RE: [Declude.JunkMail] External test question

2003-01-05 Thread Markus Gufler 
Hi Madscientist,

As I can understand we have a different situation here. 
I have no statistics about this but after weeks of research in smtp-
declude- and spamchk-logfiles I'm 100% sure that we will never reach
such a value. 

Assuming that with our current settings (declude + blacklists + spamchk)
we're catching only 50% of all spams, (I'm sure the real value is
appreciably higher) you can simply double the values in the
ratio-diagramm of our spam-report. Then we have a max value of 60%
during weekends and 20% during workdays.

Markus



 -Original Message-
 From: [EMAIL PROTECTED] 
 [mailto:[EMAIL PROTECTED]] On Behalf Of Madscientist
 Sent: Sunday, January 05, 2003 1:38 AM
 To: [EMAIL PROTECTED]
 Subject: RE: [Declude.JunkMail] External test question
 
 
 According to recently collected Message Sniffer logs, on 
 average more than 70% of incoming email is spam. We have an 
 extremely low reported false positive rate.
 
 _M
 
 ]-Original Message-
 ]From: [EMAIL PROTECTED]
 ][mailto:[EMAIL PROTECTED]]On Behalf Of 
 Smart Business ]Lists
 ]Sent: Saturday, January 04, 2003 4:40 PM
 ]To: Markus Gufler
 ]Subject: Re: [Declude.JunkMail] External test question
 ]
 ]
 ]Saturday, January 4, 2003 you wrote:
 ]MG A.) With identified as spam you mean they reached the 
 hold value? ]MG B.) With 2430 processed msgs you mean 
 inbound + outbound? ]MG In this case 39% is a very high 
 value if you've not some spammers ]MG as client that create 
 outgoing spam. ] ]39% is about what we saw a year ago.  Some 
 days we're as high as 80% ]held.  Our False Positives are 
 usually under 4% of held.  We manually ]inspect. ] ]Our stats 
 for last 7 days (incoming only) ](both messages and spam have 
 been down since 12/24 - ]I guess everyone has taken a bit of 
 a vacation) ]
 ]DateFpFp%  Held  Total  Held%
 ]==  ==  =    =  ==
 ]12/28/2002   5  0.94%   534841  63.50%
 ]12/29/2002   6  1.39%   432755  57.22%
 ]12/30/2002  13  2.23%   583  1,474  39.55%
 ]12/31/2002  10  1.74%   575  1,393  41.28%
 ]01/01/2003   7  1.59%   441796  55.40%
 ]01/02/2003  25  4.10%   610  1,546  39.46%
 ]01/03/2003  16  3.02%   530  1,492  35.52%
 ]
 ]
 ]Terry Fritts
 ]
 ]---
 ][This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] External test question

2003-01-05 Thread Madscientist 
Everybody's sysetm is different of course.
I only offer those statistics as additional data.
You might consider that since condtions change over time, and in particular
spam rates for any given system tend to rise over time, you should be
prepared for higher rates in the future.

