Not all message filters work
I have Kaspersky Internet Security on my PC and it adds [!! SPAM] to the subject of messages it definitely thinks are spam and [?? Probable SPAM] to ones it's not so sure about. The trouble is, I cannot get the rules I have added to look for these words in the subject to actually work. My other rules are working OK, but the spam rules are simply ignored. A further strange thing is, the additional words that Kaspersky has added do appear in the headers above the messages, but they don't appear in the subject line in the messages index. How can I troubleshoot this further?
All Replies (8)
check the source to see if it offers more info: Select the email so it shows in Message Pane. click on 'More' and select 'view source'
copy paste the email source info and post into this forum. Obviously editing email addresses with xxxx.
Return-Path: <bounce-mc.us2_5504866.2098769-dea101=xxxxx.xxx.com@mail154.atl81.rsgsv.net> Envelope-to: dea101@xxxxx.xxx.com Delivery-date: Fri, 27 Nov 2015 10:05:07 +0000 Received: from [212.159.9.108] (helo=avasin12.plus.net) by inmx16 with esmtp (PlusNet MXCore v2.00) id 1a2Ftq-0005cE-GW for dea101@xxxxx.xxx.com; Fri, 27 Nov 2015 10:05:06 +0000 Received: from mail154.atl81.rsgsv.net ([198.2.129.154]) by avasin12.plus.net with Plusnet Cloudmark Gateway id ma531r00G3L0gbJ01a55nk; Fri, 27 Nov 2015 10:05:06 +0000 X-CM-Score: 0.00 X-CNFS-Analysis: v=2.1 cv=Av4Tp7JP c=1 sm=1 tr=0 b=1 a=zZGAlIEHAOVmVrTtqa/JmQ==:117 a=zZGAlIEHAOVmVrTtqa/JmQ==:17 a=WNDWebX5AAAA:8 a=0Bzu9jTXAAAA:8 a=IlHm9nEzAAAA:8 a=qtqOOiqGOCEA:10 a=9DvhAHx2yrWFMPxQWpQA:9 a=--qaBYxuAAAA:8 a=3j4BkbkPAAAA:8 a=JqEG_dyiAAAA:8 a=BkpHzsgbAAAA:8 a=1XWaLZrsAAAA:8 a=sS8pAsIuAAAA:8 a=JmhL_RV-AAAA:8 a=PyZogzJ0F6wwS_REW3QA:9 a=qzK3vr3_ZtbJ0rUV:21 a=SwES1IUfnFGPly4h:21 a=QEXdDO2ut3YA:10 a=SSmOFEACAAAA:8 a=9zJ4F0rtAAAA:20 a=lJjz8N4HAAAA:8 a=RCQYDNg8AAAA:8 a=gIVQHC19AAAA:8 a=W13r5htJ-AxHEyJjEjAA:9 a=bOTVhz3N42FUZqTI:21 a=nNnJs8KNKNstHtca:21 a=EqXl3D_vDUiMDpQG:21 a=_W_S_7VecoQA:10 a=frz4AuCg-hUA:10 a=cleBgrIRjxMA:10 a=p403mkujtbAA:10 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=k1; d=mail154.atl81.rsgsv.net; h=Subject:From:Reply-To:To:Date:Message-ID:List-ID:List-Unsubscribe:Sender:Content-Type:MIME-Version; i=shop=3Dtargetdry.com@mail154.atl81.rsgsv.net; bh=PErla9UxjUzY1yrTySx5zewecJw=; b=LbCnAR7avrxqVg0Gfn2x6adtxuYwPGgIHftyGaGe0OraaK7MQoRSrLLKxSTGj5rT3eBLAoYR3nib 6pL+pNmzuK9zOw6TgZtLnsj9ecGq3oT6YY2T/1QF7leIUOp4WMsZmBRjZjvlx5BN7qkEvz63/6gB Oj1V/6f5d3Ay101WF5k= DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=k1; d=mail154.atl81.rsgsv.net; b=0B6zvBgPf5t+/htk3bTHCyiJrfPe+Td4kF/s5aDaWxwRYAJ2f5ShO8JwlL/3Z0BnMekqAelO4aZW 9ONDfV5knpvaMAZuXyovurmDCsLgiCtElGKBb2XY+YB9LM6VpoqKNzSBCpXyv2YZQoEHNs9skN71 +XLU2FNOhn5qYStlMwM=; Received: from (127.0.0.1) by mail154.atl81.rsgsv.net id hb0ld41ohk0q for <dea101@xxxxx.xxx.com>; Fri, 27 Nov 2015 09:04:52 +0000 (envelope-from <bounce-mc.us2_5504866.2098769-dea101=xxxxx.xxx.com@mail154.atl81.rsgsv.net>) From: "Target Dry" <shop@targetdry.com> Reply-To: "Target Dry" <shop@targetdry.com> To: “xxxxx” <dea101@xxxxx.xxx.com> Date: Fri, 27 Nov 2015 09:04:52 +0000 Message-ID: <2f99fb2ad631c8dce46a275d7ff27615f8a.20151127090213@mail154.atl81.rsgsv.net> X-Mailer: MailChimp Mailer - **CID2371a3cc41ff27615f8a** X-Campaign: mailchimp2f99fb2ad631c8dce46a275d7.2371a3cc41 X-campaignid: mailchimp2f99fb2ad631c8dce46a275d7.2371a3cc41 X-Report-Abuse: Please report abuse for this campaign here: http://www.mailchimp.com/abuse/abuse.phtml?u=2f99fb2ad631c8dce46a275d7&id=2371a3cc41&e=ff27615f8a X-MC-User: 2f99fb2ad631c8dce46a275d7 X-Feedback-ID: 5504866:5504866.2098769:us2:mc List-ID: 2f99fb2ad631c8dce46a275d7mc list <2f99fb2ad631c8dce46a275d7.705053.list-id.mcsv.net> X-Accounttype: pd List-Unsubscribe: <mailto:unsubscribe-mc.us2_2f99fb2ad631c8dce46a275d7.2371a3cc41-ff27615f8a@mailin1.us2.mcsv.net?subject=unsubscribe>, <http://targetdry.us2.list-manage.com/unsubscribe?u=2f99fb2ad631c8dce46a275d7&id=7d9a0bf88e&e=ff27615f8a&c=2371a3cc41> X-SpamFlt-Status: Spam Sender: "Target Dry" <shop=targetdry.com@mail154.atl81.rsgsv.net> X-KASFlt-Status: Version: 5.3.8 X-KASFlt-Status: LuaCore: 341 341 f55136d4c96ece35cad82fa8f6ab419ca20d8994 X-KASFlt-Status: Lua profiles 87361 [Nov 26 2015] X-KASFlt-Status: {Has list-unsubscribe header [mass mail]} X-KASFlt-Status: Status: blacklisted X-KASFlt-Status: Method: content [black phrases list] X-KASFlt-Status: {Content: phrases from black list} X-KASFlt-Status: Rate: 100 X-MimeOLE: Produced By Microsoft MimeOLE V10.0.10011.16384 x-mcda: FALSE Content-Type: multipart/alternative; boundary="----=_NextPart_000_0041_01D12902.61C503F0" MIME-Version: 1.0 X-PN-Virus-Filtered: by PlusNet MXCore (v5.00) X-PN-Spam-Filtered: by PlusNet MXCore (v5.00) Subject: [!! SPAM] Our Black Friday Sale Is Here! Shop 40% OFF Stylish Rainwear
This is a multi-part message in MIME format.
=_NextPart_000_0041_01D12902.61C503F0
Content-Type: text/plain; format=fixed; charset="utf-8" Content-Transfer-Encoding: quoted-printable
well the 'Subject definitely has 'Spam' in it. Please post an image of the 'spam' message filter you created, so I can check the details. It might be something easy to tweak.
there is also this header:
X-SpamFlt-Status: Spam
If we cannot ge the current spam message filter working, you could try this: In the Message Filter you are creating/trying to get to work. Click on the 'Subject' drop down and at the bottom select 'Customise' A 'Customise -headers' window opens. at the top under 'New Message Header' Type: X-SpamFlt-Status - careful of the spelling it must be correct click on 'Add' click on 'OK'
Now you can select: 'X-SpamFlt-Status' and 'contains' and 'Spam'
Hello again.
Thanks for your help. I'll try to upload screenshots of my two spam filters, plus a summary of all the filters I have so far (the others are all working fine). I'll maybe try your other suggestion as well later this evening.
Unfortunately, the suggestion to use the X-SpamFlt-Status option doesn't work either.
Filters work in the order they appear in the list box. My guess is "unclassified" is looking afet your spam and moving it somewhere so the next filter does not see it.
Message filters auto run on the 'Inbox'. As you want these filters to auto work on emails received into 'Inbox', it would be useful to have those 'spam' emails in the 'Inbox' then you must make sure to choose the 'Inbox' when testing a manual run. I say this because I notice you have 'General on default plusnet..' selected. So I'm presuming you have already moved those spam emails into the 'General' folder ??? It also looks like you are testing whether all the filters work at once instead of confirming that the actual filter works on it's own first.
So to begin with you need to test each message filter on it's own with others disabled. Then you will know that the filter works/not works. Then you can work out whether other filters are impacting on your known working filters.
Make sure you are testing on the Inbox because that is where the auto filter will run. So, it goes without saying that you need 'spam' marked emails in the Inbox when performing a test on whether the filter actually works. I notice that 'Marked spam' filter has condition 'Contains' 'spam'. If this picks up everything with 'Spam' in it, then the 'Possible spam' filter will not find anything with 'spam' or even 'possible spam' because the first filter will have moved the email.
If you are trying to separate those 'spam' emails.... For 'Marked Spam' filter: Suggest:
- Select 'Match all of the following'
- 'Subject' and 'contains' and 'Spam'
- 'Subject' and 'doesn't contain' and 'Probable'
To test a specific message filter for a Manual Run: Make sure some 'spam' and 'probable spam' emails are in the Inbox. In Message filters: click on 'Filter log' Select: 'Enable the filter log' click on 'Close' Only enable one message filter eg: 'Marked spam' Temporarilly disable all others.
At the bottom 'Run selected filters on' choose the folder containing those spam emails, which should be your 'Inbox'. then click on 'Run now'.
Require feedback on testing 'Marked Spam' filter.
Modified by Toad-Hall
I tried some experimenting the other night but I couldn't get the filter to work as soon as I added the "doesn't contain" option. Without that parameter, the filter sometimes worked and sometimes didn't, so I ended up becoming really confused as to what was going on. In the end, I decided to disable the Kaspersky spam filter and try using Mailwasher Pro again as I have a lifetime licence for that. The Mailwasher option seems to work best for me. I only removed it because Kaspersky support flagged it as a possible conflict with their antivirus, causing bootup problems with my PC (sometimes requiring 4 or 5 attempts to start my PC), but it seems to not have actually been the cause, but rather the free Rapport program provided by my bank. In any case, I'm using Norton Security instead for the time being as I have a strong feeling that Kaspersky may have been causing other problems (with another e-mail client I have on my PC). Thanks for your help with this though - it's much appreciated.