AntiSpam 2.5 problems [Assumed Solved]

:-\ problems:

  1. some spams are passing through;
  2. put back option to disable send ASA (it makes me problems);
  3. when the massage viewer is checked, remove the window to make quarantined massage window biger;

PS: ver. 2.1 was better !!

OK number one is no more problem but 2 and 3 remain.

Hi Zombie:

     Thank you for the remark on CAS2.5.
      I am glad to answer your questions:

--------2. put back option to disable send ASA (it makes me problems);
Would you please tell us what problems this option brings to you?

-------3. when the massage viewer is checked, remove the window to make quarantined massage window biger;
This is a good suggestion, we will consider this feature. Thank you.

I get back lot of notifications from Mail Delivery servers !!

one more problem:

when I select all massages and click delete, i can not change status to allow this massage and massage is lost !!

Hi Zombie:

    It seems you have subscribed some mail lists. You could add those addresses into 'Authentication Database' as 'Distribution list' first, so you subscribed mail will be approved with out sending out alert messages. Or you could use 'Only allow digital signed e-mails' option in the 'Policy' page. This option will not send out alert message, too.
   This is really one problem here. I think there are some better solutions to it. Do you have any suggestion here? Thanks!

Hi Junhua,
I salute this new version of CAS, it apper to solve some of my previous issues I have noticed, but, hoping I am not hypercritical, there are some new issues to be corrected.

From “zombie” - “I get back lot of notifications from Mail Delivery servers !!”

  • I think that “zombie” wanted to say that many real email servers respond to CAS autentification message launched for a false account that do not exist with those notifications. Anyway, this is my case.
    Pehaps an improvement would be if CAS could delete automaticaly those “postmaster/mail-daemon[ at ]…” from servers it sent autentifications messages. For this autoresponses CAS will send another Autentification Message which obviousely will not be replied but is also unnecessary.

From “zombie” - “when I select all massages and click delete, i can not change status to allow this massage and massage is lost !!”

  • I think that a good idea is to change that behaviour by recoding that group of buttons (Allow sender/…/Delete) in order to alow all other actions.
    In fact, pushing the delete button look’s like a permanent deletion action instead of a “mark for deletion” action which is much confortable offering the chance to change some decisions made by mistake in a rush.

Another observation is that now I can’t order email addresses list (alowed or blocked) by domain.That was available in the previouse version and I find it useful especialy when I wanted to check if one or a group of addresses on a domain has established the desired action .
Now I have to browse the whole list, which is pretty unconfortable if the list is increasing every day by tens of addresses.

LE: Sorry, I discovered later the right-click option on the “Email address” top column

Related to another post on this forum, I have to mention that import of blacklist/whitelist addresses from a .bbl/.bwl file have some problems that cause program crash. I closed the program, renamed the .adb file then restarted the program .It make a new file and import from email client (outlook) my contacts, but my previous collection of blacklisted addresses couldn’ be used.A patch for this issue would be very appreciate.

Hope that this is useful for you.

Brgds,
Adyb

all buttons here that we (I) need are DELETE ALL as " mark for deletion " and ALLOW SENDER as " mark for allow email ", permanet action can be done when I change window or going out from CAS configuration !!, as in the ver. 2.1.

Hi Adyb:
Thank you for your suggestion!

  ---"- I think that "zombie" wanted to say that many real email servers respond to CAS autentification message launched for a false account that do not exist with those notifications. Anyway, this is my case.
      Pehaps an improvement would be if CAS could delete automaticaly those "postmaster/mail-daemon[ at ]...." from servers it sent autentifications messages. For this autoresponses CAS will send another Autentification Message which obviousely will not be replied but is also unnecessary."
  
   I also think this should be done.

   --- "- I think that a good idea is to change that behaviour by recoding that group of buttons (Allow sender/.../Delete) in order to alow all other actions.

In fact, pushing the delete button look’s like a permanent deletion action instead of a “mark for deletion” action which is much confortable offering the chance to change some decisions made by mistake in a rush."

   Yes, permanent actions should be taken as late as possible.

clear all mail delivery notifications will also be bad job, only good job is to disable send ASA.

:-\ the spam that is leaved on the server it checks again and again…I am back to ver. 2.1

Hi Zombie:

      The spam is leaved on the server before Comodo AntiSpam delete it. Comodo AntiSpam only check blocked e-mails in case some modification is made to white-list or you have changed the policy.

(:NRD) my opinion how the most functional antispam looks like:

  1. everything is listed as spam if I do not have it in my email address book;
  2. if I decide that something is not the spam I ALLOW SENDER ond its email address goes to address book;
  3. when I delete the rest I do not want to see it anymore;

Hi Junhua,

unfortunately I have to come back with another issue …
I’m talking about the IP blocking which doesn’t appear to work.
In fact I have an IP set to “block email from”, wherefrom I receive regulary virused email (mydoom, certified by NOD32), every time another false email address.
CAS doesn’t delete them automaticaly, filtering by IP, but put him in Quarantine “Awaiting challange response” filtering just on email address basis.
I supose that priority of IP filter is lower than priority of email addresses filter.
My suggestion is to change it to the oposite in order to reject from the begining emails that comes from bad sources.
Hope that this is useful for you.

Brgds

Hi Zombie:

 I suggest you select the "Only allow digitally signed e-mails" in the policy page. All your e-mail will be blocked if they are not signed or their sender are not listed in white-list. And if you delete  others, they will be deleted from your pop servers in the next time to receive e-mails.

Hi Adyb:

    As i know, it's ture that 'priority of IP filter is lower than priority of email addresses filter'.
    But every e-mail will be filtered by both two filters, except one filter approving it or blocking it.
    IP filter could not work with some spams with forged  mail header, for they always have no source IP information.  I think the e-mail you got looks like this type. Would you please zip the email sample and post it to forum? You need save it as *.eml file by your email client, then zip it and post it as attachment. Thanks!

Hi Junhua,
Adout double filtering, I can only guess that if the email address is checked first and quarantined (because the address is new and fake every time), the IP filtering have to wait until it pass.Changing the order it will be deleted instantly and without any error and the whole checking process (useless in this case) will be saved.
About the message, I am not very familiar with meaning of the email header records, but I know that all contain fake addresses, IP, etc.
I am using Outlook 2003 and the .eml extension is not one of the save options, but I saved it as a .msg file.The virus attachement is not included because it was deleted by Nod32 from the begining.

Brgds.

[attachment deleted by admin]

Hi Adyb:

  Thank you for your valuable sample.
  I think it will help us to defeat the spamers.

problem with digitally signed e-mails is that it needs additional activity of email recipients that most of them do not like.

filters like IP, domains etc. are not usefull while it can be simulated (changed) and different every time.

(:WAV) is the new ver. somewhere on the horizont