I have been using MWP for a few years and got one good HTML filter from a user but its apparently not good enough anymore. I use word filters for such as penis and viagra but with all the tricks they use still getting those plus a ton lately about prescriptions at discount. I don't want to filter that word as I get legit mail from my script plan at work. Looking for some more user filters for sexual and other misc. spam. Also would love one for these people in Africa,etc asking for money. Have searched this forum til my eyes got crossed for user filters and I see references to those I cannot find such as from Gary. Can anyone point me to discussions that show actual user filters and what they are to filter? Here is the only one I have now. Its called (2)HTML Spam tricks (B)

If the Body contains the RegExpr "fontsize="?0"?" or "((<![\w\s,\.\-]+>)+([\w\s,\.\-]){1,20}){3}" or "(</\w>)[\w\s,\.\-]{1,20}(\1([\w\s,\.\-]){1,20}){2}" then add the sender to the blacklist, mark the message as mail to be deleted and mark the message as mail to be bounced.

Anything you can offer would be appreciated. I am very PC literate but not cybersavvy enough to use filters other than those that can be inserted in filters.txt.

Terri

Hi Terri

If you downloaded that filter a while ago, there may be a newer version. Gary's filters are discussed many places, but mostly here .

I've tweaked a few of them, too. S P A C E D Subject is one, but I'm not sure which others.

I've also posted untested rules here and there, without adding them to my filters.

Some of the better filters look at the header. The User Formerly Known As Denn988 (or TUFKA-Denn988) posted at least two very interesting filters. The RDNS one may have false positives, and it may require customization. If you use it, move it to the bottom of your list of filters. The IANA Reserved IPs is more accurate and can even override the Friends list.

Best of luck!

Thanks guys...onward now to look at them and install.

TErri

To all:

I just looked at Gary's Filters and I noticed that he already had a "Base64" filter in there.

There is a glaring problem with it though.

His filter looks for any occurence of base64 encoding, both in the header and in the body.

Looking in the header for base64 encoding is fine, but I would suggest that looking in the body will cause too many false positives.

Any time that you insert or attach a picture (gif, jpg, bmp, etc) into an e-mail it will more than likely (I would like to say absolutely, but I am not 100% positive of this) be encoded base64.

A filter that looks into the body for base64 encoding is going to flag anything with a picture in it.

Stick to a filter that only looks into the header for base64 encoding if you don't want to throw away valid e-mails simply because they have a picture.

Once again, I really appreciate all the help ...what a great forum this is. To keep me from having to read all the MWP help stuff again can you tell me in a nutshell how to rank which will be done first...freinds/blacklist or filters and which I should run first? I guess I am really lazy today and I know someone can summarize for me. I read so much in the help docs yesterday mu eyes are still crossed.

Terri

Well, I'm not exactly sure myself.

In general, Friends/Blacklist override both Filters and the DNS blacklist check, except when the filter is set to "take precedence over the Friends/Blacklist."

The built in hueristics are a different matter. I have seen hueristics override Friends in the case of Virus. This was the case when I received SoBig.E, and the From was forged to be someone on my friends list. I'm not sure whether all the hueristic status types do this, though.

Then there's the issue of what comes first, Friends list or Blacklist. AFAIK, specific addresses (User@domain.com) override wildcard entries (*.domain.com). This allows users to blacklist every address (*), and use the friends list as a sort of gatekeeper. In the event of a conflict, a message box should appear.

HTH

TIME GHOST...thats what I thought and of course I look at my list to see what is being filtered out before I process. Thanks so much

Terri

Please ignore....

ditto...

_________________
Tony CLSID List