| View previous topic :: View next topic |
| Author |
Message |
hyperscan
Cadet
Joined: Dec 07, 2003
Posts: 4
Location: Uk
|
 Posted: Sun Dec 07, 2003 7:42 pm Post subject: Body Filter doesn't work for me. |
|
|
I am using Mailwasher version 3.3.0.
All the filters work OK except the body filter. I always take the "BODY" to mean the actual MESSAGE, yet when I enter body text into the filter, mailwasher ignores it. Can someone please put me right on this.
Thanks
|
|
| Back to top |
|
 |
denn988
Guest
IP: 66.44.*.*
|
| Posted: Sun Dec 07, 2003 8:52 pm Post subject: |
|
|
Without some example of what kind of problem you are experiencing, it would be very difficult to give you any help.
You might want to post the example here. There are quite a few users who watch these forums and would be willing to help, but need more info.
Also...
If the part of the body that you are trying to filter on occurs past the point where MWP downloads, you will never trap anything. You might want to look at the message in MWP's Preview Pane in order to determmine if you have enough message being downloaded for the filter to trap it.
|
|
| Back to top |
|
|
hyperscan
Cadet
Joined: Dec 07, 2003
Posts: 4
Location: Uk
|
| Posted: Sun Dec 07, 2003 9:45 pm Post subject: |
|
|
If I see a word, for example ENLARGE in the preview pane, on the first line. I create a filter and ask Mailwasher to detect ENLARGE in the body, but Mailwasher takes no notice of that filter in future bodys and displays them in the header list.
|
|
| Back to top |
|
|
denn988
Guest
IP: 66.44.*.*
|
| Posted: Sun Dec 07, 2003 11:15 pm Post subject: |
|
|
hyperscan,
Going to need a little more than that to go on...
Do you know how to find the 'filters.txt' file in your MWP data directory?
If you don't....in MWP goto HELP >> ABOUT. You will find a link at the bottom of that dialog box which will take you to the Data Directory (just below the checkbox for extended error logging).
Open the 'filters.txt' file and find your filter in there. The filters in this file are listed in the same order as they are in MWP's 'Filters' pane.
Copy the filter from the file and paste it into the message body entry box (post a reply) for the forum. Once you have it pasted, immediately select the text for the filter so that the entire filter test is highlighted.
With the filter text highlighted, click on the 'Code' button above the message entry box. You will see the following before and after the filter text:
[ code] (will be before the text..the first space will be missing)
[ /code] (will be after the text...the first space will be missing)
This will ensure that your filter is not translated by the BBCode or HTML translators. When you select PREVIEW you will see the filter code in a quote box as shown in the example below:
| Code: | | [enabled],"TEXT BASE64 [AD]","TEXT BASE64 [AD]",255,OR,Delete,Automatic,EntireHeader,containsRE,"^Content-Type: text/(html|plain).{0,40}?^Content-Transfer-Encoding: base64",Body,containsRE,"^Content-Type: text/(html|plain).{0,40}?^Content-Transfer-Encoding: base64" |
With that information in hand, we can see just exactly what your filter is looking for and how it is set to handle the info. That should (hopefully) be enough information to determine why your filter is not working.
|
|
| Back to top |
|
|
denn988
Guest
IP: 66.44.*.*
|
| Posted: Mon Dec 08, 2003 12:32 am Post subject: |
|
|
hyperscan,
There is one other thing that you need to be aware of concerning BODY filters.
The Spammers are more than aware of simple filters that look for words in the BODY, and have developed a few tricks to obfuscate those words so that simple text filters cannot find them.
One of those tricks is to use HTML to break up the words. Example:
| Code: |
ENLARGE could be sent with HTML comments that breaks it up so that a simple filter looking for ENLARGE cannot find it....but when the e-mail client translates the HTML it will appear as ENLARGE.
E<!Now is the time for>NL<!all good men to>ARG<!come to the aid of their country>E
|
In order to be able to tell if this is why your filters are not working you will need to look at the RAW text of the message. The preview pane in MWP defaults to translated view in those case where HTML text is used. That is called the 'NORMAL VIEW' in the preview pane.
If you select 'RAW SOURCE VIEW' you will be able to see the raw text in the preview pane, including the message header. Check the message using the RAW SOURCE VIEW to see if the Spammer is using any of these tricks to obfuscate their message from your filters.
|
|
| Back to top |
|
|
hyperscan
Cadet
Joined: Dec 07, 2003
Posts: 4
Location: Uk
|
| Posted: Mon Dec 08, 2003 7:53 am Post subject: |
|
|
Hi Denn
I think your last message answered my question.