Hope this helps,
_M

]-Original Message-
]From: [EMAIL PROTECTED]
][mailto:[EMAIL PROTECTED]]On Behalf Of Markus Gufler
]Sent: Sunday, January 05, 2003 8:32 AM
]To: [EMAIL PROTECTED]
]Subject: RE: [Declude.JunkMail] External test question
]
]
]Hi Madscientist,
]
]As I can understand we have a different situation here.
]I have no statistics about this but after weeks of research in smtp-
]declude- and spamchk-logfiles I'm 100% sure that we will never reach
]such a value.
]
]Assuming that with our current settings (declude + blacklists + spamchk)
]we're catching only 50% of all spams, (I'm sure the real value is
]appreciably higher) you can simply double the values in the
]ratio-diagramm of our spam-report. Then we have a max value of 60%
]during weekends and 20% during workdays.
]
]Markus
]
]
]
] -Original Message-
] From: [EMAIL PROTECTED]
] [mailto:[EMAIL PROTECTED]] On Behalf Of Madscientist
] Sent: Sunday, January 05, 2003 1:38 AM
] To: [EMAIL PROTECTED]
] Subject: RE: [Declude.JunkMail] External test question
]
]
] According to recently collected Message Sniffer logs, on
] average more than 70% of incoming email is spam. We have an
] extremely low reported false positive rate.
]
] _M
]
] ]-Original Message-
] ]From: [EMAIL PROTECTED]
] ][mailto:[EMAIL PROTECTED]]On Behalf Of
] Smart Business ]Lists
] ]Sent: Saturday, January 04, 2003 4:40 PM
] ]To: Markus Gufler
] ]Subject: Re: [Declude.JunkMail] External test question
] ]
] ]
] ]Saturday, January 4, 2003 you wrote:
] ]MG A.) With identified as spam you mean they reached the
] hold value? ]MG B.) With 2430 processed msgs you mean
] inbound + outbound? ]MG In this case 39% is a very high
] value if you've not some spammers ]MG as client that create
] outgoing spam. ] ]39% is about what we saw a year ago.  Some
] days we're as high as 80% ]held.  Our False Positives are
] usually under 4% of held.  We manually ]inspect. ] ]Our stats
] for last 7 days (incoming only) ](both messages and spam have
] been down since 12/24 - ]I guess everyone has taken a bit of
] a vacation) ]
] ]DateFpFp%  Held  Total  Held%
] ]==  ==  =    =  ==
] ]12/28/2002   5  0.94%   534841  63.50%
] ]12/29/2002   6  1.39%   432755  57.22%
] ]12/30/2002  13  2.23%   583  1,474  39.55%
] ]12/31/2002  10  1.74%   575  1,393  41.28%
] ]01/01/2003   7  1.59%   441796  55.40%
] ]01/02/2003  25  4.10%   610  1,546  39.46%
] ]01/03/2003  16  3.02%   530  1,492  35.52%
] ]
] ]
] ]Terry Fritts
] ]
] ]---
] ][This E-mail was scanned for viruses by Declude Virus
](http://www.declude.com)]
]
]---
]This E-mail came from the Declude.JunkMail mailing list.  To
]unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
]unsubscribe Declude.JunkMail.  The archives can be found at
]http://www.mail-archive.com.
]
]---
][This E-mail was scanned for viruses by Declude Virus
](http://www.declude.com)]
]
]---
]This E-mail came from the Declude.JunkMail mailing list.  To
]unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
]unsubscribe Declude.JunkMail.  The archives can be found at
]http://www.mail-archive.com.
]
]
]---
][This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] External test question

2003-01-05 Thread Markus Gufler 
Every response from people in this list helps to get a better view of
how things happen.

Thanks
Markus :-)






 -Original Message-
 From: [EMAIL PROTECTED] 
 [mailto:[EMAIL PROTECTED]] On Behalf Of Madscientist
 Sent: Sunday, January 05, 2003 4:28 PM
 To: [EMAIL PROTECTED]
 Subject: RE: [Declude.JunkMail] External test question
 
 
 Everybody's sysetm is different of course.
 I only offer those statistics as additional data.
 You might consider that since condtions change over time, and 
 in particular
 spam rates for any given system tend to rise over time, you should be
 prepared for higher rates in the future.
 
