| Author |
Thunderbird -how to block this particular spam
|
|
| tonyjeffs 2006-10-25, 7:12 am |
| I'm fairly new to Thunderbird and am impressed with it.
There is one specific form of spam that I can't filter:
It comprises a 'picture of text' giving advice on the stockmarket,
followed by random text. The sender title and headers are different
every time, so there's nothing consistent that i can see to use in a
filter.
Any ideas?
Thanks
Tony
| |
| Leonidas Jones 2006-10-25, 7:12 am |
| tonyjeffs wrote:
> I'm fairly new to Thunderbird and am impressed with it.
> There is one specific form of spam that I can't filter:
> It comprises a 'picture of text' giving advice on the stockmarket,
> followed by random text. The sender title and headers are different
> every time, so there's nothing consistent that i can see to use in a
> filter.
> Any ideas?
>
> Thanks
> Tony
>
Enable the Junk Mail Controls, and train the junk filters, it will catch
most of them in couple of weeks.
Lee
| |
|
| Leonidas Jones wrote:
> tonyjeffs wrote:
>
> Enable the Junk Mail Controls, and train the junk filters, it will catch
> most of them in couple of weeks.
>
> Lee
I get what sounds like the same crap. And my filter has
not caught one over the months. The Stock market advice
is a gif, and the rest of the message is random text from
one message to another. The header seems to be different
as well. No stopping this.
Only thing I have figured out to do is to have a couple of
email address that are used specifically to subscribe to
the yahoo groups and when this starts up, suspend that one
and use the new one for a time then repeat.
Dan
| |
| tonyjeffs 2006-10-25, 1:22 pm |
| Lee, Dan
I've been running it for a month, and, like you Dan, the spam-blocker
is showing no sign of learning about this particular one. It's learned
everything else.
I was previously using Ella, a spam-blocker add on for ie, and that
could do it. I should've been more specific about using a separate
usened email address in the first place.
Dan wrote:
> Leonidas Jones wrote:
>
> I get what sounds like the same crap. And my filter has
> not caught one over the months. The Stock market advice
> is a gif, and the rest of the message is random text from
> one message to another. The header seems to be different
> as well. No stopping this.
>
> Only thing I have figured out to do is to have a couple of
> email address that are used specifically to subscribe to
> the yahoo groups and when this starts up, suspend that one
> and use the new one for a time then repeat.
>
> Dan
| |
|
| tonyjeffs wrote:
> Lee, Dan
>
> I've been running it for a month, and, like you Dan, the spam-blocker
> is showing no sign of learning about this particular one. It's learned
> everything else.
> I was previously using Ella, a spam-blocker add on for ie, and that
> could do it. I should've been more specific about using a separate
> usened email address in the first place.
>
>
>
> Dan wrote:
>
BTW, yahoo mail which is where all my mail comes through
does not learn this one either.
Dan
| |
| Mozilla Champion (Dan) 2006-10-25, 1:22 pm |
| Dan C wrote:
> tonyjeffs wrote:
> BTW, yahoo mail which is where all my mail comes through does not learn
> this one either.
>
> Dan
I dont know what else to tell you. Junk Mail Controls will catch this
type of spam. Here it is catching 99 plus % of spam sent my way,
inclusive of those ones you describe.
| |
| Tony Raven 2006-10-25, 1:22 pm |
| Mozilla Champion (Dan) wrote on 25/10/2006 16:27 +0100:
>
> I dont know what else to tell you. Junk Mail Controls will catch this
> type of spam. Here it is catching 99 plus % of spam sent my way,
> inclusive of those ones you describe.
Not here it ain't
--
Tony
"Anyone who conducts an argument by appealing to authority is not using
his intelligence; he is just using his memory."
- Leonardo da Vinci
| |
|
| Mozilla Champion (Dan) wrote:
> Dan C wrote:
>
>
> I dont know what else to tell you. Junk Mail Controls will catch this
> type of spam. Here it is catching 99 plus % of spam sent my way,
> inclusive of those ones you describe.
Is there a way to see how successfully the Junk mail control is working?
i.e. percentage?
I kept getting the same email "Here at world stock report...Trading
alert" for about two months but has only now (within the week) started
filtering it automatically. So it must eventually work but why does it
take so long?
Adam
| |
| John Thompson 2006-10-25, 7:11 pm |
| On 2006-10-25, tonyjeffs <tonyjeffs@tonyjeffs.com> wrote:
> I'm fairly new to Thunderbird and am impressed with it.
> There is one specific form of spam that I can't filter:
> It comprises a 'picture of text' giving advice on the stockmarket,
> followed by random text. The sender title and headers are different
> every time, so there's nothing consistent that i can see to use in a
> filter.
