TBird message filter syntax

[cjs]

I copied the message filter file from one profile to another, and that
worked fine. I made changes to these new message filters from inside
TBird, and that worked fine. I booted today and started TBird and got
this message

"One of your filters uses a custom header that contains an invalid
character, such as ':', a non-printable character, a non-ascii
character, or an eight-bit ascii character. Please edit the
msgFilterRules.dat file, which contains your filters, to remove
invalid characters from your custom headers."

several times (six or eight).

I can't find a message filter syntax document anywhere on the web, so
I can't check the files for the offending chars. Please advise.

[Mike Easter]

cjs wrote:

> "One of your filters uses a custom header that contains an invalid
> character, such as ':', a non-printable character, a non-ascii
> character, or an eight-bit ascii character. Please edit the
> msgFilterRules.dat file, which contains your filters, to remove
> invalid characters from your custom headers."
>
> several times (six or eight).
>
> I can't find a message filter syntax document anywhere on the web, so
> I can't check the files for the offending chars. Please advise.

I don't know of a filter rules .dat syntax file, but there are plenty of
sites with a list of the 95 printable 7 bit ascii characters. Here's a
picture from the wiki http://peek.snipr.com/v199u The 95 printable
ASCII characters, numbered from 32 to 126 (decimal)

--
Mike Easter

[Mike Easter]

cjs wrote:

> "One of your filters uses a custom header that contains an invalid
> character,

- the 'custom header' part is a way to focus your search
- this thread seems to be saying that something other than 'invalid
character' can trigger the alert
http://www.frenchmozilla.fr/glossaire/TMX/memoire_en-US_hi-IN.tmx

Note the reply referring to 'a header:value test has an illegal name'

--
Mike Easter

[cjs]

1. When I read the file, I don't see any kind of header.
2. I don't know what versions of ASCII chars are valid (%40 vs. @, for
instance)
3. The french mozilla link led to nekkid XML code. Should it have?

Since there's a wrong way to do it, there must be a right way to do
it, so there must be documentation somewhere.

cjs

[Wayne Mery]

On 3/24/2010 10:15 AM, cjs wrote:
> I can't find a message filter syntax document anywhere on the web, so

nothing relevant in http://kb.mozillazine.org/Filters_%28Thunderbird%29
- so I'd search in mozillazine forums and if nothing found then post in
their support forum.

here is one reference
http://forums-test.mozillazine.org/viewtopic.php?f=28&t=1752485&start=0

http://mesquilla.com/extensions/filtaquilla/ may perhaps help you
accomplish your needs with less complexity. Even if not, it's a good read.

--
http://wiki.mozilla.org/Thunderbird:Testing
http://www.spreadthunderbird.com/aff/165/

[Carroll18Virgie]

Following my monitoring, thousands of persons all over the world receive the <a href="http://goodfinance-blog.com/topics/credit-loans">credit loans</a> from different creditors. Hence, there is good possibilities to find a credit loan in all countries.

[gla...@linuxuser.iam]

On 10/20/2011 04:54 PM, Carroll18Virgie wrote:
> Following my monitoring, thousands of persons all over the world receive
<>

this is second posting referencing such "off topic" message.

how about putting poster on 'blocklist'?

--
peace out. tc, hago.

walking the walk. long live tux.

g
.

[goodwin]

On 10/20/2011 11:37 AM, gla...@linuxuser.iam wrote:
> On 10/20/2011 04:54 PM, Carroll18Virgie wrote:
>> Following my monitoring, thousands of persons all over the world receive
> <>
>
> this is second posting referencing such "off topic" message.
>
> how about putting poster on 'blocklist'?
>

the first was in the FF group under the nym "user", same mail addy.
I haven't seen this in Tbird...

but spam is spam, another addition to the filters.

[goodwin]

oops - the email addy is fully the same as the FF post.

[gla...@linuxuser.iam]

why add to filters when poster is a obviously a spammer and should be put
on 'blocklist'.

> oops - the email addy is fully the same as the FF post.

where as url in message body should be added to 'blocklist'.

