Hey GREAT Idea. Glad someone is using their noodle until Roberto gets a chance to update the software! I ran with your idea and created this script.

It's alot easier to follow, you can copy and paste each line and it will remove by keyword or subject line.

update tblquarantine set expire=1 where RejectDetails = 'found keywords: [found prohibited attachment]'
update tblquarantine set expire=1 where RejectDetails = 'found keywords: [(Subject:\x20(hi|Hi|HI|hello|Hello|HELLO|error|Error|ERROR|test|Test|TEST))]'
update tblquarantine set expire=1 where RejectDetails = 'found keywords: [(subject:\x20(test$|hi|hello$|error$))]'
update tblquarantine set expire=1 where RejectDetails = 'found keywords: [(Subject:(hi$|hello$|test$|error$))]'
update tblquarantine set expire=1 where RejectDetails = 'found keywords: [Here is my photo, that you asked for yesterday.]'
update tblquarantine set expire=1 where RejectDetails = 'found keywords: [Important information for you. Read it immediately !]'
update tblquarantine set expire=1 where RejectDetails = 'found keywords: [The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.]'
update tblquarantine set expire=1 where RejectDetails = 'found keywords: [The message contains Unicode characters and has been sent as a binary attachment.]'
update tblquarantine set expire=1 where RejectDetails = 'found keywords: [Mail transaction failed. Partial message is available.]'
update tblquarantine set expire=1 where Subject = 'hi'
update tblquarantine set expire=1 where Subject = ''
update tblquarantine set expire=1 where RejectDetails = 'found keywords: [mydoom]'
update tblquarantine set expire=1 where RejectDetails = 'found keywords: [Novarg]'

Indeed good call George. We confirm the bug you found. We still haven't verified 100%, but so far it seems to be present in all previous builds, including v1.2.x.

We should have it fixed in the next build.

Roberto F.
LogSat Software

X E LENT idea!

Works like a charm. I even added a few more decrips to delete and have them all go at once.

Thanks,

g

Just to throw out another idea...

I have put a separate (outside of SpamFilter) process in place to purge the MyDoom generated emails (at least most of them) on an hourly basis.  The following query will purge viral messages only, reducing the size of your quarantine database dramatically, while leaving "legitimate" quarantined items alone.

update tblquarantine set expire=1 where RejectDetails = 'found keywords: [found prohibited attachment]' and subject in ('hello','hi','test','server report','error','status','mail delivery system','mail transaction failed','w32.elkern  removal tools')

(Note: HTML truncates whitespace... there are TWO spaces between the words "elkern" and "removal" above.)

After running this query, the messages will be deleted from the database the next time SpamFilter runs it's "deleting expired items" cycle.

This query text is conservative.  It doesn't purge ALL of the MyDoom messages, just 95%+ of them, enough to effect a BIG reduction in quarantine size without being too aggressive.  It could easily be adjusted to be more aggressive, if you wish.  By deleting all of the query text starting with the word "and" you've got an aggressive, take-no-prisoners, "I'm not going to allow ANY attachments to be quarantined on my mail system!" query... that will probably delete some legitimate quarantined messages with attachments if you're not very careful.

You can manually run this query periodically, or use your favorite method of query scheduling to run it on a routine basis. I run it hourly on our mid-volume mail system, but you high-volume guys routing 10,000 messages an hour will probably need to run it a little more often than this.

This query works for a default Microsoft SQL Server (case-insensitive) installation.  Syntax and methods will differ for other database platforms.

George,

Good Call !!!!  It looks like the same problem in .282. As soon as I unchecked "Do not quarantine..." in the keyword filter section, boom the quarantine started working.

I am very impressed with the 282 beta. I am sure I have not run into all the bugs but I can't believe how much spam and viruses it catching. In fact my virus server has not seen a single virus because spamfilter is catching all of the attachments.

Lee

Well I have found a bug I think. In 281 if you select do not quaratine keyword rejections then noting get quaratined but if you uncheck it then quarantined emails go to the database. I found this after reinstalling SF when I discovered that no emails were getting sent to the DB server. I would say this is strange but given how things have been going all week due to Mydoom I am not surprised.

Murphy's law and all.

Guys,

When I was running the 282, I did not have the same issue you are having.  However, you may want to try the 285.

Dan S.

Well, I ended up dumping the database on the server and went back to 281. Now everything is working again. If someone plans on dumping the quarantine database make sure you backup the login names to an access table so you can restore it after you have everything working again. I didn't bother with the emails since most of them were either junk or Mydoom attachments. Too bad we can't drop attachments and keep keyword blocked emails.

I also wish that I didn't have quaratine max recipient blocked emails. (wish list item "Do not quarantine" option to go with existing setting section.

g

The problem is worst then I thought at first. Come to find out, now no email is quarantine. I have rebuilt the database and still no email goes to the database.

Roberto, help!!!