Skip to Main Content

University of Wyoming Division of Information Technology

Spam Filtering at UW

Note: All UW Exchange users should receive a daily email message from PureMessage listing quarantined spam messages. For information about options for this service, including how to opt-out and continue to have spam tagged and delivered to your Inbox as described below, see the Spam Blocking at UW web page (

Manage your spam account: UW Spam Account Login Page

How to Report Undetected Spam and Legitimate Mail Detected as Spam

PureMessage applies a series of tests to each incoming message, determining the likelihood that a particular message is Spam. Mail identified as possible Spam is “tagged” with the word "Spam" followed by an "H", "M" or "L" as follows:


"H" indicates a high probability that the message is Spam, "M" medium and "L" low. This tag is added to the message's subject line. Additional technical information (

Users can do one of two things: (1) use the filtering rules offered by the email application (Outlook, for example) to direct tagged messages to a separate folder or (2) sort email by subject to gather the tagged messages together for quick review and deletion. See How to Create a Rule in Microsoft Outlook to Manage Spam E-mail ( for assistance with the creation of a Spam filtering rule.

Users will notice some email messages that are tagged as Spam are actually emails they want to receive (e.g. magazine and newspaper updates, travel updates and other subscribed services). Filtering can be configured to separate these desired emails from the unwanted emails by setting up personal Exception List or "white list" rules in a user's email program. See How to Create an Exception Rule in Microsoft Outlook ( Users that already have Junk E-mail and/or Adult Content rules activated in their Outlook account may receive duplicates of Spam messages. If this occurs, Junk E-mail and Adult Content rules can simply be turned off.

It is recommended that users review tagged messages before deletion – PureMessage, or any currently available Spam filtering software, will not always interpret and tag all messages correctly. Some non-Spam email will be misidentified as Spam. And, to avoid over quota storage problems, users should remember to periodically delete unwanted Spam messages after review.

Users may opt-out of Spam filter-tagging by emailing Initially, all messages that are deemed by PureMessage to be Spam will be tagged and delivered. Future alternatives include quarantining suspected Spam on a central server, as well as centralized individual user preferences.

For issues relating to Spam filtering please contact the IT Help Desk at 766-HELP (4357), option 1. Students should direct questions to of page

Email Virus Removal

For over a year, email messages identified by the UW central email gateway as containing viruses have had the actual virus removed (stripped) from the message and replaced with a text file. Virus removal has not been obvious unless a user opens and reads the text attachment.

Beginning in late September 2003 the text “[VIRUS REMOVED]” was appended to the subject line of all email messages  stripped of an attached virus in order to make the virus cleaning more apparent.

On June 2, 2004, the attached text file name was changed from ATTXXXXXX.txt to Virus_removed.txt. The file contains information similar to the following:

Attachment removed

The original attachment has been removed from this message.
The attachment was removed because

Possible Virus Detected: W32/Netsky-C

If you need further information, contact the
HELP desk at (307) 766-HELP
Information Technology, University of Wyoming

Email messages containing attachments that can't be scanned

As of May 28, 2004, the email gateway started tagging the Subject line of mail containing attachments which cannot be scanned by the antivirus software (for instance, encrypted Zip files) as follows:

[WARNING: ATTACHMENT NOT SCANNED FOR VIRUSES] followed by the original subject.

Starting on June 2, 2004, a text file named UW_attachment_warning.txt will also be attached to these email messages. This text file contains information similar to the following:

WARNING: The virus scanner was unable to scan the next attachment. This attachment could possibly contain viruses or other malicious programs. The attachment could not be scanned for the following reasons:

The file was encrypted*

You are advised to NOT open this attachment unless you are completely sure of its contents.

The identifier for this message is 'i0RNZrud018902'.**

If you need further information, contact the HELP desk at (307) 766-HELP
Information Technology, University of Wyoming


*The reason given in this file could also be "The file was corrupted" or "The file was one part of a multi-volume archive."
**The identifier is a unique alpha-numeric combination used to identify the specific email message.

If an email contains both an attachment that cannot be scanned and one which contains a virus, the viral attachment will be removed, but the attachment that can't be scanned will not be removed, and the Subject line will contain:

[WARNING: ATTACHMENT NOT SCANNED FOR VIRUSES] followed by the original subject. Both the Virus_removed.txt file and the UW_attachment_warning.txt file will be attached to the email, along with the unscanned file attachment.

Share This Page: