G-Lock SpamCombat: Frequently Asked Questions

[marisp]

I've just installed SpamCombat onto my computer and I am using Outlook Express as my email program. Is there a way I can use SpamCombat to filter out spam before Outlook Express gets the emails?

You should simply run the SpamCombat BEFORE you run the Outlook Express. Also, you should disable (if it is enabled) in the Outlook Express the option to automatically receive email every xx min. So, you will be able to remove all spam from your mail server using the SpamCombat and then run the Outlook Express to pull down only good emails.

At first SpamCombat requires training in categorizing emails as either spam or good. You should view all the emails and check up whether they were properly categorized. If they were not, you should re-categorize them by using Mark as Clean and Mark as Spam buttons. The program learns from its mistakes and next time the emails will be flagged properly. The more you train SpamCombat, the more accuracy of the program increases. After you ensure that all the emails are marked properly, you should manually click Delete Marked Messages From Server option. After spam emails are removed from the server, you can safely run your regular email client to receive only good emails.

After a few weeks of training you can set the auto-mode in SpamCombat, meaning that it will automatically check your POP3 accounts, filter emails, and delete spam messages.


The Bayesian filter doesn't seem to be learning. I mark a message as "clean" and then find, on the next pass, the message again is marked as questionable. This sequence has happened repeatedly. Any ideas what's going on?

The Bayesian filter learns from the messages that contain more words than it is specified in the Bayesian filter settings (Word count). By default the value is 15. So, if the SpamCombat extracts 15 or more words from the message, the Bayesian filter learns. If the message has less than 15 words, the filter does not learn from such emails even if you categorize them by yourself. 15 is the optimum value. It is not recommended that you set less quantity of words because in this case the number of false positives will increase, i.e. more good emails will be marked as spam. At least, you can set 10 words but not less.

If you receive a lot of spam emails that cannot be detected by the Bayesain filter, you can use the blacklists by IP addresses and by the message header and/or body.

Note:If you classify a message as spam or clean, it is automatically deleted from the message cache. The same thing happens when you blacklist/whitelist a message by selecting a field from the message header and using the appropriate menu - the message is also removed from the cache. But if you manually select some words or string from the message and manually add it to the blacklist/whitelist, in this case the message is NOT deleted from the cache. You should click Clear MessageID Cache option to remove the messages from the cache and then re-process them.


I am un able to uninstall SpamCombat. It keeps coming up "unable to open uninstall".

To uninstall SpamCombat:

Choose Uninstall from the SpamCombat program group.

OR:

1. Open the Control Panel (under the Start menu choose Settings -> Control Panel).
2. Double-click on Add/Remove Programs icon.
3. Search for G-Lock SpamCombat and double-click on it.

ATTENTION! If the above procedures do not help uninstall SpamCombat, try to do this: click Start -> Run, type 'regedit' and click OK. You will see the Registry Editor. Search for SpamCombat registry and delete it (HKEY_CURRENT_USER\Software\G-Lock Software\SpamCombat).

Then delete manually the directory to which the SpamCombat was installed. This will remove the SpamCombat from your PC completely.

To re-install SpamCombat:

Install the new version of SpamCombat to the same folder over the old version.


If you deinstall the old version of SpamCombat and then install the new version, your filters, blacklists, whitelists, and accounts settings will be overwritten by the default settings. To be able to restore your filters and accounts, save the Profiles folder from the SpamCombat directory to a safe place before deinstalling the old version of SpamCombat and then back it up to the program's directory.


Most of the emails I received have 4 and more Received: fields in their headers. I am not sure which one contains the sender's IP address.

Each SMTP server adds a Received: field to the top of each incoming message, giving details of how it received the message, most importantly the sender's IP address:

Received: from alpha.bieberdorf.edu (alpha.bieberdorf.edu [124.211.3.11]) by mail.bieberdorf.edu (8.8.5) id 004A21; Tue, Mar 18 1997 14:36:17 -0800 (PST)

In the example above the Received: field lets us know about the email transaction between alpha.bieberdorf.edu and mail.bieberdorf.edu. The sending machine called itself alpha.bieberdorf.edu, and its IP address is 124.211.3.11.

This scenario is a little bit oversimplified. We assumed that the mail servers of the two organizations involved had free access to one another. This was almost always true in the early days of the Internet, and it's still sometimes the case today, but as security has become a greater concern, and as organizations and networks have gotten bigger, sometimes requiring many separate mail servers, it becomes more and more unusual.

Here are some possible headers from a message that had a very different "life cycle":

Received: from unwilling.intermediary.com (unwilling.intermediary.com [98.134.11.32]) by mail.bieberdorf.edu (8.8.5) id 004B32 for <rth@bieberdorf.edu>; Wed, Jul 30 1997 16:39:50 -0800 (PST)
Received: from turmeric.com ([104.128.23.115]) by unwilling.intermediary.com (8.6.5/8.5) with SMTP id LAA12741; Wed, Jul 30 1997 19:36:28 -0500 (EST)
From: Anonymous Spammer <junkmail@turmeric.com>
To: (recipient list suppressed)
Message-Id: <w45qxz23-34ls5@unwilling.intermediary.com>
X-Mailer: Massive Annoyance
Subject: WANT TO MAKE ALOT OF MONEY???

