CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

$9736.22 of $21422.68
left sidedonated so farneed $11686.46 donated to reach our goalright side, our goal
Help CastleCops serve the community on new servers, Donate Here to reach our goal.

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
Survey
spacer
Was 2007 a good year?

Yes it was a wonderful year
Yes, but there is always room for improvement
Status quo
It was a challenge
Other (leave comment)



Results
Polls

Votes: 951
Comments: 28
block bottom
spacer spacer

Filter Question

 
Post new topic   Reply to topic       All -> FavForums -> Mailwasher - Troubleshooting / General [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
sordomundo@pobox.com

Guest
IP: 66.75.*.*






PostPosted: Tue Jun 03, 2003 5:22 am    Post subject: Filter Question
Reply with quote

I get a lot of spam from an alphabet spammer from
pobox.com. Most are the result of multiple unames
CC'd at pobox, such as "sxxxx@pobox.com", "syyy@
pobox.com", "sordomundo@pobox.com".

I have tried many, many configurations of expressions
to filter on "multiple instances of unames @pobox.com
with no luck what so ever. I would like to just dump any
mail with multiple personalities listed in the CC: area.

Would any of you expression experts care to generate
an expression to cure my ills. I'd be eternally grateful.

Bob
sordomundo@pobox.com

Back to top
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16515

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Tue Jun 03, 2003 5:47 am    Post subject:
Reply with quote

I'm just learning about more advanced filter expressions so I'm not sure but how about

Code:
The 'CC' Field | contains RegExpr | (.+@pobox.com){5}
Question

Change the {5} to whatever number best suits your situation.

Back to top
View users profile Send private message
sordomundo@pobox.com

Guest
IP: 66.75.*.*






PostPosted: Tue Jun 03, 2003 6:11 am    Post subject:
Reply with quote

wrote:
I'm just learning about more advanced filter expressions so I'm not sure but how about

Code:
The 'CC' Field | contains RegExpr | (.+@pobox.com){5}
Question

Change the {5} to whatever number best suits your situation.
Thanks, I'll give that a try....

Bob

Back to top
sordomundo@pobox.com

Guest
IP: 66.75.*.*






PostPosted: Tue Jun 03, 2003 4:18 pm    Post subject:
Reply with quote

I tried the filter, " (.+@pobox.com){3}", and it didn't catch the culprit. 8^(

This is the latest ploy:

"Cc: larry.d.wilson@pobox.com, larry.johnson@pobox.com, larry.mackey@pobox.com, sordomundo@pobox.com"

I've tried at least a half dozen expressions and nothing has worked to date. Anyone else care to have a go at it ?

Back to top
gary

Lieutenant
Lieutenant
Premium Member

Joined: Dec 22, 2002
Posts: 260
Location: Dallas/Ft. Worth, USA
Premium

PostPosted: Tue Jun 03, 2003 4:52 pm    Post subject:
Reply with quote

That should have done it for you. In fact, I just ran the TRegExpr test program, copied and pasted the expression and your CC line, and it worked. Would you mind checking your regular expression to be sure there are no spaces lurking around in there from when you pasted?


_________________
Gary
Back to top
View users profile Send private message
sordomundo@pobox.com

Guest
IP: 66.75.*.*






PostPosted: Tue Jun 03, 2003 5:26 pm    Post subject:
Reply with quote

I just ran a couple test e-mails and it didn't work.
Therein lies my frustration after many tries. It seems only exact match word filters work.

Back to top
sordomundo@pobox.com

Guest
IP: 66.75.*.*






PostPosted: Tue Jun 03, 2003 5:38 pm    Post subject:
Reply with quote

My apologies, my friends filter was blocking the operation and it does work as written. Thanks to both of you for your patience and help.

Back to top
gary

Lieutenant
Lieutenant
Premium Member

Joined: Dec 22, 2002
Posts: 260
Location: Dallas/Ft. Worth, USA
Premium

PostPosted: Tue Jun 03, 2003 5:42 pm    Post subject:
Reply with quote

Hmm, that sounds like "contains" instead of "contains regExpr" is being used. If you're sure "contains regExpr" is selected under the "Edit Filter" dialog, can you take a look at the raw filter in the filters.txt file and tell us what it says? Maybe just copy that line into a response.


_________________
Gary
Back to top
View users profile Send private message
TimeGhost

Captain
Captain


Joined: Apr 11, 2003
Posts: 747
Location: USA
Team F@H

PostPosted: Tue Jun 03, 2003 8:03 pm    Post subject:
Reply with quote

I wasn't aware that MWP supported the repeat count RegExp syntax. The FAQ does not mention it. I know {n} works in the MS RegExp library contained in vbscript.dll. Is that what MWP's RegExp is based on?

Back to top
View users profile Send private message
gary

Lieutenant
Lieutenant
Premium Member

Joined: Dec 22, 2002
Posts: 260
Location: Dallas/Ft. Worth, USA
Premium

PostPosted: Tue Jun 03, 2003 8:26 pm    Post subject:
Reply with quote

It's my understanding that it's based on a freeware library written by Andrey V. Sorokin, which is in turn a port of some Henry Spencer V8-routines, which implement a subset of Perl Regular Expressions. It will also handle some of the (?...) modifiers.

You can go here and get a test program, "TRegExpr", too!

http://anso.da.ru


_________________
Gary
Back to top
View users profile Send private message
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16515

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Tue Jun 03, 2003 8:58 pm    Post subject:
Reply with quote

TimeGhost wrote:
I wasn't aware that MWP supported the repeat count RegExp syntax. The FAQ does not mention it. I know {n} works in the MS RegExp library contained in vbscript.dll. Is that what MWP's RegExp is based on?

Good point. I just found out about it by looking at some of Gary's filters. It looks like FireTrust could take an example from Gary's most excellent documentation.

Gary, do you have the complete syntax documentation for the RegExpr used by MWP?

BTW, how do you use the TRegExpr test program?

Back to top
View users profile Send private message
sordomundo@pobox.com

Guest
IP: 66.75.*.*






PostPosted: Tue Jun 03, 2003 9:01 pm    Post subject:
Reply with quote

for Gary, line reads:

[enabled],"Multiple Pobox",Filtered,16711680,OR,Hidden,Delete,To,containsRE," (.+@pobox.com){3}",CC,containsRE," (.+@pobox.com){3}"

I had my own address in the Friends list which was over riding the action of the above filter expression.

All is well now and perhaps you may want to include a similar filter in your filter offering as alphabet spammers are quite popular, at least in my experience.

Thanks again to all......

Back to top
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Mailwasher - Troubleshooting / General All times are GMT
Page 1 of 1

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer