False Positive iOS Junk Filter

On my iPad (iOS 7) I mistakenly marked a message from an important sender as junk. I want to either reverse this setting for that sender, or if I cannot do that I want to completely reset my junk settings on iOS and start over again. I know I can reset the settings in Mail on Mavericks, but there seems to be no way to do that for iOS.

There is no junk mail filter in iOS Mail.
Just move the message in question out of the Junk folder and back into the In box.

Similar Messages

Outlook Junk Email False Positives

Starting yesterday I have had several clients call me about false positives (good emails going to Outlook Junk Email folder). In some cases they are even internal emails being mis-routed to Junk email. In all of the cases they are running either
Exchange 2007 or Exchange 2010 onsite and the Outlook clients are 2007 or 2010. As I said everything was fine until yesterday but with the holiday on Wed some may have not noticed until yesterday or today. Is there some update on Tues or Wed of
this week (12/31/13) on the server or Outlook workstations causing this? I have not changed a thing and I need to get this resolved.
Thanks for any help!
-Richard K

ok, that makes sense but there are 2 things that are going on that don't fit that bill.
1. This is happening on multiple domains so I doubt I have an rbl list problem with multiple domains at the same time. I have confirmed this with checking a few of them for rbl listings and they are clean.
2. This is happening even with internal email (email to email in same domain going through the same Exchange server). That is the one that really gets me as internal emails should never be filtered to Junk.
The last definition update I see is from 12/11/13. I am not sure where to look to see where it gets it's daily updates from.

False positive junk email

how do i report emails that are apparently filtered by apple as junk and not being sent to my account?

Hello, casa4casa.
Below, I have attached a couple articles that will allow you to mark messages that have been identified as spam "Not Junk". In the second article attached, see the section labeled Troubleshooting false-positives as it has a link that you requested to notify iCloud Support.
iCloud: Manage junk mail
http://support.apple.com/kb/PH2649
iCloud: Identifying and filtering spam
http://support.apple.com/kb/HT4899
Regards,
Jason H.

False Positives for id=12713 version=S149

Just started receiving numerous firings of 12713. Looks like false positives. Is anyone else observing this?
Cisco MARS is creating the following : System Rule: DoS: Network - Success Likely
thanks
John Stark

This is indeed a false positive. You can either filter out trusted hosts or create a metasignature using this signature as a component to reduce the chance of false positives.
Tune signature 3327-6 and remove the produce alert action.
Create a custom signature as follows:
Engine Meta
Component list:
3327-6
3328-0
Meta-reset-interval = 2
Severity high
Summarize
Met-key = Axxx 1 unique victim
Component-list-in order = false
Event action: produce alert
This signature will only fire when signatures 3327-6 and 3328-0 fire. Since 3327-6 would have no event action of its own you would not see alerts from it.
Note that this signature does not have as high fidelity as the original 3327-6, that being said signature 3327-0 detects almost all public exploits for this vulnerability. We will note this in the NSDB.

Lots of false positives on outbound SPAM filtering

Starting around 5:30AM this morning a lot of our outbound e-mail began testing as positively identified SPAM. In our environment I have positively identified outbound SPAM setup to go to a quarantine.
In looking at the e-mails they are legitimate e-mails.
My first attempt was to lower the positively identified SPAM threshold from 75 to 50, had no effect.
My second attempt was to exclude our internal domains so that e-mail hitting our IronPort appliances for internal recipients would be allowed through, positively identified SPAM or not.
EDIT: Reviewing some of the e-mails, some are a simple e-mail with text only and a single .pdf attachment. Tested as positively identified SPAM. Some have multiple hyper links but are to legitimate URLs.
My questions:
What changed this morning that is causing all of these false positives?
What can I do differently to not let this occur again?
Thanks...