> Any ideas?
Spamassassin has a plugin (FuzzyOCR) that will pass the image through
optical charachter recognition software (gocr) and parse the resulting
text for common spam words:
Content analysis details: (13.0 points, 5.0 required)
pts rule name description
---- ------------------------------------------------------------------------
0.8 MY_DSL I could use a BL for this.
1.1 EXTRA_MPART_TYPE Header has extraneous Content-type:...type=entry
0.8 DATE_IN_PAST_06_12 Date: is 6 to 12 hours before Received: date
-2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
[score: 0.0000]
0.5 HTML_40_50 BODY: Message is 40% to 50% HTML
1.9 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 SARE_GIF_ATTACH FULL: Email has a inline gif
0.0 NO_RDNS2 Sending MTA has no reverse DNS
1.7 SARE_GIF_STOX Inline Gif with little HTML
8.0 FUZZY_OCR BODY: Mail contains an image with common
spam text inside
Words found:
"symbol" in 1 lines
"service" in 1 lines
"company" in 2 lines
"trade" in 1 lines
"news" in 1 lines
(6 word occurrences found)
--
John (john@os2.dhs.org)
| |
| Mozilla Champion (Dan) 2006-10-26, 1:12 am |
| Tony Raven wrote:
> Mozilla Champion (Dan) wrote on 25/10/2006 16:27 +0100:
>
> Not here it ain't
>
Well then, lets see if we can get your JMC working properly then.
Do you have it set to move messages to a common Junk folder? What is the
size of your training.dat?
| |
| Mozilla Champion (Dan) 2006-10-26, 1:12 am |
| Adam wrote:
> Mozilla Champion (Dan) wrote:
>
> Is there a way to see how successfully the Junk mail control is working?
> i.e. percentage?
> I kept getting the same email "Here at world stock report...Trading
> alert" for about two months but has only now (within the week) started
> filtering it automatically. So it must eventually work but why does it
> take so long?
>
> Adam
The easiest way is to simply use the system as extant.
When JMC catches a message it moves it to the Junk folder as unread
When you catch one, and mark it, it is moved as read.
So, your 'catch ratio' is simply comparing the number of read messages
to the number of unread messages rounding up to a 100
Keep all junk for a week and do a weekly rate, or day by day.
the mail extension Mnehny had a feature that calculated some Junk Mail
statistics, but didnt include catch ratio or some such.
I dont know why yours took so long. Here such messages get filtered
after the third or fourth - so usually within a week or less
| |
| Mozilla Champion (Dan) 2006-10-26, 1:12 am |
| John Thompson wrote:
> On 2006-10-25, tonyjeffs <tonyjeffs@tonyjeffs.com> wrote:
>
>
> Spamassassin has a plugin (FuzzyOCR) that will pass the image through
> optical charachter recognition software (gocr) and parse the resulting
> text for common spam words:
>
Be advised that use of Spamassassin will decrease the catch in JMC
currently and further impact lower catch rates in the future. Every
message that Spamassassin catches is one less that JMC 'sees' and gets
trained on
Since JMC can easily be trained to catch 99% plus of spam, use of other
filtering techniques will only reduce the catch ratio.
| |
| Tony Raven 2006-10-26, 7:12 am |
| Mozilla Champion (Dan) wrote on 26/10/2006 02:01 +0100:
> Tony Raven wrote:
>
>
> Well then, lets see if we can get your JMC working properly then.
>
> Do you have it set to move messages to a common Junk folder? What is the
> size of your training.dat?
I mark it as junk and have it set to go to the Trash rather than Junk
folder. The training.dat file is 2.8MB
--
Tony
"Anyone who conducts an argument by appealing to authority is not using
his intelligence; he is just using his memory."
- Leonardo da Vinci
| |
| Mozilla Champion (Dan) 2006-10-26, 7:12 am |
| Tony Raven wrote:
> Mozilla Champion (Dan) wrote on 26/10/2006 02:01 +0100:
>
> I mark it as junk and have it set to go to the Trash rather than Junk
> folder. The training.dat file is 2.8MB
>
I suggest you use an interim folder/file for spam collection. Putting it
straight to trash may end up with you losing legitmate emails that are
incorrectly caught. You can have the 'junk' folder emptied into the
trash automatically.
I would call that overly large. My training.dat is 232KB since 11 July
Its catching, as I said, 99% plus of spam sent my way.
Okay, since your JMC isnt working well, there will be no harm in
re-starting from scratch. You will go down to about a 65% catch ratio
but then that will improve (usually within the month) to 90% plus.
Thunderbird
Tools-->Junk Mail Controls [Adaptive Filter]
reset training data
Caveat: this WILL result in a temporary loss of efficiency, but as I
said this will improve shortly.
All you have to do is mark those messages that are junk as junk
and any ones JMC catches that are not junk as non junk.
I note you have Mnehny installed. I suggest you ignore/turn off its spam
indication - marking 'unknown' messages as not junk will NOT improve
your catch ratio (tho it might help in false positives) and will bloat
your training.dat
| |
| Tony Raven 2006-10-26, 1:12 pm |
| Mozilla Champion (Dan) wrote on 26/10/2006 10:33 +0100:
>
> Okay, since your JMC isnt working well, there will be no harm in
> re-starting from scratch. You will go down to about a 65% catch ratio
> but then that will improve (usually within the month) to 90% plus.
>
It works fine, except on the type of spam which is the subject of this
thread and which seems to be a currently fashionable spam to send.
Its amusing in some ways to see the same company hyped week after week
with promises of exploding prices within the week.
--
Tony
"Anyone who conducts an argument by appealing to authority is not using
his intelligence; he is just using his memory."
- Leonardo da Vinci
| |
| Mozilla Champion (Dan) 2006-10-26, 1:12 pm |
| Tony Raven wrote:
> Mozilla Champion (Dan) wrote on 26/10/2006 10:33 +0100:
>
> It works fine, except on the type of spam which is the subject of this
> thread and which seems to be a currently fashionable spam to send.
>
> Its amusing in some ways to see the same company hyped week after week
> with promises of exploding prices within the week.
>
>
Well, its either working FINE or it isnt. Your call.
If you WANT to continue to get that type of spam, well, is that what you
call working fine?
As I stated, here my JMC is catching 99% plus of spam sent my way
inclusive of the emails you describe.
| |
| Tony Raven 2006-10-26, 1:12 pm |
| Mozilla Champion (Dan) wrote on 26/10/2006 17:13 +0100:
> Tony Raven wrote:
>
>
> Well, its either working FINE or it isnt. Your call.
> If you WANT to continue to get that type of spam, well, is that what you
> call working fine?
>
> As I stated, here my JMC is catching 99% plus of spam sent my way
> inclusive of the emails you describe.
Why so aggressive? It works for you. It clearly doesn't work for a
number of the rest of us on one particular type of spam. Sorry I dared
to say so.
--
Tony
"Anyone who conducts an argument by appealing to authority is not using
his intelligence; he is just using his memory."
- Leonardo da Vinci
| |
| Mozilla Champion (Dan) 2006-10-26, 1:12 pm |
| Tony Raven wrote:
> Mozilla Champion (Dan) wrote on 26/10/2006 17:13 +0100:
>
> Why so aggressive? It works for you. It clearly doesn't work for a
> number of the rest of us on one particular type of spam. Sorry I dared
> to say so.
>
Who is being aggressive?
Its your call. If its working fine, then dont do anything
If you dont want those type of spams then do something. Again its your call.
| |
| Ed Mullen 2006-10-26, 1:12 pm |
| Mozilla Champion (Dan) wrote:
> Tony Raven wrote:
>
> Who is being aggressive?
> Its your call. If its working fine, then dont do anything
> If you dont want those type of spams then do something. Again its your
> call.
One test might be to have tony or someone else "edit as new" and email
it to you to see if your spam filter catches it.
--
Ed Mullen
http://edmullen.net
http://mozilla.edmullen.net
http://abington.edmullen.net
Deja FU: The feeling that you've screwed this up before.
| |
| Mozilla Champion (Dan) 2006-10-26, 7:12 pm |
| Ed Mullen wrote:
> Mozilla Champion (Dan) wrote:
>
> One test might be to have tony or someone else "edit as new" and email
> it to you to see if your spam filter catches it.
>
They are quite welcome to do that. My email is right there in every
message (moz.champion@sympatico.ca)
If they are going to do that tho, I request they inform me when doing so
so I can keep a weather eye out for it. Use of [testspam] as an additon
to the subject line will assist
| |
| John Thompson 2006-10-26, 7:12 pm |
| On 2006-10-26, Mozilla Champion (Dan) <moz.champion@sympatico.ca> wrote:
> John Thompson wrote:
[vbcol=seagreen]
> Be advised that use of Spamassassin will decrease the catch in JMC
> currently and further impact lower catch rates in the future. Every
> message that Spamassassin catches is one less that JMC 'sees' and gets
> trained on
>
> Since JMC can easily be trained to catch 99% plus of spam, use of other
> filtering techniques will only reduce the catch ratio.
No, that's not true. All spamassassin does is tag spam; it's up to you
to decide what to do with it. Thunderbird's junk mail controls have an
option to "trust spam headers" from spamasassin, and by selecting this,
Thunderbird will toss spamassassin-tagged mail into the Junk folder
where the JMC can learn it along with all the other stuff it catches.
