RE: [Declude.JunkMail] Wondering about Declude 3.x
I see links for decludeproc3059.exe on the page Any clues as to how to install it? I execute it and nothing happens Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Thursday, October 20, 2005 12:44 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Wondering about Declude 3.x Yes the only change is the decludeproc.exe although in the full install now it has all the new configs and both SM and IM versions. I will put the links on the upgrade page for just the decludeproc.exe for SM and IM David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Thursday, October 20, 2005 12:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Wondering about Declude 3.x Will there be an update version or just a full install? The file looks to be 6 MB, and I bet the only change is the decludeproc.exe? - Original Message - From: David Barker [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Wednesday, October 19, 2005 2:38 PM Subject: RE: [Declude.JunkMail] Wondering about Declude 3.x Planning to post 3.0.5.9 tomorrow. Fixes include COUNTRY and MAILFROM, improved installer, autoreview directory option, error directory for files not able to be moved, smartermail forward issue resolved etc. In general we have been pleased with the results - of the outstanding issues these seem to be isolated to a specific customer environments, and we are currently working to try replicate these. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, October 19, 2005 3:25 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Wondering about Declude 3.x I appreciate the others sharing their experiences, but I was also hoping that someone from Declude could comment on the current state, any known issues, and what the plans are related to bugs and/or tweaks to the newly introduced code. Thanks, Matt Matt wrote: Since things have been quite for some time, I just wanted to check up on what is happening with 3.x. The last that I heard, there were several people having issues with multi-processor systems. The thread settings also concern me in the way that they are being implemented. It appears from reports that these can greatly affect the performance of a system (and therefore it's stability/ability), and knowing how variable E-mail can be, I'm not sure that this is something that I would want to have hard coded on my system. I would hope that there would be another way to go about this. Right now I'm on 2.0.6.16 and have been for some time, but as bugs arise, and bug fixes are released, I would like to have the peace of mind to upgrade to the latest code, but I'm not sure that I have that yet. I know that the folks at Declude have been working long and hard at this for sometime now, and I don't want to disrespect that hard work, but I would appreciate an update on where things are, and where they are going as far as the service issues go. Thanks, Matt --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: New DNS Server
I appreciate this also I tried to run it but I do not have a boot file as my server is using the registry Is there a way to accommodate that? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave DohertySent: Thursday, October 20, 2005 3:21 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] OT: New DNS Server Hi Evans- I have a working script you can grab at http://skywaves.net/utils/dns_autosecondary.txt. Change a couple of vairables, save it, call it from the task scheduler, and you're done. Instructions are included. All are welcome to use it. -DaveDoherty Skywaves, Inc. - Original Message - From: Evans Martin To: Declude.JunkMail@declude.com Sent: Thursday, October 20, 2005 1:14 AM Subject: [Declude.JunkMail] OT: New DNS Server Im running Windows 2003 and MS DNS on my primary name server. Now I need to slave another server to it. What is the quickest way to transfer all of the domains from my old server to my new one and change them all from master to slave zones? Thanks, Evans Martin --- Evans L. MartinAIM: martek01http://www.martek.net [EMAIL PROTECTED]Fax: 615-523-1679Mobile: 615-533-0197
[Declude.JunkMail] declude 3.05.5, Invuribl sniffer
=false / add key=URI_Senderbase_Magnitude_Threshold value=50 / add key=URI_Senderbase_Magnitude_Weight value=0 / !--Enables the checking of the remote mail servers IP address against Senderbase -- !--If the remote mail servers IP addresses daily magnitude exceeds the monthly magnitude -- !-- by the defined threshold the defined weight will be added (Beta 4)-- add key=Enable_RemoteMailServer_Senderbase_Magnitude_Check value=false / add key=RemoteMailServer_Senderbase_Magnitude_Threshold value=50 / add key=RemoteMailServer_Senderbase_Magnitude_Weight value=0 / /appSettings /configuration DECLUDE.CFG threads 20 waitformail 500 waitforthreads 1500 waitbetweenthreads 100 concatetelogsthreshold 10 concatetelogs Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] declude 3.05.5, Invuribl sniffer
Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Tuesday, October 11, 2005 11:15 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] declude 3.05.5, Invuribl sniffer A couple of quick suggestions: You are double-scoring here: SBL ip4rsbl-xbl.spamhaus.org * 28 0 SPAMHAUS ip4r sbl.spamhaus.org 127.0.0.2 25 0 The XBL wholly incorporates data from three highly-trusted DNSBL sources: - the CBL (Composite Block List) from cbl.abuseat.org - the BOPM (Blitzed Open Proxy Monitor) from opm.blitzed.org - the NJABL open proxy IPs list from www.njabl.org. and MAILPOLICE-BLOCK incorporates both of the mailpolice lists block.rhs.mailpolice.com - consolidated list of bulk-senders, pornographic, and fraud sites one less DNS call - Original Message - From: Harry Vanderzand [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, October 11, 2005 8:58 AM Subject: [Declude.JunkMail] declude 3.05.5, Invuribl sniffer I think I have finally got my server improved to the point where it is running smoothly and spam is getting caught to the level I have been used to. (If not better) It has been a combination of find the right declude.cfg settings for my hardware (dual xeon 3.4 ...) and also implementing Invuribl to catch this new wave of SPAM that came out at the same time we were all switching to 3.05.5. I set up the trial of invuribl and found it a worthwhile addition so I will be acquiring a licence. As Invuribl takes care of some of the tests that pre-existed in my global.cfg I would not mind seeing a global.cfg file that has been tuned for invuribl and sniffer. Sniffer is NOT running in persistent mode as that I cannot get going (everything starts backlogging) As I know many of you are into this tuning exercise I will include my varies setup files, global.cfg followed by invuribl.exe.config and declude.cfg. Any tuning assistance will be greatly appreciated. Thank you GLOBAL.CFG: # # Declude JunkMail configuration file # PIDDEBUG OFF CODE # The in the LOGFILE option gets replaced with the month/date with v1.11 and higher LOGFILE declude\dec.log LOGLEVELLOW HOP 0 #HOPHIGH 1 LOG_OK NONE # # Below are some advanced options # STOPPROCESSINGONFIRSTDELETEON CONSOLE OFF HIDETESTS CATCHALLMAILS IPNOTINMX NOLEGITCONTENT XSENDER ON XSPOOLNAME ON XINHEADER X-Note: Total spam weight of this E-mail is %WEIGHT%. XINHEADER X-Note: Spam Tests Failed: %TESTSFAILEDWITHWEIGHTS% XINHEADER X-Note: REMOTEIP: %REMOTEIP% XINHEADER X-Note: REVDNS: %REVDNS% XINHEADER X-Note: FROM: %MAILFROM% XINHEADER X-Note: TO: %RECIPHOST% XINHEADER X-Spam-Tests-Failed: %TESTSFAILED% [%WEIGHT%] XOUTHEADER X-Spam-Tests-Failed: %TESTSFAILED% [%WEIGHT%] #XINHEADER X-Country-Chain: %COUNTRYCHAIN% #XOUTHEADER X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. #IPBYPASS 127.0.0.1 #XOUTHEADER Organization: inTown Internet #WHITELIST HABEAS WHITELIST AUTH # # Definitions of the tests to use (do not edit unless you know what you are doing). # These must come before the actions. # # First is the name of the check, then the type of check (ip4r is a DNS lookup using # the reverse of the IP address). # # For type ip4r, 'matchstring' is the string to look for, or * for anything. # SPFFAIL spffail x x 3 0 AHBL ip4r dnsbl.ahbl.org * 5 0 DSBL ip4r list.dsbl.org * 8 0 ORDB ip4r relays.ordb.org * 5 0 SBL ip4rsbl-xbl.spamhaus.org * 28 0 SBBLip4rsbbl.they.com 127.0.0.240 SOLID ip4rdnsbl.solid.net 127.0.0.250 EASYNET-PROXIES ip4r proxies.blackholes.easynet.nl 127.0.0.2 7 0 SORBS-HTTP ip4r dnsbl.sorbs.net 127.0.0.2 8 0 SORBS-SOCKS ip4r dnsbl.sorbs.net 127.0.0.3 8 0 SORBS-MISC ip4r dnsbl.sorbs.net 127.0.0.4 8 0 SORBS-SMTP ip4r dnsbl.sorbs.net 127.0.0.5 7 0 SORBS-SPAM ip4r dnsbl.sorbs.net 127.0.0.6 7 0 SORBS-WEB ip4r dnsbl.sorbs.net 127.0.0.7 7 0 SORBS-BLOCK ip4r dnsbl.sorbs.net 127.0.0.8 7 0 SORBS-ZOMBIE ip4r dnsbl.sorbs.net 127.0.0.9 7 0 SORBS-DUHL ip4r dnsbl.sorbs.net 127.0.0.10 3 0 BONDEDSENDER ip4r query.bondedsender.org 127.0.0.10 -20 0 BOGUSMX rhsbl bogusmx.rfc-ignorant.org 127.0.0.8 50 DSBLMULTI ip4rmultihop.dsbl.org127.0.0.240 NJABL-DYNABLOCK ip4rdynablock.njabl.org 127.0.0.3 8 0 NJABL-RELAYS ip4rdnsbl.njabl.org 127.0.0.2 7 0 NJABL-DUL ip4rdnsbl.njabl.org 127.0.0.3 5 0N NJABL-MULTI ip4rdnsbl.njabl.org 127.0.0.5 7 0
[Declude.JunkMail] 3.05.5 issues
I find that since being on the new version that more spam is slipping through. We have imail v8.05, declude and sniffer on win 2000 server dual xeon 3.4Ghz with 2Gb ram. Threads are set to 50 with no other setting in declude.cfg Any advice you can give me to tighten it to where we had it before? I have had several clients complaining Other than changing from V2.06.16 to 3.05 nothing else has changed on the server thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: [Declude.JunkMail] 3.05.5 issues
thank you I was under the understanding given me by David from Declude that it was appropriate given the amount of power my hardware has. What would you recommend for my hardware? Thanks John, I always appreciate your active involvement in the list Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 12:11 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues Your threads is way too high, and I suspect that there are time outs occurring and not all scanning is being done. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 6:17 AMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] 3.05.5 issues I find that since being on the new version that more spam is slipping through. We have imail v8.05, declude and sniffer on win 2000 server dual xeon 3.4Ghz with 2Gb ram. Threads are set to 50 with no other setting in declude.cfg Any advice you can give me to tighten it to where we had it before? I have had several clients complaining Other than changing from V2.06.16 to 3.05 nothing else has changed on the server thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: [Declude.JunkMail] 3.05.5 issues
when I did that the machine get much busier so I set it back Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David BarkerSent: Tuesday, October 04, 2005 12:28 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues Harrymake sure you are running message Sniffer in persistent mode. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 12:27 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues thank you I was under the understanding given me by David from Declude that it was appropriate given the amount of power my hardware has. What would you recommend for my hardware? Thanks John, I always appreciate your active involvement in the list Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 12:11 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues Your threads is way too high, and I suspect that there are time outs occurring and not all scanning is being done. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 6:17 AMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] 3.05.5 issues I find that since being on the new version that more spam is slipping through. We have imail v8.05, declude and sniffer on win 2000 server dual xeon 3.4Ghz with 2Gb ram. Threads are set to 50 with no other setting in declude.cfg Any advice you can give me to tighten it to where we had it before? I have had several clients complaining Other than changing from V2.06.16 to 3.05 nothing else has changed on the server thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: [Declude.JunkMail] 3.05.5 issues
