Re: [Declude.JunkMail] Campaign for spamheaders filter variable (continues) - question for Scott
-Scott, Would this be possible to check in an external test? Is the %HEADERCODE% variable available? Here's my early thoughts: gloabl.cfg: HEADER-VBS external1 CScript D:\IMail\Declude\FPFilters\vbs\header.vbs CW=%WEIGHT% MAXW=330 MINW=75 %HEADERCODE% 10 0 header.vbs: ' Initialize error checking On Error Resume Next Dim Headertocheck ' As String Dim intResult ' As Integer If Replace(UCase(Wscript.Arguments(0)), CW=, ) = Replace(UCase(Wscript.Arguments(1)), MAXW=, ) Then WScript.Quit(0) End If If Replace(UCase(Wscript.Arguments(0)), CW=, ) = Replace(UCase(Wscript.Arguments(2)), MINW=, ) Then WScript.Quit(0) End If Headertocheck = Wscript.Arguments(3) intresult = 0 if Headertocheck = c040120e Intresult = 1 End If WScript.Quit(intresult) Scott Fisher Director of IT Farm Progress Companies Mike Nice [EMAIL PROTECTED] 07/16/04 10:45AM Scott, Can you send me the headers of one of these E-mails? I'd like to add this test to a local external test (Similar to SPAMCHK) utility we have. Thanks, Mike Nice - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, July 16, 2004 10:49 AM Subject: [Declude.JunkMail] Campaign for spamheaders filter variable (continues) There is one constant. It always fails the SPAMHeaders test with a code of c040120e. Checking my logs for June and August, I've had over 3000 mails that had this SPAMHeaders test code and not one of them has been a non-spam e-mail. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Campaign for spamheaders filter variable (continues) - question for Scott
I've thought that this might be possible as an external test in this way, but I have yet to get around to testing it out. It could be that the %HEADERCODE% variable isn't populated until later like %WEIGHT% was before modification, and if so, enabling it should provide a sufficient mechanism for those of us that care to achieve this level of detail. An external test would also be available to all versions of Declude instead of a solution by way of a filter that would only be appropriate for Pro users, albeit more difficult to integrate for some. The only real footnote is that there is only one code returned for both SPAMHEADERS and BADHEADERS, and occasionally these will double hit. Personally I could do without the double hits and would prefer to score each code individually (some not at all). It certainly works into the framework of an external test quite well since it only one result is possible at one time. It would also help to have a list of the codes if one doesn't already exist. If we wanted definitions, we could look them up in the tool that is provided. Matt Scott Fisher wrote: -Scott, Would this be possible to check in an external test? Is the %HEADERCODE% variable available? Here's my early thoughts: gloabl.cfg: HEADER-VBS external 1 "CScript D:\IMail\Declude\FPFilters\vbs\header.vbs CW=%WEIGHT% MAXW=330 MINW=75 %HEADERCODE%" 10 0 header.vbs: ' Initialize error checking On Error Resume Next Dim Headertocheck ' As String Dim intResult ' As Integer If Replace(UCase(Wscript.Arguments(0)), "CW=", "") = Replace(UCase(Wscript.Arguments(1)), "MAXW=", "") Then WScript.Quit(0) End If If Replace(UCase(Wscript.Arguments(0)), "CW=", "") = Replace(UCase(Wscript.Arguments(2)), "MINW=", "") Then WScript.Quit(0) End If Headertocheck = Wscript.Arguments(3) intresult = 0 if Headertocheck = "c040120e" Intresult = 1 End If WScript.Quit(intresult) Scott Fisher Director of IT Farm Progress Companies "Mike Nice" [EMAIL PROTECTED] 07/16/04 10:45AM Scott, Can you send me the headers of one of these E-mails? I'd like to add this test to a local external test (Similar to SPAMCHK) utility we have. Thanks, Mike Nice - Original Message - From: "Scott Fisher" [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, July 16, 2004 10:49 AM Subject: [Declude.JunkMail] Campaign for spamheaders filter variable (continues) There is one constant. It always fails the SPAMHeaders test with a code of c040120e. Checking my logs for June and August, I've had over 3000 mails that had this SPAMHeaders test code and not one of them has been a non-spam e-mail. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
Re: [Declude.JunkMail] Campaign for spamheaders filter variable (continues)- question for Scott
I'll send you my codes off-list. I've got the codes and what spam category they fell into. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 07/16/04 11:31AM I've thought that this might be possible as an external test in this way, but I have yet to get around to testing it out. It could be that the %HEADERCODE% variable isn't populated until later like %WEIGHT% was before modification, and if so, enabling it should provide a sufficient mechanism for those of us that care to achieve this level of detail. An external test would also be available to all versions of Declude instead of a solution by way of a filter that would only be appropriate for Pro users, albeit more difficult to integrate for some. The only real footnote is that there is only one code returned for both SPAMHEADERS and BADHEADERS, and occasionally these will double hit. Personally I could do without the double hits and would prefer to score each code individually (some not at all). It certainly works into the framework of an external test quite well since it only one result is possible at one time. It would also help to have a list of the codes if one doesn't already exist. If we wanted definitions, we could look them up in the tool that is provided. Matt Scott Fisher wrote: -Scott, Would this be possible to check in an external test? Is the %HEADERCODE% variable available? Here's my early thoughts: gloabl.cfg: HEADER-VBS external1 CScript D:\IMail\Declude\FPFilters\vbs\header.vbs CW=%WEIGHT% MAXW=330 MINW=75 %HEADERCODE% 10 0 header.vbs: ' Initialize error checking On Error Resume Next Dim Headertocheck ' As String Dim intResult ' As Integer If Replace(UCase(Wscript.Arguments(0)), CW=, ) = Replace(UCase(Wscript.Arguments(1)), MAXW=, ) Then WScript.Quit(0) End If If Replace(UCase(Wscript.Arguments(0)), CW=, ) = Replace(UCase(Wscript.Arguments(2)), MINW=, ) Then WScript.Quit(0) End If Headertocheck = Wscript.Arguments(3) intresult = 0 if Headertocheck = c040120e Intresult = 1 End If WScript.Quit(intresult) Scott Fisher Director of IT Farm Progress Companies Mike Nice [EMAIL PROTECTED] 07/16/04 10:45AM Scott, Can you send me the headers of one of these E-mails? I'd like to add this test to a local external test (Similar to SPAMCHK) utility we have. Thanks, Mike Nice - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, July 16, 2004 10:49 AM Subject: [Declude.JunkMail] Campaign for spamheaders filter variable (continues) There is one constant. It always fails the SPAMHeaders test with a code of c040120e. Checking my logs for June and August, I've had over 3000 mails that had this SPAMHeaders test code and not one of them has been a non-spam e-mail. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