Between spamassassin and Thunderbird's JMC very little spam makes it
through to my Inbox.
--
John (john@os2.dhs.org)
| |
| Mozilla Champion (Dan) 2006-10-27, 1:12 am |
| John Thompson wrote:
> On 2006-10-26, Mozilla Champion (Dan) <moz.champion@sympatico.ca> wrote:
>
>
> No, that's not true. All spamassassin does is tag spam; it's up to you
> to decide what to do with it. Thunderbird's junk mail controls have an
> option to "trust spam headers" from spamasassin, and by selecting this,
> Thunderbird will toss spamassassin-tagged mail into the Junk folder
> where the JMC can learn it along with all the other stuff it catches.
>
> Between spamassassin and Thunderbird's JMC very little spam makes it
> through to my Inbox.
>
Incorrrect. 'trusting' another applications measurements means that JMC
DOESNT check the messsge, therefore nothing about it is added to the
training.dat.
Every message that is caught by Spamassassin, is not checked by JMC.
This will impact the current catch ratio as well as future catch ratios
| |
|
| Mozilla Champion (Dan) wrote:
> Ed Mullen wrote:
>
>
> They are quite welcome to do that. My email is right there in every
> message (moz.champion@sympatico.ca)
>
> If they are going to do that tho, I request they inform me when doing so
> so I can keep a weather eye out for it. Use of [testspam] as an additon
> to the subject line will assist
Is there a "edit as new" feature? I am not seeing if so.
Since part of this crap is a gif, I will just save it to
disk, and cut and paste the rest. Of course the complete
header will be different than the sender, so I don't see
how this will accomplish much.
Gee if we could just get you on their mailing list....
Dan
| |
| Mozilla Champion (Dan) 2006-10-27, 1:11 pm |
| Dan C wrote:
> Mozilla Champion (Dan) wrote:
>
> Is there a "edit as new" feature? I am not seeing if so.
>
> Since part of this crap is a gif, I will just save it to disk, and cut
> and paste the rest. Of course the complete header will be different
> than the sender, so I don't see how this will accomplish much.
>
> Gee if we could just get you on their mailing list....
>
> Dan
Certainly is an 'Edit as New' feature, right there under the Message
menu. i.e. select the message in question, then
Message-->Edit Message as New
Why cut part of it out? Send the entire thing.
| |
|
| Mozilla Champion (Dan) wrote:
> Dan C wrote:
>
> Certainly is an 'Edit as New' feature, right there under the Message
> menu. i.e. select the message in question, then
> Message-->Edit Message as New
>
> Why cut part of it out? Send the entire thing.
Didnt understand the concept. TESTSPAM on the way. Do
you want receive them for a day or so?
Doubt one or two will do you much good.
Dan
| |
| Mozilla Champion (Dan) 2006-10-27, 1:11 pm |
| Dan C wrote:
> Mozilla Champion (Dan) wrote:
>
> Didnt understand the concept. TESTSPAM on the way. Do you want receive
> them for a day or so?
>
> Doubt one or two will do you much good.
>
> Dan
We shall see, I suspect that my JMC will pick them up verbatim anyway
| |
| Mozilla Champion (Dan) 2006-10-27, 1:11 pm |
| Mozilla Champion (Dan) wrote:
> Dan C wrote:
>
> We shall see, I suspect that my JMC will pick them up verbatim anyway
Exactly as I suspected, they were picked up by my JMC with no problem
whatso-ever. They and several others of various stocks are all of a
similar type, JMC catches them quite well.
| |
| Mozilla Champion (Dan) 2006-10-27, 1:11 pm |
| Mozilla Champion (Dan) wrote:
> Mozilla Champion (Dan) wrote:
>
> Exactly as I suspected, they were picked up by my JMC with no problem
> whatso-ever. They and several others of various stocks are all of a
> similar type, JMC catches them quite well.
Headers are NOT the only part of what Junk Mail Controls consider, JMC
looks at the ENTIRE message. So you sending the message to me (which
will change most of the headers) doesnt matter. The bulk of the message
hasnt changed so it will still be picked up.
Of course, if I had you in my address book, it would be exempt, but that
isnt the case here, you dont have the spammer in your address book do you?
| |
|
| Mozilla Champion (Dan) wrote:
> Mozilla Champion (Dan) wrote:
>
>
> Headers are NOT the only part of what Junk Mail Controls consider, JMC
> looks at the ENTIRE message. So you sending the message to me (which
> will change most of the headers) doesnt matter. The bulk of the message
> hasnt changed so it will still be picked up.