I have got it down to 15 and tried to set sniffer back to persistent mode again However I find that with sniffer in persistent mode as David suggested, the proc directory starts back logging. which means the system is not keeping up with the flow of mail. Within 20 minutes I had 1400 files in the proc directory. I stopped the sniffer service and now it is gradually catching up. Any more suggestions as to what can get tuned? I appreciate the assistance Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 1:06 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues Trial and error is best. Set it to some thing like 20 and watch what happens. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 9:27 AMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues thank you I was under the understanding given me by David from Declude that it was appropriate given the amount of power my hardware has. What would you recommend for my hardware? Thanks John, I always appreciate your active involvement in the list Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 12:11 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues Your threads is way too high, and I suspect that there are time outs occurring and not all scanning is being done. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 6:17 AMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] 3.05.5 issues I find that since being on the new version that more spam is slipping through. We have imail v8.05, declude and sniffer on win 2000 server dual xeon 3.4Ghz with 2Gb ram. Threads are set to 50 with no other setting in declude.cfg Any advice you can give me to tighten it to where we had it before? I have had several clients complaining Other than changing from V2.06.16 to 3.05 nothing else has changed on the server thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: [sniffer] [Declude.JunkMail] 3.05.5 issues
Thanks I will heed that advice Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 2:38 PMTo: Declude.JunkMail@declude.comSubject: FW: [sniffer] [Declude.JunkMail] 3.05.5 issues Did not notice the post I was responding to was sent to 2 lists. It is always best not to send a post to 2 lists at the same time. Create separate posts. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 11:07 AMTo: sniffer@SortMonster.comSubject: RE: [sniffer] [Declude.JunkMail] 3.05.5 issues Work on one thing at a time. Leave Sniffer in persistent mode and work on the threads. You have it at 15 now, and things are backing up. Turn it up to say 25 and see what happens. Also, are you running an heavy resource filters such as body filters? John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 10:45 AMTo: Declude.JunkMail@declude.comCc: sniffer@SortMonster.comSubject: RE: [sniffer] [Declude.JunkMail] 3.05.5 issues I have got it down to 15 and tried to set sniffer back to persistent mode again However I find that with sniffer in persistent mode as David suggested, the proc directory starts back logging. which means the system is not keeping up with the flow of mail. Within 20 minutes I had 1400 files in the proc directory. I stopped the sniffer service and now it is gradually catching up. Any more suggestions as to what can get tuned? I appreciate the assistance Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 1:06 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues Trial and error is best. Set it to some thing like 20 and watch what happens. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 9:27 AMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues thank you I was under the understanding given me by David from Declude that it was appropriate given the amount of power my hardware has. What would you recommend for my hardware? Thanks John, I always appreciate your active involvement in the list Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 12:11 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues Your threads is way too high, and I suspect that there are time outs occurring and not all scanning is being done. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 6:17 AMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] 3.05.5 issues I find that since being on the new version that more spam is slipping through. We have imail v8.05, declude and sniffer on win 2000 server dual xeon 3.4Ghz with 2Gb ram. Threads are set to 50 with no other setting in declude.cfg Any advice you can give me to tighten it to where we had it before? I have had several clients complaining Other than changing from V2.06.16 to 3.05 nothing else has changed on the server thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: [Declude.JunkMail] 3.05.5 issues
Could you please tell me where one can find the archives? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin CoxSent: Tuesday, October 04, 2005 1:59 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] 3.05.5 issues Check the sniffer archives for the past month for a recent discussion of proper setup of sniffer in persistent mode. If it's not set up properly it will time out, which would result in the backup you saw. Darin. - Original Message - From: Harry Vanderzand To: Declude.JunkMail@declude.com Cc: sniffer@SortMonster.com Sent: Tuesday, October 04, 2005 1:45 PM Subject: RE: [Declude.JunkMail] 3.05.5 issues I have got it down to 15 and tried to set sniffer back to persistent mode again However I find that with sniffer in persistent mode as David suggested, the proc directory starts back logging. which means the system is not keeping up with the flow of mail. Within 20 minutes I had 1400 files in the proc directory. I stopped the sniffer service and now it is gradually catching up. Any more suggestions as to what can get tuned? I appreciate the assistance Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 1:06 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues Trial and error is best. Set it to some thing like 20 and watch what happens. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 9:27 AMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues thank you I was under the understanding given me by David from Declude that it was appropriate given the amount of power my hardware has. What would you recommend for my hardware? Thanks John, I always appreciate your active involvement in the list Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Tuesday, October 04, 2005 12:11 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05.5 issues Your threads is way too high, and I suspect that there are time outs occurring and not all scanning is being done. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, October 04, 2005 6:17 AMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] 3.05.5 issues I find that since being on the new version that more spam is slipping through. We have imail v8.05, declude and sniffer on win 2000 server dual xeon 3.4Ghz with 2Gb ram. Threads are set to 50 with no other setting in declude.cfg Any advice you can give me to tighten it to where we had it before? I have had several clients complaining Other than changing from V2.06.16 to 3.05 nothing else has changed on the server thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
