Spam getting under MWP radar

Stuhar · Cadet Joined: Dec 05, 2003 Posts: 6 Location: Netherlands

Over the last week or two I've been getting several spam mail coming into my Outlook inbox despite pre-screening with MWP. At first I thought it was mail that had arrived between my checking MWP and then clicking receive on Outlook. But now I think that some evil doers out there have figured a way of stealthing MWP, because the spam gets through - not least because my NAV has caught about a dozen virus-laden mails in the past week.

In case you're wondering, I have my MWP settings to show "hidden" e-mails.

If anyone's interested I can forward example mails of what has slipped through.

Best
Stuart

AlphaCentauri · Lieutenant Joined: Nov 20, 2003 Posts: 223 Location: USA

Does Outlook have the ability to set preferences to let you download mail but not delete it from your server's mailbox? If you did that for a bit, you could see if it was visible to MWP after Outlook had found it. (You could use MWP to clean up your mailbox during the experiment).

stan_qaz · Posted: Sat Feb 07, 2004 11:37 am Post subject:

For mail to get by mailwasher there are only two paths that have been confirmed.

1. Mail arrives between the time maqilwasher locks the account and your e-mail client locks the account. This can be minimized by checking mail in mailwasher and then processing the spam, but prior to launching the e-mail client check mail again and proceed to the client only if there is no new mail.

2. A session between mailwasher and the mail server did not complete and e-mails were on the server that were not downloaded. This will either give you the errors dialog or the warning triangle on the status line.

Anybody else seen any other paths for spam past mailwasher that I missed?

Ikeb · Posted: Sat Feb 07, 2004 5:21 pm Post subject:

Stuhar, what makes you suspect that what you're observing is not due to issue #1 as outlined by Stan? How much time transpires between your last check of your accounts via MWP and the download via Outlook? How much SPAM do you receive? Have you checked the missed messages' last "Received: from" time stamp in comparison to the time you requested the Outlook download?

Stan, I seem to recall someone not checking all accounts with MWP and that happened to be the one being checked via the email client. Also, Stuhar points to the possibility of having SPAM hidden away by MWP itself. Such finger problems (or as Roger might say "pilot error") should be considered as well.

Dunno that issue #2 you list would cause MWP to miss SPAM though.....

stan_qaz · Posted: Sat Feb 07, 2004 11:30 pm Post subject:

Ikeb · Posted: Sun Feb 08, 2004 3:49 am Post subject:

Ah OK. I was for some reason, thinking in terms of the client not completing the session with the server.

Upon processing messages, another reason MWP should, at the bare minimum, check mail before minimizing and bringing the client into focus. Again I am compelled to mention that a proxy would eliminate this "failure to communicate" gotcha as well.....

stan_qaz · Posted: Sun Feb 08, 2004 4:21 pm Post subject:

Also mailwasher shouldn't launch the mail client if any session doesn't complete normally.

Guest · Posted: Mon Feb 09, 2004 11:56 pm Post subject:

[quote="stan_qaz"]

Ikeb · Posted: Tue Feb 10, 2004 3:04 am Post subject:

First of all, Stan wrote that, not me.

Secondly, FireTrust could do something about it. Not that they could fix the client <> server communications problem mind you. However MWP could be made to warn that processing messages after such an event may not have detected all SPAM at the server and that a re-poll is recommended.

Guest · Posted: Tue Feb 10, 2004 8:11 am Post subject:

Guest · Posted: Tue Feb 10, 2004 11:29 am Post subject:

Ikeb · Posted: Tue Feb 10, 2004 1:48 pm Post subject:

Next time this happens I suggest you save the message that creates the error condition and see if anything unusual is apparent. Send it to to me via my email button if you wish ... it's one way to find out if my server would produce the same symptoms ... Wink


	Home ˇ Topics ˇ Submit News ˇ Top 10 This entire site, Cops Themes, and Computer Cops are Š 2002 - 2004 Computer Cops, LLC. All rights reserved. You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0. Acceptable Use Policy. Use signifies your agreement. Engine Copyright Š 2002 by PHP-Nuke, GNU/GPL Licensed. ICRA Member. Paul Laudanski, Member of Computer Cops, LLC Server Load: 710 pages served in previous 5 minutes. Page Generation: 0.731 seconds.