 Hope this helps,
 _M
 
 ]-Original Message-
 ]From: [EMAIL PROTECTED]
 ][mailto:[EMAIL PROTECTED]]On Behalf Of Markus Gufler
 ]Sent: Sunday, January 05, 2003 8:32 AM
 ]To: [EMAIL PROTECTED]
 ]Subject: RE: [Declude.JunkMail] External test question
 ]
 ]
 ]Hi Madscientist,
 ]
 ]As I can understand we have a different situation here.
 ]I have no statistics about this but after weeks of research in smtp-
 ]declude- and spamchk-logfiles I'm 100% sure that we will never reach
 ]such a value.
 ]
 ]Assuming that with our current settings (declude + 
 blacklists + spamchk)
 ]we're catching only 50% of all spams, (I'm sure the real value is
 ]appreciably higher) you can simply double the values in the
 ]ratio-diagramm of our spam-report. Then we have a max value of 60%
 ]during weekends and 20% during workdays.
 ]
 ]Markus
 ]
 ]
 ]
 ] -Original Message-
 ] From: [EMAIL PROTECTED]
 ] [mailto:[EMAIL PROTECTED]] On Behalf Of 
 Madscientist
 ] Sent: Sunday, January 05, 2003 1:38 AM
 ] To: [EMAIL PROTECTED]
 ] Subject: RE: [Declude.JunkMail] External test question
 ]
 ]
 ] According to recently collected Message Sniffer logs, on
 ] average more than 70% of incoming email is spam. We have an
 ] extremely low reported false positive rate.
 ]
 ] _M
 ]
 ] ]-Original Message-
 ] ]From: [EMAIL PROTECTED]
 ] ][mailto:[EMAIL PROTECTED]]On Behalf Of
 ] Smart Business ]Lists
 ] ]Sent: Saturday, January 04, 2003 4:40 PM
 ] ]To: Markus Gufler
 ] ]Subject: Re: [Declude.JunkMail] External test question
 ] ]
 ] ]
 ] ]Saturday, January 4, 2003 you wrote:
 ] ]MG A.) With identified as spam you mean they reached the
 ] hold value? ]MG B.) With 2430 processed msgs you mean
 ] inbound + outbound? ]MG In this case 39% is a very high
 ] value if you've not some spammers ]MG as client that create
 ] outgoing spam. ] ]39% is about what we saw a year ago.  Some
 ] days we're as high as 80% ]held.  Our False Positives are
 ] usually under 4% of held.  We manually ]inspect. ] ]Our stats
 ] for last 7 days (incoming only) ](both messages and spam have
 ] been down since 12/24 - ]I guess everyone has taken a bit of
 ] a vacation) ]
 ] ]DateFpFp%  Held  Total  Held%
 ] ]==  ==  =    =  ==
 ] ]12/28/2002   5  0.94%   534841  63.50%
 ] ]12/29/2002   6  1.39%   432755  57.22%
 ] ]12/30/2002  13  2.23%   583  1,474  39.55%
 ] ]12/31/2002  10  1.74%   575  1,393  41.28%
 ] ]01/01/2003   7  1.59%   441796  55.40%
 ] ]01/02/2003  25  4.10%   610  1,546  39.46%
 ] ]01/03/2003  16  3.02%   530  1,492  35.52%
 ] ]
 ] ]
 ] ]Terry Fritts
 ] ]
 ] ]---
 ] ][This E-mail was scanned for viruses by Declude Virus
 ](http://www.declude.com)]
 ]
 ]---
 ]This E-mail came from the Declude.JunkMail mailing list.  To
 ]unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
 ]unsubscribe Declude.JunkMail.  The archives can be found at
 ]http://www.mail-archive.com.
 ]
 ]---
 ][This E-mail was scanned for viruses by Declude Virus
 ](http://www.declude.com)]
 ]
 ]---
 ]This E-mail came from the Declude.JunkMail mailing list.  To
 ]unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
 ]unsubscribe Declude.JunkMail.  The archives can be found at
 ]http://www.mail-archive.com.
 ]
 ]
 ]---
 ][This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]
 
 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.
 
 ---
 [This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Completely off topic

2003-01-05 Thread David Lewis-Waller 
Sorry about this but am in a bit of a pickle and a panic. A key service
in Win2k has been removed accidently by clicking the remove service ican
(red cross). Does anyone know how to get this service (World Wide Web
Publishing Service) back?

David

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Completely off topic

2003-01-05 Thread Smart Business Lists 
David,

Sunday, January 5, 2003 you wrote:
DLW Does anyone know how to get this service (World Wide Web
DLW Publishing Service) back?

1st Try  net start world wide web publishing service

If that doesn't work I think you probably will have to reinstall -
 Start-Settings-Control Panel-Add/Remove Programs-Window Components

 


Terry Fritts

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Completely off topic

2003-01-05 Thread David Lewis-Waller 
Terry,

I was hoping you weren't going to say that. I only has TS access the
server is 280 miles away.

Cheers anway

David

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Smart Business
Lists
Sent: 05 January 2003 16:50
To: David Lewis-Waller
Subject: Re: [Declude.JunkMail] Completely off topic


David,

Sunday, January 5, 2003 you wrote:
DLW Does anyone know how to get this service (World Wide Web Publishing

DLW Service) back?