>
> Of course, if I had you in my address book, it would be exempt, but that
> isnt the case here, you dont have the spammer in your address book do you?
Interesting. No spammer is not in address book.
So what is your JMC doing different from mine? I have
been marking this stuff as junk for a few months now to no
avail. BTW, I am using version 1.5.0.7 (20060909).
What do you suggest?
Thanks for your help, btw.
Dan
| |
| Mozilla Champion (Dan) 2006-10-27, 1:11 pm |
| Dan C wrote:
> Mozilla Champion (Dan) wrote:
[vbcol=seagreen]
>
>
> Interesting. No spammer is not in address book.
>
> So what is your JMC doing different from mine? I have been marking this
> stuff as junk for a few months now to no avail. BTW, I am using version
> 1.5.0.7 (20060909).
>
> What do you suggest?
>
> Thanks for your help, btw.
>
> Dan
As I mentioned previously, my suggestion is to restart your training.dat
Tools-->Junk Mail Controls [Adaptive Filter]
<Reset Training Data>
Caveat: this WILL zeroize you training.dat back to nothing and will
result in a temporary reduction in catch ratio to approx. 65%.
This will improve over time and usually within a month be up to 90% or more.
NB: Do NOT attempt to 'jump start' the training or 'add in' training on
old message to speed up the process. Do NOT mark unknown messages as non
spam. Do NOT use other filtering methods to augment JMC
Simply: You get a spam, mark it as such. If JMC catches a good one,
then un mark it. Thats its. nothing more.
| |
|
| Mozilla Champion (Dan) wrote:
> Dan C wrote:
>
>
>
> As I mentioned previously, my suggestion is to restart your training.dat
>
> Tools-->Junk Mail Controls [Adaptive Filter]
> <Reset Training Data>
>
> Caveat: this WILL zeroize you training.dat back to nothing and will
> result in a temporary reduction in catch ratio to approx. 65%.
> This will improve over time and usually within a month be up to 90% or
> more.
>
> NB: Do NOT attempt to 'jump start' the training or 'add in' training on
> old message to speed up the process. Do NOT mark unknown messages as non
> spam. Do NOT use other filtering methods to augment JMC
>
> Simply: You get a spam, mark it as such. If JMC catches a good one,
> then un mark it. Thats its. nothing more.
Thanks Dan.
I appreciate.
BTW like the word "zeroize"
Dan
| |
|
| Mozilla Champion (Dan) wrote:
> Tony Raven wrote:
>
> I suggest you use an interim folder/file for spam collection. Putting it
> straight to trash may end up with you losing legitmate emails that are
> incorrectly caught. You can have the 'junk' folder emptied into the
> trash automatically.
>
> I would call that overly large. My training.dat is 232KB since 11 July
> Its catching, as I said, 99% plus of spam sent my way.
>
> Okay, since your JMC isnt working well, there will be no harm in
> re-starting from scratch. You will go down to about a 65% catch ratio
> but then that will improve (usually within the month) to 90% plus.
>
> Thunderbird
> Tools-->Junk Mail Controls [Adaptive Filter]
> reset training data
>
> Caveat: this WILL result in a temporary loss of efficiency, but as I
> said this will improve shortly.
> All you have to do is mark those messages that are junk as junk
> and any ones JMC catches that are not junk as non junk.
>
> I note you have Mnehny installed. I suggest you ignore/turn off its spam
> indication - marking 'unknown' messages as not junk will NOT improve
> your catch ratio (tho it might help in false positives) and will bloat
> your training.dat
Where does the "training.dat" file reside? I did a
Windows explore search on computer and it does not show up.
Dan
| |
| Mozilla Champion (Dan) 2006-10-28, 1:15 pm |
| Dan C wrote:
> Mozilla Champion (Dan) wrote:
>
>
> Where does the "training.dat" file reside? I did a Windows explore
> search on computer and it does not show up.
>
> Dan
Your training.dat is inside your profile.
http://www.mozilla.org/support/thun.../profile#locate
| |
| Leonidas Jones 2006-10-28, 1:15 pm |
| Mozilla Champion (Dan) wrote:
> Dan C wrote:
>
> Your training.dat is inside your profile.
> http://www.mozilla.org/support/thun.../profile#locate
Note, Application Data is a hidden folder in Windows. When you do a
system search, you must include hidden files and folders.
Lee
| |
| John Thompson 2006-10-29, 1:12 am |
| On 2006-10-27, Mozilla Champion (Dan) <moz.champion@sympatico.ca> wrote:
> John Thompson wrote:
[vbcol=seagreen]
> Incorrrect. 'trusting' another applications measurements means that JMC
> DOESNT check the messsge, therefore nothing about it is added to the
> training.dat.
