Spam Filtering at UW
Note: All UW Exchange users should receive a daily email message from PureMessage listing quarantined spam messages. For information about options for this service, including how to opt-out and continue to have spam tagged and delivered to your Inbox as described below, see the Spam Blocking at UW web page (www.uwyo.edu/infotech/services/email/spam/blocking.asp).
Manage your spam account: UW Spam Account Login Page
PureMessage applies a series of tests to each incoming message, determining the likelihood that a particular message is Spam. Mail identified as possible Spam is “tagged” with the word "Spam" followed by an "H", "M" or "L" as follows:
"H" indicates a high probability that the message is Spam, "M" medium and "L" low. This tag is added to the message's subject line. Additional technical information (www.uwyo.edu/infotech/services/email/spam/headerinfo.htm)
Users can do one of two things: (1) use the filtering rules offered by the email application (Outlook, for example) to direct tagged messages to a separate folder or (2) sort email by subject to gather the tagged messages together for quick review and deletion. See How to Create a Rule in Microsoft Outlook to Manage Spam E-mail (www.uwyo.edu/ASKIT/displaydoc.asp?askitdocid=155&parentid=1) for assistance with the creation of a Spam filtering rule.
Users will notice some email messages that are tagged as Spam are actually emails they want to
receive (e.g. magazine and newspaper updates, travel updates and other subscribed services).
Filtering can be configured to separate these desired emails from the unwanted emails by setting
up personal Exception List or "white list" rules in a user's email program. See How to Create an Exception Rule in Microsoft
Users that already have Junk E-mail and/or Adult Content rules activated in
their Outlook account may receive duplicates
of Spam messages. If this occurs, Junk E-mail and Adult Content rules can simply be turned off.
It is recommended that users review tagged messages before deletion – PureMessage, or any currently available Spam filtering software, will not always interpret and tag all messages correctly. Some non-Spam email will be misidentified as Spam. And, to avoid over quota storage problems, users should remember to periodically delete unwanted Spam messages after review.
Users may opt-out of Spam filter-tagging by emailing email@example.com. Initially, all
messages that are deemed by PureMessage to be Spam will be tagged and delivered. Future
alternatives include quarantining suspected Spam on a central server, as well as centralized
individual user preferences.
For issues relating to Spam filtering please contact your IT User Consultant (www.uwyo.edu/infotech/services/helpdesk/uc/) or the IT Help Desk at 766-HELP (4357). Students should direct questions to firstname.lastname@example.org.
For over a year, email messages identified by the UW central email gateway as containing viruses have had the actual virus removed (stripped) from the message and replaced with a text file. Virus removal has not been obvious unless a user opens and reads the text attachment.
Beginning in late September 2003 the text “[VIRUS REMOVED]” was appended to the subject line of all email messages stripped of an attached virus in order to make the virus cleaning more apparent.
On June 2, 2004, the attached text file name was changed from ATTXXXXXX.txt to Virus_removed.txt. The file contains information similar to the following:
The original attachment has been removed from this message.
The attachment was removed because
Possible Virus Detected: W32/Netsky-C
If you need further information, contact the
HELP desk at (307) 766-HELP
Information Technology, University of Wyoming
Email messages containing attachments that can't be scanned
As of May 28, 2004, the email gateway started tagging the Subject line of mail containing attachments which cannot be scanned
by the antivirus software (for instance, encrypted Zip files) as follows:
[WARNING: ATTACHMENT NOT SCANNED FOR VIRUSES] followed by the original subject.
Starting on June 2, 2004, a text file named UW_attachment_warning.txt will also be attached to these email messages. This text file contains information similar to the following:
WARNING: The virus scanner was unable to scan the next attachment. This attachment could possibly contain viruses or other malicious programs. The attachment could not be scanned for the following reasons:
The file was encrypted*
You are advised to NOT open this attachment unless you are completely sure of its contents.
The identifier for this message is 'i0RNZrud018902'.**
If you need further information, contact the HELP desk at (307) 766-HELP
Information Technology, University of Wyoming
*The reason given in this file could also be "The file was corrupted" or "The file was one part of a multi-volume archive."
**The identifier is a unique alpha-numeric combination used to identify the specific email message.
If an email contains both an attachment that cannot be scanned and one which
contains a virus, the viral attachment will be removed, but the attachment that can't be scanned will not be removed, and the
Subject line will contain:
[WARNING: ATTACHMENT NOT SCANNED FOR VIRUSES] followed by the original subject. Both the Virus_removed.txt file and the UW_attachment_warning.txt file will be attached to the email, along with the unscanned file attachment.