Great... Could the Declude staff have this added to the manual? Darin.
----- Original Message ----- From: "Guhl, Markus (LDS)" <[EMAIL PROTECTED]> To: <Declude.Virus@declude.com> Sent: Monday, June 06, 2005 4:28 AM Subject: AW: [Declude.Virus] Newbie question hi darin, we use AVAFTERJM ON with Declude 2.0.6.14 and it works like we need it. mfg i.a. gez. markus guhl *********************************** lds nrw ref. 241 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *********************************** -----Ursprüngliche Nachricht----- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Auftrag von Darin Cox Gesendet: Sonntag, 5. Juni 2005 23:02 An: Declude.Virus@declude.com Betreff: Re: [Declude.Virus] Newbie question I don't know if it still exists since it is not in the current manual, but there was an option in previous versions of AV called AVAFTERJM that allowed JunkMail to run first. Otherwise you are correct that AV would run first. Darin. ----- Original Message ----- From: "Kevin Rogers" <[EMAIL PROTECTED]> To: <Declude.Virus@declude.com> Sent: Sunday, June 05, 2005 3:17 PM Subject: Re: [Declude.Virus] Newbie question Thanks for the quick response. Yes, I have the Pro versions for both AV and Junkmail. Darin Cox wrote: >Do you have the Pro version of Declude Junkmail? You have to have pro to >use filters and outbound scanning. The fromfile filter I mentioned will >work in the standard version, though. > >Darin. > > >----- Original Message ----- >From: "Kevin Rogers" <[EMAIL PROTECTED]> >To: <Declude.Virus@declude.com> >Sent: Sunday, June 05, 2005 2:56 PM >Subject: Re: [Declude.Virus] Newbie question > > >I changed it to HEADERS and still I am receiving emails from these >addresses (got 4 of them personally yesterday). My virus scanner is now >updated every four hours, so F-Prot caught these viruses, but I still am >receiving the virus notifications. Perhaps the scanning takes place >(and the notifications are sent out) before my filter is called? > >This is what my filter file contains: >HEADERS 0 CONTAINS [EMAIL PROTECTED] >HEADERS 0 CONTAINS [EMAIL PROTECTED] >etc..... > >This is what I have in my global.cfg >MYFILTER filter C:\Imail\Declude\Filter.txt x 20 0 > >This is in my $default$.junkmail file >WEIGHT20 HOLD > >What am I missing? > >Thanks. > > >Scott Fisher wrote: > > > >>The MAILFROM filter test is seperate from anything in the headers. It >>is the envelope sender. >> >>If you want to test on the header from (I call it display from because >>that's what Outlook displays), you need to check the HEADERS. >> >> >>----- Original Message ----- From: "Kevin Rogers" <[EMAIL PROTECTED]> >>To: <Declude.Virus@declude.com> >>Sent: Friday, June 03, 2005 3:26 AM >>Subject: Re: [Declude.Virus] Newbie question >> >> >> >> >>>Great. Exactly what I needed. >>>I was also confused about the MAILFROM. Does MAILFROM mean what is >>>displayed as the FROM: in the headers or what it says in the "X-Note: >>>This E-mail was sent from 206-72-95-86.wi.skypipeline.com >>>([206.72.95.86])" or in the X-Declude-Sender field? >>> >>>Maybe I should just use the HEADERS 0 CONTAINS.... instead. >>> >>>Thanks again. >>> >>> >>> >>>Scott Fisher wrote: >>> >>> >>> >>>>One caveat. The MAILFROM uses the envelope mailfrom, which is >>>>different than the ones displayed in the headers. >>>>If the below doesn't stop it, add >>>>HEADERS 0 CONTAINS [EMAIL PROTECTED] >>>>HEADERS 0 CONTAINS [EMAIL PROTECTED] >>>> >>>>----- Original Message ----- From: "Kevin Rogers" >>>><[EMAIL PROTECTED]> >>>>To: <Declude.Virus@declude.com> >>>>Sent: Thursday, June 02, 2005 10:37 PM >>>>Subject: Re: [Declude.Virus] Newbie question >>>> >>>> >>>> >>>> >>>>>I looked up the filter section at the manual. This is what I did. >>>>> >>>>>I made a file called filter.txt. This contains: >>>>>MAILFROM 0 CONTAINS [EMAIL PROTECTED] >>>>>MAILFROM 0 CONTAINS [EMAIL PROTECTED] >>>>>etc..... >>>>> >>>>>I then added this line in global.cfg: >>>>>MYFILTER filter C:\Imail\Declude\filter.txt x 20 0 >>>>> >>>>>In my $default$.junkmail file there was already this line: >>>>>WEIGHT20 HOLD >>>>> >>>>>Do I need to do anything else to the junkmail file to reference >>>>>MYFILTER or does the WEIGHT20 take care of everything? >>>>> >>>>>Thanks. >>>>> >>>>>Kevin >>>>> >>>>> >>>>> >>>>>Darin Cox wrote: >>>>> >>>>> >>>>> >>>>>>Nope... add a "filter" test and put those lines in it. The same >>>>>>thing I >>>>>>mentioned without pro applies here for adding test names to the >>>>>>global.cfg >>>>>>and $default$.junkmail. >>>>>> >>>>>>The manual at http://declude.com/junkmail/manual.htm decribes >>>>>>adding filter >>>>>>files pretty well. >>>>>> >>>>>>Darin. >>>>>> >>>>>> >>>>>>----- Original Message ----- From: "Kevin Rogers" >>>>>><[EMAIL