can't block spammer

Hi there,

I use XP Pro 2nd Edition with OE6 for my e-mails. I have set up
number of message rules to block various spammers, but one particula
spammer gets by the message rules:

webhostlowcosthost.com

I have this in the the Where the From Line Contains People, both a
webhostlowcosthost and as webhostlowcosthost.com

The Action selected for this rule is to delete it from the server.

But I still get about 4-8 e-mail spams from this address daily. Fo
example:

AHS_Home_Warranty.vdedolf@pblxte.webhostlowcosthost.com
1Ink.xsyvyc@ycueex.webhostlowcosthost.com
Cash4Gold.ykrtrmm@lswkrr.webhostlowcosthost.com
Colon_Aid.dg@oqntse.webhostlowcosthost.com
Google_Easy_Profits.nelbrjvi@gmkwic.webhostlowcosthost.com
2insure4less.sebdqtdl@gtflhh.webhostlowcosthost.com
Debt_solutions.ddgyx@hdmxju.webhostlowcosthost.com
GlucoBalance_MD.rsykktc@dafiba.webhostlowcosthost.com

Apparently these spammers have figured out a way to get past th
message rules in OE6. Any ideas how to block this? Please help

--
WaxhawRo
-----------------------------------------------------------------------
WaxhawRon's Profile: http://forums.techarena.in/members/waxhawron.ht
View this thread: http://forums.techarena.in/windows-xp-support/1021905.ht

http://forums.techarena.i

Bruce
Sun Aug 17 09:32:27 PDT 2008

Crossposted to Outlook Express General newsgroup.

Check the return path in the message source for one that got through to be
sure it is the same. (Ctrl+F3).

In general:

Have all rules that divert mail to folders first.

Delete it from server next.

All others last.

Make sure that every rule also has Stop processing more rules checked,
unless that option is grayed out.

How to set up OE Message Rules:
http://www.oeupdates.com/outlook-express-message-rules-block-spam.html

http://www.timeatlas.com/mos/Email/Outlook_Express/Creating_Rules_in_Outlook_Express/

http://www.jackieswebworks.com/outlook%20express%20notes.htm

Some Message Rule Ideas:
http://www.mindspring.com/~majik/messagerules.htm

Some tips:
http://insideoe.tomsterdam.com/tips/rules.htm

Controlling Junk Mail in Outlook Express:
http://www.microsoft.com/windows/IE/community/columns/junkmail.mspx

Message Rules not working?:
http://www.tomsterdam.com/insideoe/faqs/why.htm#rules
--

Bruce Hagen
MS-MVP Outlook Express
Imperial Beach, CA


"WaxhawRon" <WaxhawRon.3eap3b@DoNotSpam.com> wrote in message
news:WaxhawRon.3eap3b@DoNotSpam.com...
>
> Hi there,
>
> I use XP Pro 2nd Edition with OE6 for my e-mails. I have set up a
> number of message rules to block various spammers, but one particular
> spammer gets by the message rules:
>
> webhostlowcosthost.com
>
> I have this in the the Where the From Line Contains People, both as
> webhostlowcosthost and as webhostlowcosthost.com
>
> The Action selected for this rule is to delete it from the server.
>
> But I still get about 4-8 e-mail spams from this address daily. For
> example:
>
> AHS_Home_Warranty.vdedolf@pblxte.webhostlowcosthost.com
> 1Ink.xsyvyc@ycueex.webhostlowcosthost.com
> Cash4Gold.ykrtrmm@lswkrr.webhostlowcosthost.com
> Colon_Aid.dg@oqntse.webhostlowcosthost.com
> Google_Easy_Profits.nelbrjvi@gmkwic.webhostlowcosthost.com
> 2insure4less.sebdqtdl@gtflhh.webhostlowcosthost.com
> Debt_solutions.ddgyx@hdmxju.webhostlowcosthost.com
> GlucoBalance_MD.rsykktc@dafiba.webhostlowcosthost.com
>
> Apparently these spammers have figured out a way to get past the
> message rules in OE6. Any ideas how to block this? Please help.
>
>
> --
> WaxhawRon
> ------------------------------------------------------------------------
> WaxhawRon's Profile: http://forums.techarena.in/members/waxhawron.htm
> View this thread:
> http://forums.techarena.in/windows-xp-support/1021905.htm
>
> http://forums.techarena.in
>

Elmo
Sun Aug 17 10:04:26 PDT 2008

WaxhawRon wrote:
> Hi there,
>
> I use XP Pro 2nd Edition with OE6 for my e-mails. I have set up a
> number of message rules to block various spammers, but one particular
> spammer gets by the message rules:
>
> webhostlowcosthost.com
>
> I have this in the the Where the From Line Contains People, both as
> webhostlowcosthost and as webhostlowcosthost.com
>
> The Action selected for this rule is to delete it from the server.
>
> But I still get about 4-8 e-mail spams from this address daily. For
> example:
>
> AHS_Home_Warranty.vdedolf@pblxte.webhostlowcosthost.com
> 1Ink.xsyvyc@ycueex.webhostlowcosthost.com
> Cash4Gold.ykrtrmm@lswkrr.webhostlowcosthost.com
> Colon_Aid.dg@oqntse.webhostlowcosthost.com
> Google_Easy_Profits.nelbrjvi@gmkwic.webhostlowcosthost.com
> 2insure4less.sebdqtdl@gtflhh.webhostlowcosthost.com
> Debt_solutions.ddgyx@hdmxju.webhostlowcosthost.com
> GlucoBalance_MD.rsykktc@dafiba.webhostlowcosthost.com
>
> Apparently these spammers have figured out a way to get past the
> message rules in OE6. Any ideas how to block this? Please help.

Unless you check "Leave a copy of messages on server", "Delete from the
server" should have no effect. Emails are usually downloaded from the
server, then the rules are applied. So you should change the rule to
delete any email from those addresses, mark as read, and end filtering
for that email.

If you want a working method to block all SPAM, create these two mail
rules in OE to send "unknowns" to another folder. You'll still have to
look at the headers. I look at the "sender" column first to help decide
whether each is a legitimate email or not.

In Outlook Express, click Tools, Message Rules, Mail.

_First rule:_

A. In "Select the conditions for your rule" click "Where the from line
contains people", click "contains people", click Address Book, click
the first name, shift-click the last, click "From" button, click OK.

B. In "Select the actions for your rule", click "Stop processing more
rules". This will let everyone in your address book fall through to
your Inbox.

C. Name the first rule "Pass" or "Accept".

_Second rule:_

A. In "Select the conditions for your rule" click "For all messages"

B. In "Select the actions for your rule", click "Move to the specified
folder". Click "Specified" in the bottom pane, click New Folder, type
SPAM, click OK, click the SPAM folder to highlight, click OK to select
that folder.

C. Name the rule "SPAM".

This moves the unwanted emails to the SPAM folder.

_If you find an email in the SPAM folder you don't want filtered_

- Click and drag the email to the Inbox. While it's still highlighted:

- Click "Message", "Create Rule from Message".

- In "Select conditions for your rule":

"Where the From line contains people" should already be checked and
should show the email address of the person you're adding under "Rule
Description".

- In "Select the actions for your rule"

Click "Stop Processing more rules".

- "Name the rule"
Name the rule after the individual so it's easier to recognize.

Make sure the rule is NOT listed last. If it is, move it upwards. The
SPAM rule must be the last one listed.

_Advantages_

1. No SPAM or other malware from email! No amount of filtering by
sender or subject matter will prevent spammers; they use a different
subject and address every few days. But this setup prevents ALL SPAM
from fictitious addresses.

2. Few Viruses! Only viruses from compromised systems which have your
email address in their address book.

3. After checking through subject lines in the SPAM folder, you can
delete all the spam, etc. without viewing them. Press Ctrl/A to select
all subjects, press Shift/Delete to permanently delete all messages in
the SPAM folder. This way, short of viewing the first email in the
list, no other email is actually viewed.

_With Thunderbird_
(OE7 might have this feature too.)

Create one rule. Click:

Tools, Message Filters, Filters for Email account, New, make the Filter
Name "SPAM", If "From" "isn't in my address book" "Personal Address
Book", Perform these actions: "Move Message to" "Trash on Local Folders".

Check Unread messages in the Trash folder and delete occasionally. Drag
to the Inbox if you want to keep one. Right-click the email in the
header, click "Add to Address Book" if you find you've missed one.

--
Joe =o)

*~~Laughingstar~~*
Sun Aug 17 10:17:32 PDT 2008

excellent info - thankx
"Bruce Hagen" <Nospam@mymail.invalid> wrote in message
news:e3U4WbIAJHA.4852@TK2MSFTNGP04.phx.gbl...
> Crossposted to Outlook Express General newsgroup.
>
> Check the return path in the message source for one that got through to be
> sure it is the same. (Ctrl+F3).
>
> In general:
>
> Have all rules that divert mail to folders first.
>
> Delete it from server next.
>
> All others last.
>
> Make sure that every rule also has Stop processing more rules checked,
> unless that option is grayed out.
>
> How to set up OE Message Rules:
> http://www.oeupdates.com/outlook-express-message-rules-block-spam.html
>
> http://www.timeatlas.com/mos/Email/Outlook_Express/Creating_Rules_in_Outlook_Express/
>
> http://www.jackieswebworks.com/outlook%20express%20notes.htm
>
> Some Message Rule Ideas:
> http://www.mindspring.com/~majik/messagerules.htm
>
> Some tips:
> http://insideoe.tomsterdam.com/tips/rules.htm
>
> Controlling Junk Mail in Outlook Express:
> http://www.microsoft.com/windows/IE/community/columns/junkmail.mspx
>
> Message Rules not working?:
> http://www.tomsterdam.com/insideoe/faqs/why.htm#rules
> --
>
> Bruce Hagen
> MS-MVP Outlook Express
> Imperial Beach, CA
>
>
> "WaxhawRon" <WaxhawRon.3eap3b@DoNotSpam.com> wrote in message
> news:WaxhawRon.3eap3b@DoNotSpam.com...
>>
>> Hi there,
>>
>> I use XP Pro 2nd Edition with OE6 for my e-mails. I have set up a
>> number of message rules to block various spammers, but one particular
>> spammer gets by the message rules:
>>
>> webhostlowcosthost.com
>>
>> I have this in the the Where the From Line Contains People, both as
>> webhostlowcosthost and as webhostlowcosthost.com
>>
>> The Action selected for this rule is to delete it from the server.
>>
>> But I still get about 4-8 e-mail spams from this address daily. For
>> example:
>>
>> AHS_Home_Warranty.vdedolf@pblxte.webhostlowcosthost.com
>> 1Ink.xsyvyc@ycueex.webhostlowcosthost.com
>> Cash4Gold.ykrtrmm@lswkrr.webhostlowcosthost.com
>> Colon_Aid.dg@oqntse.webhostlowcosthost.com
>> Google_Easy_Profits.nelbrjvi@gmkwic.webhostlowcosthost.com
>> 2insure4less.sebdqtdl@gtflhh.webhostlowcosthost.com
>> Debt_solutions.ddgyx@hdmxju.webhostlowcosthost.com
>> GlucoBalance_MD.rsykktc@dafiba.webhostlowcosthost.com
>>
>> Apparently these spammers have figured out a way to get past the
>> message rules in OE6. Any ideas how to block this? Please help.
>>
>>
>> --
>> WaxhawRon
>> ------------------------------------------------------------------------
>> WaxhawRon's Profile: http://forums.techarena.in/members/waxhawron.htm
>> View this thread:
>> http://forums.techarena.in/windows-xp-support/1021905.htm
>>
>> http://forums.techarena.in
>>
>

WaxhawRon
Sun Aug 17 10:58:57 PDT 2008


Thank you all for your suggestions. I will try them all and hope that
one works.

FYI, Stop Processing is grayed out as soon as an other alternative is
checked.

Also FYI, tomsterdam.com site does not work. Syntax error.

WaxhawRon


--
WaxhawRon
------------------------------------------------------------------------
WaxhawRon's Profile: http://forums.techarena.in/members/waxhawron.htm
View this thread: http://forums.techarena.in/windows-xp-support/1021905.htm

http://forums.techarena.in

Bruce
Sun Aug 17 11:26:50 PDT 2008

Make sure that every rule also has Stop processing more rules checked,
***unless*** that option is grayed out.

Delete it from server and Do not download grays that option out since Stop
processing more rules is a moot point. (You can't process more rules if
there is no message downloaded). Other rules will not gray out that option.

Hope you have success.
--

Bruce Hagen
MS-MVP Outlook Express
Imperial Beach, CA



"WaxhawRon" <WaxhawRon.3eaunc@DoNotSpam.com> wrote in message
news:WaxhawRon.3eaunc@DoNotSpam.com...
>
> Thank you all for your suggestions. I will try them all and hope that
> one works.
>
> FYI, Stop Processing is grayed out as soon as an other alternative is
> checked.
>
> Also FYI, tomsterdam.com site does not work. Syntax error.
>
> WaxhawRon
>
>
> --
> WaxhawRon
> ------------------------------------------------------------------------
> WaxhawRon's Profile: http://forums.techarena.in/members/waxhawron.htm
> View this thread:
> http://forums.techarena.in/windows-xp-support/1021905.htm
>
> http://forums.techarena.in
>

Bruce
Sun Aug 17 11:33:36 PDT 2008


"WaxhawRon" <WaxhawRon.3eaunc@DoNotSpam.com> wrote in message
news:WaxhawRon.3eaunc@DoNotSpam.com...

> Also FYI, tomsterdam.com site does not work. Syntax error.


Updated link.

Message Rules not working?:
http://www.insideoe.com/faqs/why.htm#rules
--

Bruce Hagen
MS-MVP Outlook Express
Imperial Beach, CA

WaxhawRon
Sun Aug 17 12:29:11 PDT 2008


Bruce--I've rearranged my message rules. Top of the list now is to
delete from server anything from webhostlowcosthost or
webhostlowcosthost.com Second on the list is to delete and then stop
processing anything from this spammer.

I'll let you know if any more spams get past these two rules.

Thank you very much for your advice.


--
WaxhawRon
------------------------------------------------------------------------
WaxhawRon's Profile: http://forums.techarena.in/members/waxhawron.htm
View this thread: http://forums.techarena.in/windows-xp-support/1021905.htm

http://forums.techarena.in

VanguardLH
Sun Aug 17 16:26:35 PDT 2008

Elmo wrote:

> Unless you check "Leave a copy of messages on server", "Delete from the
> server" should have no effect. Emails are usually downloaded from the
> server, then the rules are applied. So you should change the rule to
> delete any email from those addresses, mark as read, and end filtering
> for that email.

True for Outlook, not for Outlook EXPRESS and for many other e-mail
clients. You CAN download just the headers of a message (using the TOP
command) rather than download the entire message (using the RETR
command). That allows the e-mail client to exercise tests based solely
on the headers, and only the headers were downloaded rather than the
entire message. If the rule fires, it can send a DELE command to the
server. It doesn't matter if you have "leave messages on server". The
DELE command will still delete them. This option only changes the
*default* behavior of a POP3 e-mail client which usually issues a RETR
command followed by the DELE command. With "leave messages on server",
the POP client will issue the RETR command but not the following DELE
command. Having this option is merely a client-side configuration as to
whether it sends a DELE command or not. A rule that fires and sends a
DELE command doesn't care about the setting of the "leave messages on
server" option. If the server-delete rule fires, the client will send
the DELE command regardless if "leave messages on server" is enabled or
not.