1st Try  net start world wide web publishing service

If that doesn't work I think you probably will have to reinstall -
Start-Settings-Control Panel-Add/Remove Programs-Window Components

 


Terry Fritts

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Completely off topic

2003-01-05 Thread Marc Catuogno 

I also only have TS access.  But I had the host company put the I386
directory on separate partition so I can add and remove components.
Your host company should be able to do that, thereby allowing you to
remove and re-install windows components when needed.  Good luck~

Marc

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of David
Lewis-Waller
Sent: Sunday, January 05, 2003 12:05 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Completely off topic

Terry,

I was hoping you weren't going to say that. I only has TS access the
server is 280 miles away.

Cheers anway

David

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Smart Business
Lists
Sent: 05 January 2003 16:50
To: David Lewis-Waller
Subject: Re: [Declude.JunkMail] Completely off topic


David,

Sunday, January 5, 2003 you wrote:
DLW Does anyone know how to get this service (World Wide Web Publishing

DLW Service) back?

1st Try  net start world wide web publishing service

If that doesn't work I think you probably will have to reinstall -
Start-Settings-Control Panel-Add/Remove Programs-Window Components

 


Terry Fritts

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re[2]: [Declude.JunkMail] Completely off topic

2003-01-05 Thread sbsi lists 
Hi David,

Sunday, January 5, 2003, 11:04:57 AM, you wrote:
DLW I was hoping you weren't going to say that. I only has TS access
DLW the server is 280 miles away.

Unless you don't have the I386 directory available (if you do, you're
alright) -- But, if you have to and if you have bandwidth, ZIP up the
I386, ftp it up and then UNZIP ... then you should be ok.

I had to do this a few weeks ago after an admin hosed one of their
dedicated boxes!

regards,
-jason


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Removal of tests results in mail still being caught by weight

2003-01-05 Thread Rich 
I've removed some tests for a customer that want's to receive
Freelotto.com's mails. Those tests have been commented out of his profile
with a # and the log shows them as ignored, but the message still comes up
with a weight of 25, which sends it into his spambox. Should I remove
those tests entirely? Or do I have to increase his weight
threshold? Here's a copy of the log file on the received message...

01/05/2003 09:53:08 Q70ed11a From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]
01/05/2003 09:53:13 Q710711a OSSOFT:5 SNIFFER:10 BADIPS:10 . Total weight = 25
01/05/2003 09:53:13 Q710711a Msg failed OSSOFT
(http://spamhaus.org/SBL/sbl.lasso?query=SBL5078). Action=IGNORE.
01/05/2003 09:53:13 Q710711a Msg failed SNIFFER (Message failed SNIFFER:
63.). Action=IGNORE.
01/05/2003 09:53:13 Q710711a Msg failed BADIPS ( Cable and Wireless).
Action=IGNORE.
01/05/2003 09:53:13 Q710711a Msg failed WEIGHT10 (Weight of 25 reaches or
exceeds the limit of 10.). Action=SUBJECT.
01/05/2003 09:53:13 Q710711a Msg failed WEIGHT15 (Weight of 25 reaches or
exceeds the limit of 15.). Action=IGNORE.
01/05/2003 09:53:13 Q710711a Msg failed WEIGHT20 (Weight of 25 reaches or
exceeds the limit of 20.). Action=MAILBOX.
01/05/2003 09:53:13 Q710711a Msg failed WEIGHT25 (Weight of 25 reaches or
exceeds the limit of 25.). Action=IGNORE.
01/05/2003 09:53:13 Q710711a Subject: FreeLotto Confirmation TSN 1361496252
01/05/2003 09:53:13 Q710711a From:
[EMAIL PROTECTED] To: [EMAIL PROTECTED]


--
Rich Griebel
[EMAIL PROTECTED]
http://www.kendra.com
Scanned for Viruses using Declude and F-Prot


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Removal of tests results in mail still being caught by weightbeing caught by weight

2003-01-05 Thread R. Scott Perry 


I've removed some tests for a customer that want's to receive
Freelotto.com's mails. Those tests have been commented out of his profile
with a # and the log shows them as ignored, but the message still comes up
with a weight of 25, which sends it into his spambox. Should I remove
those tests entirely? Or do I have to increase his weight
threshold? Here's a copy of the log file on the received message...


The catch here is that the weight will still be used, even if no action is 
taken on the test (since a lot of people don't take any actions on any spam 
tests, but instead only take an action on the WEIGHT tests).

In this case, increasing his weight threshold would work.
  -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.