E-mail spam filter for Microsoft Windows ™
|
|
jwSpamSpy E-mail spam filter for Microsoft Windows ™ |
Better detection of "pump and dump" scams (2006-02-19)
This version detects more "pump and dump" penny stock scam emails. It also better catches the "Yukos Oil" version of the Nigerian 419 scam. It displays a message when a new software update is available.
Upgrade expire notification fixed (2006-01-09)
This version fixes a problem where the daily report incorrectly claimed the update period had expired if the expiry date was in the same calendar year.
Various updates between July and December 2005
We released new software versions about twice a month during this period, which aren't detailed here.
Resize dialog, Netscape FP, AVAST (2005-07-06)
The user interface of jwSpamSpy has been renovated:
In Outlook Express and Outlook you can drag attached emails to a mail filder. This makes rrestoring mails flagged as suspect and delivered as attachments very easy. In Netscape and Mozilla Thunderbird this is not possible. You can only save the attachment as a file. Build 1.00.050706 provides one "magic" folder per email account to handle this. Any email saved to a folder called "clean" will be delivered to the inbox without any filtering. It arrives as a fresh mail, as if it had only just arrived from the outside. In a future version we may auto-whitelist the senders of all mails found in this folder, to help you keep such mails unflagged with minimal effort.
We updated our virus scanner so that it would not longer raise a false alarm from the AVAST virus scanner. That means that AVAST and jwSpamSpy will now happily coexist on the same machine (thanks to AVAST's helpful technical support!).
A bug that sometimes prevented manual entry of license keys via cut and paste on some machines was fixed.
Support for SURBL backlist (2005-02-23)
Starting from this version, jwSpamSpy queries the SURBL domain block list. This allows jwSpamSpy to catch more spam. At the same time we have reduced the scores of several spam tests that sometimes produce false positives. The combination of these two changes should ensure that more spam is caught and at the same time fewer valid mails will be flagged as suspicious.
We are aware of a conflict between PC-Cillin 2005 and its "Incoming (real-time) POP3 Scanning" feature and jwSpamSpy. You can disable the POP3 scanning in PC-Cillin 2005, as jwSpamSpy will also catch those virus emails.
Reduced false positives (Outlook Express) (2005-02-15)
Reduced false positives: Thunderbird, AspMail (2005-01-23)
Changes:
Problem with activating license key (2005-01-07)
We fixed a problem with the evaluation version that would not accept valid license keys starting from January 1, 2005. Versions downloaded before that data need to be updated before the key can be activated. The necessary instructions are contained in the notification mail automatically sent to customers who purchase a license. Versions downloaded from January 7 do not have this problems.
Reduced false positives, virus filtering (2004-12-10)
Virus filtering has been updated so that certain newer variants of viruses are recognized and filtered or at least flagged as suspicious if executable or archive files are attached and certain conditions are met.
The auto-update is now a one-click operation, as the path prompt in the update archive file has been disabled. The update file is always unpacked into a folder beneath the program folder. There is now an option to not prompt for updates, for systems that boot up without anyone attending the console. With this option enabled, future updates will be automatically installed when the system boots up.
More effective whitelisting (2004-10-31)
Note that as before mail from whitelisted sender addresses is stopped is if the mail contains a virus, since virtually all viruses use fake sender addresses, making the sender address check meaningless in that case.
When we extended the evaluation period from 14 days to 30 days, the warning that the trial period had expired still came up after 14 days. However, the filter only deactivated after the full 30 day trial period, as intended. We apologize for the confusion this may have caused.
Keep those virus scanners happy ;-) (2004-10-06)
Extending the trial period (2004-09-27)
Performance, server name in About dialog (2004-09-09)
For concenience, the host name or IP address under which the email program can reach the local mail server (i.e. jwSpamSpy) is now displayed in the About jwSpamSpy dialog. Previously this name was only displayed during setup and when adding mailboxes in jwSpamSpy.
