Spam Filter ISP Forums : Corrupt spam notification emails https://www.logsat.com/spamfilter/forums/ Thu, 12 Mar 2026 21:27:31 +0000 Fri, 13 Apr 2007 03:33:55 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6016 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Corrupt spam notification emails : FYI the 8 other notifications...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=10003&title=corrupt-spam-notification-emails#10003 Author: lyndonje
Subject: 6016
Posted: 13 April 2007 at 3:33am

FYI the 8 other notifications were all reported as corrupt again by the backup, so doesn't look like they're being corrupt in transit...?]]> Fri, 13 Apr 2007 03:33:55 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=10003&title=corrupt-spam-notification-emails#10003 <![CDATA[Corrupt spam notification emails : Another thing I&#039;ve just tried......]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=9999&title=corrupt-spam-notification-emails#9999 Author: lyndonje
Subject: 6016
Posted: 12 April 2007 at 6:33am

Another thing I've just tried... The above two mentioned emails which Outlook won't even display, I've set the EmailTo to a POP3 account and downloaded with Outlook Express - both emails downloaded and displayed fine? Would this indicate a problem with these emails and exchange?]]> Thu, 12 Apr 2007 06:33:04 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=9999&title=corrupt-spam-notification-emails#9999 <![CDATA[Corrupt spam notification emails : So far it doesnt seem like a...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=9998&title=corrupt-spam-notification-emails#9998 Author: lyndonje
Subject: 6016
Posted: 12 April 2007 at 4:36am

So far it doesnt seem like a transit issue....

I've selected 10 notification emails that have previously been detected by the backup as corrupt. I set their emailto field to myself, and deliver to 1 and expire to 0.

Only 8 of the 10 got into my Inbox. The other two would not sync from the exchange server (I'm using Cached Exchange Mode in OL2003). If I had cahced exchange mode disabled, I presume I would see the emails in my Inbox, but not be able to open them, as this is the symptom some emails have shown on other systems so I'm guessing this is the difference there. I then tried a further two times at having these two particular emails sent through but every time there was a sync issue. These two messages are:
The sync error is
Quote 09:26:34     The following message had an error and synchronization of it was skipped (0x8004011b):


I'll wait to see what tonights backup says about the other 8 emails....


Edited by lyndonje]]> Thu, 12 Apr 2007 04:36:48 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=9998&title=corrupt-spam-notification-emails#9998 <![CDATA[Corrupt spam notification emails : Hi Roberto,Got my hopes up there!...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=9997&title=corrupt-spam-notification-emails#9997 Author: lyndonje
Subject: 6016
Posted: 12 April 2007 at 4:15am

Hi Roberto,

Got my hopes up there! But as is often the case, if you're using Exchange this doesn't work, or so the page says:

Quote This works on mail obtained from Internet mail transports, not Exchange server mailboxes.


Just had another idea to give us an indication on whether they are being corrupt in transit... notifications that have already been sent to the respective recipeints that have been detected as corrupt are still stored in the database. I can change the EmailTo field of previously known corrupt emails to myself, and set deliver to 1 and expire to 0. Let them come through to me. If all are again detected as corrupt, its unlikely to be a problem in transit, however if some arn't detected as corrupt, it could be transit?

What do you think?
]]> Thu, 12 Apr 2007 04:15:29 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=9997&title=corrupt-spam-notification-emails#9997 <![CDATA[Corrupt spam notification emails : lyndon,I&#039;ve been fiddling...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=9994&title=corrupt-spam-notification-emails#9994 Author: LogSat
Subject: 6016
Posted: 11 April 2007 at 6:12pm

lyndon,

I've been fiddling around with your samples for several days now, trying to figure out "why" they were considered corrupted. The one I've been concentrating on is the email in your "Message 1" above. To be honest, I really can't find anything wrong with it... Everything looks as it should.

Yes, looking to see what happens in transit is a good idea. If you're using Outlook 2003, there is finally a way to view the email's original, unmodified source. Look at http://www.outlook-tips.net/howto/view_source.htm for the registry entry to change.
]]> Wed, 11 Apr 2007 18:12:07 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=9994&title=corrupt-spam-notification-emails#9994 <![CDATA[Corrupt spam notification emails : Anybody have anymore ideas on...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=9992&title=corrupt-spam-notification-emails#9992 Author: lyndonje
Subject: 6016
Posted: 11 April 2007 at 7:36am

Anybody have anymore ideas on this? Roberto have you managed to take a look?