>
> Every message that is caught by Spamassassin, is not checked by JMC.
> This will impact the current catch ratio as well as future catch ratios
I still disagree. The SA-tagged messages are tossed into the Junk
filter, where I can review them. If I agree that they are spam, I tick
the "Junk Status" flag and the JMC learns it just like any other message
for which I tick the "Junk Status" flag.
--
John (john@os2.dhs.org)
| |
| John Thompson 2006-10-29, 1:12 am |
| On 2006-10-27, Mozilla Champion (Dan) <moz.champion@sympatico.ca> wrote:
> Simply: You get a spam, mark it as such. If JMC catches a good one,
> then un mark it. Thats its. nothing more.
That's fine, except for the messages that the JMC has no means of
judging -- e.g. image spam with Bayes poison text. For messages such as
that, spamassassin can process the image to find spam text inside and
render a judgement based on that. The filters (JMC and spamassassin) are
not mutually exclusive; that can act together to provide better coverage
than either filter can do on its own.
--
John (john@os2.dhs.org)
| |
| Mozilla Champion (Dan) 2006-10-29, 7:11 am |
| John Thompson wrote:
> On 2006-10-27, Mozilla Champion (Dan) <moz.champion@sympatico.ca> wrote:
>
>
> That's fine, except for the messages that the JMC has no means of
> judging -- e.g. image spam with Bayes poison text. For messages such as
> that, spamassassin can process the image to find spam text inside and
> render a judgement based on that. The filters (JMC and spamassassin) are
> not mutually exclusive; that can act together to provide better coverage
> than either filter can do on its own.
>
Hogwash!
As I said, here my JMC is catching 99.8% of ALL spam sent my way,
inclusive of these image ones you are on about.
In fact, I just got through convincing someone else to re-do their
training.dat because these types of spams were continuatlly getting thru
his. He reports MUCH better results now.
Junk Mail Controls (JMC) WILL catch these types of spams. As I said, for
every 200 spam sent to any of my accounts, I see one in my inbox.
If your JMC isnt catching these spams, then perhaps its time to re-do
your JMC training.
| |
| Mozilla Champion (Dan) 2006-10-29, 7:11 am |
| John Thompson wrote:
> On 2006-10-27, Mozilla Champion (Dan) <moz.champion@sympatico.ca> wrote:
>
>
> I still disagree. The SA-tagged messages are tossed into the Junk
> filter, where I can review them. If I agree that they are spam, I tick
> the "Junk Status" flag and the JMC learns it just like any other message
> for which I tick the "Junk Status" flag.
>
IF you do that, then fine. But most people dont.
| |
|
| Mozilla Champion (Dan) wrote:
> John Thompson wrote:
>
>
> Hogwash!
>
> As I said, here my JMC is catching 99.8% of ALL spam sent my way,
> inclusive of these image ones you are on about.
>
> In fact, I just got through convincing someone else to re-do their
> training.dat because these types of spams were continuatlly getting thru
> his. He reports MUCH better results now.
>
>
> Junk Mail Controls (JMC) WILL catch these types of spams. As I said, for
> every 200 spam sent to any of my accounts, I see one in my inbox.
>
>
> If your JMC isnt catching these spams, then perhaps its time to re-do
> your JMC training.
Dan,
Would you mind going through an explanation as to WHY the
training.dat file needs to be reset?
Why if it gets "too " big does it cease learning, or does
it cease learning if it gets corrupted or...?
Dan
| |
| Mozilla Champion (Dan) 2006-10-30, 7:12 am |
| Dan C wrote:
> Mozilla Champion (Dan) wrote:
>
>
> Dan,
>
> Would you mind going through an explanation as to WHY the training.dat
> file needs to be reset?
> Why if it gets "too " big does it cease learning, or does it cease
> learning if it gets corrupted or...?
>
> Dan
It doesnt NEED to be reset unless it isnt performing as well as
expected. Size of the file is irrelevent to performance - a 'small'
training.dat (c300K) can perform as well if not better than a large
(c1m) one (or vice versa).
I never had to re-do my training because my JMC always performed well.
But for others who were having problems with the catch ratio, or JMC not
picking up on specific types of spams, restarting the training.dat went
a long way to resolving the problem. If you are not having problems
with JMC, then there is no requirement to re-do the training.dat
| |
|
| Mozilla Champion (Dan) wrote:
> Dan C wrote:
>
>
> It doesnt NEED to be reset unless it isnt performing as well as
> expected. Size of the file is irrelevent to performance - a 'small'
> training.dat (c300K) can perform as well if not better than a large
> (c1m) one (or vice versa).
>
>
> I never had to re-do my training because my JMC always performed well.