Therefore I will examine the mail more closely over the next day or so and get back to you.
|
|
| Back to top |
|
|
hyperscan
Cadet
Joined: Dec 07, 2003
Posts: 4
Location: Uk
|
| Posted: Mon Dec 08, 2003 4:30 pm Post subject: |
|
|
Here is the RAW body, complete with the hidden word (male organ), that I wanted to filter out:
<html>
<body>
<ktnqlqqcdbf><center>
<font face="verdana" size="+3">T<kwfedzsrymt>he o<kedhpnhdsgw>nly<ksxllbjbdwqir> so<kcpgbiwdwwykbwb>lut<kydeckycdngvpkb>ion to P<kopxxatdohx>en<klrtaljbmxzbhoc>is
E<kzbyfhdccncn>nl<kisdnxdhpmdvlcw>arge<kzdnptlgoxlvjdd>me<kzingtdbvgj>nt</font>
<br><font color="white">krlivjknjq wcyeptcsyptnlc</font><br>
<font size="+2" face="arial"><b><kkbyrtvexkxrpba><font color="#F30101"><kdaaooihflw>L<kcdaglocmbzza>IM<kujqkynhyjdsdcs>I<kicrbgeblpoc>TE<kptqngodopgfwn>D
<kpuhkopczaetvu>OF<kxmngaebisa>FE<kihxyrybthi>R:</font></b> A<kdadwquwhktic>dd at l<khovceabbnuzzv>east 3 I<kzzpwikbibaw>NCH<kkttcidnzxweb>ES or ge<kjvrhhlccavhfe>t y<klxmyesdkba>our mon<kugjsmjbjltozl>ey
bac<kkntotytiudfoc>k!
<br><font color="white">yrmrxfzvzv fngcfabeaf</font><kkzejzccyuys><br>
<table width="600"><kkmwsagfwzadeum>
<tr>
<td><kxmcdrbdjja>
<font face="arial">
<kjhqcnedwogffob>We a<karovmubzttaop>re s<kmuhdiicdtxv>o sur<kdpnmircqtca>e o<kzzzszjbiewlgr>ur p<klxvmgebvvybn>rod<kcxvqcjbvgfjloc>uct wo<kfwznhddidbfmd>rks w<kthpplbzdnefkd>e ar<klesrdacnjg>e wi<kvtpzocofnmm>lling to pr<ksfzszkddnh>ove
it b<khhxanxfnaidfy>y of<kdhaapibqkhbrx>fer<kjuqpvyhsuhyadj>ing a <b>f<krbvupchrfv>re<kfsuasedgtucweb>e t<kzlgfplxegpbrj>ri<kjhwikrdthpfqx>al b<kwmqkhsbjljr>ott<knqybshmdol>le</b> + a 1<kudvzrwdtlg>0<kpgmppsbqethydb>0%
<b>m<khbcqikdmxeffjd>on<kfwqyngupak>ey b<kfdzdovdpumcw>ack g<kfzwmurdfwvg>uar<kttyktdskumf>ante<kknnnqlhhru>e</b> u<kjfudodciwr>pon p<kjkzxpcdhmslu>ur<krwuhdvdkmwpz>cha<kqtlskzdjzedfic>se if y<kidrujkbvholx>ou ar<kjxmnwdcuhcvuhz>e
n<kpucdrfbrnzzk>ot sa<klarsqvbzqcwocb>ti<knktgveccbe>sfie<kbsgilocrvnvd>d w<krytudkclhhb>ith th<ksbeclpyfid>e r<kerylofenmdlq>esul<klqqcxgcqpzejzp>ts.
</td><kneknptdgpx>
</tr>
Thanks
|
|
| Back to top |
|
|
denn988
Guest
IP: 66.44.*.*
|
| Posted: Mon Dec 08, 2003 4:50 pm Post subject: |
|
|
hyperscan,
Untill MWP changes their program to allow the option of filtering either the RAW text or the TRANSLATED text, there is limited abilityto filter based on words in the body.
There is however something that you can do to help with the specific kind of obfuscation that the Spammer is doing in the example above.
Create a filter that looks into the BODY and contains the following Regular Expression:
| Code: |
<[^>]*?[bcdfghjklmnpqrstvwxyz]{7}[^>]*?>(?# 7 or more consecutive constonants in html ) |
It looks for consecutive constonants in the HTML of the message. This filter will trigger if any HTML that is downloaded within the message body contains 7 consecutive constonants.
Example:
| Code: |
<bbbbbbbb>
OR
<aaabbbbbbbaaa> will trigger the filter
<bbbbabbb> will not
|
It may help....have the filter mark the message for deletion. I would not set the filter up to automatically delete until you have tested it fairly extensively and are confident of minimal false positives.
|
|
| Back to top |
|
|
Ikeb
Special Response Team
Forums Admin
Joined: Apr 20, 2003
Posts: 16515
|
| Posted: Mon Dec 08, 2003 5:03 pm Post subject: |
|
|
hyperscan, actually filtering for the hidden word is difficult with the current MWP filtering capability. You would have to look for possible tags between each letter. And then you have managed to catch only that particular word or phrase. For example, take ENLARGE. A filter (untested) to look for that could be: | Code: | | e(<.*>|*|!)??n(<.*>|*|!)??l(<.*>|*|!)??a(<.*>|*|!)??r(<.*>|*|!)??g(<.*>|*|!)??e |
So now what? You've (maybe) caught one word. Are you going to do this for all 'key indicator' words?
A more pragmatic approach uses the fact that a tag is breaking up the word when there's no reason to do so other than to confuse anti-SPAM measures by obfuscating the message. One recent thread explored the possibilities.
|
|
| Back to top |
|
|
|
|
Forum FAQ
Search
Usergroups
Profile
Login to check your private messages
Login
