Spam Filter ISP Forums : Embarrassed by new client https://www.logsat.com/spamfilter/forums/ Wed, 17 Jun 2026 22:29:55 +0000 Sat, 29 Dec 2012 11:57:43 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6725 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Embarrassed by new client : RBarrow,As the fix was already...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=14466&title=embarrassed-by-new-client#14466 Author: LogSat
Subject: 6725
Posted: 29 December 2012 at 11:57am

RBarrow,

As the fix was already prepared and was very straightforward, we've already re-patched the previous SpamFilter v4.5.0.62 with it. The fixed version (v4.5.0.63) is now available in the registered user area.

Thanks for re-reporting this!
]]> Sat, 29 Dec 2012 11:57:43 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=14466&title=embarrassed-by-new-client#14466 <![CDATA[Embarrassed by new client : Thanks for checking!We will...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=14465&title=embarrassed-by-new-client#14465 Author: RBarrow
Subject: 6725
Posted: 28 December 2012 at 11:23pm

Thanks for checking! We will look for the next build.
 
Roy
]]> Fri, 28 Dec 2012 23:23:31 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=14465&title=embarrassed-by-new-client#14465 <![CDATA[Embarrassed by new client : We were able to duplicate this...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=14464&title=embarrassed-by-new-client#14464 Author: LogSat
Subject: 6725
Posted: 28 December 2012 at 11:01pm

We were able to duplicate this issue. There appears to have been a regression error with the new SpamFilter v4.5.x that removed the fix that was added in SpamFilter v4.1.2.813. We'll have this re-fixed shortly.

Please note that the fix did not handle the specific trick employed in the "Test mail 4/7", and that the fake spam in "Test mail 3/7" will also not be blocked by SpamFilter as it is not a real spam email. We do not use SpamAssassin and thus that specific signature is meaningless to SpamFilter.
]]> Fri, 28 Dec 2012 23:01:42 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=14464&title=embarrassed-by-new-client#14464 <![CDATA[Embarrassed by new client : We are running 4.50.31 and these...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=14462&title=embarrassed-by-new-client#14462 Author: RBarrow
Subject: 6725
Posted: 28 December 2012 at 4:20pm

We are running 4.50.31 and these 7 messages are still getting through the system.  Are there settings I need to change to get this addressed?

Seems the last activity on the thread was > 2 yrs...but still passing same test emails

Roy
]]> Fri, 28 Dec 2012 16:20:15 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=14462&title=embarrassed-by-new-client#14462 <![CDATA[Embarrassed by new client : I was the original poster of this...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=13520&title=embarrassed-by-new-client#13520 Author: yapadu
Subject: 6725
Posted: 26 March 2010 at 3:19am

I was the original poster of this last year.  I just ran the test again, against a domain protected by spamfilter and to a gmail account.

The testing service sends 7 messages, just like they did last year.  I tested gmail first.

gmail allowed 3/7, 6/7 and 7/7 through.

My spamfilter did better than a year ago, but strangely the virus test got through to my outlook client.

So spamfilter did not stop 2/7 and 4/7.  2/7 is the test virus, which my system should be stopping as I have the virus module.  I will do some more testing, and as Roberto mentioned above 4/7 is still a known issue.
]]> Fri, 26 Mar 2010 03:19:56 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=13520&title=embarrassed-by-new-client#13520 <![CDATA[Embarrassed by new client : The original post regarded issues...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=13514&title=embarrassed-by-new-client#13514 Author: LogSat
Subject: 6725
Posted: 24 March 2010 at 5:49pm

The original post regarded issues with SpamFilter's inability to match filenames/extensions specified in the "Attachment filter" when the filename is obfuscated in the email's mime extensions. We addressed all the obfuscations except one type which is still pending. This however should not have anything to do with the antivirus plugin. Infected files (including of course the eicar test signature) should be stopped regardless of what the filename is.

If this is not occurring, can you please (both Jerbo and Yapadu) zip and email us SpamFilter's activity logfile for a day this happened, also including your SpamFilter.ini file, and the to/from email addresses used for the test, so we can locate them in the logs? I'll send you both a PM with our FTP site login for you to upload the files if they are over 8MB in size.
]]> Wed, 24 Mar 2010 17:49:53 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=13514&title=embarrassed-by-new-client#13514 <![CDATA[Embarrassed by new client : I recently had a customer bring...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=13512&title=embarrassed-by-new-client#13512 Author: jerbo128
Subject: 6725
Posted: 24 March 2010 at 9:36am

I recently had a customer bring the same concerns...
Our setup allowed 5 of the 7 emails, including the one with the virus attached. (and we use the virus filtering plugin Confused )
 
Of the others, the .bat attachment was blocked, a couple came in without any attachment showing in outlook, and a couple came in with an attachment named to another extension.
 
So Roberto, can you please provide some input here?
 
Cheers,
 
Jeremy
 
 
]]> Wed, 24 Mar 2010 09:36:02 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=13512&title=embarrassed-by-new-client#13512 <![CDATA[Embarrassed by new client : I see GFI now has a tester as...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=13485&title=embarrassed-by-new-client#13485 Author: yapadu
Subject: 6725
Posted: 11 March 2010 at 11:40pm

I see GFI now has a tester as well (not sure how long they have had it).  They send a bunch of tests, a lot of which are tests against the email client.

But they do send 5 copies of eicar test virus.  Spamfilter fails on all of them Cry
]]> Thu, 11 Mar 2010 23:40:29 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=13485&title=embarrassed-by-new-client#13485 <![CDATA[Embarrassed by new client : Was the issue of these messages...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=13484&title=embarrassed-by-new-client#13484 Author: yapadu
Subject: 6725
Posted: 11 March 2010 at 8:24pm

Was the issue of these messages getting past spamfilter ever resolved?  I continue to see new clients testing our system and the virus messages still go through from the looks of it.]]> Thu, 11 Mar 2010 20:24:50 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=13484&title=embarrassed-by-new-client#13484 <![CDATA[Embarrassed by new client : yapadu,Thank you for the report.The...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=13079&title=embarrassed-by-new-client#13079 Author: LogSat
Subject: 6725
Posted: 31 July 2009 at 5:59pm

yapadu,

Thank you for the report.
The GTUBE signature is very specific to Spamassassin, and as we do not use that software in SpamFilter, the test will of course fail. Users are free to add that string in their keywords if they wish, but SpamFilter does not block it by default.

In regards to the emails with attachments that made it thru however, you are perfectly right. They should have been stopped. The filename was obfuscated in such a way that SpamFilter did not recognize it as a valid name and allowed it. This was wrong and we are considering it a serious bug.

We are currently beta-testing SpamFilter v4.1.2.813, which addresses all the tricks used in the above obfuscation, with the exception (so far) of one - the one used in "Test mail 4/7". That will take a bit longer to address.

If you wish to receive the beta before we pre-release it on our website please contact us via email.


Edited by LogSat - 31 July 2009 at 5:59pm]]> Fri, 31 Jul 2009 17:59:20 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=13079&title=embarrassed-by-new-client#13079