Page tree
Skip to end of metadata
Go to start of metadata

Antispam

Spam filter

The spam filter provides you with an extensive range of settings options for effectively blocking email with undesirable content or from undesirable senders (e.g. mass email senders). The program checks for numerous email characteristics that are typical of spam. These characteristics are used to calculate a value reflecting the likelihood of it being spam. You can use the USE SPAM FILTER button to enable or disable the spam filter.

In order to switch the different filter types of the spam filter on or off, simply set or remove the checkmark in front of the respective entry. To make changes to the various filters, just click on the relevant entry. A dialog then appears for changing the parameters.

The following settings options are available:

  • Spam OutbreakShield: The OutbreakShield detects and neutralises threats from malicious programs in mass emails before the relevant up-to-date virus signatures become available. OutbreakShield uses the Internet to monitor increased volumes of suspicious email, enabling it to close the window between the mass mail outbreak and its containment with specially adapted virus signatures, practically in real time. If you use a computer downstream from a proxy server, click on the Internet settings button to carry out the relevant changes. You should change these settings only if your OutbreakShield doesn't function.
  • Use whitelist: Certain sender addresses or domains can be explicitly excluded from suspected spam via the whitelist. Simply enter the email address (e.g. newsletter@infosite.com) or domain (e.g. infosite.com) that you want to exclude from suspected spam in the Addresses/Domains field and the G DATA software will treat messages from that sender or sender domain as not spam.

You can use the IMPORT button to insert predefined lists of email addresses or domains into the whitelist. Each address or domain must be listed on a separate line. A plain txt file format is used for storing this list; you can create this list using Windows Notepad for example. You can also use the EXPORT button to export whitelists as text files.

  • Use blacklist: Certain sender addresses or domains can be explicitly flagged as suspected spam via the blacklist. Simply enter the email address (e.g. newsletter@megaspam.de.vu) or domain (e.g. megaspam.de.vu) that you want to check for spam in the Addresses/Domains field and the G DATA software will generally treat emails from that sender or sender domain as emails with a very high spam probability. You can use the IMPORT button to insert predefined lists of email addresses or domains into the blacklist. Each address or domain must be listed on a separate line. A plain txt file format is used for storing this list; you can create this list using Windows Notepad for example. With the EXPORT button you can export blacklists as text files.
  • Use real-time blacklists (default setting): You can find lists on the Internet that contain the IP addresses of servers known to send spam. The G DATA software uses queries to the real-time blacklists to determine whether the sending server is listed. If it is, this increases the probability that it is spam. In general, we recommend that you use the default settings here, although you can also add your own Internet addresses to blacklists 1, 2 and 3.
  • Use keywords (email text): By defining a list of keywords you can also identify suspected spam through the words used in the email text. If at least one of these terms is included in the email text, the spam probability increases. You can change this list how you want by using the ADD, CHANGE and DELETE buttons. You can add predefined lists of keywords to your list using the IMPORT button. Entries in such a list must be listed one below the other in separate lines. A plain txt file format is used for storing this list; you can create this list using Windows Notepad for example. You can also use the EXPORT button to export a list of keywords as a text file. By checking Search for whole words only, you can specify that the G DATA software will only search for complete words in the subject line of an email.
  • Use keywords (subject): You can also identify suspected spam messages through the text in the subject line by defining a list of keywords. An occurrence of at least one of the listed terms in the subject line increases the spam probability.
  • Use content filter: The content filter is a self-learning filter that calculates spam probability on the basis of the words used in the email text. This filter not only works on the basis of predefined word lists but also learns from each new email received. You can view the word lists that are used by the content filter for identifying email as spam via the Query table contents button. You can delete all words in this table by using the Reset tables button, after which the content filter will restart its learning process again from the beginning.

Reaction

Here you can define how the spam filter should process email messages that may contain spam. You can use the spam probability value calculated for the affected email by the G DATA software to define three different levels of filtering.

  • Suspected spam: Here you can define how those email messages in which the G DATA software finds individual spam elements are handled. Such messages may not generally be spam, but can also be newsletters or part of a mass mailing that is of interest to the recipient in rare cases. In such cases, it is recommended that you inform the recipient that the email is suspected spam.
  • High spam probability: This covers emails that contain many spam characteristics and are rarely of interest to the recipient.
  • Very high spam probability: These are emails that meet all the criteria of spam. Such emails are rarely wanted, and rejecting email with these characteristics is recommended in most cases.

