Do you have the Pro version of Declude Junkmail? You have to have pro to use filters and outbound scanning. The fromfile filter I mentioned will work in the standard version, though.
Darin. ----- Original Message ----- From: "Kevin Rogers" <[EMAIL PROTECTED]> To: <Declude.Virus@declude.com> Sent: Sunday, June 05, 2005 2:56 PM Subject: Re: [Declude.Virus] Newbie question I changed it to HEADERS and still I am receiving emails from these addresses (got 4 of them personally yesterday). My virus scanner is now updated every four hours, so F-Prot caught these viruses, but I still am receiving the virus notifications. Perhaps the scanning takes place (and the notifications are sent out) before my filter is called? This is what my filter file contains: HEADERS 0 CONTAINS [EMAIL PROTECTED] HEADERS 0 CONTAINS [EMAIL PROTECTED] etc..... This is what I have in my global.cfg MYFILTER filter C:\Imail\Declude\Filter.txt x 20 0 This is in my $default$.junkmail file WEIGHT20 HOLD What am I missing? Thanks. Scott Fisher wrote: > The MAILFROM filter test is seperate from anything in the headers. It > is the envelope sender. > > If you want to test on the header from (I call it display from because > that's what Outlook displays), you need to check the HEADERS. > > > ----- Original Message ----- From: "Kevin Rogers" <[EMAIL PROTECTED]> > To: <Declude.Virus@declude.com> > Sent: Friday, June 03, 2005 3:26 AM > Subject: Re: [Declude.Virus] Newbie question > > >> Great. Exactly what I needed. >> I was also confused about the MAILFROM. Does MAILFROM mean what is >> displayed as the FROM: in the headers or what it says in the "X-Note: >> This E-mail was sent from 206-72-95-86.wi.skypipeline.com >> ([206.72.95.86])" or in the X-Declude-Sender field? >> >> Maybe I should just use the HEADERS 0 CONTAINS.... instead. >> >> Thanks again. >> >> >> >> Scott Fisher wrote: >> >>> One caveat. The MAILFROM uses the envelope mailfrom, which is >>> different than the ones displayed in the headers. >>> If the below doesn't stop it, add >>> HEADERS 0 CONTAINS [EMAIL PROTECTED] >>> HEADERS 0 CONTAINS [EMAIL PROTECTED] >>> >>> ----- Original Message ----- From: "Kevin Rogers" >>> <[EMAIL PROTECTED]> >>> To: <Declude.Virus@declude.com> >>> Sent: Thursday, June 02, 2005 10:37 PM >>> Subject: Re: [Declude.Virus] Newbie question >>> >>> >>>> I looked up the filter section at the manual. This is what I did. >>>> >>>> I made a file called filter.txt. This contains: >>>> MAILFROM 0 CONTAINS [EMAIL PROTECTED] >>>> MAILFROM 0 CONTAINS [EMAIL PROTECTED] >>>> etc..... >>>> >>>> I then added this line in global.cfg: >>>> MYFILTER filter C:\Imail\Declude\filter.txt x 20 0 >>>> >>>> In my $default$.junkmail file there was already this line: >>>> WEIGHT20 HOLD >>>> >>>> Do I need to do anything else to the junkmail file to reference >>>> MYFILTER or does the WEIGHT20 take care of everything? >>>> >>>> Thanks. >>>> >>>> Kevin >>>> >>>> >>>> >>>> Darin Cox wrote: >>>> >>>>> Nope... add a "filter" test and put those lines in it. The same >>>>> thing I >>>>> mentioned without pro applies here for adding test names to the >>>>> global.cfg >>>>> and $default$.junkmail. >>>>> >>>>> The manual at http://declude.com/junkmail/manual.htm decribes >>>>> adding filter >>>>> files pretty well. >>>>> >>>>> Darin. >>>>> >>>>> >>>>> ----- Original Message ----- From: "Kevin Rogers" >>>>> <[EMAIL PROTECTED]> >>>>> To: <Declude.Virus@declude.com> >>>>> Sent: Thursday, June 02, 2005 7:09 PM >>>>> Subject: Re: [Declude.Virus] Newbie question >>>>> >>>>> >>>>> I have pro. How do I add filters? >>>>> >>>>> Should I add that line "MAILFROM10 