I'm sure every popular newsgroup sees them - two posts with the same subject line, roughly the same overall size, but one of them instead of "normal" contents (an MKV, MP4 or such) contains another RAR file and that RAR file is passworded.
There was this hint in one of the groups:
> Depending on which client you use all you have to do is compare the headers
>of the real teevee with the passworded fakes and then you can easily tell which
>is real. In newsleecher right click any of the posting, and pick leech more,
> special , header.
In Forte Agent, "author: teevee and not message-id: astraweb" does
nicely.
How I know how to filter author, but how do I filter message-id ?
Any other hints how to deal with these sneaky passworded posts?
thanks, Larry
Need help how to filter fake posts
Re: Need help how to filter fake posts
do you mean search service or headers?
new headers you can filter message id with combined author / message-id filter (use filter editor to create it), then add it to edit menu->properties->kill filters. it is easy to create a filter in the filter editor, read the help topic on the website, if something is not clear i can elaborate here further.
after headers have been downloaded normally UE doesn't keep message-ids in memory, unless you use at least 100 times more memory greedy newsgroup type which does (like forte agent), only if you use an inefficient storage mode you can apply a message-id filter to already downloaded headers to see them.
as search service there are no kill filters applied on import, but you can mark those as spam in search service and let me know to check it out, if some systematic pattern i can get rid of them there.
so those are available options, as to the future maybe a better solution would be to do some more sofisticated prescreening of rar sets, but you are right sometimes it is tricky, e.g. sometimes the spammer would omit the .rar file out of .rXX set which is only recovered through .par2 repair.
new headers you can filter message id with combined author / message-id filter (use filter editor to create it), then add it to edit menu->properties->kill filters. it is easy to create a filter in the filter editor, read the help topic on the website, if something is not clear i can elaborate here further.
after headers have been downloaded normally UE doesn't keep message-ids in memory, unless you use at least 100 times more memory greedy newsgroup type which does (like forte agent), only if you use an inefficient storage mode you can apply a message-id filter to already downloaded headers to see them.
as search service there are no kill filters applied on import, but you can mark those as spam in search service and let me know to check it out, if some systematic pattern i can get rid of them there.
so those are available options, as to the future maybe a better solution would be to do some more sofisticated prescreening of rar sets, but you are right sometimes it is tricky, e.g. sometimes the spammer would omit the .rar file out of .rXX set which is only recovered through .par2 repair.
Re: Need help how to filter fake posts
I'm referring to the headers as seen within the newsgroups in UE, not the search service (altho I'd suspect they have the same problem.
Let me try to explain the problem better... One person will make a "normal" post that consists of .rXX and par files. Once downloaded the content is a MKV, AVI, or other such file. Another person will make another post, with an identical Subject line, identical file names (the .rXX and par files), however, once downloaded the content is single RAR file, but that RAR file is password protected. I want to avoid wasting my time downloading these "trick" passworded posts
UE *very* nicely finds and avoids downloading password protected posts when it sees it in the posted .rXX file, but it gets fooled when the password protection is in the contents once combined. That's understandable.
However, some other people, also trying to avoid downloading these trick passworded posts, showed away to identify them in some other newsreaders. I've only ever used NewsPro and UE, so I don't know how interpret these other newsreader instruction, but it seems to involve "Message-ID" and I don't see that anywhere in UE's search/filter choices. So if you can interpret what that hint was doing in the other newsreader and tell me how to do that in UE, that would be great.
Note: I'm not sure the hint is fool proof, but it has been mentioned in a few times. If you can think of a better way, that'd be great.
Larry
Let me try to explain the problem better... One person will make a "normal" post that consists of .rXX and par files. Once downloaded the content is a MKV, AVI, or other such file. Another person will make another post, with an identical Subject line, identical file names (the .rXX and par files), however, once downloaded the content is single RAR file, but that RAR file is password protected. I want to avoid wasting my time downloading these "trick" passworded posts
UE *very* nicely finds and avoids downloading password protected posts when it sees it in the posted .rXX file, but it gets fooled when the password protection is in the contents once combined. That's understandable.
However, some other people, also trying to avoid downloading these trick passworded posts, showed away to identify them in some other newsreaders. I've only ever used NewsPro and UE, so I don't know how interpret these other newsreader instruction, but it seems to involve "Message-ID" and I don't see that anywhere in UE's search/filter choices. So if you can interpret what that hint was doing in the other newsreader and tell me how to do that in UE, that would be great.
Note: I'm not sure the hint is fool proof, but it has been mentioned in a few times. If you can think of a better way, that'd be great.
Larry
Re: Need help how to filter fake posts
Do you want to see message-id per post or to filter them out?
If you want to see message-id per post doubleclick the set so it will load/expand. For single messages newsgroup view has the "message-id" column, you can see the message-id there (usually there is .par2 or .nfo which are single, partials you can see message-id of parts in show parts mode after marking them for download it is the only way to load them currently, but usually there is a single message it gives you a clear idea about the rest of the set).
To filter them out:
Invoke edit menu->filter editor.
There is a filter there "message-id" in the "predicate" group control.
You can combine it with other conditions like the author using the "composite" filter, e.g. you can create such a filter with author teevee and message-id containing "astraweb". Then you add the filter as kill filter edit menu->properties->kill filters.
If you need something different try to explain what is lacking. If it is something above I could elaborate it further.
If you want to see message-id per post doubleclick the set so it will load/expand. For single messages newsgroup view has the "message-id" column, you can see the message-id there (usually there is .par2 or .nfo which are single, partials you can see message-id of parts in show parts mode after marking them for download it is the only way to load them currently, but usually there is a single message it gives you a clear idea about the rest of the set).
To filter them out:
Invoke edit menu->filter editor.
There is a filter there "message-id" in the "predicate" group control.
You can combine it with other conditions like the author using the "composite" filter, e.g. you can create such a filter with author teevee and message-id containing "astraweb". Then you add the filter as kill filter edit menu->properties->kill filters.
If you need something different try to explain what is lacking. If it is something above I could elaborate it further.
Re: Need help how to filter fake posts
Thanks Alex!
The "trick" I didn't see was looking at the single nfo/par file, so that shows message-id then. Good.
I also didn't realize the filter editor had it when the ad-hoc (right term?) bar didn't have it (that bar at the top with the various New/Old, Read/Unread checkboxes). Any chance of getting the message-id in this bar ?
Larry
The "trick" I didn't see was looking at the single nfo/par file, so that shows message-id then. Good.
I also didn't realize the filter editor had it when the ad-hoc (right term?) bar didn't have it (that bar at the top with the various New/Old, Read/Unread checkboxes). Any chance of getting the message-id in this bar ?
Larry
Re: Need help how to filter fake posts
you may add kill filter like that to edit menu->properties->kill filter to exclude headers matching it from the incoming headers.
just be sure the kill filter is narrow enough (maybe more precise conditions, like full poster name), so it won't filter out valid headers.
just be sure the kill filter is narrow enough (maybe more precise conditions, like full poster name), so it won't filter out valid headers.
- filter.png (13 KiB) Viewed 16839 times
Re: Need help how to filter fake posts
I didn't know I could do expressions with filters (teevee&astraweb) !!
thanks again! Larry
thanks again! Larry