Outlook forces the download of the entire message before it will
exercise any rules against that message. This is NOT required behavior
for a POP e-mail which can use the "TOP 0" command to just get the
headers of a message ("TOP n" retrieves all headers plus the specified
number of lines from the body). Outlook does not use the TOP command.
That is why Outlook has no rule to "delete from server". Outlook
EXPRESS and many other e-mail clients *do* use the TOP command to
retrieve headers only. That is why those clients DO have the "delete
from server" clause to add to a rule.

VanguardLH
Sun Aug 17 16:36:21 PDT 2008

WaxhawRon wrote:

> Hi there,
>
> I use XP Pro 2nd Edition with OE6 for my e-mails. I have set up a
> number of message rules to block various spammers, but one particular
> spammer gets by the message rules:
>
> webhostlowcosthost.com
>
> I have this in the the Where the From Line Contains People, both as
> webhostlowcosthost and as webhostlowcosthost.com
>
> The Action selected for this rule is to delete it from the server.
>
> But I still get about 4-8 e-mail spams from this address daily. For
> example:
>
> AHS_Home_Warranty.vdedolf@pblxte.webhostlowcosthost.com
> 1Ink.xsyvyc@ycueex.webhostlowcosthost.com
> Cash4Gold.ykrtrmm@lswkrr.webhostlowcosthost.com
> Colon_Aid.dg@oqntse.webhostlowcosthost.com
> Google_Easy_Profits.nelbrjvi@gmkwic.webhostlowcosthost.com
> 2insure4less.sebdqtdl@gtflhh.webhostlowcosthost.com
> Debt_solutions.ddgyx@hdmxju.webhostlowcosthost.com
> GlucoBalance_MD.rsykktc@dafiba.webhostlowcosthost.com
>
> Apparently these spammers have figured out a way to get past the
> message rules in OE6. Any ideas how to block this? Please help.

For the unwanted e-mail, select it and hit Ctrl+F3 to see the raw source
of the message. Is that domain actually specified in the From header?

Do you have more than 1 rule defined? If so, is this rule to delete
messages from that domain listed before or after any other rules that
have the stop-clause included in them? Maybe those rules are firing so
they stop any processing of further rules against that same message?

If you have multiple rules, have to disabled ALL of them except the one
that deletes the unwanted message and then re-exercised the rules? You
could also use Apply Now and just select the one rule to make sure it
works against the unwanted mail.

Is the unwanted mail in your Inbox? The rules only *automatically*
exercise against messages that arrive into your Inbox folder (except
when you use Apply Now to manually run them).

You can obviously only delete a message from the server if it is still
up on the server. If ANY rule or any action committed by you results in
downloading the message then it is no longer on the server to delete it
from there. If you move the message into a different folder, if you
mark it as read, if you check for some string within the body of the
message then that message MUST get downloaded to do those moves or
tests. All "delete from server" rules MUST be before any other rules
that will result in downloading the message. So it is likely you have
more than one rule defined and that one of the preceding rules results
in downloading the entire message rather than just yanking a copy of its
headers only.

WaxhawRon
Sun Aug 17 19:49:57 PDT 2008


If the measures I have taken do not block the spam from this sender,
which I'll know tomorrow, then I'll Ctrl F3 and check the raw source.
I've not done this before, and it will be interesting to see. Is this
going to give me more information than highlighting the e-mail in the
inbox and clicking File--Properties--Details--Message Source ?

I do have more rules defined, as I am successfully blocking several
spam sites that have leached on to my e-mail address for some reason. I
don't surf sites I don't know, and NEVER click on anything when I don't
have an expectation of where it will take me. I regularly use AdAware
and AVG and House Call to check for cookies and malware. I also
physically check the cookies in both Firefox and IE, just to be sure
nothing has been accidentally approved. I also use Interclue on
Firefox, so most times I don't even click on links and such. (This is a
great app, by the way!)

But I have moved up the rules I made up for this particular spammer, so
that they will be the priority rules. I'll see what happens after
midnight when a new cycle of spam starts from this source, and I'll get
back to you tomorrow with the results.

Thanks again for all of your help.

WaxhawRon


--
WaxhawRon
------------------------------------------------------------------------
WaxhawRon's Profile: http://forums.techarena.in/members/waxhawron.htm
View this thread: http://forums.techarena.in/windows-xp-support/1021905.htm

http://forums.techarena.in

Bruce
Sun Aug 17 20:27:01 PDT 2008

Ctrl+F3 takes you directly to the message source.
File--Properties--Details--Message Source is the same, just a long way to
get there.
--

Bruce Hagen
MS-MVP Outlook Express
Imperial Beach, CA


"WaxhawRon" <WaxhawRon.3ebjnc@DoNotSpam.com> wrote in message
news:WaxhawRon.3ebjnc@DoNotSpam.com...
>
> If the measures I have taken do not block the spam from this sender,
> which I'll know tomorrow, then I'll Ctrl F3 and check the raw source.
> I've not done this before, and it will be interesting to see. Is this
> going to give me more information than highlighting the e-mail in the
> inbox and clicking File--Properties--Details--Message Source ?
>
> I do have more rules defined, as I am successfully blocking several
> spam sites that have leached on to my e-mail address for some reason. I
> don't surf sites I don't know, and NEVER click on anything when I don't
> have an expectation of where it will take me. I regularly use AdAware
> and AVG and House Call to check for cookies and malware. I also
> physically check the cookies in both Firefox and IE, just to be sure
> nothing has been accidentally approved. I also use Interclue on
> Firefox, so most times I don't even click on links and such. (This is a
> great app, by the way!)
>
> But I have moved up the rules I made up for this particular spammer, so
> that they will be the priority rules. I'll see what happens after
> midnight when a new cycle of spam starts from this source, and I'll get
> back to you tomorrow with the results.
>
> Thanks again for all of your help.
>
> WaxhawRon
>
>
> --
> WaxhawRon
> ------------------------------------------------------------------------
> WaxhawRon's Profile: http://forums.techarena.in/members/waxhawron.htm
> View this thread:
> http://forums.techarena.in/windows-xp-support/1021905.htm
>
> http://forums.techarena.in
>

WaxhawRon
Mon Aug 18 08:43:38 PDT 2008


Bruce,

moving up the two rules I made for this spammer--the first is delete
from server, the second is send to delete folder and stop processing
rules--seems to have worked. Apparently the priority of the rule in the
pecking order makes a difference. Today, so far, I ahve nothing from
this spammer, not even in my delete folder.

Thank you for all the good advice.

Best,
WaxhawRon


--
WaxhawRon
------------------------------------------------------------------------
WaxhawRon's Profile: http://forums.techarena.in/members/waxhawron.htm
View this thread: http://forums.techarena.in/windows-xp-support/1021905.htm

http://forums.techarena.in

Bruce
Mon Aug 18 09:30:44 PDT 2008

You're welcome. The revised link I gave you explains how the rules get
checked.

Message Rules not working?:
http://www.insideoe.com/faqs/why.htm#rules
--

Bruce Hagen
MS-MVP Outlook Express
Imperial Beach, CA


"WaxhawRon" <WaxhawRon.3ecjrb@DoNotSpam.com> wrote in message
news:WaxhawRon.3ecjrb@DoNotSpam.com...
>
> Bruce,
>
> moving up the two rules I made for this spammer--the first is delete
> from server, the second is send to delete folder and stop processing
> rules--seems to have worked. Apparently the priority of the rule in the
> pecking order makes a difference. Today, so far, I ahve nothing from
> this spammer, not even in my delete folder.
>
> Thank you for all the good advice.
>
> Best,
> WaxhawRon
>
>
> --
> WaxhawRon
> ------------------------------------------------------------------------
> WaxhawRon's Profile: http://forums.techarena.in/members/waxhawron.htm
> View this thread:
> http://forums.techarena.in/windows-xp-support/1021905.htm
>
> http://forums.techarena.in
>