False friend

Whether you're a MailWasher veteran or complete newbie, all users are welcome to get together. Discussions include usage and possible problems.
Jubilee
Mystified Moa
Posts: 8
Joined: Tue Sep 23, 2008 1:03 am

False friend

Thu Sep 25, 2008 4:54 am

email from friend according to learning filter is in fact spam.
no option to tick spam.
How do I teach the learning filter?
User avatar
AlphaCentauri
Guardian Gecko
Contact:
Posts: 362
Joined: Thu Jul 24, 2008 3:39 pm

Re: False friend

Thu Sep 25, 2008 5:13 am

The purpose of a friends list is so no matter how spammy, emails from your friends won't be accidentally deleted as spam. So it's not necessary to teach the learning filters about them. If you want to report the spam to spamcop or FirstAlert, you have to remove the address from the friends list, report without deleting, put it back on the friends list, then delete.

If you have addresses on the friends list that get spoofed a lot, like ebay, it may be easier to create a filter that recognizes the address and also looks for confirmation like an IP address in the headers that corresponds to the sending server for that email address, and then put that filter ahead of any spam filters.

The most common case of spam trying to use your friends list to get past filters is spam that uses your own address in both the "from" and the "to" fields. You normally would want your own address on the friends list if you mail from more than one computer and sometimes mail things to yourself to transfer files from one computer to the other. Since I have a dynamic IP address, I can't use the IP address to create a filter to tell real mail I've sent myself from spoofed stuff.

So in my email client, I have set up the preferences to include text in the "organization" line. I have the same text in the preferences on all my computers. It can be a real organization that goes with the email address, or just an easy-to-remember code number (like some phone number you know well but that no one else would associate with you, for instance). Then you can create a filter that says that any email that has your email address in the "from" line, but does not have that exact string of text/code in the complete headers, is spam.
Jubilee
Mystified Moa
Posts: 8
Joined: Tue Sep 23, 2008 1:03 am

Re: False friend

Thu Sep 25, 2008 5:18 am

yes
but he is not a friend or known to me
he has been identified as one by the learning filter
he is selling viagra
User avatar
stan_qaz
Omniscient Kiwi
Location: Gilbert, Arizona
Posts: 8671
Joined: Fri Jul 25, 2008 5:13 am

Re: False friend

Thu Sep 25, 2008 5:49 am

The learning filter does not have any connection to the Friends list, Friends is a separate tool.

I think we have a basic confusion here, what does the status column say?

Is there a tick mark in the Friends column?

Are you using the action or learning columns, if so what do they say?
User avatar
AlphaCentauri
Guardian Gecko
Contact:
Posts: 362
Joined: Thu Jul 24, 2008 3:39 pm

Re: False friend

Thu Sep 25, 2008 5:54 am

Jubilee wrote:yes
but he is not a friend or known to me
he has been identified as one by the learning filter
he is selling viagra
You should have a column for items in your inbox that says, "From." Look in that space for the email from the "false friend." It may have anybody's name on it. But what counts is the email address.

Suppose you have a friend named Joe Smith, and his email address is jsmith@yahoo.com
Now, if an email arrives that has a "from" line that says "James Smith <jsmith@yahoo.com>" Mailwasher is going to list it as a friend, since the email address matches, even if the name doesn't. You can see your friends list by clicking the clipboard called "settings" at the top of the MWP inbox, then under "spam tools" on the left, choose "my friends list." In this imaginary instance, you would either see an entry for jsmith@yahoo.com, or else a "wild card," like "*@yahoo.com" or "jsmith@*.com."

Now, what is listed in the "from" has nothing to do with who sent it. Spammers put fake information there. So sometimes they just get lucky and use an email address that is on your friends list. So for the rare lucky guess, don't worry about that one email. But for email addresses they will use a lot, like your own, you want to use a filter instead of the friends list to keep good emails from being marked as spam without the spam emails getting allowed through. You would create a filter, then unclick the box next to the item on your friends list so it stops overriding the filters.
Jubilee
Mystified Moa
Posts: 8
Joined: Tue Sep 23, 2008 1:03 am

Re: False friend

Thu Sep 25, 2008 7:08 am

action is blank
spam is blank
status is friend - determined by learning filter
from email address is not in my friends list
User avatar
AlphaCentauri
Guardian Gecko
Contact:
Posts: 362
Joined: Thu Jul 24, 2008 3:39 pm

Re: False friend

Thu Sep 25, 2008 7:24 am

Jubilee wrote:action is blank
spam is blank
status is friend - determined by learning filter
from email address is not in my friends list
If you look at the email in source view (click the icon that looks like a piece of paper with "< >" on it, just above the message preview window) it will show you the headers. Even if the email is blank, there will be some rudimentary headers or it couldn't have been delivered. If you copy whatever that says and send it to me in a private message (click the little square that says "PM" under my avatar to the left of this message), I can look at it and tell more about why it might have been called a "friend."
User avatar
stan_qaz
Omniscient Kiwi
Location: Gilbert, Arizona
Posts: 8671
Joined: Fri Jul 25, 2008 5:13 am

Re: False friend

Thu Sep 25, 2008 7:30 am

This one stumps me, I've never seen that status message.
User avatar
rusticdog
Firetrust Monkey
Posts: 15864
Joined: Mon Jun 13, 2005 6:27 pm

Re: False friend

Thu Sep 25, 2008 11:51 am

Jubilee wrote:action is blank
spam is blank
status is friend - determined by learning filter
from email address is not in my friends list
If the Status reads Friend, then the address will be in the Friends List somewhere. If you trained a message as Good, then the address is also added to your friends list. To get around this you will need to remove the address from your Friends list and retrain the message as bad.
Jubilee
Mystified Moa
Posts: 8
Joined: Tue Sep 23, 2008 1:03 am

Re: False friend

Fri Sep 26, 2008 8:29 am

You are absolutely right.
I found it was getting through because of a wildcard expression.
I am now thoroughly embarrassed.
Thank you
User avatar
rusticdog
Firetrust Monkey
Posts: 15864
Joined: Mon Jun 13, 2005 6:27 pm

Re: False friend

Fri Sep 26, 2008 8:54 am

no need to feel embarrassed....we all make mistakes

the other day was quite cold, I ended up throwing my jeans on over my PJs....later that night before bed I searched around for about 40 minutes trying to find my PJ bottoms....wait, what?.....sorry too much information...
User avatar
AlphaCentauri
Guardian Gecko
Contact:
Posts: 362
Joined: Thu Jul 24, 2008 3:39 pm

Re: False friend

Fri Sep 26, 2008 8:56 am

Jubilee wrote:You are absolutely right.
I found it was getting through because of a wildcard expression.
I am now thoroughly embarrassed.
Thank you
You don't learn anything when you get it right the first time.

Now you can help someone else who has the same problem. How do you think I knew where to look?

Return to “Troubleshooting and Help for MailWasher 5 and 6”