[gla...@linuxuser.iam]

in viewing the firefox post, name is different, user address is same.

therefore 'blocklist' filtering will need to be on url in body.


to save someone of "rolling their round2it", i ran a "dns - who is"
check at;

http://whois.domaintools.com/91.212.226.143

and this is part of return;


IP Location: Russian Federation Russian Federation Artem Artem Zhirkov
Alekseevich

ASN: AS5577
Resolve Host: ip-91-212-226-143.as5577.net
IP Address: 91.212.226.143

inetnum: 91.212.226.0 - 91.212.226.255
netname: ZHIRK
descr: Artem Zhirkov Alekseevich
country: RU

abuse-mailbox: au...@netedicated.ru


and tried to send;

}> To: au...@netedicated.ru
}> Subject: spammer
}>
}> Greetings,
}>
}> Attached, you will find 2 emails that are being sent by a spammer using
}> your address of "NNTP-Posting-Host: 184.173.202.26"
}>
}> I and many others would appreciate your handling said spammer.
}>
}> Thank you.

which failed with "Alert" window;

An error occurred while sending mail. The mail server responded:
[PERMFAIL] destination not valid withing DNS. Please check the message
recipients and try again.

so it seems that this site may well be a source for spammers.

further checking at;

http://cqcounter.com/whois/domain/netdedicated.ru.html

showed;

domain: NETDEDICATED.RU
nserver: ns1.netdedicated.ru. 212.117.166.64
nserver: ns2.netdedicated.ru. 212.117.162.52
state: REGISTERED, DELEGATED, UNVERIFIED
person: Private Person
e-mail: zhi...@gmail.com
registrar: REGTIME-REG-RIPN
created: 2009.01.15
paid-till: 2012.01.15
source: TCI

so, curious to see what may happen, i sent email to "zhi...@gmail.com".

now if i get an increase of spam and address is any of above, i will have
to report url addresses to locals to see what can be done. :-(

i should have left well enough alone and let chris set 'blacklist' filters.

[Chris Ilias]

On 11-10-20 2:37 PM, gla...@linuxuser.iam wrote:
> On 10/20/2011 04:54 PM, Carroll18Virgie wrote:
>> Following my monitoring, thousands of persons all over the world receive
> <>
>
> this is second posting referencing such "off topic" message.
>
> how about putting poster on 'blocklist'?

I've been trying to create a filter to hold these us...@mozilla-xp.com/
spam messages from the mailing list. I'm hoping the latest iteration
works. :)

--
Chris Ilias <http://ilias.ca>
Mailing list/Newsgroup moderator

[gla...@linuxuser.iam]

On 10/20/2011 09:07 PM, Chris Ilias wrote:
<>

> I've been trying to create a filter to hold these us...@mozilla-xp.com/
> spam messages from the mailing list. I'm hoping the latest iteration
> works. :)

me too.

is "us...@mozilla-xp.com" a good address, or is it bogus?


i have a feeling the isp they come from is a spamming isp.

from what i could tell in running dns lookup, i believe the main isp
being used and maybe where any further abuse reporting should be sent.

for sure, they are going to get wise that folks are on to them and
hopefully they will leave mozilla.org alone.

[goodwin]

On 10/20/2011 04:32 PM, gla...@linuxuser.iam wrote:

> for sure, they are going to get wise that folks are on to them and
> hopefully they will leave mozilla.org alone.

bullwark, they could care less. what are you thinking? you parse a
piece of spam and derive it to be from .ru space and you think someone
there is going to listen to you?

you are either dreaming or delusional.

and what blocklist are you thinking of? if you have your own mail
server, that would work, probably with IP tables, but this is a
Thunderbird group. might you point me to a useful blocklist we could
all use?

[gla...@linuxuser.iam]

On 10/21/2011 04:16 AM, goodwin wrote:
<>

so, do you have chris ilias filtered to be deleted or do you just not
bother to read his post?

[goodwin]

On 10/20/2011 09:33 PM, gla...@linuxuser.iam wrote:
> On 10/21/2011 04:16 AM, goodwin wrote:
> <>
>
> so, do you have chris ilias filtered to be deleted or do you just not
> bother to read his post?
>

I was wrong in not seeing that you wish Chris to list the spammer - my
apologies - was reading from your 2nd post.

What flipped me was your switch to discussion of the source and
suggestion that larting them may be effective - reminded me of a major
poster here from several years ago that claimed to have shut down every
spammer that dared send to him.

back to my meds...