A problem that could sometimes cause the filter to get stuck while checking new mail has been fixed.
While a backup copy is normally made of all mails categorized as spam (no mail is entirely discarded), this by default is no longer the case for those mails that received the maximum spam rating. This should reduce disk space usage without sacrificing safety.
House cleaning on domain list (2004-08-04)
Filtering MyDoom worm (2004-07-26)
Outlook Express automatically closed during install
User interface: Doubleclick, Exit to Manual
When you invoke the main dialog either way, you will enter Manual Mode, i.e. periodic checking for email gets suspended. To close the main dialog and re-activate Automatic Mode so that new mails get filtered every couple of minutes there is now a shortcut command in the menu of the main dialog: "jwSpamSpy | Exit to Automatic".
We hope you'll enjoy these enhancements :-)
Abuse contact database and dialog (2004-06-23)
Local mailbox host can be specified as a name (2004-06-13)
Workaround for cppop quirk (2004-06-13)
Spam with .cx-domains could hang jwSpamSpy (2004-06-07)
The latest build, jwSpamSpy 1.00.040607 (June 7, 2004) fixed this problem by no longer querying a whois-server for .cx domains and by better handling time-outs from failed whois-queries.
jwSpamSpy shows statistics of filter results (2004-06-01)
Ad-aware prevents jwSpamSpy from installing correctly (2004-05-28)
Links:
Prior to this version, a mail sent via Outlook Express from a non-whitelisted sender could sometimes be flagged as suspicious. This happened when the sender kept Outlook Express runing for a long time, without ever closing the application or rebooting Windows.
In a number of cases where previous version report legitimate mails as possible spam, jwSpamSpy no longer raises objections. This includes certain emails sent with Outlook Express with very short messages and HTML enabled, similar emails sent using IncrediMail and some FireFox emails.
Whitelisting a sender prevented an email from that sender from being blocked completely, but it could still be marked as suspicious. Starting from version 1.00.041031 mails from such senders will never be flagged as suspicious.
Several of our trial customers refrained from installing their product after their existing virus scanner complained. This was a false alarm, we're happy to report. The scanners raised a false alarm simply because the jwSpamSpy installer included some known text messages from common viruses. We look for these messages to shield email users from pointless non-delivery notifications which are sent when their addresses are abused as fake sender addresses by email viruses such as Netsky, Bagle, etc. To avoid this problem the virus signature file in jwSpamSpy has been moved from self-extracting installer to our website.
Other fixes and features:
The next build of jwSpamSpy will have a 30 day trial period instead of the current 14 day period. This will give users more time to evaluate the product before making a choice about buying a license for the full product.
We have identified a problem with jwSpamSpy running on Windows 95/98. After picking up mail or deleting spam from the main dialog, the menus stop responding. You have to close the dialog and reopen it to issue more command. We are working on making a fix available.
The September 9, 2004 version includes several performance enhancements. Emails are now downloaded in parallel with email checking (multi-threading).
Today we removed all domains from the local domain blacklist (dom-bl.txt) that were added before January 5, 2004. The primary objective was to remove some "false positives", i.e. domains that were not spam domains but had gotten onto the list. In December 2003, we settled on our current procedure for determining whether a domain should be listed or not. We have had a small number of false positves amongst entries added to the list more than a year ago. By discarding older entries we minimize the chance of valid mail being blocked. Our data set now feeds into surbl.org (Spam URI Realtime Blocklists), a public URL blocklist using a DNS server.
Starting with build 1.00.040703, jwSpamSpy filters the MyDoom.M / MyDoom.M virus. These viruses were not recognized by earlier versions of the software.
This version also fixes a problem with invalid evaluation period expiry dates, that were produced when an evaluation version was installed on certain dates.
