GFI
English Deutsch Français Italiano Nederlands Español
Forums  Register  Login  My Profile  Inbox  Address Book  My Subscription  My Forums 

Member List  Search  FAQ  Ticket List  Log Out

 

RE: CNN Spam

 
Logged in as: Guest
Users viewing this topic: none
  Printable Version
All Forums >> [Content Security] >> GFI MailEssentials for Exchange/SMTP >> RE: CNN Spam Page: <<   < prev  1 [2] 3   next >   >>
Login
Message << Older Topic   Newer Topic >>
RE: CNN Spam - 13.Aug.2008 9:52:41 AM   
rotorblade

 

Posts: 18
Joined: 7.May2008
Status: offline
Mr. Letourneau,

The issue here is that these e-mails are bypassing certain filters. Yes, the e-mails are eventually being filtered and tagged but the Keywords and sender black list filter does not work. I replied on another post referencing this same issue and as I mentioned in that post to you, my Keywords filter is above my white list so my question is why? I have opened a case on this but it seems that no one at GFI is taking this very seriously. It’s becoming a big problem.

Dave  

(in reply to protechonline)
Post #: 16
RE: CNN Spam - 13.Aug.2008 9:57:38 AM   
John Letourneau

 

Posts: 1124
Joined: 28.Apr.2008
From: Clayton, NC
Status: offline
Dave,

In regards to the case you have open with GFI, do you happen to know the case number?  I'd like to take a look at this case and any samples/logs you have sent along.

_____________________________

Regards,
John Letourneau - Senior Technical Support Representative
GFI Software - www.gfi.com

(in reply to rotorblade)
Post #: 17
RE: CNN Spam - 13.Aug.2008 10:00:49 AM   
rotorblade

 

Posts: 18
Joined: 7.May2008
Status: offline
Sure, any help you can provide is greatly appreciated!
 
Case# CAS-83135-4J4M GFI:00904118

Thanks,

Dave  

(in reply to John Letourneau)
Post #: 18
RE: CNN Spam - 13.Aug.2008 10:23:04 AM   
John Letourneau

 

Posts: 1124
Joined: 28.Apr.2008
From: Clayton, NC
Status: offline
Dave,

I'm looking at your logs now but wanted to ask a quick question.  In your keyword whitelist do you have "CNN Alerts" or "CNN Alerts:" listed?  Please make sure it is listed as "CNN Alerts:"

_____________________________

Regards,
John Letourneau - Senior Technical Support Representative
GFI Software - www.gfi.com

(in reply to rotorblade)
Post #: 19
RE: CNN Spam - 13.Aug.2008 11:30:20 AM   
Ytsejamer1

 

Posts: 69
Joined: 7.Mar.2006
Status: offline
quote:

ORIGINAL: John Letourneau

I'm looking at your logs now but wanted to ask a quick question.  In your keyword whitelist do you have "CNN Alerts" or "CNN Alerts:" listed?  Please make sure it is listed as "CNN Alerts:"


Yup...that's how I did it...i did a couple different variations of CNN Alerts:  My keyword filter had been nabbing all of them until I decided to let Mail Security deal with it and delete them when they come in.

(in reply to John Letourneau)
Post #: 20
RE: CNN Spam - 13.Aug.2008 12:18:24 PM   
Papabrad

 

Posts: 26
Joined: 3.Apr.2005
Status: offline
Many of you have probably noticed that these CNN emails have shifted to MSNBC Breaking News spam.

Looks like the BOTnet controller has changed things up.

(in reply to rotorblade)
Post #: 21
RE: CNN Spam - 13.Aug.2008 1:10:52 PM   
jmjstevens

 

Posts: 21
Joined: 9.Feb.2005
From: Northern Virginia, USA
Status: offline
quote:

ORIGINAL: Papabrad

Many of you have probably noticed that these CNN emails have shifted to MSNBC Breaking News spam.

Looks like the BOTnet controller has changed things up.

Seeing them from BBC as well

(in reply to Papabrad)
Post #: 22
RE: CNN Spam - 13.Aug.2008 1:55:36 PM   
rotorblade

 

Posts: 18
Joined: 7.May2008
Status: offline
John,

No and it's not even enabled.

