server. This becomes a nightmare if there are a
lot of messages and they normally filter to different folders when
downloaded to the Bat. When I invoke the Dispatcher, I see a list of
messages (sometimes a very long list). Since they are ALL marked 'Read'
- how do I know if they are ignored messages that haven't been
downloaded (and should be deleted) or false positives from filters (and
should be downloaded)?

The answer to that isn't very efficient: the only way to be sure is to
check EACH AND EVERY message before downloading/deleting.

Which kinda defeats the purpose of signal strings, huh?

-- 
 Ken Green
 Using The Bat! v1.62r on Windows 2000 5.0 Build 2195 Service Pack 4



Current version is 2.00 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re: Worm filter text

2003-09-28 Thread Allie Martin
Neal Laugman, [NL] wrote:

NL I've looked at Spampal but not in detail. Free is good too. I've
NL installed Alexander's Baysian plug-in and its just starting to work.
NL Guess it's the techy in me that drives me to do it myself:/ It just
NL seems with all of the capabilities of TB one could be the master of
NL our plagues.

The way I see it, it's sort of like saying, if I develop software then I
shouldn't be buying any software and instead be writing my own. :)

I know it's not as drastic as that, but spam changes so much that doing
your own filtering can often be tedious at best, especially if filtering
by exclusion doesn't work for you (this is my situation now). With
filtering by exclusion, you indirectly catch spam by filtering out all
legitimate mail and then assuming that what's left is spam.

As an alternative to the easier method of filtering by exclusion, one
has to directly filter out the spam. The best approach is using a third
party utility that adjusts itself as it filters. It gets better and
better as you indicate to it that messages it didn't detect are in fact
spam. It takes away the work of having to create string values to look
for. Since they look at different aspects of the message and apply a
scoring system, a high degree of accuracy of filtering (minimal false
positives and negatives) can be achieved with minimal effort from your
side.

My mailserver, MDaemon uses spam assassin technology, in combination
with blacklist checking and a Bayesian filtering mechanism. My only
input in what it does is to export my junk mail folder contents to a
special directory that the bayesian filter learns from. I do this when
the spam folder reaches about 50 spam messages. Currently, the spam
filtering is extremely accurate with no false positives as far as I can
recall. The occasional false negative passes through and I just move it
to the junk mail folder for export so that it may be encorporated in the
bayesian learning process. All much less of a headache than fiddling
with search strings using regex, something I'm perfectly capable of but
would rather not waste time doing if I can avoid it. I'll soon be
looking into automating the junk mail folder export process. It would be
then that I would have no interaction at all with spam filtering.

SpamPal is VERY good (first hand experience) and so is Popfile, I've
been made to understand.

-- 
 -= allie_M =- | List Moderator
PGPKeys: http://www.ac-martin.com/pgpkeys.html
_ 


pgp0.pgp
Description: PGP signature

Current version is 2.00 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html

Re[2]: Worm filter text

2003-09-28 Thread Neal Laugman
Sunday, September 28, 2003, 3:53:13 PM, Allie wrote:

AM Neal Laugman, [NL] wrote:

NL I've looked at Spampal but not in detail. Free is good too. I've
NL installed Alexander's Baysian plug-in and its just starting to work.
NL Guess it's the techy in me that drives me to do it myself:/ It just
NL seems with all of the capabilities of TB one could be the master of
NL our plagues.

AM The way I see it, it's sort of like saying, if I develop software then I
AM shouldn't be buying any software and instead be writing my own. :)

I guess I haven't learned that lesson yet as well as I thought I had.

AM My mailserver, MDaemon uses spam assassin technology, in combination
AM with blacklist checking and a Bayesian filtering mechanism.

I will investigate MDaemon http://www.altn.com/ further. They offer an
interesting package. Do you run this commercially?

AM All much less of a headache than fiddling with search
AM strings using regex, something I'm perfectly capable of but would
AM rather not waste time doing if I can avoid it.

I know you are probably right - so why do I need yet another hobby?

AM SpamPal is VERY good (first hand experience) and so is Popfile, I've
AM been made to understand.

Thanks for the recommendations. I will look into these.

-- 
Neal

Using The Bat! v2.00.18 on Windows 2000 Service Pack 3



Current version is 2.00 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Worm filter text

2003-09-27 Thread Neal Laugman
Hi,

Here are the two text files I have cobbled together that will stop
most of the swen worms. Still getting one or two a minute and none got
through in the last 8 hours since I went off-line last night.

There are two selective download filters: form and to. Originator.txt and
addressee.txt are the external files you would use respectively.

My apologies to the list for trying to upload a zip file yesterday; I
now understand attachments are not allowed here.

