US NMA and IMF2

After a couple of days of spam from 'The United States National Medical Association' trying to sell us drugs online from an everchanging variety of email addresses I decided to investigate why these things were getting through even though we had the Exchange SP2 IMFv2 installed and enabled.

First up I added the required entry to the MSExchange.UceContentFilter.xml file (add opening and closing brackets and slash as required):

customweightentry type="SUBJECT" change="MAX" text="The United StatesNational Medical Association"

Make sure you save this in notepad in the unicode format or you can get application log errors and a failure to work regardless of getting the rest of this right.

Then I did a restart of the SMTP Virtual Server from within the Exchange admin tool. Back to gmail and a little test to my internal mail, straight to my mailbox.

Not to be deterred I had a quick rummage around the net regarding IMF not working. According to a fellow blogger the IMF although getting updated automatically with the required registry entry was basically creating a new folder structure each time an update was installed.

Looking at the folder structure I could see 3 different versions in the IMF folder. Another interesting point was that the XML file had to be in the version that you were running (IMFv1 ran from the IMF folder proper). So I copied the XML file into the newest folder.

Penultimately you had to make sure that the correct DLL was registered, one was in each version folder and one in the root presumably from the old IMFv1 days. So I ran a:

regsvr32 C:\Path To Exchange\BIN\MSCFV2\6.5.7931.0\MSExchange.UceContentFilter.dll

Still nothing so I did a restart of the SMTP Virtual Server, no dice so finally did a restart of the SMTP service....and....HUZZAH! We now have blocking again.