I have received a couple of messages in the last two days in my inbox
that were NOT scanned by Declude. I thought the headers below were
strange, since they seem to have MIME segments in them. However,
another message in my inbox that was spam (below my hold weight) also
has similar MIME segments, but was scanned by Declude, evidenced by the
Declude headers. The Declude headers are not present (I add several
headers with Declude) in the email below. The line "X-Virus-Scanned:
amavisd-new 2.3.0 (20050424) at taisweb.net" was added by my gateway
postfix box that scans messages with clamav.
When searching the Declude logs, the queue number 9F3B01A600000A71 does
not appear. Neither does a07e000006888a82, though I wouldn't expect it
to as that is the forward message, which should appear after Declude
scans. Version info: Imail v8.2 HF2, Declude Junkmail Pro/Virus
Standard/Hijack v2.0.6.10.
For reference, I have attached a file with the headers of the other spam
message I mentioned, so you can see what kind of headers I add that are
missing below.
--------IMAIL LOG--------
SMTPD (9f3b01a600000a71) [172.20.5.2] connect 68.118.154.7 port 60324
SMTPD (9f3b01a600000a71) [68.118.154.7] EHLO mx2.rmslink.net
SMTPD (9f3b01a600000a71) [68.118.154.7] MAIL
FROM:<[EMAIL PROTECTED]>
SMTPD (9f3b01a600000a71) [68.118.154.7] RCPT TO:<[EMAIL PROTECTED]>
SMTPD (9f3b01a600000a71) [x] looking up taisweb.net in HOSTS
SMTPD (9f3b01a600000a71) [68.118.154.7] DATA
SMTPD (9f3b01a600000a71) [68.118.154.7]
S:\imail\spool\D9f3b01a600000a71.SMD 4808
SMTP (0000000000000000) Info - Adding Queue file
S:\imail\spool\Q9F3B01A600000A71.SMD
SMTP (9f3b01a600000a71) processing S:\imail\spool\Q9F3B01A600000A71.SMD
SMTP (9f3b01a600000a71) ldeliver mail.taisweb.net copyall-main (1)
[EMAIL PROTECTED] 4808
SMTP (9f3b01a600000a71) forwarded message to [EMAIL PROTECTED]
using new file: a07e000006888a82
SMTP (9f3b01a600000a71) finished S:\imail\spool\Q9F3B01A600000A71.SMD
status=1
--------HEADERS----------
Microsoft Mail Internet Headers Version 2.0
Received: from mail.taisweb.net ([68.118.153.2]) by ex1.wilcoxent.net
with Microsoft SMTPSVC(6.0.3790.211);
Wed, 1 Jun 2005 07:48:14 -0400
Received: from SMTP32-FWD by mail.taisweb.net
(SMTP32) id A9F3B01A600000A71; Wed, 1 Jun 2005 07:48:14
Received: from mx2.rmslink.net [68.118.154.7] by mail.taisweb.net with
ESMTP
(SMTPD-8.20) id AF3C0298; Wed, 01 Jun 2005 07:42:52 -0400
Received: from localhost (localhost [127.0.0.1])
by mx2.rmslink.net (Postfix) with ESMTP id 2F58139863
for <[EMAIL PROTECTED]>; Wed, 1 Jun 2005 07:20:47 -0400 (EDT)
Received: from gatesalbert.com (81-202-101-107.user.ono.com
[81.202.101.107])
by mx2.rmslink.net (Postfix) with SMTP id 46D5B39845
for <[EMAIL PROTECTED]>; Wed, 1 Jun 2005 07:20:40 -0400 (EDT)
From: "Feli Ridgeway" <[EMAIL PROTECTED]>
To: "Napier Kincaid" <[EMAIL PROTECTED]>
Subject: Re: Really Works GGood
Date: Wed, 1 Jun 2005 06:42:20 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0057_01C5669E.F7E87600"
X-Priority: 3
X-MSMail-Priority: Normal
X-Unsent: 1
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Message-Id: <[EMAIL PROTECTED]>
X-Virus-Scanned: amavisd-new 2.3.0 (20050424) at taisweb.net
Return-Path: [EMAIL PROTECTED]
X-OriginalArrivalTime: 01 Jun 2005 11:48:14.0907 (UTC)
FILETIME=[CB72F8B0:01C5669F]
------=_NextPart_000_0057_01C5669E.F7E87600
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
------=_NextPart_000_0057_01C5669E.F7E87600
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