-- 
Neal, the Reg-Ex Challenged One

/* originator.text */

@advisor.com
@advisor.microsoft.com 
@advisor.microsoft.net 
@advisor.ms.com 
@advisor.ms.net 
@advisor.msdn.com 
@advisor.msdn.net 
@advisor.msn.com 
@advisor.msn.net 
@advisor.net 
@advisor_com 
@advisor_microsoft.com 
@advisor_microsoft.net 
@advisor_ms.com 
@advisor_ms.net 
@advisor_msdn.com 
@advisor_msdn.com
@advisor_msdn.com
@advisor_msdn.net 
@advisor_msn.com 
@advisor_msn.net 
@advisor_net
@america.com
@america.net 
@aol.com
@aol.net
@bbxsito.microsoft.net
@bbxsito.microsoft.net
@bigfoot.com
@bigfoot.net
@bulletin.com 
@bulletin.microsoft.com 
@bulletin.microsoft.net 
@bulletin.ms.com 
@bulletin.ms.net 
@bulletin.msdn.com 
@bulletin.msdn.net 
@bulletin.msn.com 
@bulletin.msn.net 
@bulletin.net 
@bulletin_com 
@bulletin_microsoft.com 
@bulletin_microsoft.net 
@bulletin_ms.com 
@bulletin_ms.net 
@bulletin_msdn.com 
@bulletin_msdn.net 
@bulletin_msn.com 
@bulletin_msn.net 
@bulletin_net
@confidence.com 
@confidence.microsoft.com 
@confidence.microsoft.net 
@confidence.ms.com 
@confidence.ms.net 
@confidence.msdn.com 
@confidence.msdn.net 
@confidence.msn.com 
@confidence.msn.net 
@confidence.net
@emaildomain.net
@freemail.com 
@hotmail.com
@lb.redirect.msnbc.com
@microsoft.com 
@microsoft.net 
@ms.com 
@ms.net
@msdn.com 
@msdn.net 
@msn.com 
@msn.net 
@msnews.microsoft.com
@netmail.com
@netmail.net
@news.com 
@news.microsoft.com 
@news.microsoft.net 
@news.ms.com 
@news.ms.net 
@news.msdn.com 
@news.msdn.net 
@news.msn.com 
@news.msn.net 
@news.net 
@news_com 
@news_microsoft.com 
@news_microsoft.net 
@news_ms.com 
@news_ms.com
@news_ms.com
@news_ms.net 
@news_msdn.com 
@news_msdn.net 
@news_msdn.net
@news_msdn.net
@news_msn.com 
@news_msn.net 
@news_net 
@newsletter.com 
@newsletter.microsoft.com 
@newsletter.microsoft.net 
@newsletter.ms.com 
@newsletter.ms.net 
@newsletter.msdn.com 
@newsletter.msdn.net 
@newsletter.msn.com 
@newsletter.msn.net 
@newsletter.net 
@newsletter_com 
@newsletter_microsoft.com 
@newsletter_microsoft.net 
@newsletter_ms.com 
@newsletter_ms.net 
@newsletter_msdn.com 
@newsletter_msdn.net 
@newsletter_msn.com 
@newsletter_msn.net 
@newsletter_net 
@newsletters.com
@newsletters.microsoft.com
@newsletters.net
@newsletters_com
@newsletters_ms.com
@newsletters_ms.net
@puremail.com
@puremail.net
@rocketmail.com
@rocketmail.net
@smtpdomain.com
@support.com 
@support.microsoft.com 
@support.microsoft.net 
@support.ms.com 
@support.ms.net 
@support.msdn.com 
@support.msdn.net 
@support.msn.com 
@support.msn.net 
@support.net 
@technet.com 
@technet.microsoft.com 
@technet.microsoft.net 
@technet.ms.com 
@technet.ms.net 
@technet.msdn.com 
@technet.msdn.net 
@technet.msn.com 
@technet.msn.net 
@technet.net 
@tenchiclub.com
@uocra.org
@updates.com 
@updates.microsoft.com 
@updates.microsoft.net 
@updates.ms.com 
@updates.ms.net 
@updates.msdn.com 
@updates.msdn.net 
@updates.msn.com 
@updates.msn.net 
@updates.net
@wsobm.com
@yahoo.com
@yahoo.net
postmaster
admin
MS Public Bulletin Postmaster