The history of the message can be reconstructed by reading the Received: headers from bottom to top. This message originates from turmeric.com which IP address is 104.128.23.115. It passed from there to unwilling.intermediary.com, and from there to its final destination at mail.bieberdorf.edu. But how did unwilling.intermediary.com get there, since it has nothing to do with either the sender or the recipient?

Understanding the answer requires some knowledge of SMTP. In essence, turmeric.com simply connected to the SMTP port at unwilling.intermediary.com and told it "Send this message to mailto:rth@bieberdorf.edu". It did this, probably, in the most direct manner imaginable, by saying RCPT TO: mailto:rth@bieberdorf.edu. At that point, unwilling.intermediary.com took over processing the message; since it had been told to send it to a user at some other domain (bieberdorf.edu), it went out and found the mail server for that domain and handed off its mail in the usual manner. This process is known as mail relaying.

[markk]

the above is helpful , it indicates that you wouldonly want to black list the first sender IP and leave all other relay point NON_blacklisted , because legitimate mail could come thru them in future , not just the individual bad mail in original issue
Received: from turmeric.com ([104.128.23.115])

the way to confirm the sources , originasl sender, is to just check date / time info

2. I would have given detailed err message but did not record it at the time , so I could not . I see how I should in future take the time to do so.

[riukas]

I am unable to upgrade to the newer version of SC by simultaneously leaving the collected 'knowledge' of the Bayesian filter. I've backed up Profiles folder, installed a new version of SC on top of the old one, and overwritten default Profiles with my back-up version. But it doesn't work. I see that filter is starting it's learning from the beginning. [WinXP, installation as administrator, using as a user]

Is there a way other than re-training the Bayesian filter each time an upgrade is made?

[marisp]

If you still have a backup of the Profiles folder, try to copy the words.dat and words.dat_ files from this directory: ...\Profiles\Default\Filters to the respective place in the SpamCombat installation. These files contain all the words the Bayesian filter saved to its database when training and the statistics of the Bayesian filter. Maybe these files were lost somehow when you were transferring the Profiles folder.

[Siman]

Marisp said:
If you deinstall the old version of SpamCombat and then install the new version, your filters, blacklists, whitelists, and accounts settings will be overwritten by the default settings. To be able to restore your filters and accounts, save the Profiles folder from the SpamCombat directory to a safe place before deinstalling the old version of SpamCombat and then back it up to the program's directory.
------------------------

My laptop screen went black yesterday and I was able to attach an old CRT monitor to it to still use it, so I backed up all my important files to a USB drive to move everything over to another laptop while I am getting the first one repaired. I copied all the files from C:\Program Files\G-Lock Software (there is no 'Spamcombat' subdirectory as Marisp says) thinking that I would be able to restore my whitelist, blacklist, and filters easily that way, more or less as Marisp describes. I also wanted to restore my email setups since I use about a dozen of them. Well the functionality doesn't actually work as advertised unfortunately. The files way down deep in C:\Program Files\G-Lock Software\G-Lock SpamCombat\install\Profiles\Default\Filters on the dead-screen laptop all had old dates and were identical to the fresh install I had just done on the backup laptop.

So I searched the Registry for 'G-Lock' and found the right area but apparently the data I needed are not kept there either. What I finally wound up doing was loading SpamCombat on the dead-screen laptop and creating a backup at File => Backup Profile, copying the backed-up profile to the USB drive and then to the backup laptop, loading SpamCombat and running File => Restore Profile, and THAT finally worked.

I wasted a whole lot of time doing the obvious and logical things that didn't work, and Marisp's 'help' was just an extra useless waste of time. It's very possible that the procedure she described once worked with an obsolete version of G-Lock SpamCombat but I can tell you it doesn't work with Version 2.70. I still have no idea where the actual data are kept but I suppose it doesn't matter because the backup and restore process eventually worked for me. I'm posting this so that some poor soul in the same situation as me in the future might find the real solution and not waste so much time as I did being misled by Marisp. I'm also posting this so that the authors of SpamCombat might see it and decide to do a better job of keeping the help information on this forum up to date and useful. I love the program in general, but this help forum for it sucks big time as it is now.

[marisp]

Hello Siman,

I'm very sorry that the information on our user forum misled you. Yes, the procedure of copying and pasting the Profiles folder worked for the old versions of the SpamCombat and I might have suggested this way of transferring the workplace in one of the old versions. There is the Backup/Restore feature in the latest versions that allows quickly and easily move the program workplace.