Firetrust Support Forums

I have given MWP 2010 a couple months shakedown now and I'm receiving even more SPAM than ever with the older versions. Perhaps it's the fact that I still can't get the SPAM filters working properly. The help files leave a lot to be desired. Here are a few examples of what I'm trying to do (all met with very little or no success).

Auto delete any message with *.info*, *.biz*, *.cn* or *.ru* in the entire message (headers, body, ect) - never happens
Here is the filter I created - SETTINGS >> FILTERS, name=biz info, filter type=spam, rules=any, rule #1 (from)=*.info*, rule #2 (from)=*.biz* >> ACTION, auto delete this e-mail. Another one just like it for .cn and .ru that doesn't work either. And, yes, I saved each screen before moving on to the next and they do re-appear as created when I return to the individual filter.

These are created much the same way:
Certain words in subject such as "viagra", Viagra", "pills" (pills works for some reason some times) - never happens even with viagra spelled correctly and not using similar-looking letters.
My old e-mail address "firstname.lastname" (entire message) to filter out older SPAM lists - never finds or deletes

Some may be marked as SPAM in the MWP Inbox but still delivered to my e-mail inbox without any filters catching them.

Finally, after adding a SPAM filter (and saving it) and returning to the INBOX, the "wash" happens, but absoutely nothing is washed (removed) from INBOX. Those marked as SPAM are not even removed on the next automatic mail check. It's like MWP does not recoginize and act on it's own flagging.

Filters are not case sensitive by default, there is no * (wildcard) for plain text, you need to use regex for these ie. .+ = 1 or more characters
.* = 0 or more characters
\. = Full-stop (Dot)

Make regex case sensitive with the following: My viagra regex is:Meds regex:

Thanks.

MWP 2010 seems to take a round-about way of doing was was working before. Not for the novice anymore. Wildcards are so effective everywhere else. Looks like MWP 2010 needs to take a step backwards once in a while and take a look at the overall picture.

If you take out the stars in you plain text rules and use contains then they should work. I prefer the regex route though

.info, .biz, .cn or .ru

The filters are very similar to v5-6 filters, I copied mine across and they worked without any problems so you'd see the same issues with wildcards in either version. There is a good filter example topic here http://forum.firetrust.com/viewtopic.php?f=50&t=5575 and info on regex filters here http://forum.firetrust.com/viewtopic.php?f=50&t=5642 that should be more use than the help files.

Spammers play a lot of tricks with words in their e-mails so you need to look at the message source to see just what they are sending and set your filter up to catch that, I'd guess you'd need a couple dozen filter rules to catch most of the Viagra variations.

The auto-delete for filters is a pretty good idea as is the auto delete based on total spam score but there looks to be a but in the way it is working. I'd suggest you fool with your filters until you are happy with the way they are working and not use auto delete until the next version is released and the bug is (hopefully) fixed.

The way MW 2010 works is a bit more complicated but that was intentional as the friends and black lists are becoming less effective as spammers learn tricks to bypass both of them. Bounce has become almost completely useless against spam, still may have minimal use against idiots sending you mail though. The DNSBLs are less effective as spammers move from using compromised mail servers to compromised Windows PCs and shuffle the outgoing spam flow around to bypass blocking. Bayesian is being spoofed by the random text the spammers are adding in and First Alert had to go to an entirely new method of operation to deal with the spammers new tricks and stop abusive users from messing it up. All of that adds up to needing the weighted filtering MW 2010 offers rather than the single tool at a time method v6 offered.

I'm sure things will continue to get more complicated as long as folks are running computers vulnerable to being taken over and the spammers keep learning and using new tricks to bypass folks attempts to block their spew. MW is in a good position to add a bunch of new and powerful tools to the existing set once it gets the rest of the v6 features added back in and the bugs that are cropping up fixed.

I've been hanging around messing with MW for years and I'm really proud of the community of users MW has built up, they are for the most part doing a great job of contributing bug reports (like yours on filters not auto deleting) and following them up with the Firetrust developers and getting them fixed.