/* originator.txt */
  
/* addressee.txt */

admin
advisor.com 
advisor.microsoft.com 
advisor.microsoft.net 
advisor.ms.com 
advisor.ms.net 
advisor.msdn.com 
advisor.msdn.net 
advisor.msn.com 
advisor.msn.net 
advisor.net 
advisor_com 
advisor_microsoft.com 
advisor_microsoft.net 
advisor_ms.com 
advisor_ms.net 
advisor_msdn.com 
advisor_msdn.com
advisor_msdn.com
advisor_msdn.net 
advisor_msn.com 
advisor_msn.net 
advisor_net
america.com
america.net 
aol.com
aol.net
bbxsito.microsoft.net
bbxsito.microsoft.net
bigfoot.com
bulletin.com 
bulletin.microsoft.com 
bulletin.microsoft.net 
bulletin.ms.com 
bulletin.ms.net 
bulletin.msdn.com 
bulletin.msdn.net 
bulletin.msn.com 
bulletin.msn.net 
bulletin.net 
bulletin_com 
bulletin_microsoft.com 
bulletin_microsoft.net 
bulletin_ms.com 
bulletin_ms.net 
bulletin_msdn.com 
bulletin_msdn.net 
bulletin_msn.com 
bulletin_msn.net 
bulletin_net
confidence.com 
confidence.microsoft.com 
confidence.microsoft.net 
confidence.ms.com 
confidence.ms.net 
confidence.msdn.com 
confidence.msdn.net 
confidence.msn.com 
confidence.msn.net 
confidence.net
email user
emailserver.com
freemail.com 
hotmail.com
Mail Client Postmaster
[EMAIL PROTECTED]
microsoft.com 
microsoft.net 
ms.com 
ms.net
msdn.com 
msdn.net 
msn.com 
msn.net 
msnews.microsoft.com
mxserver.com
mxserver.com
netmail.com
netmail.net
Network Client [EMAIL PROTECTED]
Network Receiver [EMAIL PROTECTED]
news.com 
news.microsoft.com 
news.microsoft.net 
news.ms.com 
news.ms.net 

Re: Worm filter text

2003-09-27 Thread Edgar
Hello Neal,

Saturday, September 27, 2003, 9:17:50 PM, you wrote:

 There are two selective download filters: form and to. Originator.txt and
 addressee.txt are the external files you would use respectively.

And  only  the  mails  that  match  with both (so From AND to) will be
deleted?

-- 
Cheers,
 Edgar

Communicating with TB! v2.00.6, Windows XP 5.1.2600 Service Pack 1
   
A  journey  of  a thousand miles starts with a single step.  - Chinese
Proverb







Current version is 2.00 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re[2]: Worm filter text

2003-09-27 Thread Neal Laugman
Saturday, September 27, 2003, 12:05:43 PM, Edgar wrote:

E Hello Neal,

E Saturday, September 27, 2003, 9:17:50 PM, you wrote:

 There are two selective download filters: form and to. Originator.txt and
 addressee.txt are the external files you would use respectively.

E And  only  the  mails  that  match  with both (so From AND to) will be
E deleted?

No - this is an OR condition: if one does not do it, the second
will. I have the sender filter first, then the addressee. I also have
some Subject items I forgot to mention which would be yet a third
Selective download filter:

virus
error
patch
pack
latest
increase
Critical
Security 
Bulletin 
Security
pack
unknown
undelivered
failure
no subject
latest
newest
returned
bug
error
recipient
network
mail
message
privacy

It was also pointed out to me by Ken that AOL and Yahoo are in the
list. Delete these if it is a problem.

I'm sure open to a reg-ex solution (hint to lurkers..)


-- 
 Neal



Current version is 2.00 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html


Re: Worm filter text

2003-09-27 Thread Thomas Fernandez
Hello Neal,

On Sat, 27 Sep 2003 11:17:50 -0800 GMT (28/09/2003, 02:17 +0700 GMT),
Neal Laugman wrote:

 There are two selective download filters: form and to. Originator.txt and
 addressee.txt are the external files you would use respectively.

[Orig]
 @advisor.com
 @advisor.microsoft.com 
 @advisor.microsoft.net 
 @advisor.ms.com 
 @advisor.ms.net 
 @advisor.msdn.com 
 @advisor.msdn.net 
 @advisor.msn.com 
 @advisor.msn.net 
...

Why don't you just use @advisor? Same goes for @bulletin and
@news etc.

 @aol.com

You don't know anybody who uses AOL? For me this would cause quite a
number of false positives.

 @freemail.com
 @hotmail.com
 @yahoo.com

You'll definitely get false-postives when reading this very mailing
list.

Same (a lot of false positives) will be true for your addressee list.
I think you just stored the domains of the email addresses with which
the worm arrived on your computer. Of course you have a very high
probability that a new infected mail is caught, but the probability of
false-postives is far too high for my taste.

If you think otherwise, try this as a filtering string for the kill
filter: @. You will not receive a single infected mail.

-- 

Cheers,
Thomas.

Moderator der deutschen The Bat! Beginner Liste.

Note: Please don't misconstrue my 14 jobs as 'job-hopping'. I have
never quit a job.

Message reply created with The Bat! 2.00.6
under Chinese Windows 98 4.10 Build  A 
using a Pentium P4 1.7 GHz, 128MB RAM




Current version is 2.00 | Using TBUDL information:
http://www.silverstones.com/thebat/TBUDLInfo.html