PROTECTED]> >>>>>>To: <Declude.Virus@declude.com> >>>>>>Sent: Thursday, June 02, 2005 7:09 PM >>>>>>Subject: Re: [Declude.Virus] Newbie question >>>>>> >>>>>> >>>>>>I have pro. How do I add filters? >>>>>> >>>>>>Should I add that line "MAILFROM10 CONTAINS [EMAIL PROTECTED]" in >>>>>>virus.cfg or global.cfg? Do I need to use another file? >>>>>> >>>>>>If I use the HEADERS option "HEADERS 10 CONTAINS >>>>>>[EMAIL PROTECTED]" >>>>>>- where would I put that? >>>>>> >>>>>>Sorry for the newbie questions. >>>>>> >>>>>>Kevin >>>>>> >>>>>> >>>>>> >>>>>>Scott Fisher wrote: >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>If you've got pro, you could add a filter: >>>>>>>MAILFROM10 CONTAINS [EMAIL PROTECTED] >>>>>>>that will check the envelope mailfrom. >>>>>>> >>>>>>>To check for those addresses in the headers: >>>>>>>HEADERS 10 CONTAINS [EMAIL PROTECTED] >>>>>>> >>>>>>>Another option is to update your virus software more often to >>>>>>>minimize >>>>>>>the opportunity window for the virus. >>>>>>> >>>>>>>----- Original Message ----- From: "Kevin Rogers" >>>>>>><[EMAIL PROTECTED]> >>>>>>>To: <Declude.Virus@declude.com> >>>>>>>Sent: Thursday, June 02, 2005 5:15 PM >>>>>>>Subject: [Declude.Virus] Newbie question >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>>>How do I ban certain email addresses? >>>>>>>> >>>>>>>>Some viruses have gotten through lately (first that I know about >>>>>>>>since installing Declude) sent from forged email addresses using >>>>>>>>our >>>>>>>>own domain. We do not whitelist our domain. I'd like to ban >>>>>>>>some of >>>>>>>>these common addresses (e.g., [EMAIL PROTECTED], >>>>>>>>[EMAIL PROTECTED], etc.) >>>>>>>> >>>>>>>>Thanks. >>>>>>>> >>>>>>>>--- >>>>>>>>[This E-mail was scanned for viruses.] >>>>>>>> >>>>>>>>--- >>>>>>>>This E-mail came from the Declude.Virus mailing list. To >>>>>>>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>>>>>type "unsubscribe Declude.Virus". The archives can be found >>>>>>>>at http://www.mail-archive.com. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>--- >>>>>>>This E-mail came from the Declude.Virus mailing list. To >>>>>>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>>>>type "unsubscribe Declude.Virus". The archives can be found >>>>>>>at http://www.mail-archive.com. >>>>>>>--- >>>>>>>[This E-mail was scanned for viruses.] >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>--- >>>>>>[This E-mail was scanned for viruses.] >>>>>> >>>>>>--- >>>>>>This E-mail came from the Declude.Virus mailing list. To >>>>>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>>>type "unsubscribe Declude.Virus". The archives can be found >>>>>>at http://www.mail-archive.com. >>>>>> >>>>>>--- >>>>>>This E-mail came from the Declude.Virus mailing list. To >>>>>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>>>type "unsubscribe Declude.Virus". The archives can be found >>>>>>at http://www.mail-archive.com. >>>>>>--- >>>>>>[This E-mail was scanned for viruses.] >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>--- >>>>>[This E-mail was scanned for viruses.] >>>>> >>>>>--- >>>>>This E-mail came from the Declude.Virus mailing list. To >>>>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>>type "unsubscribe Declude.Virus". The archives can be found >>>>>at http://www.mail-archive.com. >>>>> >>>>> >>>>> >>>>> >>>>--- >>>>This E-mail came from the Declude.Virus mailing list. To >>>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>type "unsubscribe Declude.Virus". The archives can be found >>>>at http://www.mail-archive.com. >>>>--- >>>>[This E-mail was scanned for viruses.] >>>> >>>> >>>> >>>> >>>> >>>--- >>>[This E-mail was scanned for viruses.] >>> >>>--- >>>This E-mail came from the Declude.Virus mailing list. To >>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>type "unsubscribe Declude.Virus". The archives can be found >>>at http://www.mail-archive.com. >>> >>> >>> >>--- >>This E-mail came from the Declude.Virus mailing list. To >>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>type "unsubscribe Declude.Virus". The archives can be found >>at http://www.mail-archive.com. >>--- >>[This E-mail was scanned for viruses.] >> >> >> >> >> >--- >[This E-mail was scanned for viruses.] > >--- >This E-mail came from the Declude.Virus mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.Virus". The archives can be found >at http://www.mail-archive.com. > >--- >This E-mail came from the Declude.Virus mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.Virus". The archives can be found >at http://www.mail-archive.com. >--- >[This E-mail was scanned for viruses.] > > > > > --- [This E-mail was scanned for viruses.] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
