Technotes

We have identified a number of Spammers who as a means to clean their address lists, have been sending out large numbers of emails containing random dictionary words. This technote describes how to set up a text analyser scenario to detect them.

Banned Hosts are SMTP host machines from which no email messages will be accepted. This option is typically used to block Spam mail from undesirable hosts.

Some customers use Banned Hosts to block all SMTP hosts, whilst allowing access from a particular subnet.

e.g.

!10.10.10.*

*.*.*.*

NOTE: You specify exceptions to a banned host entry by adding an entry for the allowed host(s) and preceding it with an exclamation mark (!). You should place the negated entry for the exception above the entry for the banned host.

When using this type of block-all-but-allow-some format it is possible for some valid machines to be blocked unexpectedly.

When installing an additional server, where the instance name in not the default the error occurs at point of installing:

Cannot start service PMIIS on Computer
“The dependency service does not exist or has been marked for deletion”

Image-based 'Penny Stock' spam, and indeed image-based spam in general, has undergone rapid changes recently, and will continue to evolve rapidly. Use of Text analysis to detect characteristics of the SMTP header and the HTML has provided a degree of success, and is highly recommended. (See technote http://www.clearswift.com/support/technotes/item.aspx?ID=1574)

At times, however, the margins used to distinguish between image-based spam and legitimate business mail has narrowed to the point where the risk of false positives and the processing overhead can be problematic. This TechNote outlines an alternative, effective, and fast approach to blocking image based spam, using multiple scenarios.

PLEASE NOTE: The method will generate some degree of false positives, especially with newsletters, and other HTML based messages with embedded images. However, we outline a method of using text analysis to limit this (this will require customer-end management)

In addition, as this is a very aggressive policy, so it may be more appropriate to apply this policy to your "top spam recipients" rather than a blanket policy for all your users. If you have configured reporting, it should be relatively easy for you to run a report, for example for your top 250 spam recipients, and then use this address information to create a policy folder in "Incoming" in which to apply this policy.

SMTPSS - debug reveals the following:

• Service status Status = STOP PENDING
• ExitCode = 1066
• The system failed to configure the Data Management Engine.
• Order string '' for plugin 'Pretty Good Privacy' has not been configured.
• Service status
• Status = STOPPED
• ExitCode = 1066

MIMEsweeper for SMTP 5.2 Service Pack 2 brings new Anti-Spam features to the MIMEsweeper for SMTP 5.2 edition.

In order to maximise the effectiveness of your spam detection, it is important that you use all the available features, including the new features. This Technote will guide you through All the features.

This Technote describes how to view Active Directory LDAP Policy Settings using the NTDSUTIL tool.

This technote describes how to set up a Text Analyser Scenario to use the "Spam: xxx" type of Managed Expression List

This technote describes how to set up a Text Analyzer Scenario to use the "Source: xxx" type of Managed Expression List

This technote describes how to set up a Text Analyser Scenario to use the "Swear Words: xxx" type of Managed Expression List

This technote describes how to set up a Text Analyzer Scenario to use the "Unacceptable: xxx" type of Managed Expression List

This technote describes how to set up a Text Analyzer Scenario to use the "Scripts: xxx" Managed Script Lists

This technote describes how to set up a Text Analyzer Scenario to use the "Japanese: xxx" type of Managed Expression List

There have been recent enquiries regarding compatability of the Symantec Scan Engine (SSE) 5.1 and MIMEsweeper for SMTP 5.2.5.

A few years back, it made sense to respond when a message was sent to a non-existent address at your domain, or when viruses and other messages were blocked. This is no longer the case.

This technote describes how to set up a Text Analyser Scenario to use the "Spam: Penny Stock Images" Managed Expression Liss

Several customer have reported inconsistencies when comparing Reports showing activity per machine and Reports showing Messages Activity.

Your folder <INSTALLPATH>\ Data\Operations\Disposer\MGmailtransactions\failed is filled with MSGID.REC and MSGID.DAT file pairs. The .REC files shows error message of type:

** The stored procedure usp_pmi_AddPolicy (@RETURN_VALUE(ID),@policyGUID(ID), @policy(SCENARIO ROUTE)); caused a violation of a primary key or unique constraint. ---> System.Data.SqlClient.SqlException: Violation of UNIQUE KEY constraint 'UC_pmi_Policy_Policy'. Cannot insert duplicate key in object 'pmi_Policy'.
The statement has been terminated. **

After upgrading to MIMEsweeper for SMTP 5.2, the Reclassifier Scenario cannot be opened, and you cannot view/modify the contents of it.

Two features within the MIMEsweeper for SMTP 5 range can use LDAP servers:
In versions 5.0_x, 5.1_x and 5.2_x : LDAP Address List, and from version 5.2_x : PCS LDAP Address List

Some spam is very obviously spam to the recipient, though there is sometimes confusion with end-users about what is, and is not spam.

This technote attempts to bring some clarity to "what is", and "what is not" spam, and also describes the most common types of spam (making up around 99% of spam)

When using a PCS LDAP Address list and testing policy with the Identify Policy feature the results may not be accurate.

Customers installing MIMEsweeper for SMTP 5.2 on a Microsoft French Windows 2003 or Microsoft German Windows 2003 Operating system, are required to install Microsoft .NET Framework as a pre-requisite. 

After creating a PCS LDAP Address list, you can test the results of the query by using the test window.

If you want to search for a user using the "Search For User" button, the result displayed maybe seen

"The current configuration does not include the specified e-mail address."

whether the address exists or not.

Under certain circumstances a MIMEsweeper service may hang or crash without providing useful information in the event viewer logs.  In these cases it may be necessary to generate a dump file using the ADPlus debugging utility.  Once the log file has been generated please contact your regional support services.

SpamLogic “learns” from the email traffic it analyses. This knowledge is stored in the SpamLogic database.

In some circumstances, environmental factors could potentially cause a decrease in performance of the detection or false-positive rate of SpamLogic. In this case it is possible to reset the SpamLogic database to the default, so that SpamLogic can recover and learn normally.

The MIMEsweeper for SMTP system center indicates that the infrastructure service on one of the servers in the deployment is unavailable.

In order to evaluate or troubleshoot the effectiveness of your Anti-spam solution, it is important to be able to make measurements of its effectiveness and compare that to what is normally expected.

This can help identify if your solution is working effectively.

After running the System Maintenance Utlity component "anti-spam filter training wizard", the following error may appear :

Operations Database Failed to upload FILENAME.EXTENSION to Operations Database: There was an exception running the extensions specified in the config file. --> Maximum request length exceeded.

As default, the log level of MIMEsweeper for SMTP 5.x /MIMEsweeper for WEB is '3' (INFO), which gives basic information on the state of the services. This log level can be increased.

When upgrading from 5.0 to 5.1, the Audit Database upgrade fails. An incorrectly formatted Database name is used, thus causing the upgrade to fail.

If using a Clean and Cleaned classification, the message count displayed in the Report Center is incorrect.

Spammers use automated intelligent agents or 'bots' to trawl web sites and harvest email adresses. This is a major source of email addresses for the spammer. There is a correlation between the presence of plain text email addresses on web sites and the amount of spam those sites receive.

MIMEsweeper install fails because the ASP.NET account is missing.  When the account is created Mimesweeper will install but will generate errors accessing the Policy Editor, Manager, or Maintenance Utility.