AW: [Declude.JunkMail] blacklist file
hi, according to the manual (http://www.declude.com/Version/Manuals/JunkMail/JM_3.0.5.asp) "6.9 Your own sender blacklists" you need some file (blacklist.txt) with the adresses you want to block. this file needs lines like: @mastercardconfirm.com bad adress [EMAIL PROTECTED] spams my folders badserver.com spamsending server please note, that you need an adress AND a reason in every line. the next thing is a line in you're global cfg like: BLACKLIST fromfileC:\IMAIL\Declude\Filters\blacklist.txtx200 this would punish every mail that was send by an adress that is in you're blacklist.txt with a weight of 20 points (so this would only block the mail if you hold mails with a weight of 20 or more). if you want to block the mail right away you need a line in you're $default$.junkmail like BLACKLIST HOLD or BLACKLIST DELETE an other way to block mails by the senderadress is imail itselfe. there should be something like a "SMTP inbound kill list" (i have something like that in my imail 7.14). hope it helps best regards from germany mfgi.a.gez.markus guhl***lds nrwref. 241tel.: 0211 9449 6947fax.: 0211 9449 8344mailto:[EMAIL PROTECTED]*** Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von Craig EdmondsGesendet: Dienstag, 21. Februar 2006 11:44An: Declude.JunkMail@declude.comBetreff: [Declude.JunkMail] blacklist fileWichtigkeit: HochVertraulichkeit: Vertraulich Newbie question here Using Declude 3.05 on IMAIL. I want to blacklist email addresses so that when a spammer sends an email to my server, the email does not go through to my end users. my global.cfg file has the following line.. BLACKLIST fromfile C:\IMAIL\Declude\Filters\blacklist.txtx200 My blacklist.txt file has the following entry BLACKLIST FROM @mastercardconfirm.com Is the above syntax correct for blocking email addresses/domains? Kindest RegardsCraig Edmonds123 Marbella InternetW: www.123marbella.comE : [EMAIL PROTECTED]
AW: [Declude.JunkMail] blacklist file
hi darin, maybe my english isn't good enough. by reading it again it looks like a blank-reason is possible (all versions). it's a german habbit to follow the writen word. mfgi.a.gez.markus guhl***lds nrwref. 241tel.: 0211 9449 6947fax.: 0211 9449 8344mailto:[EMAIL PROTECTED]*** Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von Darin CoxGesendet: Dienstag, 21. Februar 2006 15:26An: Declude.JunkMail@declude.comBetreff: Re: [Declude.JunkMail] blacklist file Did the reason become a requirement in 2.0 or 3.0? It isn't required in versions prior to 2.0. Darin. - Original Message - From: Guhl, Markus (LDS) To: Declude.JunkMail@declude.com Sent: Tuesday, February 21, 2006 9:08 AM Subject: AW: [Declude.JunkMail] blacklist file hi, according to the manual (http://www.declude.com/Version/Manuals/JunkMail/JM_3.0.5.asp) "6.9 Your own sender blacklists" you need some file (blacklist.txt) with the adresses you want to block. this file needs lines like: @mastercardconfirm.com bad adress [EMAIL PROTECTED] spams my folders badserver.com spamsending server please note, that you need an adress AND a reason in every line. the next thing is a line in you're global cfg like: BLACKLIST fromfileC:\IMAIL\Declude\Filters\blacklist.txtx200 this would punish every mail that was send by an adress that is in you're blacklist.txt with a weight of 20 points (so this would only block the mail if you hold mails with a weight of 20 or more). if you want to block the mail right away you need a line in you're $default$.junkmail like BLACKLIST HOLD or BLACKLIST DELETE an other way to block mails by the senderadress is imail itselfe. there should be something like a "SMTP inbound kill list" (i have something like that in my imail 7.14). hope it helps best regards from germany mfgi.a.gez.markus guhl***lds nrwref. 241tel.: 0211 9449 6947fax.: 0211 9449 8344mailto:[EMAIL PROTECTED]*** Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von Craig EdmondsGesendet: Dienstag, 21. Februar 2006 11:44An: Declude.JunkMail@declude.comBetreff: [Declude.JunkMail] blacklist fileWichtigkeit: HochVertraulichkeit: Vertraulich Newbie question here Using Declude 3.05 on IMAIL. I want to blacklist email addresses so that when a spammer sends an email to my server, the email does not go through to my end users. my global.cfg file has the following line.. BLACKLIST fromfile C:\IMAIL\Declude\Filters\blacklist.txtx200 My blacklist.txt file has the following entry BLACKLIST FROM @mastercardconfirm.com Is the above syntax correct for blocking email addresses/domains? Kindest RegardsCraig Edmonds123 Marbella InternetW: www.123marbella.comE : [EMAIL PROTECTED]
AW: [Declude.JunkMail] adding weight based on x-country-chain
hi, it was a "experimental" test (from the time scott was in charge). but it still works (up to3.0.5.24bb). there is no documentationof this in the manuals but you can search in the archive (http://www.mail-archive.com/declude.junkmail@declude.com/). best regards from germany mfgi.a.gez.markus guhl***lds nrwref. 241tel.: 0211 9449 6947fax.: 0211 9449 8344mailto:[EMAIL PROTECTED]*** Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von Susan DuncanGesendet: Mittwoch, 15. Februar 2006 16:50An: Declude.JunkMail@declude.comBetreff: RE: [Declude.JunkMail] adding weight based on x-country-chain I was looking for this in the documentation and didnt find it in the Junkmail documentation http://www.declude.com/Version/Manuals/JunkMail/JM_2.0.6.asp I dont see anything about country nor remoteip the way you are using it (its a variable as far as I can see). I didnt see anything on the all_list.dat file either and I did text searches on the manual file. Im wondering if I am just not looking in the right place. Susan Duncan Web/Communications Officer / Agent des Communications/webUnion of Taxation Employees / Syndicat des employées de l'ImpôtTel: 613-235-6704 ext 240Fax: 613-234-7290e-mail: [EMAIL PROTECTED]http://www.ute-sei.org/ -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott FisherSent: February 15, 2006 10:15 AMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] adding weight based on x-country-chain The COUNTRY filter is used for searching the last country in the country chain. The COUNTRY filter requires the all_list.dat file. See the end of the document for a link to this file. COUNTRY was introduced in the 1.62. The COUNTRIES filter is used for searching all countries in the country chain. The COUNTRIES filter requires the all_list.dat file. See the end of the document for a link COUNTRIES was introduced in the 1.62 version. You could use a filter of: COUNTRY END IS US COUNTRY END IS CA REMOTEIP 5 CONTAINS . - Original Message - From: Susan Duncan To: Declude.JunkMail@declude.com Sent: Wednesday, February 15, 2006 8:48 AM Subject: [Declude.JunkMail] adding weight based on x-country-chain Is there a way to add a weight based on the country? I do not want to block on country, but the chances of mail coming from somewhere other than Canada or the US is fairly remote, so a weight on country + anything would mean its got a high chance of being spam. I couldnt find anything in the docs on it. Susan Duncan Web/Communications Officer / Agent des Communications/webUnion of Taxation Employees / Syndicat des employées de l'ImpôtTel: 613-235-6704 ext 240Fax: 613-234-7290e-mail: [EMAIL PROTECTED]http://www.ute-sei.org/