Just thinking on... incase the email generated and saved in the database isn't corrupt, and the email is being somehow corrupt during transit, does anybody know of a way to see the full and raw source of an email in an exchange mailbox via outlook and compare that with the data saved in the SF database?
]]> Wed, 11 Apr 2007 07:36:35 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=9992&title=corrupt-spam-notification-emails#9992 <![CDATA[Corrupt spam notification emails : But they would have to take time...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=9980&title=corrupt-spam-notification-emails#9980 Author: WebGuyz
Subject: 6016
Posted: 05 April 2007 at 8:59am

But they would have to take time to read the email and sometimes your just not sure from the subject. Some of our older customers get tons of email everyday.

To make it more manageable I ripped the guts out of a Webmail package for use in the spam admin and now when the customer see the quarantine list they have a small graphic on each line, when they click on the graphic, the actual email appears in a popup window in html, instead of a jumble of text that makes no sense and is hard to read.

 

]]> Thu, 05 Apr 2007 08:59:43 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=9980&title=corrupt-spam-notification-emails#9980 <![CDATA[Corrupt spam notification emails : Yeah, similar. The problem I...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=9975&title=corrupt-spam-notification-emails#9975 Author: lyndonje
Subject: 6016
Posted: 05 April 2007 at 3:48am

Yeah, similar. The problem I see with that is its another step the user has to take to find out if anything genuine has been stopped. They may take the time follow the link only to find it was all spam anyway.

The email I send lists the sender address & subject. If there is nothing of interest in the email the user can simply delete/ignore it. The emails listed in the notification will then automatically be deleted after 7 days, and even if they arn't deleted they won't be mentioned in future notifications. In the tblQuarantine table I've added a notified field, and an auth field. The asp generates a random auth code for each message and sets the notified flag to true when a message has been included in a notification. Therefore the SQL statement in the auto_notify.asp page only pulls messages where deliver, expired and notifed are all false.

The link in the email contains the MsgID, Auth Code and Quarantine ID. When the link for a particular email is followed, an ASP page is run that makes sure the MsgID, Auth Code & Quarantine ID all match. If so its sets the deliver flag to true for SF to whitelist and forward. If all three codes dont match, or an email has already been delivered or deleted, an error is displayed indicating the likely cause. Only problem is some of these are corrupt.... and I don't know why!


Edited by lyndonje]]> Thu, 05 Apr 2007 03:48:50 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=9975&title=corrupt-spam-notification-emails#9975 <![CDATA[Corrupt spam notification emails : We are doing something similar...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=9971&title=corrupt-spam-notification-emails#9971 Author: WebGuyz
Subject: 6016
Posted: 04 April 2007 at 1:20pm

We are doing something similar but I just created a table in SQL with 3 fields:

 email | auth | date

When I generate a notification email  a link is sent in the email the customer receives like this:

Dear x,

  You currently have 46 messages in the quarantine db. We encourage you to check to make sure valid mail has not been stopped. Please click the link below to be taken to you spam administration menu.

http://spam_web/default.asp?email=joeblow@mydomain.com&a uth=H&Q@!tR

When the user clicks this link the asp program checks the SQL table to see if the username & auth code match and if they do it logs them into the web spam admin area to view quarantines, modify whitelists,etc..

The 7 digit code is just a random generator script I found. Everytime emails are sent out I update the auth code and date so every link the customers receives is unique.

 



Edited by WebGuyz]]> Wed, 04 Apr 2007 13:20:19 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=9971&title=corrupt-spam-notification-emails#9971 <![CDATA[Corrupt spam notification emails : Got it. I use SSL when browsing...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=9969&title=corrupt-spam-notification-emails#9969 Author: LogSat
Subject: 6016
Posted: 04 April 2007 at 11:19am

Got it. I use SSL when browsing the forums, and thus your referrer check blocked me. Looking at the messages, I'll let you know if we spot anything.]]> Wed, 04 Apr 2007 11:19:25 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6016&PID=9969&title=corrupt-spam-notification-emails#9969