Following up on my earlier post on this subject, it appears that the Rules
processing operation may get confused when a Rule refers to people and there
is more than one name in both the Rule and the address list.



Here is what I think I am seeing (in the examples below, A, B, C, D, E, X, Y
and Z represent properly structured email addresses):

-------------------------------

Scenario 1:

If I create a Rule which says:



Apply this rule after the message arrives

Where the To line contains 'A' or 'B' or 'C' or 'D' or 'E'

Delete it

and Stop processing more rules



and I get an EMAIL which has ONLY ONE of the addresses A, B, C, D or E in
the TO: line,
the rule works and the email is moved to the Deleted Items folder.

-------------------------------

Scenario 2:

If I use the same Rule as in scenario 1, but the incoming EMAIL contains
MORE THAN ONE of the addresses A-E,
the rule fails.
(NOTE: I have not yet done a systematic and exhaustive test to see if the
failure is due solely to having more than one of A-E in the address list, or
if perhaps there is only a failure if there is also an address X, Y, or Z in
the TO: field which is NOT also contained in the rule.)

-------------------------------

Scenario 3:

If I modify the same RULE so that it contains ONLY ONE of the addresses A-E,
and I get an email with any one or more of the addresses A-E,
the rule works.

-------------------------------



In other words, Rules processing seems to fail if there are multiple
addresses in both the rule and the email. In my view of the world, there is
no reason why Scenario 2 should not delete an email if ANY of the TO:
addresses in the email matches ANY of the addresses in the rule.



While Rules processing does allow both AND and OR logic to be used in a
Rule, one cannot mix AND and OR logic in a single Rule. In the case where
an email has more than one address (such as A-E and X-Z) being tested
against a rule and the test is to match the email address on an OR basis
against the address list in the rule, a failure of any one address in the
email address list to match any of the addresses in the rules should not
cause the rule to fail, as this is essentially saying that the rules
processing is translated (per the above example) as:



IF email-address-A
matches any of rule-addresses
AND
email-address-B
matches any of rule-addresses
AND
email-address-C
matches any of rule-addresses
AND
email-address-D
matches any of rule-addresses
AND
email-address-E
matches any of rule-addresses
AND
email-address-X
matches any of rule-addresses
AND
email-address-Y
matches any of rule-addresses
AND
email-address-Z
matches any of rule-addresses
THEN execute rule



Since most spam that I see has lots of entries in the TO: address list, it
is far easier from a rules management standpoint to have a single rule which
refers to a large single list of email addresses than it is to have hundreds
of rules each of which refers to only one address.



I am using Excel to manage my rules address list, copying all of the TO:
entries in each new large batch of unfiltered spam into Excel and using the
Filter function to cut the list down to one copy of each entry, sorting the
list, then pasting the list back into a single OE6 rule (after inserting the
proper ' or ' linkages between list elements).

"Norman Litell" wrote in message
k.net...
Following up on my earlier post on this subject, it appears that the Rules
processing operation may get confused when a Rule refers to people and
there
is more than one name in both the Rule and the address list.


In the first rule, after entering the vowels click Options and select Does
Not.

--
Frank Saunders, MS-MVP OE/WM
http://www.fjsmjs.com
Please reply in newsgroup. Do NOT send email.

Sorry, but I don't understand your response. Let me try once again - for
the third time -- to clarify my situation...

1. I get lots of spam.
2. From what I can see going through each of these spam messages, MOST OF
this spam includes a limited set of addressees in either the TO: or CC: part
of the email.
3. I have never received a relevant email which included any one of this
set of spam-associated email addressees in either the TO: or CC: address
list.
4. I therefore want to Delete any and all emails which include at least one
of these spam-associated addressees in either the TO: or CC: list of
addressees.

That is what I am attempting to accomplish with my proposed rules.