AW: AW: [Declude.JunkMail] Spool Directory Backed Up
hi, did you report this to support? we have a similar problem (using imail 7.15 with declude 3.0.5.23) with *.fwd, *.gse and manually moved *.smd files. support still doing some research on our problem. but we have some kind of work around: we call smtp32.exe -qr -x as a task every 60 minutes to start the imail queue-run. best regards from germany mfg i.a. gez. markus guhl *** lds nrw ref. 241 tel.: 0211 9449 6947 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von A. Clausen Gesendet: Dienstag, 24. Januar 2006 22:25 An: Declude.JunkMail@declude.com Betreff: Re: AW: [Declude.JunkMail] Spool Directory Backed Up Guhl, Markus (LDS) wrote: hi, are those files backing up regular incomming mails or are they *.fwd and *.gse files? what happens when you put a mail (d*.smd and q*.smd) into spool by hand (something like a false positiv)? which version of imail do you use? I've tried manipulating by hand. Moving data out. If I go to the spool function in Webmail it does appear that hitting send will shove through the message, but other than that, everything seems to just sit on the queue. I can't quite say for sure, but I'm fairly certain this happened after the upgrade of Declude. One curious thing is if I go to into the IMail administrator program and try through there to manually send a message, I get a window showing Declude.exe is trying to push the program. This is a big problem, and I'm just not sure where to turn. I've moved all the queue files out of the queue and putting a few in, but the files just seem to sit there and do nothing. It's quite frustrating, as everything was working fine until the Declude upgrade. -- A. Clausen --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
AW: AW: [Declude.JunkMail] Spool Directory Backed Up
hi john, we did not changed those settings when we changed from declude 2.x to 3.0.5.23 (queue timer is 20 and tries before returning to sender is also 20) but those queueruns did not even start. also a *.fwd should be processed right away (at least this was my expirience when will still used declude 2.x). when i force imail to deliver (by using send all) it works, so it looks like something is preventing imail from starting the queuerun but not from doing the queuerun. i'm just guessing, but could it be that some of the new declude-processes are blocking parts of the imail processes? best regards markus -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von John Carter Gesendet: Mittwoch, 25. Januar 2006 17:16 An: Declude.JunkMail@declude.com Betreff: RE: AW: [Declude.JunkMail] Spool Directory Backed Up In 7.X on the SMTP panel, you will have tries before returning to sender and queue timer. What are the settings there? John C -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Guhl, Markus (LDS) Sent: Wednesday, January 25, 2006 9:48 AM To: Declude.JunkMail@declude.com Subject: AW: AW: [Declude.JunkMail] Spool Directory Backed Up hi randy, since we use imail 7.15 we do not have somethimg like Queuemgr. the funny thing is, that something like that never happend with declude 2.x. it started at the very second we changed to 3.0.5.x. my declude.cfg settings are THREADS 13 CONCATENATELOGS ON #CONCATENATELOGSTHRESHOLD 50 #KEEPINDIVIDUALLOGSON WINSOCKCLEANUP ON WAITFORMAIL 1500 WAITFORTHREADS 150 WAITBETWEENTHREADS 300 as i said, declude is working on it. i do not think that it is a loadproblem. we changed during the christmasholydays (we provide the mailboxes for 6800 schools) and there was nearly no load when we first detected the problem. all incomming mails get processed and delivered (as long as those mails do not hit a forward), but all *.fwd , *.gse and manually moved *.smd files wait in the spool-directory (it looks like imail stopped it's own queue-run). best regards markus -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von GlobalWeb.net Webmaster Gesendet: Mittwoch, 25. Januar 2006 16:13 An: Declude.JunkMail@declude.com Betreff: RE: AW: [Declude.JunkMail] Spool Directory Backed Up We had a similar issue with both 8.15 and 8.2x and Declude 3.x - After calls to both Declude and then IPSwitch on separate occasions, settings were adjusted in the declude.cfg file and the Queuemgr config to better suit our mail loadsfirst up pretty high, then backed down a little lower. Since the last change, we have not had this issue present its ugly head again. What are your settings for Delivery Threads, Retry Threads and declude.cfg settings? Randy GlobalWeb.net -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Guhl, Markus (LDS) Sent: Wednesday, January 25, 2006 8:01 AM To: Declude.JunkMail@declude.com Subject: AW: AW: [Declude.JunkMail] Spool Directory Backed Up hi, did you report this to support? we have a similar problem (using imail 7.15 with declude 3.0.5.23) with *.fwd, *.gse and manually moved *.smd files. support still doing some research on our problem. but we have some kind of work around: we call smtp32.exe -qr -x as a task every 60 minutes to start the imail queue-run. best regards from germany mfg i.a. gez. markus guhl *** lds nrw ref. 241 tel.: 0211 9449 6947 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von A. Clausen Gesendet: Dienstag, 24. Januar 2006 22:25 An: Declude.JunkMail@declude.com Betreff: Re: AW: [Declude.JunkMail] Spool Directory Backed Up Guhl, Markus (LDS) wrote: hi, are those files backing up regular incomming mails or are they *.fwd and *.gse files? what happens when you put a mail (d*.smd and q*.smd) into spool by hand (something like a false positiv)? which version of imail do you use? I've tried manipulating by hand. Moving data out. If I go to the spool function in Webmail it does appear that hitting send will shove through the message, but other than that, everything seems to just sit on the queue. I can't quite say for sure, but I'm fairly certain this happened after the upgrade of Declude. One curious thing is if I go to into the IMail administrator program and try through there to manually send a message, I get a window showing Declude.exe is trying to push the program. This is a big problem, and I'm just not sure where to turn. I've moved all the queue files out of the queue and putting a few in, but the files just seem to sit there and do nothing. It's quite frustrating, as everything was working fine until the Declude upgrade. -- A. Clausen --- [This E-mail
