Do you use Thunderbird? if yes then just click this link. You will do it https://support.mozilla.org/en-US/kb/thunderbird-and-junk-spam-messages#w_tell-thunderbird-what-is-junk

Sorry - I does not work. I need filter solution that will check BODY source of HTML message and throw to trash email which have: lenorok.ru (HEX = %6c%65%6e%6f%72%6f%6b%2e%72%75)

name="lenorok.ru" enabled="yes" type="17" action="JunkScore" actionValue="100" action="Move to folder" actionValue="mailbox://nobody@Local%20Folders/Junk" condition="OR (body,contains,lenorok.ru) OR (body,contains,%6c%65%6e%6f%72%6f%6b%2e%72%75)"

So I presume you set up all the Junk Controls and then selected various emails from a .ru email address and marked them as 'Junk' to train the Junk filter.

If you need message filter to search for items that are not being picked up by Junk controls. Tools > Message Filters or Menu icon > Message Filters > Message Filters Apply filter when 'Manually Run' and 'Getting new mail' Filter after Junk Classification match any of the following From and Contains and .ru Body and Contains and .ru

Perform action Set junk Status and Junk Move Message to and Junk folder on account click on OK

Make sure the filter is enabled. Make sure the filter is at the top, so it runs it first. Make sure it is the only filter enabled.

It is useful to enable the filter log so you can see the results. click on 'filter Log' select 'enable filter log' click on 'Close'

If you have some emails in the Inbox that have a .ru in either From or Body, then test the filter by manually running the filter on the Inbox. run selected filter on 'Inbox' click on 'Run Now'

Gnospen said

name="lenorok.ru" enabled="yes" type="17" action="JunkScore" actionValue="100" action="Move to folder" actionValue="mailbox://nobody@Local%20Folders/Junk" condition="OR (body,contains,lenorok.ru) OR (body,contains,%6c%65%6e%6f%72%6f%6b%2e%72%75)"

This filter catch only: lenorok.ru - if I send sampe email with: lenorok.ru in message filter work.

But if there is lenorok.ru in HEX = %6c%65%6e%6f%72%6f%6b%2e%72%75 filter does not catch it out. This HEX we can see using CTRL + U (view source of email message)

I ran just body contains %6c%65%6e%6f%72%6f%6b%2e%72%75 on support- mail and yours were picked

So maybe you should have two filters.

EDIT You are right, When its surrounded with other hex it doesnt find it

Gnospen said

I ran just body contains %6c%65%6e%6f%72%6f%6b%2e%72%75 on support- mail and yours were picked So maybe you should have two filters. EDIT You are right, When its surrounded with other hex it doesnt find it

Yes - Thunderbird does not find it. It is strange - when you resend email with surrounded HEX like:

Uwaga! Tutaj mozna zarobic pieniadze w Internecie! <http://www.google.com/url?q=%68%74%74%70%3A%2F%2F%62%37%62%69%70%65%2e%6c%65%6e%6f%72%6f%6b%2e%72%75&sa=D&sntz=1&usg=AFQjCNGQc5m2zrHjaNqZVrkf_-tT9mX-3g>

the filter will throw it to trash.

BUT if we get this email directly from the spammers filter in Thunderbird does not catch the HEX.

Maybe https://addons.mozilla.org/en-US/thunderbird/addon/gmailui/ or https://addons.mozilla.org/en-us/thunderbird/addon/filtaquilla/ will help. They both offer regular expressions and allow you to force a literal search.

But generally I find managing filters to handle spam a waste of time.

Zenos said

Maybe https://addons.mozilla.org/en-US/thunderbird/addon/gmailui/ or https://addons.mozilla.org/en-us/thunderbird/addon/filtaquilla/ will help. They both offer regular expressions and allow you to force a literal search. But generally I find managing filters to handle spam a waste of time.

Zenos you are my GURU :) Gmailui fix the problem. Over 1000 spam mails per day go to trash by filtering. Thank you very much.