Really appreciate the replies...
Bob, SBRS is disabled on my outbound mail and it also comes from private/internal IP addresses, does show "not enabled" in message tracking...
After my post this morning our appliances (two C660s) were still false positiving a lot of outbound mail that was for external recipients (my filter was excluding internal domains).. but after 1:00PM central or so they started declining and since 3:00PM there hasn't been a single one.. Could be the volume of e-mail is starting to go down a little but I'm guessing there was a CASE rules update...
Now I just need to decide if I'm going to set the SPAM threshold back to what it was or just leave it alone.. We have had a problem with internal users getting their mail accounts compromised and send out a lot of phishing e-mails that I have been trying to block.

False positive for Windows RPC DCOM Overflow id=3327 version=S188

Hi,
Could you take a look at the below capture to see if there is false positive at work.
Thanks,
Matt
signature: description=Windows RPC DCOM Overflow id=3327 version=S188
subsigId: 6
sigDetails: \\\x3c400 chars>\
interfaceGroup:
vlan: 0
participants:
attacker:
addr: locality=INTERNAL <address removed>
port: 1914
target:
addr: locality=INTERNAL <address removed>
port: 445
context:
fromTarget:
000000 63 00 5F 00 66 00 73 00 2E 00 6E 00 6F 00 72 00 c._.f.s...n.o.r.
000010 74 00 68 00 62 00 61 00 79 00 62 00 61 00 6E 00 t.h.b.a.y.b.a.n.
000020 63 00 6F 00 72 00 70 00 2E 00 63 00 6F 00 6D 00 c.o.r.p...c.o.m.
000030 00 00 00 00 57 00 69 00 6E 00 64 00 6F 00 77 00 ....W.i.n.d.o.w.
000040 73 00 20 00 35 00 2E 00 30 00 00 00 57 00 69 00 s. .5...0...W.i.
000050 6E 00 64 00 6F 00 77 00 73 00 20 00 32 00 30 00 n.d.o.w.s. .2.0.
000060 30 00 30 00 20 00 4C 00 41 00 4E 00 20 00 4D 00 0.0. .L.A.N. .M.
000070 61 00 6E 00 61 00 67 00 65 00 72 00 00 00 00 00 a.n.a.g.e.r.....
000080 00 7E FF 53 4D 42 73 00 00 00 00 98 07 C8 00 00 .~.SMBs.........
000090 00 00 00 00 00 00 00 00 00 00 00 00 FF FE 00 48 ...............H
0000A0 C0 3E 04 FF 00 7E 00 00 00 09 00 53 00 A1 07 30 .>...~.....S...0
0000B0 05 A0 03 0A 01 00 57 00 69 00 6E 00 64 00 6F 00 ......W.i.n.d.o.
0000C0 77 00 73 00 20 00 35 00 2E 00 30 00 00 00 57 00 w.s. .5...0...W.
0000D0 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 32 00 i.n.d.o.w.s. .2.
0000E0 30 00 30 00 30 00 20 00 4C 00 41 00 4E 00 20 00 0.0.0. .L.A.N. .
0000F0 4D 00 61 00 6E 00 61 00 67 00 65 00 72 00 00 00 M.a.n.a.g.e.r...
fromAttacker:
000000 00 04 41 32 00 01 00 00 00 00 00 71 00 00 00 00 ..A2.......q....
000010 00 D4 00 00 80 B9 00 A1 6F 30 6D A2 6B 04 69 4E ........o0m.k.iN
000020 54 4C 4D 53 53 50 00 03 00 00 00 01 00 01 00 58 TLMSSP.........X
000030 00 00 00 00 00 00 00 59 00 00 00 00 00 00 00 48 .......Y.......H
000040 00 00 00 00 00 00 00 48 00 00 00 10 00 10 00 48 .......H.......H
000050 00 00 00 10 00 10 00 59 00 00 00 15 8A 88 E2 05 .......Y........
000060 00 93 08 00 00 00 0F 47 00 57 00 2D 00 30 00 30 .......G.W.-.0.0
000070 00 32 00 38 00 37 00 00 46 5A 5E 7D 09 B9 25 FB .2.8.7..FZ^}..%.
000080 EF 1F 07 DE BD 60 85 13 57 00 69 00 6E 00 64 00 .....`..W.i.n.d.
000090 6F 00 77 00 73 00 20 00 32 00 30 00 30 00 30 00 o.w.s. .2.0.0.0.
0000A0 20 00 32 00 31 00 39 00 35 00 00 00 57 00 69 00 .2.1.9.5...W.i.
0000B0 6E 00 64 00 6F 00 77 00 73 00 20 00 32 00 30 00 n.d.o.w.s. .2.0.
0000C0 30 00 30 00 20 00 35 00 2E 00 30 00 00 00 00 00 0.0. .5...0.....
0000D0 00 00 00 58 FF 53 4D 42 75 00 00 00 00 18 07 C8 ...X.SMBu.......
0000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE ................
0000F0 00 48 00 3F 04 FF 00 58 00 08 00 01 00 2D 00 00 .H.?...X.....-..