> But for others who were having problems with the catch ratio, or JMC not
> picking up on specific types of spams, restarting the training.dat went
> a long way to resolving the problem. If you are not having problems
> with JMC, then there is no requirement to re-do the training.dat
Thanks. And Thanks for all your help... For now.
Dan
| |
|
| Dan C wrote:
> Mozilla Champion (Dan) wrote:
> Thanks Dan.
Dan,
As a result of my and others exchange with you over the
failure of our Thunderbird installs to adequately handle
this particular spam, I have reset my JMC training.dat
file and have followed your suggestions. But my JMC has
failed to catch ANY of them through multiple daily
opportunities over about 10 day period.
To refresh your memory, the spam contained a gif of a
stock tip followed with text. I forwarded to you a
number of examples which your JMC caught.
Any suggestions, observations, words of wisdom?
Dan C
| |
| Mozilla Champion (Dan) 2006-11-04, 1:11 pm |
| Dan C wrote:
> Dan C wrote:
>
> Dan,
>
> As a result of my and others exchange with you over the failure of our
> Thunderbird installs to adequately handle this particular spam, I have
> reset my JMC training.dat file and have followed your suggestions. But
> my JMC has failed to catch ANY of them through multiple daily
> opportunities over about 10 day period.
>
> To refresh your memory, the spam contained a gif of a stock tip followed
> with text. I forwarded to you a number of examples which your JMC caught.
>
> Any suggestions, observations, words of wisdom?
>
> Dan C
Well, something is botched then <g>
I have been monitoring my spam for the 'type' of spam and have noted
that JMC is catching it quite well. In fact the actual spam I was sent
by another user (it was getting past his JMC) was caught by my JMC with
no problems.
Is your JMC enabled on all accounts?
Please send me one of the spams if you would, so we can be sure all is
as it should be. Please add [test message] to the spam subject so I can
recover it from my JMC if need be. My address is
moz.champion@sympatico.ca
| |
|
| Mozilla Champion (Dan) wrote:
> Dan C wrote:
>
>
>
> Well, something is botched then <g>
> I have been monitoring my spam for the 'type' of spam and have noted
> that JMC is catching it quite well. In fact the actual spam I was sent
> by another user (it was getting past his JMC) was caught by my JMC with
> no problems.
>
> Is your JMC enabled on all accounts?
>
> Please send me one of the spams if you would, so we can be sure all is
> as it should be. Please add [test message] to the spam subject so I can
> recover it from my JMC if need be. My address is
> moz.champion@sympatico.ca
All of this particular spam always come in under my email
address: danr.c@sbcglobal.net. It is enabled if that is
done under Tools|Junk Mail Controls. And it is catching
other kinds.
Dan
Sample is forwarded to you with a note.
| |
| Mozilla Champion (Dan) 2006-11-05, 1:11 pm |
| Dan C wrote:
> Mozilla Champion (Dan) wrote:
>
>
> All of this particular spam always come in under my email address:
> danr.c@sbcglobal.net. It is enabled if that is done under Tools|Junk
> Mail Controls. And it is catching other kinds.
>
> Dan
>
> Sample is forwarded to you with a note.
>
Message received. My JMC is catching that spam, I noted it several days
ago in my catch file
How many of these are you getting? If you have another one, please send
me that as well.
| |
|
| Mozilla Champion (Dan) wrote:
> Dan C wrote:
>
>
> Message received. My JMC is catching that spam, I noted it several days
> ago in my catch file
>
>
> How many of these are you getting? If you have another one, please send
> me that as well.
Seven came in on the 3rd. I would say anywhere from 5 to
12 come a day. i will forward a couple of the latest.
Thanks again.
| |
| Mozilla Champion (Dan) 2006-11-06, 7:12 am |
| Dan C wrote:
> Mozilla Champion (Dan) wrote:
>
> Seven came in on the 3rd. I would say anywhere from 5 to 12 come a
> day. i will forward a couple of the latest.
>
> Thanks again.
Well, I compared the ones you forwarded to my catch. Some (not all) of
them are the same - so your JMC should be catching them
Are you receiving these on a yahoo email account?
| |
|
| Mozilla Champion (Dan) wrote:
> Dan C wrote:
>
>
> Well, I compared the ones you forwarded to my catch. Some (not all) of
> them are the same - so your JMC should be catching them
>
> Are you receiving these on a yahoo email account?
Yes. This is an yahoo account.
| |
| Mozilla Champion (Dan) 2006-11-06, 1:12 pm |
| Dan C wrote:
> Mozilla Champion (Dan) wrote:
>
>
> Yes. This is an yahoo account.
Okay, lets attempt to restart the entire enchilada.