[Declude.JunkMail] 3.05 upgrade
I have followed the following steps: Stop the Imail SMTP service Stop the Imail Queue Manager service. rename declude.exe to declude.old Perform the upgrade. Make sure the DecludeProc service is started. (it was not) Restart the Imail SMTP and Queue Manager service. Decludeproc service was not running and the mail accumulated in the proc directory. Had to revert back to the 2.06.16 version. My Imail is 8.05 What is going wrong here. This seemed really simple. Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: [Declude.JunkMail] 3.05 upgrade
I had missed the cfg file creation. Got a call from Declude to assist me. Support was excellent and they got me going right away! Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists)Sent: Monday, September 26, 2005 5:28 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] 3.05 upgrade Did you create the file declude.cfg in the imail\declude folder per instructions on the down load site? Look at the Windows Event log, any Decludeproc stops noted? John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Monday, September 26, 2005 2:24 PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] 3.05 upgrade I have followed the following steps: Stop the Imail SMTP service Stop the Imail Queue Manager service. rename declude.exe to declude.old Perform the upgrade. Make sure the DecludeProc service is started. (it was not) Restart the Imail SMTP and Queue Manager service. Decludeproc service was not running and the mail accumulated in the proc directory. Had to revert back to the 2.06.16 version. My Imail is 8.05 What is going wrong here. This seemed really simple. Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: [Declude.JunkMail] Possible imail\declude issue
216.16.233.16 is a web site sending out orders to the mail server. There was a period of a day and a half when these orders were not received. In checking the log I found that there was a missing log. Any idea what may have caused it? Normally it all works fine Yes, John is right in correcting me. This would seem to indicate that the message wasn't fully received. Try tracerouting to 216.16.233.16 in order to see if something is dropping packets. It should automatically resend after a period of time if this is a normal mail server.MattJohn Tolmachoff (Lists) wrote: Incorrect. The missing line of the SMTPD log is a missing line, meaning either something interrupted the session or the lines are missing. Declude knows nothing of the message until after Imail SMTP service has received it in its entirety. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of MattSent: Monday, May 16, 2005 1:17 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Possible imail\declude issue Harry,That's what happens when Declude blocks an E-mail with an action like HOLD or DELETE, or it gets blocked or deleted in Declude Virus. You need to check your JunkMail and Virus logs to determine what happened.MattHarry Vanderzand wrote: I have a complaint from a clinet of missing e-mails that have a record inhis database but the e-mail was never received.Upon checking the logs I find entries as follows:05:16 15:52 SMTPD(018600DC) [216.16.233.16] MAIL FROM: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED]When they should look like:05:16 15:52 SMTPD(018600DC) [216.16.233.16] MAIL FROM: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16]D:\IMail\spool\Df9e2018600dcce43.SMD 1604The spool line is missingI cannot find any other clues as too what is happening here.Anybody have any ideas?We run i-mail 8.05, imail v1.82 and snifferHarry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Scott FisherSent: Sunday, May 15, 2005 11:30 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] German political spamI cloned the subject lines and added them in this format to help combat thebounces:BODY 150 CONTAINS SUBJECT: (marcus's subjects)- Original Message -From: "Markus Gufler" [EMAIL PROTECTED]To: Declude.JunkMail@declude.comSent: Sunday, May 15, 2005 11:41 AMSubject: RE: [Declude.JunkMail] German political spam Ok, I've added all subject line patterns (my, Marc's Nicks and bothSpamassassin cf-files) to one declude filter file.Please note that I've commented out "h eise.de" and "s piegel.de" body filter files and also that I usa a weight of 200.Markus ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. -- =MailPure custom filters for Declude JunkMail Pro.http://www.mailpure.com/software/=-- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
RE: [Declude.JunkMail] Possible imail\declude issue
sorry I mistyped my last reply. an entry in the log is missing as per the example below Does that indicate the sender aborted the submission of the mail or what. I am trying to figure out why that happens It is like it is nor getting spooled or queued. What can cause this thanks Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Tuesday, May 17, 2005 1:05 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Possible imail\declude issue Harry,The only thing that I know of that could delete a log in a normal setup would be manually configuring IMail's built in ISplCln.exe. http://support.ipswitch.com/kb/IM-19990629-DM06.htmAndrew posted some comments just a few days ago about a bug in an older versions of this: http://www.mail-archive.com/declude.junkmail@declude.com/msg22444.htmlIf you don't have this scheduled to run, then it isn't the issue.MattHarry Vanderzand wrote: 216.16.233.16 is a web site sending out orders to the mail server. There was a period of a day and a half when these orders were not received. In checking the log I found that there was a missing log. Any idea what may have caused it? Normally it all works fine Yes, John is right in correcting me. This would seem to indicate that the message wasn't fully received. Try tracerouting to 216.16.233.16 in order to see if something is dropping packets. It should automatically resend after a period of time if this is a normal mail server.MattJohn Tolmachoff (Lists) wrote: Incorrect. The missing line of the SMTPD log is a missing line, meaning either something interrupted the session or the lines are missing. Declude knows nothing of the message until after Imail SMTP service has received it in its entirety. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of MattSent: Monday, May 16, 2005 1:17 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Possible imail\declude issue Harry,That's what happens when Declude blocks an E-mail with an action like HOLD or DELETE, or it gets blocked or deleted in Declude Virus. You need to check your JunkMail and Virus logs to determine what happened.MattHarry Vanderzand wrote: I have a complaint from a clinet of missing e-mails that have a record inhis database but the e-mail was never received.Upon checking the logs I find entries as follows:05:16 15:52 SMTPD(018600DC) [216.16.233.16] MAIL FROM: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED]When they should look like:05:16 15:52 SMTPD(018600DC) [216.16.233.16] MAIL FROM: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED]05:16 15:52 SMTPD(018600DC) [216.16.233.16]D:\IMail\spool\Df9e2018600dcce43.SMD 1604The spool line is missingI cannot find any other clues as too what is happening here.Anybody have any ideas?We run i-mail 8.05, imail v1.82 and snifferHarry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Scott FisherSent: Sunday, May 15, 2005 11:30 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] German political spamI cloned the subject lines and added them in this format to help combat thebounces:BODY 150 CONTAINS SUBJECT: (marcus's subjects)- Original Message -From: "Markus Gufler" [EMAIL PROTECTED]To: Declude.JunkMail@declude.comSent: Sunday, May 15, 2005 11:41 AMSubject: RE: [Declude.JunkMail] German political spam Ok, I've added all subject line patterns (my, Marc's Nicks and bothSpamassassin cf-files) to one declude filter file.Please note that I've commented out "h eise.de" and "s piegel.de" body filter files and also that I usa a weight of 200.Markus ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The a
RE: [Declude.JunkMail] Possible imail\declude issue
I have a complaint from a clinet of missing e-mails that have a record in his database but the e-mail was never received. Upon checking the logs I find entries as follows: 05:16 15:52 SMTPD(018600DC) [216.16.233.16] MAIL FROM: [EMAIL PROTECTED] 05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED] 05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED] When they should look like: 05:16 15:52 SMTPD(018600DC) [216.16.233.16] MAIL FROM: [EMAIL PROTECTED] 05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED] 05:16 15:52 SMTPD(018600DC) [216.16.233.16] RCPT TO: [EMAIL PROTECTED] 05:16 15:52 SMTPD(018600DC) [216.16.233.16] D:\IMail\spool\Df9e2018600dcce43.SMD 1604 The spool line is missing I cannot find any other clues as too what is happening here. Anybody have any ideas? We run i-mail 8.05, imail v1.82 and sniffer Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Sunday, May 15, 2005 11:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] German political spam I cloned the subject lines and added them in this format to help combat the bounces: BODY 150 CONTAINS SUBJECT: (marcus's subjects) - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Sunday, May 15, 2005 11:41 AM Subject: RE: [Declude.JunkMail] German political spam Ok, I've added all subject line patterns (my, Marc's Nicks and both Spamassassin cf-files) to one declude filter file. Please note that I've commented out h eise.de and s piegel.de body filter files and also that I usa a weight of 200. Markus --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Mailbox stats
Does anyone have any simple software to analyze the imail logs and for a domain give stats one number of mails in and out and a list of where mails are coming from and going to?. I have a customer asking for these kind of stats and I suspect there is something out there. Would rather not spend a lot of time and effort to achieve it however. Thanks Harry Vanderzand inTown Internet Computer Services --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SMTP relay question
I have client who relay their mail thorough me As I am filtering their incoming mail for spam I have always assumed that I am filtering their outgoing mail also. Is the outgoing mail checked for spam automatically or is there a setting for that? I have just taken on another client with this setup and want to be confident in this Any help will be appreciated Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection - Computer hardware sales and service - Experienced website developers --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SMTP relay question
Just went through the manual on this and there is not much explanation I see the section in global.cfg for outgoing. It looks the same as the junkmail filters for users and domains. Is this section applicable to all outgoing mail? Can outgoing mail be filtered by domain? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, February 01, 2005 12:22 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] SMTP relay question If you have JM Pro and have the outgoing actions defined in your Global.CFG, then yes. Darin. - Original Message - From: Harry Vanderzand [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, February 01, 2005 12:17 PM Subject: [Declude.JunkMail] SMTP relay question I have client who relay their mail thorough me As I am filtering their incoming mail for spam I have always assumed that I am filtering their outgoing mail also. Is the outgoing mail checked for spam automatically or is there a setting for that? I have just taken on another client with this setup and want to be confident in this Any help will be appreciated Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection - Computer hardware sales and service - Experienced website developers --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Test needed along with sniffer
