The following NewsProxy filter expressions work fine with
googlegroups, but it doesn't appear to be working with the latest
source of SPAM from the greatnowhere.com server. Any suggestions as to
what I'm doing wrong and how I can remedy it? TIA

* flag: Subject:Re:*
* flag:SUSPECTED_SPAM Message-ID:*googlegroups.com*
* flag:SUSPECTED_SPAM Message-ID:*greatnowhere.com*

BTW - The following is the header from one of the numerous SPAM
messages that have started innundating various newsgroups today:

Subject: un Achat de achat lipitor canada avec livraison
on achat lipitor en France a vendre
Achat acheter lipitor canada france
dans commande achat lipitor us usa corpus
dans commande acheter lipitor...

On Mon, 12 May 2008 13:27:28 +1200, Nicetameetya
anonymous.invalid.con> wrote:

Can't say just yet as I only added this line to my nfilter.dat:

* drop Message-ID: *greatnowhere.com*

Like you, I run Agent 4.2. My NewsProxy is V1.2.4. Don't know if
this will help, but I've noted when I make edits to nfilrer.dat, I
need to exit Agent, exit NewsProxy, restart NewsProxy, then restart
Agent for the new edits to take effect.

[Default] On Sun, 11 May 2008 20:52:12 -0500, Ron May
hotmail.com> told us in complete confidence:

Nicetameetya anonymous.invalid.con> wrote:

[...]

[...]

Wouldn't it be better to just * drop From: *kmwkawrt@yahoo*

There seems to be only one spammer who's dumb enough to use one name
(at least this is all I've noticed so far). I can understand KF'ing
Googlegroups, but to blanket kill a small free newsserver like
greatnowhere, seems a bit of an over reaction.

On Mon, 12 May 2008 05:16:20 +0000 (UTC), Mike Dee
wrote:

Point taken. I'll check my dropped articles log, and if greatnowhere
fixes the problem, say, within a week or so, I'll "#" the filter.

[Default] On Mon, 12 May 2008 05:16:20 +0000 (UTC), Mike Dee
told us in complete confidence:

Opps - I meant to write: Fair enough. But the spammer has used 4
sockpuppets so far, so killfiling them using a global Agent filter
makes more sense to me. Besides, I did not "kill" greatnowhere.com
with my NewProxy filter, it simple marks posts from that server as
"Suspected Spam."

Nicetameetya anonymous.invalid.con> wrote:

Quite true and point taken.

I've since seen a few more (same person different name) from
greatnowhere. I'm going to post off a few headers to greatnowhere.

I'm subbed to greatnowhere also, so I'll take care to send this via
another server, otherwise you may not read it ;-)

[Default] On Mon, 12 May 2008 06:29:40 +0000 (UTC), Mike Dee
told us in complete confidence:

Darn. I was hoping to see if my NP filter expression worked ;-)

[Default] On Mon, 12 May 2008 06:29:40 +0000 (UTC), Mike Dee
told us in complete confidence: