Serious problems with .188

[pwhit]

I upgraded to MailWasher Pro 7.12.188 recently (from an unknown previous version, but I think it was 7.12.56 -> 7.12.173 -> 7.12.188.

I have had major problems since. Many of my crucial messages started getting moved to the Recycle Bin. I have added the domains in question to my friends list, then expicitly set them as do not delete in a "Allowed" list, then did a Restore to the mailbox. As soon as MWP did another wash, it moved them back to the Recycle Bin. It's so bad, it''s almost as if one of the boolean primary boolean checks is inverted, or it's executing filters from bottom up now rather than top-down.

[gingbat]

Move the recycle bin filter to the top of the list, and under the Actions tab for it, drag the slider to +200, and select, "Never mark for delete".

Re why they are being re-deleted, it sounds like one or more of your spam tools may have been set to auto delete and are catching these emails....?

First thing to do is to ensure none of your spam tools are set for auto deletion, note you can first check to see which spam tool is responsible by clicking one of the deleted emails in the MWPro recycle bin, then click View>>Sidebar>>Evaluation button.

It'll tell you there what spam tool is catching these emails.

To disable auto delete:

Filters, (Settings>>Spam Tools>>Filters>>click a filter>>Edit) disable auto delete by disabling this option under the Actions tab...
Origin of Spam, Settings>>Spam Tools>>Orign of Spam>>Options, uncheck, "Auto delete"
Firstalert, Settings>>Spam Tools>>Firstalert, uncheck, "Auto delete"
Spam Ratings, Settings>>Spam Tools>>Spam Ratings, and un-tick, "Auto delete if rating reaches:"


[pwhit]

@gingbat thanks for the quick reply but two problems with this: a) I don't have a recycle bin filter. b) I already have such a filter at the top of my list called "Allowed" that has +200 and "Never mark for delete". I guess my problem isn't that they are being deleted, the problem is that far too much is going to my Recycle Bin, including messages tagged recognized Allowed (first on the list). That's why I mentioned it was almost like a bug had been introduced that checked them in the reverse order. Or no/random/hash order.

[pwhit]

After being restored, on first check, this message went straight back in the Recycle Bin with this analysis:

[pwhit]

Okay, it's the spam origin tests, and it's ignoring the scoring. For one representative message that was being false-positive sent to Recycle Bin, I turned off SpamCop origin that it was reporting in analysis (for pwc.com, PricewaterhouseCoopers Inc., LIT, which makes it very unlikely to truly be in the list) and it still went to the Recycle Bin, claiming SpamHaus also found it (by IP apparently). So I turned off SpamHaus as well and when I restored it again, it remained in my inbox.

So it would seem there's something wrong with the spam origins checks; it's unlike that both services have suddenly started having a bunch of false positives.

[pwhit]

Confirmed that SpamHaus does not have any issues with pwc.com, and they were in my friends list:
https://check.spamhaus.org/not_listed/? ... rm=pwc.com

[gingbat]

Yes, if spamhaus catches an email and is set to auto delete, it will be auto deleted, just leave disabled, I never use it myself as often has issues like this.

[pwhit]

@gingbat, SpamHaus and SpamCop are NOT reporting it as problematic, yet it is being marked for delete by MWP, claiming that they have, and ignore the scoring system that should have prevented it in this case anyway.

I have disabled these inputs to avoid the issue but clearly this is a problem with MWP and it effectively means these features cannot be used. I also previously had to disable FirstAlert, due to the crash at startup problem when it is enabled.

Fortunately, I have an extensive set of filters and do not really rely on SBLs and services, but it is a shame that I cannot use these features due to problems in MWP.

[gingbat]

OK, in that case, can you please send me one of the emails that they claim is NOT on their database but is being marked as such in MW and I'll do some tests here.

Send to support at firetrust dot com, referring to this forum post.

Please send the actual email in question as a text (.txt) file, (not inline or as another type of document) , to do this, open MWPro and click the "Show email info" link just above the preview pane, (Click View>>Preview Pane if you do not have this enabled) then click the "Source tab.

That will show the raw text of the email, copy that into a new txt file (click in the email and click ctrl A to select all, then click Ctrl C to copy) and send as an attachment.

NOTE: how-too video here: https://1drv.ms/v/s!Ak8zLigJcntT4l8m7NK ... S?e=koBdby

[pwhit]

@ginbat Sure thing. Since disabling the SBLs, I've been able to continue with MWP, so I actually emptied my Recycle Bin after restoring the good ones. But I have at least one or two that I'll send right away.
Thanks!

[gingbat]

Great, thanks for that, however my MWPro does not catch these with either spamcoo or spamuhaus... although I note that the email you sent was a restored email, so that would have changed the header....

Do you have an original one to send me possibly, before it was deleted/restored?

[tlg]

I've nothing but issues with the last few builds, I rolled back to 7.12.125 and it works perfectly.

[pwhit]

@tlg, I just tried 7.12.125 and I have the same problem with false-positives when MWP interprets SBL results, see images below. And ignoring of the scores.

However, it's worth noting that the problem remained when I rolled back to 7.12.125. I'm going to try 7.12.56 which I don't think I had any trouble with, but my gut (40 years of being a professional developer) says the problem isn't code version but more of an environmental/configuration problem in some way. I can avoid all trouble by turning off both SBLs (and I still have FirstAlert disabled), but the fact that MWP demonstrates this problem with either SBL enabled also implies it's not something that changed at one of them.

Of 144 messages in my mailbox for MWP to pick up, it sent 143 of them to the Recycle bin, including those with very high positive scores, those in my absolutely "Allowed" list, etc. Restoring a message just puts another copy back in the Bin when it checks again. Turning off the SBLs and rerunning causes the messages to appear in my inbox as expect. So for now, I'll just disable the black lists and FirstAlert.

[gingbat]

Yes, it's pretty odd alright, however if it were a MW issue you'd think we'd be getting a lot more users report it... I wonder if your ISP is caching some old data and sending that to MW?

If you send me one of the original (NON restored) emails and I can check it here in MW....?

[pwhit]

@gingbat I have previously emailed a restored one as a text attachment, but I understand you might be concerned about the path taken.

So I've restored .188 and just tried enabling SpamHaus briefly, sending myself a message with a bit of bold in an HTML body, and it went straight to the Recycle Bin as a SpamHaus match, same problem. I've turned both SBLs back off and I will email you the source as a text attachment to the support email.