My point and problem is this:
-- IF I have a list of known "bad" (i.e., spam-associated) addressees that
might appear in either the TO: or CC: line of an email..
-- the easiest thing for me is to continually build a list of the "bad "
addressees, and create ONE rule which says that, any time a message contains
at least one of these addressees in either/or the TO: or CC: lines...
DELETE the @#%&$&%@#$ message.!!!

THAT is what I want to do -- and that is what OE6 does not seem to have a
simple -- and workable -- solution for.


"Frank Saunders, MS-MVP OE/WM" wrote in message
...
"Norman Litell" wrote in message
k.net...
Following up on my earlier post on this subject, it appears that the
Rules
processing operation may get confused when a Rule refers to people and
there
is more than one name in both the Rule and the address list.

????????????????
In the first rule, after entering the vowels click Options and select Does
Not.
????????????????

--
Frank Saunders, MS-MVP OE/WM
http://www.fjsmjs.com
Please reply in newsgroup. Do NOT send email.

"Norman Litell" wrote

1. I get lots of spam.
2. From what I can see going through each of these spam messages, MOST OF
this spam includes a limited set of addressees in either the TO: or CC:
part
of the email.
3. I have never received a relevant email which included any one of this
set of spam-associated email addressees in either the TO: or CC: address
list.
4. I therefore want to Delete any and all emails which include at least
one
of these spam-associated addressees in either the TO: or CC: list of
addressees.

I just created a mail rule that says:

/begin rule
Where CC line contains
@spamcop.net
@... [more domains]

Delete it and stop processing more rules.
/end rule

It seems to work.

--
Bob
http://www.kanyak.com

Bob,

I haven’t tried what you suggested, as it misses the basic point of my
problem.



Most of my spam contains a specific and limited set of email addresses in
either the TO: or CC: fields of the message. Nearly all of these are of the
form .



I clearly cannot block all email from standard email domains such as
earthlink, yahoo, hotmail, etc…, so your domain-level example does not
address my problem.



To repeat my issue and example once again:



1.. Please look at my post of 8/3/06 at 5:50pm to see an example of the
rule which has approx 50 email addresses in it.


2.. If I get an email with as the ONE and ONLY
addressee, the rule works and the email is deleted.
Similarly, if I get an email with as the ONE
and ONLY addressee, the rule works and the email is deleted.


3.. If I get an email with BOTH AND
as addressees (again, both names are in my single
multi-address rule), the rule fails.


The only way I can see to make the rules system work for example 3 is to
have two separate rules, each of which has only one entry – either ronk124
or Yered. That leads to a situation where I would need to create hundreds
of rules instead of just one or two large rules which ‘or’ the bad
addresses.



Norman





"Opinicus" wrote in message
...
"Norman Litell" wrote

1. I get lots of spam.
2. From what I can see going through each of these spam messages, MOST
OF
this spam includes a limited set of addressees in either the TO: or CC:
part
of the email.
3. I have never received a relevant email which included any one of
this
set of spam-associated email addressees in either the TO: or CC: address
list.
4. I therefore want to Delete any and all emails which include at least
one
of these spam-associated addressees in either the TO: or CC: list of
addressees.

I just created a mail rule that says:

/begin rule
Where CC line contains
@spamcop.net
@... [more domains]

Delete it and stop processing more rules.
/end rule

It seems to work.

--
Bob
http://www.kanyak.com

Norman:

Why have you not tried my suggestion of blocking everyone with an address
From Earthlink, EXCEPT the people you want to allow? I will give it to you
again.

You need two message rules and the first one must be above the second. They
should be the first rules after all your Delete it from server rules.

Rule 1:

Box 1: Where the from line contains people
Box 2: Stop processing more rules
Box 3: Click on Contains people and Add the addresses you want to receive
one-at-a time.

Rule 2: (right below rule 1).

Where the from line contains people
Delete it and Stop processing more rules (or Delete it from the server)
Click on Contains People and Add the domain: @earthlink.net

Messages to yourself and anyone else that you wish to allow that uses
earthlink will go to the Inbox. All others will be deleted.
--
Bruce Hagen
MS MVP - Outlook Express
~IB-CA~

"Norman Litell" wrote in message
ink.net...
Bob,

I haven't tried what you suggested, as it misses the basic point of my
problem.



Most of my spam contains a specific and limited set of email addresses in
either the TO: or CC: fields of the message. Nearly all of these are of
the
form .



I clearly cannot block all email from standard email domains such as
earthlink, yahoo, hotmail, etc., so your domain-level example does not
address my problem.



To repeat my issue and example once again:



1.. Please look at my post of 8/3/06 at 5:50pm to see an example of the
rule which has approx 50 email addresses in it.


2.. If I get an email with as the ONE and
ONLY
addressee, the rule works and the email is deleted.
Similarly, if I get an email with as the ONE
and ONLY addressee, the rule works and the email is deleted.


3.. If I get an email with BOTH AND
as addressees (again, both names are in my single
multi-address rule), the rule fails.


The only way I can see to make the rules system work for example 3 is to
have two separate rules, each of which has only one entry - either ronk124
or Yered. That leads to a situation where I would need to create hundreds
of rules instead of just one or two large rules which 'or' the bad
addresses.



Norman





"Opinicus" wrote in message
...
"Norman Litell" wrote

1. I get lots of spam.
2. From what I can see going through each of these spam messages, MOST
OF
this spam includes a limited set of addressees in either the TO: or CC:
part
of the email.
3. I have never received a relevant email which included any one of
this
set of spam-associated email addressees in either the TO: or CC:
address
list.
4. I therefore want to Delete any and all emails which include at
least
one
of these spam-associated addressees in either the TO: or CC: list of
addressees.

I just created a mail rule that says:

/begin rule
Where CC line contains
@spamcop.net
@... [more domains]

Delete it and stop processing more rules.
/end rule

It seems to work.

--
Bob
http://www.kanyak.com

"Norman Litell" wrote in message
k.net...
Following up on my earlier post on this subject, it appears that the Rules
processing operation may get confused ..............................

Heavy clipping for clarity :-)


Hello Norman

I have not read you original thread, so excuse me if I am asking what has
been asked already.
The main gist of your problem seems to be for setting message rules to block
email spam.
Just two questions -
1. What type/form is this spam - text or .gif(coloured type and
background - bit like a picture)
2. Have you contacted your ISP - can they block these spams and save to you
mail box.
Rgds
Antioch

Antioch,
1. The spam has come in both text and gif forms.
2. I am already using EarthLink's spam blocking option at the ISP email
level -- what I am trying to do here is handle the spam that get through
that filter.

Norman

"antioch" wrote in message
...

"Norman Litell" wrote in message
k.net...
Following up on my earlier post on this subject, it appears that the
Rules
processing operation may get confused ..............................

Heavy clipping for clarity :-)


Hello Norman

I have not read you original thread, so excuse me if I am asking what has
been asked already.
The main gist of your problem seems to be for setting message rules to
block
email spam.
Just two questions -
1. What type/form is this spam - text or .gif(coloured type and
background - bit like a picture)
2. Have you contacted your ISP - can they block these spams and save to
you
mail box.
Rgds
Antioch

"Norman Litell" wrote in message
nk.net...
Antioch,
1. The spam has come in both text and gif forms.
2. I am already using EarthLink's spam blocking option at the ISP email
level -- what I am trying to do here is handle the spam that get through
that filter.

Norman

Heavy clipping again for clarity :-)

Thanks for the reply - I didnt know if I should post here or the other
place. Sorry to distract you from your quest. I can add no more so shall
just watch.
Might be a good idea to let others know this thread is closed - it would
make it easier for you - and others to follow - in partic me - I am hoping
to see a conclusion.
My sympathy over the inability of your ISP to block the spam.
Mine is able to block 90% in my 'honeypot' email address.
Rgds
Antioch