AW: [Declude.JunkMail] Spool Directory Backed Up
hi, are those files backing up regular incomming mails or are they *.fwd and*.gse files? what happens when you put a mail (d*.smd and q*.smd) into spool "by hand" (something like a false positiv)? which version of imail do you use? regards m. guhl Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von A. ClausenGesendet: Samstag, 21. Januar 2006 00:18An: Declude.JunkMail@declude.comBetreff: Re: [Declude.JunkMail] Spool Directory Backed Up Panda Consulting S.A. Luis Alberto Arango wrote: Have you seen any of the files in the spool to see if there are real mails and not bouncing ones. Or perhaps to make sure your mailserver wasn't hikacked? Are those emails for or from your users? Make sure nobody is using your server to relay on and is sending large amounts of spam from there. That will explain why you have 37K messages in your spool what is you daily volumen of emails? Have you checked declude logs to see if they offer valuable information to determine what is going on. Do you run Imail or Smartermail? I'm running IMail. I haven't noticed anything unusual in the logs, and I'm running two Postfix boxes in front of the IMail server to ward off distributed dictionary attacks, and their config has not changed.-- A. Clausen
[Declude.JunkMail] not processed mail and hold mix up with 3.0.5.22
Title: Message hi, we thought we could use the quiet time between christmas and new-year to move from 2.0.6.14 to 3.0.5.22. but since we moved we see some strange problems, we never saw with 2.0.6.14 (or any other version before). while most of the mails are processed regular, some mails stay in the spool directory forever (d*. and q*.-file) like there is no queue-run by imail (we use 7.14). especially .gse-files are not processed. most of the .lst and .fwd files are not processed too (the funny thing is, I saw identically .fwd files, one was processed, the other stayed in spool). even worse is all false positives that put back to spool were not delivered automatically. we have to trigger send_all in imail to get those files processed. does anyone else see this problem too? (we never saw this with 2.x and declude is the only thing that changed, so I don't think this is an imail-problem) another problem is a mix-up in our hold directories. up to now we used different hold directories for some special tests. actually only mails that triggered those special tests were moved to this special hold directory. but now we find mails in special hold directories without having triggered the corresponding test. does anyone else see this problem too? to move from 2.0.6.14 to 3.0.5.22 we shut down imail services, renamed the existing declude.exe and executed the Declude_Setup.exe. then we restarted the whole server and checked for all services to be running. everything looked well. mails were floating in and get tested by junkmail and eva. spamlike mails went to hold directories, viruslike mails were caught and mails were delivered. but now we see those two problems! did we miss something? best regards from germany markus guhl***lds nrwref. 241tel.: 0211 9449 6947fax.: 0211 9449 8344mailto:[EMAIL PROTECTED]***
AW: [Declude.JunkMail] Filter not triggering
hi kevin, just guessing: is there a blank at the end of your filterline? if there is one, then the filter will not be hit by (OTC:C mfg i.a. gez. markus guhl *** lds nrw ref. 241 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Auftrag von Kevin Bilbee Gesendet: Montag, 25. Juli 2005 16:10 An: JunkMail Declude Betreff: [Declude.JunkMail] Filter not triggering The attached email is not getting trapped by my STOCKFILTER??? Here are the log lines. They do not indicate any issues with the STOCKFILTER. In the STOCKFILTER this line should be hitting BODY 10 CONTAINS (OTC: Any idea why this email is not triggering this line and assigning 10 points Could declude not be decoding the BASE64 This also seems to be an intermittent issue! 07/24/2005 19:57:36 Q551E097C0333 Filter HELOFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5. 07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15. 07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 . Total weight = 2. 07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED] to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded text or HTML section was found in this E-mail.). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 L1 Message OK 07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play 07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 200.182.78.150 ID: M2005072419564304108 07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE 07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for [copyall_account] = IGNORE WARN [LAST ACTION=WARN] 07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED] to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded text or HTML section was found in this E-mail.). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 L2 Message OK 07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play 07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [EMAIL PROTECTED] IP: 200.182.78.150 ID: M2005072419564304108 07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE 07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=WARN] 07/24/2005 19:57:36 Q551E097C0333 Cumulative action(s) taken on this email = IGNORE WARN [LAST ACTION=WARN] Kevin Bilbee --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
AW: [Declude.JunkMail] bug in jm 2.0.6
hi,
we did some testing with 2.0.6 and it looks like HOLD [Path]\%DATE% is working
fine, but HOLD [Path] is not working any more, at least on our server (it did
under 2.0.5 and it is still in the manual). without the %date% the hold action
now adresses the standard-holdpath.
markus guhl
LDSNRW
-Ursprngliche Nachricht-
Von: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Auftrag von Darrell
([EMAIL PROTECTED])
Gesendet: Freitag, 6. Mai 2005 16:06
An: Declude.JunkMail@declude.com
Betreff: Re: [Declude.JunkMail] bug in jm 2.0.6
We are using the hold action with a directory under 2.0.6 and it is working
fine.
WEIGHTHOLD HOLD F:\SPAM-HOLD\%DATE%
Darrell
invURIBL - Intelligent URI Filtering - Stops 85%+ of SPAM with the default
configuration. Try it today - http://www.invariantsystems.com
Goebbels, Bernd (LDS) writes:
hi, this morning, we updated from 2.0.5 to 2.0.6. the hold action doesn't work
properly. in $default.$junkmail, we selected a special directory for those
mails
who failed a certain test, this worked great with 2.0.5. 2.0.6 moves these
mails
to the hold directory under spool.
the manual says:
The HOLD action will move the E-mail into the \{MAILSERVER}\spool\spam
directory. This way, you can check messages to make sure they are spam before
deleting them manually (or, you can move the files (Q*.SMD and D*.SMD for
Imail
or *.EML and *.HDR for SmarterMail) back to the spool directory to have them
delivered on the next queue run (about 20-30 minutes)).
Specify the directory to hold spam in:
HOLD [Path]
we just discover this bug and immediately changed back to 2.0.5.
bernd goebbels
LDSNRW
Germany
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
Nfy^
%y j)fj)b b{.n+lzwZI[hfu%fvz
%y j)Srzjm j)Zb(
AW: [Declude.JunkMail] How do I get a copy of all messages that fail a certain test?
hi greg, maybe this will help: double the SPECIALTEST to SPECIALTESTI and SPECIALTESTII. put the action WARN to SPECIALTESTI and the action COPYTO to SPECIALTESTII change all DELETE-actions to a ROUTETO create a deliveryrule for the imail-adress the copyto and the routeto are pointig to. in this deliveryrule (like H!~SPECIALTEST) you can eliminate those messages that get routeto without hitting SPECIALTESTI this should do the following: 1. if a message just hits SPECIALTESTI (and SPECIALTESTII) but is under the deleteweight it will be delivered to the original adress and copied to your specialbox. 2. if a message hits SPECIALTESTI (and SPECIALTESTII) but is over the deleteweight it will not delivered to the original adress but routet to your specialbox. 3. if a message does't hit SPECIALTESTI (and SPECIALTESTII) but is over the deleteweight it will not delivered to the original adress but routet to your specialbox. there the deliveryrule should delete the message i hope this will help markus guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Auftrag von System Administrator Gesendet am: Dienstag, 17. August 2004 14:18 An: [EMAIL PROTECTED] Betreff: Re: [Declude.JunkMail] How do I get a copy of all messages that fail a certain test? on 8/13/04 9:55 AM, Bonno Bloksma wrote: Read the archives. A mesage cannot be *both* deleted and send to someone else. A copy to action is just adding an extra recipient to the smtp envelope. As soon as that has been done the delete action will delete it all, including the just modified smtp envelope. If you want a copyto/delete combination, use the routeto action. That will send the mesage to another e-mail adderess in stead of to the intended recipient. Routeto doesn't produce any better results than copyto. If the weight of the incoming message exceeds our delete weight then I don't receive a version of the message. I'm using the latest interim, with 2 duplicate tests with different actions. The second test uses the routeto (or copyto) action while the first test uses the warn action. I have an independent .junkmail file for the routeto (or copyto) e-mail address with no delete actions in that file. For example, a message is sent to [EMAIL PROTECTED] (which uses a .junkmail file that does contain delete actions) and the message fails SPECIALTEST and fails enough other tests to exceed our delete weight. Instead of the copyto or routeto action happening (to a special e-mail address with it's own .junkmail file which contains no delete actions) the incoming message gets deleted. 1. Things work perfectly if the message fails the SPECIALTEST and the weight of the incoming message is below the delete weight. 2. I can't remove the delete action for the delete weight, as over 100,000 messages a day exceed the delete weight. 3. The [EMAIL PROTECTED] address was just an example. Any message to any subscriber could fail the SPECIALTEST and be over the delete weight. I simply want a copy of every message that fails the SPECIALTEST. Ideas? Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
AW: [Declude.JunkMail] How do I get a copy of all messages that fail a certain test?
hi greg, try routeto instead of delete. routeto works like copyto, but without delivering the mail to the real repicient. gruesse markus guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Auftrag von System Administrator Gesendet am: Freitag, 13. August 2004 15:35 An: [EMAIL PROTECTED] Betreff: Re: [Declude.JunkMail] How do I get a copy of all messages that fail a certain test? on 8/13/04 9:18 AM, Bud Durland wrote: I belive the remedy is to create a second test, of the same type with the same criteria, and make COPYTO the action for that new test I'm currently doing that. Apparently, the over the delete weight messages get deleted before the copyto takes place. Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
AW: [Declude.JunkMail] My whitelist not working correctly
hi peter, according to the manual it should work: To whitelist an E-mail address, add a line WHITELIST FROM [EMAIL PROTECTED] to the \IMail\Declude\global.cfg file (replacing [EMAIL PROTECTED] with the address you wish to whitelist). You can also whitelist all mail from a specific domain by using WHITELIST FROM @example.com (you can whitelist a single subdomain with WHITELIST FROM @subdomain.example.com, or all subdomains with WHITELIST FROM .example.com). Note that WHITELIST FROM will whitelist a return address (like IMail does in the Kill List), which may be different from the From: or Reply-To: addresses. You need to look at the X-Declude-Sender: header (if you use the XSENDER ON option) or the MAIL FROM: line in the IMail SMTP log file to find the return address. but think twice! if you use WHITELIST FROM @example.com you would also whitelist all spam and viruses with this @example.com as faked return adress. we only whitelist by ip or content (things like special words or, if nothing else is present an url in the mail). mfg i.a. gez. markus guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Auftrag von Peter Lowish Gesendet am: Montag, 19. Juli 2004 01:15 An: [EMAIL PROTECTED] Betreff: RE: [Declude.JunkMail] My whitelist not working correctly Oh dear - thanks again - again - again Scott Can I also have WHITELIST FROM @skytv.co.nz Will that work too? Cheers Peter -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Monday, 19 July 2004 10:45 a.m. To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] My whitelist not working correctly I have a whitelist to prevent certain domain names and ip addresses being being scanned by declude. The whitelist includes the IP from where a form is sent to a series of email addresses of one client The list is called from global.cfg WHITELISTFILE C:\IMail\declude\filters\whitelist.txt The file whitelist.txt contains the line WHITELIST IP 216.71.64.89 No bad spaces and contains an empty last line The problem here is that the WHITELIST IP option only works in the global.cfg file (the whitelistfile option only allows domains and/or E-mail addresses to be whitelisted). To whitelist that IP, you would need the WHITELIST IP 216.71.64.89 line in the \IMail\Declude\global.cfg file. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] sober.h stopped?
hi, i did not catch or get any sober.h-messages for the last 3 days. is somebody still catching this spam/virus-hybrid monster? if not, why? is there any information about a deadline in this thing? as fare as i understand the sober.h-thing there was the virus sober.g that fetched the spamsending virus sober.h for the computers that it had infected. when sober.h was on a computer it shut down sober.g. now i don't see sober.h anymore. could that mean, that there is some sober.i ready to start? mfg i.a. gez. markus guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] problems with TESTSFAILED END NOTCONTAINS
Hi, i use a combo-filter DOMAINFAELSCHER, there are only 3 lines in this filter: TESTSFAILED END CONTAINS SERVEROK TESTSFAILED END NOTCONTAINS DIREKTANUNS TESTSFAILED 5 CONTAINS SPAMDOMAINS (the tests SERVEROK, DIREKTANUNS and SPAMDOMAINS are called in this order in the global.cfg) my intention is, that DOMAINFAELSCHER should only add a weight when there is no hit in SERVEROK and at least one hit in DIREKTANUNS and the mail failed SPAMDOMAINS all this 4 tests are set to warn the problem is, that sometimes i get loglines like: Qb06600e100164a8a Tests failed [weight=-13]: NOABUSE=WARN NOPOSTMASTER=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE ROUTING=WARN LAENDERPRUEFUNG=WARN SPAMDOMAINS=WARN DOMAINFAELSCHER=WARN KEINSPAMHART=WARN Why is there a DOMAINFAELSCHER=WARN without a DIREKTANUNS=WARN ? I thought TESTSFAILED END NOTCONTAINS DIREKTANUNS would stop the filter, when DIREKTANUNS is not hit? gruesse markus guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
AW: [Declude.JunkMail] problems with TESTSFAILED END NOTCONTAINS
hi scott, i downloaded the interim version this morning. but i will go to the server and check the version. mfg i.a. gez. markus guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Auftrag von R. Scott Perry Gesendet am: Montag, 21. Juni 2004 16:06 An: [EMAIL PROTECTED] Betreff: Re: [Declude.JunkMail] problems with TESTSFAILED END NOTCONTAINS i use a combo-filter DOMAINFAELSCHER, there are only 3 lines in this filter: TESTSFAILED END CONTAINS SERVEROK TESTSFAILED END NOTCONTAINS DIREKTANUNS TESTSFAILED 5 CONTAINS SPAMDOMAINS Are you running the latest interim release (which is required for NOTCONTAINS to work)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
AW: [Declude.JunkMail] problems with TESTSFAILED END NOTCONTAINS
hi scott, looks like there was a misunderstanding with my systemadmin. he puts the declude.exe of the interimversion (1.79i8) to the wrong directory (..\imail\declude). i moved it to ..\imail i will write again if the problem shows up again. mfg i.a. gez. markus guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Auftrag von Guhl, Markus (LDS) Gesendet am: Montag, 21. Juni 2004 16:19 An: [EMAIL PROTECTED] Betreff: AW: [Declude.JunkMail] problems with TESTSFAILED END NOTCONTAINS hi scott, i downloaded the interim version this morning. but i will go to the server and check the version. mfg i.a. gez. markus guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Auftrag von R. Scott Perry Gesendet am: Montag, 21. Juni 2004 16:06 An: [EMAIL PROTECTED] Betreff: Re: [Declude.JunkMail] problems with TESTSFAILED END NOTCONTAINS i use a combo-filter DOMAINFAELSCHER, there are only 3 lines in this filter: TESTSFAILED END CONTAINS SERVEROK TESTSFAILED END NOTCONTAINS DIREKTANUNS TESTSFAILED 5 CONTAINS SPAMDOMAINS Are you running the latest interim release (which is required for NOTCONTAINS to work)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
AW: [Declude.JunkMail] COMBO-Filter solution for todays german polite emails
hi markus, hi all, i just get a message with the subject: SEHBEHINDERTER VON AUSLAENDERN VERPRUEGELT it looks like sober.h but i can not find this subject in any decription of this thing. is this a new form of sober.h (sober.i?)? or is this just a subjectline that has not occured yet? mfg i.a. gez. markus guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Auftrag von Markus Gufler Gesendet am: Montag, 14. Juni 2004 07:35 An: [EMAIL PROTECTED] Betreff: RE: [Declude.JunkMail] COMBO-Filter solution for todays german polite emails Odd thing is I was nailing some of your email with interbusiness.it and I don't see that anywhere in the headers of your current messages This because I used our webmail interface to guarantee, that anyone can read this message even if he's blocking messages send from an IP that is listed in certain IP-blacklists. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
AW: [Declude.JunkMail] COMBO-Filter solution for todays german polite emails
hi markus, thanks! by the way: we use anywhere, because (like sober.g) there are so many bouncing messages from other mailservers. mfg i.a. gez. markus guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Auftrag von Markus Gufler Gesendet am: Montag, 14. Juni 2004 14:10 An: [EMAIL PROTECTED] Betreff: RE: [Declude.JunkMail] COMBO-Filter solution for todays german polite emails i just get a message with the subject: SEHBEHINDERTER VON AUSLAENDERN VERPRUEGELT it looks like sober.h but i can not find this subject in any decription of this thing. Hi Markus, Thank you for this information. Now this is my current list of subject filters. SUBJECT 200 CONTAINSASYLANT QUAELTE TIERE BRUTAL ZU TODE SUBJECT 200 CONTAINSASYLANTEN BEGRABSCHTEN DEUTSCHES MAEDCHEN SUBJECT 200 CONTAINSAuf Kosten der deutschen Beitragszahler und Rentner! SUBJECT 200 CONTAINSAugen auf! (So sieht es aus!) SUBJECT 200 CONTAINSAuslaender erschleichen sich zunehmend Sozialleistungen SUBJECT 200 CONTAINSAuslaenderanteile in Schweizer Gefaengnissen SUBJECT 200 CONTAINSAUSLAENDERGEWALT BEIM HAFENGEBURTSTAG SUBJECT 200 CONTAINSAuslaendergewalt: Herr Rau, wo waren Sie? SUBJECT 200 CONTAINSAuslaenderkriminalitaet steigt weiter! SUBJECT 200 CONTAINSBankrott des Gesundheitswesens durch Auslaender! SUBJECT 200 CONTAINSBin ich zu weltfremd? Ich glaube wohl kaum SUBJECT 200 CONTAINSDas kann unmoeglich sein -Leserbrief- SUBJECT 200 CONTAINSDEUTSCHES MAEDCHEN FAST VERGEWALTIGT SUBJECT 200 CONTAINSDie Deform der sozialen Ordnung SUBJECT 200 CONTAINSDiplomatische Zensur SUBJECT 200 CONTAINSEU Beitritt der Tuerkei ? SUBJECT 200 CONTAINSEU gibt Erwerbslosen volle Freizuegigkeit SUBJECT 200 CONTAINSGarather klagen ueber eskalierende Gewalt im Stadtteil! SUBJECT 200 CONTAINSGeschrieben von Margrit am 07. April 2004 SUBJECT 200 CONTAINSLibanesen in Berlin SUBJECT 200 CONTAINSMarokkanischer Wiederholungstaeter vergewaltigte 17-jaehriges Maedel SUBJECT 40 CONTAINS Medienzensur SUBJECT 200 CONTAINSMehr fuer Auslaender als fuer Deutsche tun! SUBJECT 200 CONTAINSMoschee-Bau in Deutschland SUBJECT 200 CONTAINSMULTI-KULTI-BANDE TYRANNISIERTE MITSCHUELER SUBJECT 200 CONTAINSNein zum Zuwanderungsgesetz ! SUBJECT 200 CONTAINSNeue Voelkerwanderung droht! SUBJECT 200 CONTAINSParadies Bundesrepublik - Rente fuer die Welt - SUBJECT 200 CONTAINSPolizei traute sich nicht, kriminellen Auslaender festzunehmen SUBJECT 200 CONTAINSRichter unterstuetzt kriminelle Auslaenderin SUBJECT 200 CONTAINSSEHBEHINDERTER VON AUSLAENDERN VERPRUEGELT SUBJECT 200 CONTAINSSkandal in Berlin SUBJECT 200 CONTAINSSkandalurteil in Darmstadt SUBJECT 200 CONTAINSSo sieht die Wahrheit aus! SUBJECT 200 CONTAINSTUERKEN-TERROR AM HIMMELFAHRTSTAG SUBJECT 200 CONTAINSWas Deutschland braucht, sind deutsche Kinder! SUBJECT 200 CONTAINSWer an ein Tabu ruehrt, muss und darf vernichtet werden SUBJECT 200 CONTAINSWir haben die Auslaender doch geholt?! I don't know what version of virus this zombies are running. All this spam messages are clean and contain only a text part. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
AW: [Declude.JunkMail] Updates to the confic file
Title: AW: [Declude.JunkMail] Updates to the confic file hi, i just (13:00 CET) get me the global.cfg and found: MONKEYFORMMAIL ip4r formmail.relays.monkeys.com * 7 0 MONKEYPROXIES ip4r proxies.relays.monkeys.com * 7 0 in it. are they back? i thought they went down 8 months ago? mfg i.a. gez. markus guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: R. Scott Perry [mailto:[EMAIL PROTECTED]] Gesendet am: Dienstag, 13. April 2004 18:40 An: [EMAIL PROTECTED] Betreff: Re: [Declude.JunkMail] Updates to the confic file Where do I find and updated version of the rbl's used per default ? And there settings Or has they not been changed for the last 6 -8 months ? We constantly update the config files, as old spam databases are killed off and new ones are added. You can find the latest config files at http://www.declude.com/junkmail/manual.htm . -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
AW: [Declude.JunkMail] BODY FILTER Question
hi, i don't it will work. there is nothing like BODYFILTER within a filter. i think you should try: BODYFILTER filter E:\Imail\Declude\Filters\bodyfilter.txt with ANYWHERE 0CONTAINS sex ANYWHERE 0 CONTAINS sexy ANYWHERE 0 CONTAINS S badword that would search for those words in the whole messages (including the header) or BODYFILTER filter E:\Imail\Declude\Filters\bodyfilter.txt with BODY 0 CONTAINS sex BODY 0 CONTAINS sexy BODY 0 CONTAINS badword that would search only in the body gruessemarkus guhl***lds nrwdez. 235tel.: 0211 9449 2578fax.: 0211 9449 8344mailto:[EMAIL PROTECTED]*** -Ursprüngliche Nachricht-Von: Kevin Shimwell [mailto:[EMAIL PROTECTED]Gesendet am: Donnerstag, 25. März 2004 14:14An: Declude Junk MailBetreff: [Declude.JunkMail] BODY FILTER Question On this same subject I want a filter for body text Such as BODYFILTER filter E:\Imail\Declude\Filters\bodyfilter.txt x 0 And I want it to find exact words Will this filter work? BODYFILTER filter E:\Imail\Declude\Filters\bodyfilter.txt with BODYFILTER 0 IS sex BODYFILTER 0 IS sexy BODYFILTER 0 IS badword Kevin ShimwellLink Brokers Group, LLC ( Support )1600 Hwy 17 SouthNorth Myrtle Beach, SC 29582Phone: 843-663-1004Fax: 843-663-1007Email: [EMAIL PROTECTED]24/7 Support http://www.linkbrokers.com/support_ticket.cfmSupport M-F 1-888-546-5631
AW: [Declude.JunkMail] link
if you are looking for the interim versions: http://www.declude.com/interim/ mfgi.a.gez. markus guhl***lds nrwdez. 235tel.: 0211 9449 2578fax.: 0211 9449 8344mailto:[EMAIL PROTECTED]*** -Ursprüngliche Nachricht-Von: Chris Dufala [mailto:[EMAIL PROTECTED]Gesendet am: Mittwoch, 24. März 2004 17:32An: [EMAIL PROTECTED]Betreff: [Declude.JunkMail] link Can someone send me the link for the updates? Thanks, Chris Dufala, CCNA, MCP+I, MCSE Efficiency Experts, LLC. www.esquared.cc 727.939.8112 813.354.4467(fax)
AW: [Declude.JunkMail] Filters and outputs (perhaps)
Title: AW: [Declude.JunkMail] Filters and outputs (perhaps) you can set the loglevel in the global.cfg to HIGH. afther this you will find the words that triggered the filter in the logfile. mfg i.a. gez. m. guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: EN [mailto:[EMAIL PROTECTED]] Gesendet am: Montag, 9. Februar 2004 15:21 An: [EMAIL PROTECTED] Betreff: [Declude.JunkMail] Filters and outputs (perhaps) I have a filter that scans an email and looks for certain words that may be inappropriate. It does a great job, but sometimes a bit too great. I've taken out most of the small words that may just appear in non-graphic words, but sometimes there are still emails that get caught and I have no idea what the word is. I've looked through my filters tons of times, am positive that it's pretty good. Now, is there a way to have the word that triggered the filter appear somewhere in the headers, or anywhere else? Just a thought, cuz it's the small ones that are driving me pretty insane. Thanks, Ernesto --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
AW: [Declude.JunkMail] Blocking the attached message
Title: AW: [Declude.JunkMail] Blocking the attached message hi sharyn, up to now i block this one with the following to filterlines ANYWHERE 30 CONTAINS .com/v9.gif ANYWHERE 30 CONTAINS .com/z7.gif i found one of those gifs in all spams from this sender, the url itselfe changes, but the gifs are the same all the time. mfg i.a. gez. guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: Sharyn Schmidt [mailto:[EMAIL PROTECTED]] Gesendet am: Dienstag, 3. Februar 2004 15:01 An: 'Declude Junkmail List' Betreff: [Declude.JunkMail] Blocking the attached message Sorry, folks, to attach spam to an email but this is driving me NUTS. No matter what I do, I can't seem to block this! Is anyone else successfully blocking this one? Thanks, ~Sharyn~ Network Administrator Todhunter Information Systems Helping You Meet Our Customers' Needs Through Better Information -Original Message- From: Margo Terry [mailto:[EMAIL PROTECTED]] Sent: Sunday, February 01, 2004 5:33 PM To: [EMAIL PROTECTED] Subject: Re: Prescrip*tion Dr]ugs - Easy Ordering and Fast Delivery
AW: [Declude.JunkMail] Blocking the attached message
Title: AW: [Declude.JunkMail] Blocking the attached message ups, just got one with .com/g9.gif so i have to extend my filter. but i still think the gif is the pattern. mfgi.a.gez. guhl***lds nrwdez. 235tel.: 0211 9449 2578fax.: 0211 9449 8344mailto:[EMAIL PROTECTED]*** -Ursprüngliche Nachricht-Von: Guhl, Markus (LDS) Gesendet am: Dienstag, 3. Februar 2004 15:19An: [EMAIL PROTECTED]Betreff: AW: [Declude.JunkMail] Blocking the attached message hi sharyn, up to now i block this one with the following to filterlines ANYWHERE 30 CONTAINS .com/v9.gif ANYWHERE 30 CONTAINS .com/z7.gif i found one of those gifs in all spams from this sender, the url itselfe changes, but the gifs are the same all the time. mfg i.a. gez. guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: Sharyn Schmidt [mailto:[EMAIL PROTECTED]] Gesendet am: Dienstag, 3. Februar 2004 15:01 An: 'Declude Junkmail List' Betreff: [Declude.JunkMail] Blocking the attached message Sorry, folks, to attach spam to an email but this is driving me NUTS. No matter what I do, I can't seem to block this! Is anyone else successfully blocking this one? Thanks, ~Sharyn~ Network Administrator Todhunter Information Systems "Helping You Meet Our Customers' Needs Through Better Information" -Original Message- From: Margo Terry [mailto:[EMAIL PROTECTED]] Sent: Sunday, February 01, 2004 5:33 PM To: [EMAIL PROTECTED] Subject: Re: Prescrip*tion Dr]ugs - Easy Ordering and Fast Delivery
[Declude.JunkMail] strange log with minweight
Title: strange log with minweight hi, on loglevel high i found some stranges lines for some of my counterbalance filters. in those filters i use minweight -45. so i expect somthing like Filter: Set min weight to -45 but i found: 1/22/2004 14:54:26 Qd5ff0626008e60e7 Filter: Set min weight to . 01/22/2004 14:54:28 Qd5ff0626008e60e7 Triggered CONTAINS filter KEINSPAMHART on spamtest1 [weight--20; spamtest1 01/22/2004 14:54:28 Qd5ff0626008e60e7 Filter: Set min weight to . 01/22/2004 14:54:28 Qd5ff0626008e60e7 Triggered CONTAINS filter KEINSPAMWEICH on spamtest2 [weight--15; spamtest2 is it not possible to use minweight with negativ weights? mfg i.a. gez. markus guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] ***
AW: [Declude.JunkMail] #-coded spam
Title: AW: [Declude.JunkMail] #-coded spam hi scott, up to now i am doing fine with a filter looking for some encoded letters that don't have to be encoded, not even in german (like #101, better known as e). giving the whole thing a second thought i think it is better to filter for some encoded letters (5 to 10) then to decode the whole mail and let it run against several filters. i like the thought that the spammers help me to save some resources! mfg i.a. gez. markus guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: R. Scott Perry [mailto:[EMAIL PROTECTED]] Gesendet am: Donnerstag, 8. Januar 2004 14:26 An: [EMAIL PROTECTED] Betreff: Re: [Declude.JunkMail] #-coded spam during the last 2 days i found several spams where to whole body was coded in ASCII numbers (#followed by the ascii number of the letter like #32 for ) right now i filter for some strings like #111;#114;#100;#101;#114;#32 (means order ). does jm decodes this kind of coded mailbodys before the filters run? No. Declude handles some SMTP-level encoding (such as base64 bodies), but does not attempt to decode HTML. if not is there a possibility that jm will decode this in the future? It is possible. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] #-coded spam
Title: #-coded spam hi, during the last 2 days i found several spams where to whole body was coded in ASCII numbers (#followed by the ascii number of the letter like #32 for ) right now i filter for some strings like #111;#114;#100;#101;#114;#32 (means order ). does jm decodes this kind of coded mailbodys before the filters run? if not is there a possibility that jm will decode this in the future? mfg i.a. gez. markus guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] ***
AW: AW: [Declude.JunkMail] More ATTACH and MAILBOX questions
Title: AW: AW: [Declude.JunkMail] More ATTACH and MAILBOX questions thank you, great news!! mfg i.a. gez. guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: R. Scott Perry [mailto:[EMAIL PROTECTED]] Gesendet am: Montag, 1. Dezember 2003 16:18 An: [EMAIL PROTECTED] Betreff: Re: AW: [Declude.JunkMail] More ATTACH and MAILBOX questions since more then 2000 of my users use web messaging the attach action is no real option for me. i use declude virus as well and there i use the emailnotifikation for the recipient when an email is hold because of a vulnerability. in this notification i give the queue file name of the hold email to the recipient and let him decide if he wants the message to be delivered (right now we do this by hand, but we working on an other way). if there would be a notification based an the hold action in jm, i could use it in a similar way (at least for those messages with a weight on the edge between legal and spam). the best thing would be, if i had something like skipifweightishigher in the eml for this! We are actually looking into notifications for Declude JunkMail (where the notifications could be batched, too, such as daily notifications). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
AW: [Declude.JunkMail] More ATTACH and MAILBOX questions
Title: AW: [Declude.JunkMail] More ATTACH and MAILBOX questions hi scott, since more then 2000 of my users use web messaging the attach action is no real option for me. i use declude virus as well and there i use the emailnotifikation for the recipient when an email is hold because of a vulnerability. in this notification i give the queue file name of the hold email to the recipient and let him decide if he wants the message to be delivered (right now we do this by hand, but we working on an other way). if there would be a notification based an the hold action in jm, i could use it in a similar way (at least for those messages with a weight on the edge between legal and spam). the best thing would be, if i had something like skipifweightishigher in the eml for this! mfg i.a. gez. guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: R. Scott Perry [mailto:[EMAIL PROTECTED]] Gesendet am: Montag, 10. November 2003 21:22 An: [EMAIL PROTECTED] Betreff: Re: [Declude.JunkMail] More ATTACH and MAILBOX questions I'm testing out the ATTACH and MAILBOX options. In web messaging many of the Declude tagged MAILBOX and ATTACH messages do not display the Declude spam hider info. or appear as attachments. Is this are there workarounds for web messaging? I believe that IMail's web messaging doesn't support E-mail attachments (E-mails within a E-mail) that the ATTACH action uses. Unfortunately, I don't know of any workaround. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
AW: [Declude.JunkMail] DNS Report
right now i was able to get the site mfg i.a. gez. guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] im Auftrag von Greg Foulks Gesendet am: Montag, 13. Oktober 2003 16:30 An: Declude JunkMail (E-mail) Betreff: [Declude.JunkMail] DNS Report Is anyone able to get to the site? www.dnsreport.com Just want to make sure that it's just not me that is having problems. Thanks, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
AW: [Declude.JunkMail] Spammers take a Holiday?
think of sobig.f. it generates a large amount of virus mails. some of my customers think that i spam them with virusnotifications! mfg i.a. gez. guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: John Shacklett [mailto:[EMAIL PROTECTED] Gesendet am: Dienstag, 2. September 2003 15:19 An: [EMAIL PROTECTED] Betreff: RE: [Declude.JunkMail] Spammers take a Holiday? I had a funny thing happen over the weekend, I had more items in spool/virus than in spool/spam at one point. I'm speechless. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Todd - Smart Mail Sent: Tuesday, 02 September 2003 8:33 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spammers take a Holiday? Spam we caught yesterday was down by about 30% - 40%. Anyone else notice this? Todd Hunter Progressive Systems --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