NB: the following procedure will reset everything to zero, trainiing and
retention (of Junk).
Tools-->Junk Mail Controls [Adaptive Filter]
[] Enable adaptive Junk Mail Detection
(un check this)
<Reset Training Data>
(click this)
Quit Thunderbird.
Go into your profile folder and remove the files Junk and Junk.msf **
(** or whatever your Junk folder was named)
Restart Thunderbird, re-enable Junk Mail Controls
mark messages that are junk as junk, please report on situation.,
| |
|
| Mozilla Champion (Dan) wrote:
> Dan C wrote:
>
>
> Okay, lets attempt to restart the entire enchilada.
>
> NB: the following procedure will reset everything to zero, trainiing and
> retention (of Junk).
>
>
> Tools-->Junk Mail Controls [Adaptive Filter]
>
> [] Enable adaptive Junk Mail Detection
>
> (un check this)
>
> <Reset Training Data>
>
> (click this)
>
> Quit Thunderbird.
> Go into your profile folder and remove the files Junk and Junk.msf **
> (** or whatever your Junk folder was named)
>
> Restart Thunderbird, re-enable Junk Mail Controls
>
> mark messages that are junk as junk, please report on situation.,
I will keep you informed.
Dan
| |
|
| Dan C wrote:
> Mozilla Champion (Dan) wrote:
>
>
> I will keep you informed.
>
> Dan
Dan,
Reporting back. JMC has been 100% unsuccessful in
catching any of the above mentioned and described spam
over the passing week since we last communicated. Again,
spam contains a gif of stock information, followed by a
poorly written attempt at erotica or some other lame
attempt at story telling. I carefully followed your
directions above. JMC is working well on EVERY other type
of spam encountered so far.
What to do?
Dan
| |
| Troy Piggins 2006-11-13, 8:13 am |
| * Dan C wrote:
> Dan C wrote:
> [---=| Quote block shrinked by t-prot: 150 lines snipped |=---]
>
> Dan,
>
> Reporting back. JMC has been 100% unsuccessful in
> catching any of the above mentioned and described spam
> over the passing week since we last communicated. Again,
> spam contains a gif of stock information, followed by a
> poorly written attempt at erotica or some other lame
> attempt at story telling. I carefully followed your
> directions above. JMC is working well on EVERY other type
> of spam encountered so far.
>
> What to do?
Those .gif attachment spams will be difficult to detect by JMC
since the actual spam is an image, not text.
I've just started using a Spamassassin plugin called FuzzyOCR,
which uses optical character recognition to detect spam in
images. It's works a treat for what you are talking about.
Downside is you need to be running spamassassin and that's not
for everyone.
Maybe someone will write an extension with OCR...
--
Troy Piggins
| |
| Mozilla Champion (Dan) 2006-11-13, 8:13 am |
| Dan C wrote:
> Dan C wrote:
>
> Dan,
>
> Reporting back. JMC has been 100% unsuccessful in catching any of the
> above mentioned and described spam over the passing week since we last
> communicated. Again, spam contains a gif of stock information, followed
> by a poorly written attempt at erotica or some other lame attempt at
> story telling. I carefully followed your directions above. JMC is
> working well on EVERY other type of spam encountered so far.
>
> What to do?
>
> Dan
Are you blocking images in Thunderbird?
Again, please forward a sampling of these spams to my email address if
you will (moz.champion@sympatico.ca).Please add [testspam] to the
subject for flagging purposes.
| |
|
| Mozilla Champion (Dan) wrote:
> Dan C wrote:
>
> Are you blocking images in Thunderbird?
> Again, please forward a sampling of these spams to my email address if
> you will (moz.champion@sympatico.ca).Please add [testspam] to the
> subject for flagging purposes.
No, I am not blocking images. I am receiving images, and
do not want them blocked. Examples on the way.
| |
| Mozilla Champion (Dan) 2006-11-13, 1:12 pm |
| Dan C wrote:
> Mozilla Champion (Dan) wrote:
>
> No, I am not blocking images. I am receiving images, and do not want
> them blocked. Examples on the way.
Simply keep marking these as spam, report back in another week if you would.
| |
|
| Mozilla Champion (Dan) wrote:
> Dan C wrote:
>
>
> Simply keep marking these as spam, report back in another week if you
> would.
I will do so. But I am curious. Is your JMC still
catching my forwards? And if so why?
| |
| Mozilla Champion (Dan) 2006-11-13, 7:13 pm |
| Dan C wrote:
> Mozilla Champion (Dan) wrote:
>
> I will do so. But I am curious. Is your JMC still catching my
> forwards? And if so why?
This group, no it didnt catch them. I compared them to my recent catch
and didnt get a match, I havent seen them before
|
|
|
|