Great. Exactly what I needed.
I was also confused about the MAILFROM. Does MAILFROM mean what is
displayed as the FROM: in the headers or what it says in the "X-Note:
This E-mail was sent from 206-72-95-86.wi.skypipeline.com
([206.72.95.86])" or in the X-Declude-Sender field?
Maybe I should just use the HEADERS 0 CONTAINS.... instead.
Thanks again.
Scott Fisher wrote:
One caveat. The MAILFROM uses the envelope mailfrom, which is
different than the ones displayed in the headers.
If the below doesn't stop it, add
HEADERS 0 CONTAINS [EMAIL PROTECTED]
HEADERS 0 CONTAINS [EMAIL PROTECTED]
----- Original Message ----- From: "Kevin Rogers" <[EMAIL PROTECTED]>
To: <Declude.Virus@declude.com>
Sent: Thursday, June 02, 2005 10:37 PM
Subject: Re: [Declude.Virus] Newbie question
I looked up the filter section at the manual. This is what I did.
I made a file called filter.txt. This contains:
MAILFROM 0 CONTAINS [EMAIL PROTECTED]
MAILFROM 0 CONTAINS [EMAIL PROTECTED]
etc.....
I then added this line in global.cfg:
MYFILTER filter C:\Imail\Declude\filter.txt x 20 0
In my $default$.junkmail file there was already this line:
WEIGHT20 HOLD
Do I need to do anything else to the junkmail file to reference
MYFILTER or does the WEIGHT20 take care of everything?
Thanks.
Kevin
Darin Cox wrote:
Nope... add a "filter" test and put those lines in it. The same
thing I
mentioned without pro applies here for adding test names to the
global.cfg
and $default$.junkmail.
The manual at http://declude.com/junkmail/manual.htm decribes adding
filter
files pretty well.
Darin.
----- Original Message ----- From: "Kevin Rogers"
<[EMAIL PROTECTED]>
To: <Declude.Virus@declude.com>
Sent: Thursday, June 02, 2005 7:09 PM
Subject: Re: [Declude.Virus] Newbie question
I have pro. How do I add filters?
Should I add that line "MAILFROM10 CONTAINS [EMAIL PROTECTED]" in
virus.cfg or global.cfg? Do I need to use another file?
If I use the HEADERS option "HEADERS 10 CONTAINS [EMAIL PROTECTED]"
- where would I put that?
Sorry for the newbie questions.
Kevin
Scott Fisher wrote:
If you've got pro, you could add a filter:
MAILFROM10 CONTAINS [EMAIL PROTECTED]
that will check the envelope mailfrom.
To check for those addresses in the headers:
HEADERS 10 CONTAINS [EMAIL PROTECTED]
Another option is to update your virus software more often to minimize
the opportunity window for the virus.
----- Original Message ----- From: "Kevin Rogers"
<[EMAIL PROTECTED]>
To: <Declude.Virus@declude.com>
Sent: Thursday, June 02, 2005 5:15 PM
Subject: [Declude.Virus] Newbie question
How do I ban certain email addresses?
Some viruses have gotten through lately (first that I know about
since installing Declude) sent from forged email addresses using our
own domain. We do not whitelist our domain. I'd like to ban some of
these common addresses (e.g., [EMAIL PROTECTED],
[EMAIL PROTECTED], etc.)
Thanks.
---
[This E-mail was scanned for viruses.]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses.]
---
[This E-mail was scanned for viruses.]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses.]
---
[This E-mail was scanned for viruses.]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses.]
---
[This E-mail was scanned for viruses.]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