CONTAINS [EMAIL PROTECTED]" in >>>>> virus.cfg or global.cfg? Do I need to use another file? >>>>> >>>>> If I use the HEADERS option "HEADERS 10 CONTAINS >>>>> [EMAIL PROTECTED]" >>>>> - where would I put that? >>>>> >>>>> Sorry for the newbie questions. >>>>> >>>>> Kevin >>>>> >>>>> >>>>> >>>>> Scott Fisher wrote: >>>>> >>>>> >>>>>> If you've got pro, you could add a filter: >>>>>> MAILFROM10 CONTAINS [EMAIL PROTECTED] >>>>>> that will check the envelope mailfrom. >>>>>> >>>>>> To check for those addresses in the headers: >>>>>> HEADERS 10 CONTAINS [EMAIL PROTECTED] >>>>>> >>>>>> Another option is to update your virus software more often to >>>>>> minimize >>>>>> the opportunity window for the virus. >>>>>> >>>>>> ----- Original Message ----- From: "Kevin Rogers" >>>>>> <[EMAIL PROTECTED]> >>>>>> To: <Declude.Virus@declude.com> >>>>>> Sent: Thursday, June 02, 2005 5:15 PM >>>>>> Subject: [Declude.Virus] Newbie question >>>>>> >>>>>> >>>>>> >>>>>>> How do I ban certain email addresses? >>>>>>> >>>>>>> Some viruses have gotten through lately (first that I know about >>>>>>> since installing Declude) sent from forged email addresses using >>>>>>> our >>>>>>> own domain. We do not whitelist our domain. I'd like to ban >>>>>>> some of >>>>>>> these common addresses (e.g., [EMAIL PROTECTED], >>>>>>> [EMAIL PROTECTED], etc.) >>>>>>> >>>>>>> Thanks. >>>>>>> >>>>>>> --- >>>>>>> [This E-mail was scanned for viruses.] >>>>>>> >>>>>>> --- >>>>>>> This E-mail came from the Declude.Virus mailing list. To >>>>>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>>>> type "unsubscribe Declude.Virus". The archives can be found >>>>>>> at http://www.mail-archive.com. >>>>>>> >>>>>>> >>>>>> --- >>>>>> This E-mail came from the Declude.Virus mailing list. To >>>>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>>> type "unsubscribe Declude.Virus". The archives can be found >>>>>> at http://www.mail-archive.com. >>>>>> --- >>>>>> [This E-mail was scanned for viruses.] >>>>>> >>>>>> >>>>>> >>>>>> >>>>> --- >>>>> [This E-mail was scanned for viruses.] >>>>> >>>>> --- >>>>> This E-mail came from the Declude.Virus mailing list. To >>>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>> type "unsubscribe Declude.Virus". The archives can be found >>>>> at http://www.mail-archive.com. >>>>> >>>>> --- >>>>> This E-mail came from the Declude.Virus mailing list. To >>>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>> type "unsubscribe Declude.Virus". The archives can be found >>>>> at http://www.mail-archive.com. >>>>> --- >>>>> [This E-mail was scanned for viruses.] >>>>> >>>>> >>>>> >>>>> >>>> --- >>>> [This E-mail was scanned for viruses.] >>>> >>>> --- >>>> This E-mail came from the Declude.Virus mailing list. To >>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>> type "unsubscribe Declude.Virus". The archives can be found >>>> at http://www.mail-archive.com. >>>> >>>> >>> >>> --- >>> This E-mail came from the Declude.Virus mailing list. To >>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>> type "unsubscribe Declude.Virus". The archives can be found >>> at http://www.mail-archive.com. >>> --- >>> [This E-mail was scanned for viruses.] >>> >>> >>> >> --- >> [This E-mail was scanned for viruses.] >> >> --- >> This E-mail came from the Declude.Virus mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.Virus". The archives can be found >> at http://www.mail-archive.com. >> > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail was scanned for viruses.] > > > --- [This E-mail was scanned for viruses.] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