Starting with build 1.00.040726, jwSpamSpy automatically closes Outlook Express during its installation. This prevents a potential problem that occurred on earlier versions. jwSpamSpy can automatically import email account settings from Outlook Express and change its settings so it will pick up mail from the local mailbox filtered by jwSpamSpy. However, if the Outlook Express main window or any email windows were left open while jwSpamSpy was being installed, Outlook Express would not become aware of the changes made to its settings until it was closed and restarted. As a result, it would not see new mails that were downloaded by jwSpamSpy.
Starting with build 1.00.040624, you can invoke the main dialog of jwSpamSpy with a doubleclick of the left mouse button on the system tray icon, instead of first having to invoke the context menu of the tray icon with a right click and then selecting Manual Mode.
Starting with build 1.00.040623, jwSpamSpy lets you quickly determine who to contact for spam or viruses originating from a given IP address. "Tools | Lookup abuse contact..." opens a dialog with a field into which you can type or paste the IP address. It fills in two fields with the email address or website URL for reporting abuse incidents to the company that owns the IP addresses. You can paste the reponse into your email program to quickly and easily report incidents. Our database covers major ISPs in the USA, Canada, Europe, Australia and Japan from which we received viruses in recent months.
When you install jwSpamSpy, you can specify the machine from which email clients will pick up filtered mail. Normally this is the IP address 127.0.0.1, a value that always refers to the local machine ("localhost"). However, if you want to run the filter and the mail programm on different machines, you needed to specify a fixed IP address, such as 192.168.200.100. This was fine if a fixed IP value was explicitly assigned in the TCP/IP-settings, but would not work if the machine used a dynamically assigned address (DHCP). Starting with build 1.00.040613, the jwSpamSpy Setup program also supports specifying machine names such as DellPentium4 for the jwSpamSpy host. The mail application can then use the machine name as the mail server from which it picks up mail. This allows jwSpamSpy to run on a separate server which uses a DHCP-assigned IP address.
In some cases jwSpamSpy could not retrieve mails from mail servers running cppop, which returned incorrect message sizes when queried about pending mails. Starting with build 1.00.040613, jwSpamSpy is compatible with this mail server.
Problem: Spam emails advertising domains registered on the Christmas Islands (ccTLD .cx) can hang jwSpamSpy.
Explanation: The domain registry for .cx domains does not have a working WHOIS-server. When jwSpamSpy tries to query the server, it can get stuck.
Symptoms: No new mails delivered. jwSpamSpy manual mode dialog will not come up. In Windows 2000 or XP, if you use Ctrl+Alt-Del to bring up the task manager, you will see "jwSpamSpy.exe" in the list of processes indefinitely.
Workaround/Fix:
If jwSpamSpy gets stuck, use Ctrl+Alt-Del, then "T" to invoke the Task Manager. Click the "Processes" tab. Click on "jwSpamSpy.exe" in the list of processes, then "End Process", confirm "Yes". Browse to the jwSpamSpy application folder, usually C:\Program Files\JoeWein\SpamSpy. Open the bl folder. Create a new text file in it (right mouse click, "New", "Text document") and name it "whois-hosts.txt". Open it and add the following line to it:
cx;null
The "About jwSpamSpy" dialog now shows how many mails have been checked and what percentage was spam, non-spam or viruses:
Problem:Ad-aware 6, a spyware detector by Lavasoft, can prevent jwSpamSpy from installing correctly as it prevents our install program from making the necessary changes to the Windows registry.
Symptom: When you start your computer, the jwSpamspy icon does not appear in the system tray and your email application can not check the local POP mailboxes until you manually launch jwSpamStartup.exe from the jwSpamSpy application folder, usuall C:\Program Files\JoeWein\SpamSpy.
Solution: Turn off Ad-aware before installing jwSpamSpy. You may reenable it once you've completed the jwSpamSpy setup. Should you wish to uninstall jwSpamSpy for any reason, you will also need to temporarily disable Ad-aware.
jwSpamSpy - spam and virus filter for POP3 mailboxes
ReadMe notes for jwSpamSpy
Frequently Asked Questions (FAQ) for jwSpamSpy