Each of these three graduated reactions can be customized. Simply click on the CHANGE button and define the response that the G DATA software should use. The Reject mail option allows you to specify that the email messages do not reach your mailbox. And with Insert spam warning in mail subject and mail text you can call attention to email messages that have been identified as spam to enable these to be filtered more easily. If you use Microsoft Outlook (caution: not to be confused with Outlook Express or Windows Mail), you also have the option of moving emails containing suspected spam to a fully customizable folder in your mailbox (Move mail to folder). You can create this folder directly via the G DATA software by defining the corresponding folder under Folder name.

Note: Even if you do not use Outlook, email messages that have been identified as spam can be moved to a different folder. Just add an alert in the subject line of the message (for instance "[Spam]") and define a rule in your email program to move emails with this text in the subject line to a different folder.

Advanced settings

This area enables you to make detailed changes to the G DATA software spam detection, adapting the system to suit your email traffic. However, it is generally recommended that default settings are used here. Making changes in the advanced settings should only be done if you have the relevant expertise and know exactly what you are doing.

More filters

The following filters are created by default; however, if necessary you can also switch them off by unchecking the box.

  • Disable HTML scripts
  • Filter malicious attachments

You can use the NEW button to set up new filter rules, or edit existing filters with the EDIT button. The filters created are shown in the list and can be enabled or disabled as required by checking the checkbox to the left. If you see a check in the checkbox, it means that that filter is active. If there is no checkmark in the box, the filter is inactive. To permanently delete a filter, click the relevant filter once to highlight it and then click the DELETE button.

The filter options available here are additional filters that support the actual G DATA software spam filter and make it easier for you to configure your own personal settings. The spam filter provides you with an extensive range of setting options for effectively blocking emails with undesirable content or from undesirable senders (e.g. mass email senders). The program checks for numerous email characteristics that are typical of spam. These characteristics are used to calculate a value reflecting the likelihood of it being spam. To this end multiple tabs are available providing you with all the relevant settings options sorted by subject.

When you create a new filter, a selection window appears in which you can specify the basic filter type. All of the other details about the filter can be created using a wizard, which will guide you through that filter type. This is a convenient way to create filters for every imaginable type of threat.

  • Disable HTML scripts: This filter disables scripts in the HTML part of an email. Scripts that might look OK on a web page tend to be rather irritating when they are integrated into an HTML email. In some cases, HTML scripts are also used to actively infect computers. In this event, scripts have the option of running not only when the infected attachment is opened but even in email preview mode.
  • Filter malicious attachments: A large number of filter options for filtering email attachments are provided. Most email viruses are spread through attachments, which usually have more or less well-hidden executable files. This can be a standard .exe file containing malware, or a VB script hidden in a graphic, film or music file that is assumed to be safe. In general, users should exercise extreme caution when opening email attachments. If in doubt, the sender of the email should be asked before opening files that have not been expressly requested.

Filter attachments

Under File extensions you can list the file extensions to which you would like to apply the respective filter. You can, for instance, combine all executable files (such as EXE and COM files) in a single filter, while also filtering out other formats (for instance MPEG, AVI, MP3, JPEG, JPG, GIF etc.) that are a burden for your mail server due to their size. You can, of course, also filter out archive files of your choice, such as ZIP, RAR or CAB files. Please use a semicolon to separate all file extensions of a filter group.

The function Also filter attachments in embedded mails ensures that the filtering performed under File extensions for the selected attachment types also applies to email messages that are themselves being forwarded as email attachments. This option should generally be enabled.

Choosing Only rename attachments has the effect that attachments that are to be filtered are not deleted automatically rather just renamed. This is not only recommended for executable files (such as EXE and COM) but also for Microsoft Office files that may contain executable scripts and macros. Renaming an attachment makes it impossible to open it simply by clicking it. Instead, the user must first save (and possibly rename) the attachment before it can be used. If the checkmark for the Only rename attachments function has not been set, the respective attachments are deleted directly.