Dave

(in reply to jmjstevens)
Post #: 23
RE: CNN Spam - 13.Aug.2008 2:01:53 PM   
rotorblade

 

Posts: 18
Joined: 7.May2008
Status: offline
John,

BTW, in the Antispam8 log, the e-mails show being inspected and clean.

Dave

(in reply to rotorblade)
Post #: 24
RE: CNN Spam - 13.Aug.2008 11:27:20 PM   
Thudd

 

Posts: 3
Joined: 22.Feb.2007
Status: offline
quote:

In your keyword whitelist do you have "CNN Alerts" or "CNN Alerts:" listed?  Please make sure it is listed as "CNN Alerts:"

Call me stupid but why would that make a difference?  Surely it would/should flag them with either combination of keywords?

(in reply to John Letourneau)
Post #: 25
RE: CNN Spam - 14.Aug.2008 8:14:10 AM   
John Letourneau

 

Posts: 1124
Joined: 28.Apr.2008
From: Clayton, NC
Status: offline
Thudd,

If you have your keyword checking module set to match whole words only "CNN Alerts" and "CNN Alerts:" are two different words.  In most situations this module is configured to block whole words only.

Dave,

When you are saying "No and it's not even enabled." are you referring to having "CNN Alerts:" in your keyword checking module and this module not being enabled?  If so that would explain why it is not blocking these messages.  If not, let me know please.

_____________________________

Regards,
John Letourneau - Senior Technical Support Representative
GFI Software - www.gfi.com

(in reply to Thudd)
Post #: 26
RE: CNN Spam - 14.Aug.2008 8:47:04 AM   
rotorblade

 

Posts: 18
Joined: 7.May2008
Status: offline
quote:


Dave,

When you are saying "No and it's not even enabled." are you referring to having "CNN Alerts:" in your keyword checking module and this module not being enabled?  If so that would explain why it is not blocking these messages.  If not, let me know please.


To clarify, My Keywords module is enabled and “CNN Alerts:” is listed in the text body and subject scanning sections. Keywords is also capturing with other e-mails, just not the problematic ones, CNN, MSNBC, Internet Explorer 7….. You asked if I had anything listed in the keywords white list in reference to “CNN Alerts:”. The answer is no and my keywords white list is not enabled.

Hopefully, that clarifies it.

Thanks,

Dave    
 

(in reply to rotorblade)
Post #: 27
RE: CNN Spam - 14.Aug.2008 9:20:02 AM   
rotorblade

 

Posts: 18
Joined: 7.May2008
Status: offline
John,
 
I don’t know if this is anything but I’m seeing a few of the problematic e-mails being captured by keywords based on subject line text after the “:” in the subject line. Would punctuation have anything to do with it?  Will not capture using the keywords with CNN…. and such alike in the subject line or text body.
 
 
Dave

(in reply to protechonline)
Post #: 28
RE: CNN Spam - 14.Aug.2008 9:25:00 AM   
rotorblade

 

Posts: 18
Joined: 7.May2008
Status: offline
BTW, just in case you ask, I did try trunning off "Match whole words only". Did not help.

Dave

(in reply to rotorblade)
Post #: 29
RE: CNN Spam - 15.Aug.2008 11:10:14 AM   
rotorblade

 

Posts: 18
Joined: 7.May2008
Status: offline
Update: Problem solved for now. After doing some extensive testing I discovered that anything new added to the keywords module was not working but existing content was. A reboot did not fix it so I uninstalled and reinstalled GFI ME with the most current version which solved it for now. I assume something in the binaries was amiss.
 
You can close the case.
 
Thanks,
 
Dave

(in reply to rotorblade)
Post #: 30
Page:   <<   < prev  1 [2] 3   next >   >>
All Forums >> [Content Security] >> GFI MailEssentials for Exchange/SMTP >> RE: CNN Spam Page: <<   < prev  1 [2] 3   next >   >>
Jump to:





New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts


   © 2008. All rights reserved. GFI Software Home Products Download Trials Support Ordering Site Map About Us Contact us
GFI solutions: Exchange anti spam filter - exchange anti virus - isa server - network vulnerability scanner - event log management - USB security software - exchange archiving - fax server software