This is indeed a false positive. You can either filter out trusted hosts or create a metasignature using this signature as a component to reduce the chance of false positives.
Tune signature 3327-6 and remove the produce alert action.
Create a custom signature as follows:
Engine Meta
Component list:
3327-6
3328-0
Meta-reset-interval = 2
Severity high
Summarize
Met-key = Axxx 1 unique victim
Component-list-in order = false
Event action: produce alert
This signature will only fire when signatures 3327-6 and 3328-0 fire. Since 3327-6 would have no event action of its own you would not see alerts from it.
Note that this signature does not have as high fidelity as the original 3327-6, that being said signature 3327-0 detects almost all public exploits for this vulnerability. We will note this in the NSDB.

Why can't i change my email junk filter from never to delete after 1 week

why can't i change my email junk filter from "never" to "delete after 1 week"?

Error -1
Attempt to restore your iOS device two more times. If the issue is still unresolved, the device may need service.
http://support.apple.com/kb/TS3694

HT4899 False positive spam

How do I find a false positive spammail on my iPad? Can't see a junk folder or a spam folder anywhere.

Depends on your email provider and the type of email account (POP vs. IMAP). If it is a POP account, you likely would need to log into the providers website to see it.

How successful is the junk filter?

For quite a time I was very proud of the way the junk filter seemed to get rid of mail that had found its way past the server's filter, but recently I seem to get more and more junk. One of the typical problems that beats the filter is the use of random letters to stand for a username (eg. fgfsjdfhsk). Is there no programming that can put an end to this?

Is there no programming that can put an end to this?
Yes, there is - you should take a look at JunkMatcher - it integrates with Mail and if you set it up correctly to match your needs, it will be extremely efficient in catching spam (I get a false negative about once in two months and I do get a lot of spam...)
http://junkmatcher.sourceforge.net
Andreas

How can you distinguish a 'false positive'?

The IPS generated an alert, SMB Remote Registry Access Attempt. How to investigate the alert? I ran a couple of spyware programs on the host and found some cookies-generaly clean. At what point is the alert resigned as a false positive?
âTriggers when a client attempts to access the registry on the Windows server. Microsoft tools like REGEDIT provide the ability to access a servers registry over the network. There are several hacking tools that also provide similar capabilities. Every attempted access will cause an alarm to be sent. An attacker can cause serious damage to a computer system by changing the registry.â
appInstanceId: 403
signature: description=SMB Remote Registry Access Attempt id=5579 version=S264
subsigId: 1
marsCategory: Probe/Host/WinRegistry

You should start by looking for documented benign triggers:
https://intellishield.cisco.com/security/alertmanager/ipsSignature?signatureId=5579&signatureSubId=0
In this case, the benign triggers should tell you what you need to know.

Cellular signal becomes false positive

Everything works fine, except after a while the cellular signal becomes a false positive. By this I mean the upper left corner continue to read "Verizon 4G LTE" with a few bars, but there's actually no signal. All apps that require the Internet doesn't work. It's an easy fix though — in Settings, the Cellular Data has to be turned off, then turned back on. And by "after a while" I mean when it falls into sleep mode after a FaceTime session, then awoken. Not sure exactly how long afterwards. Not sure if it's consistently after one nap or longer. Not sure if running other apps would do the same thing.
Question is:
Is this normal?
I can imagine the upside is that you don't waste data in a prepaid data plan like when background apps continue to run.
The dreadful downside, however, is that any incoming FaceTime call cannot get through.
If this is NOT normal, is it a common glitch/bug/quirk? And how to fix it?
iPad3, OS 6.0.1

You can't begin measuring velocity until it is positive unless you have already been measuring velocity.
The solution is to always do the measurement. Evaluate it with a >0. In the true condition, then do whatever it is you want to do.

False Positives with GRC AC 5.2

Hi,
I actually have been working with GRC AC 5.2 (Compliance Calibrator) and we encountered several problems with false positives, working in the risk analysis.
¿do anyone knows how to solve this problem? ¿do you have documents or links to help?
Thanks,
Ricardo.

Thank you Alpesh for response.
In fact, i have several problem with false positives, but with transactional level. For example, i have a user with pfcg and su01 transaction. The configutation of profiles in SAP r/3 system do not allow to user involved in this, to execute both transactions in end-to-end process, i mean, the user have a transaction vía s_tcode object, have some other objects related with pfcg and su01 transactions, but he doesn´t have the values that allow to a transactions work properly. Then the Compliance Calibrator informs risks that it doesn´t exists.
It seems that is a ruleset configuration problem in the CC, then my question is, ¿the standard ruleset detects properly these problems?
Let my explain the reason that causes the problem.
We have been working with personalized ruleset, for customer-request. For that reason we look the usobt_c table and we form the ruleset-->functions in CC so that this functions were equal to usobt_c table. We did that because the standard ruleset shows false positives, such as first example of this post.
Thank you very much,
RCL.
Edited by: Ricardo Carrasco on Jun 18, 2009 11:58 PM

Junk filter is not working properly

I have been using the Junk mail filter successfully for years. Lately Mail is marking messages as Junk but still leaving some of them in my Inbox, though it is supposed to send all junk to the Junk mailbox. Also it is sending some messages to the Junk mailbox, even when they are in my Address Book and even some emails from Apple and .Mac. Why is this happening?
17 PowerBook G4-1.5Ghz DVD/R Mac OS X (10.4.8)

Hi, I'm having the same problem! If I send myself a test message it comes back as junk and my name is in my address book. I have my preferences set for anyone who is in my address book is ok and the rest is junk.
I read this and did all that was written below yet my mail program still thinks my own test message is junk. Does anyone have another suggestion?
This forum is awesome, thanks.
Martha
Why? The junk filter itself knows nothing about
Apple. When you set up Mail anew, there is only one
custom rule called “News From Apple” that, if active,
would prevent those messages from being marked as
junk. If you’ve removed or disabled that rule (I
have), then messages coming from Apple are treated
like messages coming from anyone else, as it should
be.
Or is it because "Apple Discussion Forums" isn't in
my address book?
Well, that’s one possibility. Another is that the
junk filter still isn’t working properly, and the
more thorough cleanup procedure I mentioned in my
previous post may be necessary.
Note also that having Sender of message is in my
Previous Recipients OFF in Preferences > Junk
Mail may contribute to some messages being
incorrectly marked as junk.
The junk filter cleanup procedure, in case you want
to try it, would be as follows:
1. Quit Mail.
2. In the Finder, go to ~/Library/Mail/.
3. Locate LSMMap2 and move it to the Trash.
This file stores information about what does and
doesn’t constitute junk, and allows the junk filter
to learn. Deleting this file is what Preferences >
Junk Mail > Reset does. The file was called
LSMMap in early versions of Mail; delete that
as well if you see it.
4. Locate DefaultCounts and move it to the
Trash. This file keeps statistics about the number of
messages that have been marked as junk, either
automatically by the junk filter or manually by the
user.
5. Locate MessageRules.plist and/or
MessageSorting.plist and move it to the
Desktop. The former is used by Mail 2.x, the latter
by Mail 1.x. This is where Mail stores all the rules,
including the rule that governs what the junk filter
does. There is probably also a
MessageRules.plist.backup and/or
MessageSorting.plist.backup file there; move
it to the Desktop too.
6. Look for the account folders. The name of each
account folder starts with the account type (POP,
IMAP, Mac), followed by the account username and the
incoming mail server. Open each of the account
folders, locate the Junk.mbox or
Junk.imapmbox folder within it, and move it to
the Trash if present.
7. Go to ~/Library/Mail/Mailboxes/. Locate any
Junk.mbox mailboxes there (their name may
include the account name in parenthesis), and move
them to the Trash.
Note: Messages in Junk mailboxes with an
.mbox suffix are stored locally and will be
lost forever as a result of doing steps 6 and 7. If
there is a chance that you have legit messages there
that you want to preserve, either move the messages
to another mailbox in Mail first, or move
Junk.mbox to the Desktop (to be imported back
later) instead of to the Trash. Junk mailboxes with
an .imapmbox suffix aren’t a concern because
they are stored on the server and Mail will rebuild
them automatically.
8. Open Mail. As a result of removing the rules file,
the junk filter will be disabled now. You may want to
either tell Mail to go offline immediately after
opening it, or shut down the Internet connection
before opening Mail, to prevent it from downloading
anything until the junk mail filter has been enabled
again.
9. Go to Mail > Preferences > Junk Mail,
enable junk filtering, and configure it however you
wish.
10. Go online again if you went offline in step 8.
If the above solves the problem and you don’t have
any rules you’d like to preserve or recreating them
is not a daunting task, just trash the rules files
that were moved to the Desktop and be done with it.
Note: For those not familiarized with the
~/ notation, it refers to the user’s home
folder. You can easily locate any of the folders
referred to in this post by copying the folder path
here, doing Go > Go to Folder in the Finder,
and pasting the folder path there.
eMac G4 Mac OS X (10.4.6)

Mail refuses to accept any mails if i turn spam/junk filter on! Why?

Seems like something is wrong with my spam/junk filter.
Im running a mac os x server 10.6.2. By the look of it the server tries to speak with something on port 10024 but gets no contact which makes it stop any e-mails.
Someone made a suggestion that Amivis might be turned off but when reading the docs i found no additional information on how to turn it off besides using the enable buttons in Server Admin.
Any help is welcome!

May I ask why? Have you learned that that specific problem is solved in a pre-release version? So far I've upgraded once on your advice, now I've upgraded again to 31. Problem's still there. Unless I'm told that the problem's been solved for sure in a latter version, I'm not going to upgrade because sometimes the upgrades bring problems w/them for a low tech user. I don't want to chat, etc., I just want to be able to send and receive e-mails.
I'm still working with the security software people re: some continuing issues w/FF.
I'd like to spend more time doing my work, or communicating w/friends, not dealing w/software problems.
Is there anyway of my finding out what, if any update, includes whatever is needed to solve my specific problem? I use Win7 Pro, SP1, 3.40 Gz processor, 3.19 Gb usable RAM, 64 bit OS. I don't know what other information is needed.

LMS 4.2.2 DFM still not possible to disable Duplicate IP false positives?

I found one discussion about Cisco Works 2.6 where it is pointed out that duplicate IP alerts cannot be disabled in LMS.
Now I have a installation with 2 core switches, one has all VLAN Interfaces up, the second one the same interfaces with SAME IP addresses in shutdown state.
DFM still recognizes these similar IP configuration on two boxes as duplicate ip situation, but it shouldn't because they are all shutdown.
Is it possible to disable these false positives in DFM?
Thanks for any hints!

I found one discussion about Cisco Works 2.6 where it is pointed out that duplicate IP alerts cannot be disabled in LMS.
Now I have a installation with 2 core switches, one has all VLAN Interfaces up, the second one the same interfaces with SAME IP addresses in shutdown state.
DFM still recognizes these similar IP configuration on two boxes as duplicate ip situation, but it shouldn't because they are all shutdown.
Is it possible to disable these false positives in DFM?
Thanks for any hints!

False Positive iOS Junk Filter

Similar Messages

Maybe you are looking for