Under Suffix you can enter a character string that should be appended to the file extension (*.exe_danger, for instance), which prevents this type of file from being executed by just clicking on it. Under Insert message in mail text you can inform the recipient of the filtered email that an attachment was deleted or renamed based on a filter rule.

Content filter

You can use the content filter to easily block email messages which contain certain subjects or text.

Simply enter the keywords and expressions to which the G DATA software should react under Search criterion. It is possible to use the AND and OR logical operators to link text components with one another.

Under Search scope you can now enter those elements of an email message that the software should search for the defined terms. The header is the part of an email message that, among other things, contains the email address of the sender and the recipient, the subject line, information on the programs and protocols used, and the date sent. If you have, for instance, activated Subject as the search area, only the content of the subject line will be checked, and no other information contained in the header. If you select Mail text as the search scope, you have the additional option of limiting the search scope to pure text emails, or extending the search to text in HTML emails (HTML text).

By checking Embedded mails you can define whether the content filter search should also cover email messages included as attachments in received messages.
Under Reaction you can determine what is to be done with emails identified as spam by the G DATA software. Using Reject mail means the email in question will not even be accepted by your email program.

If you check the box for Insert warning in mail subject and text you can prefix the actual text in the subject line with a warning (prefix in subject line), e.g. Spam or Warning. You can also enter text to be placed above the actual email text in the event of suspected spam (Message in text).

If you use Microsoft Outlook (caution: not to be confused with Outlook Express or Outlook Mail), you also have the option of moving emails containing suspected spam to a fully customizable folder in your mailbox (Move mail to folder). You can create this folder directly via the G DATA software by defining the corresponding folder under Folder name.

Sender filter

You can use the sender filter to easily block email coming from certain senders. To do this, simply enter the email addresses or domain names to which the G DATA software should react under Sender/domains. Use a semicolon to separate multiple entries.

Under Reaction you can determine what is to be done with emails identified as spam by the G DATA software.

Using Reject mail means the email in question will not even be accepted by your email program.

If you check the box for Insert warning in mail subject and text you can prefix the actual text in the subject line with a warning (prefix in subject line), e.g. Spam or Warning. You can also enter text to be placed above the actual email text in the event of suspected spam (Message in text).

If you use Microsoft Outlook (caution: not to be confused with Outlook Express or Windows Mail), you also have the option of moving emails containing suspected spam to a fully customizable folder in your mailbox (Move mail to folder). You can create this folder directly via the G DATA software by defining the corresponding folder under Folder name.

Language filter

The language filter lets you automatically define email in specific languages as spam. For example, if in general you do not have email contact with a German-speaking person, then you can set German as a spam language which should be filtered out. Simply select the languages in which you do not receive regular email contact and the G DATA software will raise the spam probability for such emails.
Under Reaction you can determine what is to be done with emails identified as spam by the G DATA software.

Using Reject mail means the email in question will not even be accepted by your email program.

If you check the box for Insert warning in mail subject and text you can prefix the actual text in the subject line with a warning (prefix in subject line), e.g. Spam or Warning. You can also enter text to be placed above the actual email text in the event of suspected spam (Message in text).

If you use Microsoft Outlook (caution: not to be confused with Outlook Express or Windows Mail), you also have the option of moving emails containing suspected spam to a fully customizable folder in your mailbox (Move mail to folder). You can create this folder directly via the G DATA software by defining the corresponding folder under Folder name.

Miscellaneous

You can configure more settings in this area.

  • Scan unread emails in the inbox at program start: Only for Microsoft Outlook: This option is used for checking email for suspected spam. The G DATA software will then check all unread emails in your Inbox folder and subfolders as soon as you open Outlook.
  • Other email programs (using POP3): For technical reasons, emails received via POP3 cannot be deleted directly. If a filter is set to reject emails, this email is then assigned default replacement text. The replacement text for rejected email is: The message has been rejected. However, you can also customise the text for these notification functions. In the text you define for the Subject and Mail text, the following wildcards (defined using a percentage symbol followed by a lower case letter) are available:


%s Sender

%u Subject


In your email client, you can define a rule that automatically deletes emails containing the replacement text defined here.

  • No labels