------=_NextPart_000_0057_01C5669E.F7E87600--
Microsoft Mail Internet Headers Version 2.0
Received: from mail.taisweb.net ([68.118.153.2]) by ex1.wilcoxent.net with
Microsoft SMTPSVC(6.0.3790.211);
Wed, 1 Jun 2005 00:10:34 -0400
Received: from SMTP32-FWD by mail.taisweb.net
(SMTP32) id A3504026B00001C60; Wed, 1 Jun 2005 00:10:33 -0400
Received: from mx2.rmslink.net [68.118.154.7] by mail.taisweb.net with ESMTP
(SMTPD-8.20) id A504026C; Wed, 01 Jun 2005 00:09:40 -0400
Received: from localhost (localhost [127.0.0.1])
by mx2.rmslink.net (Postfix) with ESMTP id 4BA6F3983D;
Tue, 31 May 2005 23:47:41 -0400 (EDT)
Received: from ndl1mr1-a-fixed.sancharnet.in (ndl1mr1-a-fixed.sancharnet.in
[61.0.0.45])
by mx2.rmslink.net (Postfix) with ESMTP id 61E7B3982E;
Tue, 31 May 2005 23:47:39 -0400 (EDT)
Disposition-Notification-To: [EMAIL PROTECTED]
Received: from conversion-daemon.ndl1mr1-a-fixed.sancharnet.in by
ndl1mr1-a-fixed.sancharnet.in
(iPlanet Messaging Server 5.2 Patch 2 (built Jul 14 2004))
id <0IHE00F010BGGA@""> (original mail from [EMAIL PROTECTED]); Wed,
01 Jun 2005 09:39:37 +0530 (IST)
Received: from v0p7w2 ([61.0.196.170]) by ndl1mr1-a-fixed.sancharnet.in
(iPlanet Messaging Server 5.2 Patch 2 (built Jul 14 2004))
with ESMTPA id <0IHE00LQH0VTMC@"">; Wed, 01 Jun 2005 09:39:36 +0530 (IST)
Date: Wed, 01 Jun 2005 09:41:06 +0530
From: SURESH SHARMA <[EMAIL PROTECTED]>
Subject: Hotel Ambassador, Ajmer
Sender: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED], [EMAIL PROTECTED],
[EMAIL PROTECTED]
Message-id: <[EMAIL PROTECTED]>
MIME-version: 1.0
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
Content-type: multipart/alternative;
boundary="Boundary_(ID_uB6n4O9c0dLLiP9XkYXapw)"
X-Priority: 3
X-MSMail-priority: Normal
X-Virus-Scanned: amavisd-new 2.3.0 (20050424) at taisweb.net
X-RBL-Warning: FILTER-BODY-GIBBERISH: Message failed FILTER-BODY-GIBBERISH test
(line 88, weight 6)
X-RBL-Warning: IPNOTINMX:
X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]"
X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected.
X-RBL-Warning: NOPOSTMASTER: "Not supporting [EMAIL PROTECTED]"
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 5.
X-Declude-Sender: [EMAIL PROTECTED] [61.0.0.45]
X-Declude-Spoolname: D3504026B00001C60.SMD
X-Note: ==================================================================
X-Note: Spam Score: 13 [FLAGGED ON 16+, HELD ON 20+ & DELETED ON 60+]
X-Note: Scan Time: 00:10:33 on 01 Jun 2005
X-Note: Spool File: D3504026B00001C60.SMD
X-Note: Server Name: ndl1mr1-a-fixed.sancharnet.in
X-Note: SMTP Sender: [EMAIL PROTECTED]
X-Note: Reverse DNS & IP: ndl1mr1-a-fixed.sancharnet.in [61.0.0.45]
X-Note: Country Chain: INDIA->UNITED STATES->destination
X-Note: Tests-Failed: FILTER-BODY-GIBBERISH, IPNOTINMX, NOABUSE,
NOLEGITCONTENT, NOPOSTMASTER, SPAMCHK
X-Note: ==================================================================
X-Note: This E-mail was scanned & filtered by Declude [2.0.6.10] for SPAM &
virus.
X-Note: Spam and virus blocking services provided by TAISWeb.com
X-Note: ==================================================================
Return-Path: [EMAIL PROTECTED]
X-OriginalArrivalTime: 01 Jun 2005 04:10:34.0204 (UTC)
FILETIME=[DB9839C0:01C5665F]
--Boundary_(ID_uB6n4O9c0dLLiP9XkYXapw)
Content-type: text/plain; charset=iso-8859-1
Content-transfer-encoding: 7BIT
--Boundary_(ID_uB6n4O9c0dLLiP9XkYXapw)
Content-type: text/html; charset=iso-8859-1
Content-transfer-encoding: QUOTED-PRINTABLE
--Boundary_(ID_uB6n4O9c0dLLiP9XkYXapw)--
