kill filter for collections beginning with a quote mark

[Robert2413]

In one newsgroup that I use, someone is posting encrypted file names so that the subject line of collections appears as something like
"ehCwItqAgKHDJSFIBYVhBczQr3m3Da" [*/41]
Individual file name are of the form
[XX/41] - "ehCwItqAgKHDJSFIBYVhBczQr3m3Da.volXXX+XXX.par2" -

I tried to make a kill filter with the following properties:
Subject, Begins with
\"
with Boolean wildmat checked. But this does not seem to work. What am I missing?

[alex]

As for this particular subject you can try the filter

subject ends with " -
(quote mark, space, dash)

and

subject begins with [

but I'm not sure it will filter out valid headers, it is unusual to use dash in the end, so maybe not.

[Robert2413]

I had no luck with these suggestions. Perhaps you could work on improving the kill filters to handle posts with obfuscated headers and posters' names.

I noticed one peculiar thing: hitting F4 for the properties of these obfuscated posts shows no newsgroups to which they are posted, so you might use this as one of the criteria. Another thing could be lack of spaces in the obfuscated names and random placement of capital letters (e.g. large number of capital letters not preceded by spaces).

Here's a example of the properties of one of the obfuscated posts:

Selected posts: 2
Total parts: 0
Available parts: 0 (0%)
Parts with bodies: 0 (0%)
Size: 505 MB

Subject: [XX/29] - "aaYAe7EznO0GlrUD8Od4KLs9LL9NOA.volXX+XX.par2" -
Author: gqlmqwdsml@znuxragwlr.mhw
Date: Sat, Jan 18 13:13
Offset: 13411721 (Valid)
Set
Subject: [XX/29] - "aaYAe7EznO0GlrUD8Od4KLs9LL9NOA.partXX.rar" -
Author: gqlmqwdsml@znuxragwlr.mhw
Date: Sat, Jan 18 13:13
Offset: 26305414 (Valid)
Set

[alex]

Can you email me screenshots of the filters and of the combined filter?

It looks like it worked for me.

[Robert2413]

Can you email me screenshots of the filters and of the combined filter?

It looks like it worked for me.

I worked around it by defining a whitelist of authors in the filter editor. I was able to include this in my composite filter, which looks something like this:

filter1|filter2|filter3 etc, where "Negation " is checked in the composite filter and filter1 and Filter2 look like

subject1|subject2| etc.

Filter3 is a list of whitelisted authors (actually just one author right now) where "Negation" is checked in the Filter3 definition. Thus, double-negation (once in Filter3 and once in the composite filter) yields the desired whitelist behavior.

As for my original problem, I think it may be due to the fact that I was using a composite filter with "Negation" checked. I'm not sure if there's a bug or if I just wasn't able to come up with exactly the correct filter syntax to solve the problem.