I am testing sniffer right now and wonder if I need to run all the other tests along side it. I am trying to reduce my daily workload of analyzing the spamtrap and hope that sniffer and surbl will do this. Do I even need surbl? Any advice in this matter would be greatly appreciated. Thanks in advance Harry Vanderzand inTown Internet Computer Services --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Test needed along with sniffer
I am getting service timeouts due mostly to all the declude instances of traffic volume I handle about 2 messages a day, most of them during business hours I find that I accumulate declude processes that have consumed up to a minute of cpu time only to be idle and just sit there This also causes accumulated memory to be consumed I have been rebooting this server about twice a week I have also been spending time everyday adding to my filter files The server is a dual Xeon 2.4Ghz, 533 frontside bus with an Intel SATA raid card running Raid 10 It has about 100 small web site that do not get much traffic My goal is to reduce management time of the machine and to stabilize it so the need to reboot it is lessened I am prepared to put in a dual Xeon 3.4GH, etc but also want to make sure that I do not overkill Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection - Computer hardware sales and service - Experienced website developers -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Wednesday, September 08, 2004 11:22 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Test needed along with sniffer I am testing sniffer right now and wonder if I need to run all the other tests along side it. I am trying to reduce my daily workload of analyzing the spamtrap and hope that sniffer and surbl will do this. Do I even need surbl? Do you have so much workload on your mailserver that you need to downsize your spam-filter to one or two tests? Maybe http://www2.spamchk.com/public.htm will give you some answer. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Test needed along with sniffer
Title: Message thank you Matt, I am running 179i16 so I may have another issue at hand here I have 42k myfilter file with every entry set to anywhere which essentially does a similar thing that surbl is doing. I mine the web info from them manually everyday. I do it on my own account as my account attracts a tremendous amount of spam I guess because it has been around for 10 years. Whatever gets through to it after declude has been going into my filter file I have surbl running with its 35k file I have today eliminated my filter file and will likely eliminate surbl once I get the full version of sniffer going. So far I see no more going through as it is likely that surbl has been better at that process than me. I am starting to realize that these body filters are expensive in cpu cycles I will share what I learn from all this I appreciate your assistance. Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2519-741-1222Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection- Computer hardware sales and service- Experienced website developers -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Wednesday, September 08, 2004 3:56 PMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] Test needed along with snifferHarry,Sniffer is a great addition to any Declude setup, however your issues are not due to just simply the size of your processors. We run a dual 1 GHz PIII system with RAID 5 and 5x10K Cheetahs, and we've managed to exceed 90,000 messages a day with dual virus scanners, and we could handle a bit more still. My thought is that you are either running a ton of BODY filters, a very slow virus scanner/scanners, or you are experiencing some form of I/O limitation. The idle processes also suggest that maybe there is an issue and an upgrade to a more recent version of Declude such as 1.79 or an interim release thereafter would be a good idea and most around here run them.You should be able to minimally do 10 times your current volume, so keep looking and keep describing your environment and a solution will likely come along.MattHarry Vanderzand wrote: I am getting service timeouts due mostly to all the declude instances of traffic volume I handle about 2 messages a day, most of them during business hours I find that I accumulate declude processes that have consumed up to a minute of cpu time only to be idle and just sit there This also causes accumulated memory to be consumed I have been rebooting this server about twice a week I have also been spending time everyday adding to my filter files The server is a dual Xeon 2.4Ghz, 533 frontside bus with an Intel SATA raid card running Raid 10 It has about 100 small web site that do not get much traffic My goal is to reduce management time of the machine and to stabilize it so the need to reboot it is lessened I am prepared to put in a dual Xeon 3.4GH, etc but also want to make sure that I do not overkill Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection - Computer hardware sales and service - Experienced website developers -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Markus Gufler Sent: Wednesday, September 08, 2004 11:22 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Test needed along with sniffer I am testing sniffer right now and wonder if I need to run all the other tests along side it. I am trying to reduce my daily workload of analyzing the "spamtrap" and hope that sniffer and surbl will do this. Do I even need surbl? Do you have so much workload on your mailserver that you need to downsize your spam-filter to one or two tests? Maybe http://www2.spamchk.com/public.htm will give you some answer. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
RE: [Declude.JunkMail] Test needed along with sniffer
Thank you very much. I will absorb this and share what I learn -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Wednesday, September 08, 2004 2:00 PM To: Harry Vanderzand Cc: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Test needed along with sniffer On Wednesday, September 8, 2004, 11:13:18 AM, Harry wrote: HV I am testing sniffer right now and wonder if I need to run all the HV other tests along side it. Well, you can probably get by without the other tests, but since you have Declude it would be MUCH better if you keep the other tests in place. Declude's strength is that it allows you to aggregate a variety of tests for greater accuracy. Sniffer is very, very good, but you will certainly see some benefit by using it along with other tests. HV I am trying to reduce my daily workload of analyzing the spamtrap HV and hope that sniffer and surbl will do this. Sniffer is perfect for that - particularly if you share your spamtrap data with us. Put another way, if you allow us to use your spamtrap then we will be taking over this work for you. All we need is POP3 account information and some details on how your spamtrap was formed so that we can properly classify it in our SPHUD (Spam Processing Heads Up Display). HV Do I even need surbl? Probably not. One of the AI elements in our robots crossreferences incoming spamtrap data with SURBL and other tests. More often than not we have the domain tagged before we see it in SURBL, and if we don't we grab it quickly. HV Any advice in this matter would be greatly appreciated. I recommend reviewing the Spam Test Quality Analysis: http://www2.spamchk.com/public.html You can use this to help tune your Declude configuration. I recommend applying the forumula: W = (a^2)100 Where (W) is the individual test weight (magnitude) based on test accuracy and (a) is the accuracy measured in the analysis (SA = spam-test accuracy, HA = ham-test accuracy). [ Regarding (magnitude), ham tests generate negative weights and spam tests generate positive weights. W will always be a positive value, so if you use an HA value for (a) then you will want to apply a negative W as your weight in Declude. ] For example, SNIFFER SA = 0.95, so W = ((0.95)^2)*100 = 90.25, Weight = 90. FIVETEN-SRC SA = 0.59, so W = ((0.59)^2)*100 = 34.81, Weight = 35. NOLEGITCONTENT HA=0.38, so W = ((0.38)^2)*100 = 14.44, Weight = -14 -- This test is measured when the test does not fail, so -14 must go in second weight column, not the first. If you use this analysis you should have your hold weight at or about 100. If you set your hold weight lower than 100, you will capture more spam at the risk of more false positives. If you set your hold weight higher than 100 you will have fewer false positives and more spam. !! This is research in progress - these formulas appear to work very well in preliminary testing. If you are already happy with your weighting system then you should probably stick with that until this theory has been tested further. !! We are developing a utility to do this work automatically. In the mean time, you can go through your test weights manually. You shouldn't have to do this frequently. Hope this helps, _M --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Test needed along with sniffer
Thank you, I will try the report out. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of support Sent: Wednesday, September 08, 2004 4:06 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Test needed along with sniffer Harry, We have a utility to let you know how well a specific test does in our log parser (DLAnalyzer). The test is called the Test Breakdown Summary Report. Essentially you can pick a certain test(s) and see which other tests fail along with them. This report has helped us eliminate tests that performed the same as other tests. For example you can configure the report to summarize messages that failed Sniffer. It will than show you what other tests failed on messages that also failed Sniffer. You can get more granular by even excluding tests. For example: Show me which tests were triggered in conjunction with Sniffer, but did not fail XBL. Below is the link for a sample output from this report. http://www.invariantsystems.com/dlanalyzer/testsamples/TestSum maryBreakdownR eport.html In the above report you can see that out of all messages that failed the weight30 test 85% of them also failed SPAMCOP and 63% failed XBL.. Darrell -- -- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Harry Vanderzand writes: I am testing sniffer right now and wonder if I need to run all the other tests along side it. I am trying to reduce my daily workload of analyzing the spamtrap and hope that sniffer and surbl will do this. Do I even need surbl? Any advice in this matter would be greatly appreciated. Thanks in advance Harry Vanderzand inTown Internet Computer Services --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SURBL issue
Title: Message My surbl setup has been running fine up till 1:00 am this morning my setup is: SURBL filter d:\IMail\Declude\surbl\surbl.txt x 200 In the log file I now get: Tue 09/07/2004 5:15p Update failed [conversion error] Nothing has changed in my setup and the log file has successful entries for a very long time until now Anyone have any ideas? thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2519-741-1222Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection- Computer hardware sales and service- Experienced website developers
RE: [Declude.JunkMail] SURBL issue
Following is my surbl settings, can you see anything wrong there?:
rem --- Settings (see explanation above): ---
set v_path=D:\IMail\Declude\SURBL
set v_limit=3000
set v_maxweight=20
set v_skipweight=20
set v_url=http://www.surbl.org/sc.surbl.org.rbldns
set v_exclude=test.surbl.org test.sc.surbl.org
surbl-org-permanent-test-point.com 2.0.0.127
Harry Vanderzand
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher
Sent: Tuesday, September 07, 2004 5:46 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] SURBL issue
It's working ok here just tried 2 minutes ago:
Tue 09/07/2004 4:41p Update successful [983 entries]
If it was a one time only thing, maybe you caught a bad
download or there was something bad in the zone.
A conversion error implies something wrong here:
rem --- Convert line breaks from LF to CRLF (or exit if
conversion failed): --- if exist todos.exe todos
surbl.rbldns.tmp for /f tokens=* %%c in ('findstr /r $
surbl.rbldns.tmp') do set v_result=ok if not
%v_result%==ok (set v_result=conversion error) (goto :s_end)
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 09/07/04 04:35PM
My surbl setup has been running fine up till 1:00 am this morning
my setup is:
SURBL filter d:\IMail\Declude\surbl\surbl.txt x 20 0
In the log file I now get:
Tue 09/07/2004 5:15p Update failed [conversion error]
Nothing has changed in my setup and the log file has
successful entries for a very long time until now
Anyone have any ideas?
thank you
Harry Vanderzand
inTown Internet Computer Services
11 Belmont Ave. W.
Kitchener, ON
N2M 1L2
519-741-1222
Did you know we offer:
- Province wide dial-up and high speed internet access
- Web accessible email with anti-spam\antivirus protection
- Computer hardware sales and service
- Experienced website developers
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be
found at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
[Declude.JunkMail] Some declude.exe process do not end unless the server is rebooted
I find I need to reboot the server every once in a while to clear up declude processes. Especially if I want to apply and interim release. Is there anything I should do to prevent this? Thank you Harry Vanderzand inTown Internet Computer Services --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Some declude.exe process do not end unless the server is rebooted
But I do have instances of declude process staying alive and they do not get released unless I reboot! That is my issue. After I reboot I run an update script to copy an new release. My concern is these instances that accumulate. After a week or so there are about 5 -6 instances that do not get released Harry Vanderzand inTown Internet Computer Services -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Tuesday, June 15, 2004 1:55 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Some declude.exe process do not end unless the server is rebooted Declude.exe instances fire once for each email, they don't stay resident. Instead of rebooting the server, stop your IMail SMTP and Queue services so that no mail is being processed, which means declude.exe instances won't be run. Then you can do whatever maintenance you require, and restart the services. Or how about a little script that persistently tries to copy the file, e.g. copycopy.cmd: if == %1 goto quit :mulligan @copy /y %1 declude.exe @if errorlevel 1 goto mulligan @echo New build of declude is now active! :quit --- e.g. copycopy.cmd c:\temp\declude.exe Andrew 8) -Original Message- From: Harry Vanderzand [mailto:[EMAIL PROTECTED] Sent: Tuesday, June 15, 2004 8:48 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Some declude.exe process do not end unless the server is rebooted I find I need to reboot the server every once in a while to clear up declude processes. Especially if I want to apply and interim release. Is there anything I should do to prevent this? Thank you Harry Vanderzand inTown Internet Computer Services --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Some declude.exe process do not end unless the server is rebooted
This has happened for quite some time Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection - Computer hardware sales and service - Experienced website developers -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Tuesday, June 15, 2004 5:02 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Some declude.exe process do not end unless the server is rebooted But I do have instances of declude process staying alive and they do not get released unless I reboot! ... After a week or so there are about 5 -6 instances that do not get released Are you saying that this has been happening with a number of different versions of Declude? There have been a couple cases in the past where this could happen, but I'm not aware of any known issues with Declude 1.79 or higher that could cause this. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] DNS
Whenever I have to bring my primary dns server down a lot of spam gets through. It appears that declude is only using one DNS server. Is there a way for it to use my secondary DNS when the primary is down? thanks Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Detecting disguised url's in headers
IE this url: //205.159.%372.%32%30/mort/ obviously gets translated and I could do so also. It would take a lot of extra time. I copy the url out of headers of spam that gets through and put it into my filter file. These are bothersome however. Is there a way that we could just mark these kind of mails as spam? I think it would be just spammers that do this. thanks Harry Vanderzand inTown Internet Computer Services --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Detecting disguised url's in headers
Where is this set in imail? Is it antispam of imail as we do not use it. Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection - Computer hardware sales and service - Experienced website developers -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jason Sent: Friday, March 19, 2004 1:41 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Detecting disguised url's in headers We created an Imail rule to block these. Here is what we use: (http\://\d\d\.|http\://\d\d\d\.):spambox This seems to work very well. Jason -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Friday, March 19, 2004 12:30 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Detecting disguised url's in headers IE this url: //205.159.%372.%32%30/mort/ obviously gets translated and I could do so also. It would take a lot of extra time. I copy the url out of headers of spam that gets through and put it into my filter file. These are bothersome however. Is there a way that we could just mark these kind of mails as spam? I think it would be just spammers that do this. thanks Harry Vanderzand inTown Internet Computer Services --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. [AUTOMATED NOTE: Your mail server [66.140.194.140] is missing a reverse DNS entry. All Internet hosts are required to have a reverse DNS entry. The missing reverse DNS entry will cause your mail to be treated as spam on some servers, such as AOL.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Detecting disguised url's in headers
I am not sure if my request here is being understood. I would not want to mark all messages with an IP in the url as spam. Only those messages that use %nnn%nnn%nnn etc. When you view source of an html message you can see this kind of coding. As in this case: //205.159.%372.%32%30/mort/ We always do a view source and take the url out of the source and then blacklist that, for those messages that were no caught by anti-spam at the time. I do not know what that process is called and have only ever seen it in source code of certain spam e-mail Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection - Computer hardware sales and service - Experienced website developers -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jason Sent: Friday, March 19, 2004 1:41 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Detecting disguised url's in headers We created an Imail rule to block these. Here is what we use: (http\://\d\d\.|http\://\d\d\d\.):spambox This seems to work very well. Jason -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Friday, March 19, 2004 12:30 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Detecting disguised url's in headers IE this url: //205.159.%372.%32%30/mort/ obviously gets translated and I could do so also. It would take a lot of extra time. I copy the url out of headers of spam that gets through and put it into my filter file. These are bothersome however. Is there a way that we could just mark these kind of mails as spam? I think it would be just spammers that do this. thanks Harry Vanderzand inTown Internet Computer Services --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. [AUTOMATED NOTE: Your mail server [66.140.194.140] is missing a reverse DNS entry. All Internet hosts are required to have a reverse DNS entry. The missing reverse DNS entry will cause your mail to be treated as spam on some servers, such as AOL.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] entry in log but not in header
Declude Virus should automatically block this, as it appears to contain a mailserver AV vulnerability. That is what I thought. Can you think of any reason why it did not catch it? What version of Declude are you running (\IMail\Declude -diag from a command prompt will show you)? V178i15 Do you have a line BANCRVIRUSES OFF in the \IMail\Declude\virus.cfg file? Yes I do -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] entry in log but not in header
Thank you very much Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection - Computer hardware sales and service - Experienced website developers -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, March 10, 2004 9:36 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] entry in log but not in header Do you have a line BANCRVIRUSES OFF in the \IMail\Declude\virus.cfg file? Yes I do That is why the vulnerabilities are not being caught -- that line disables all vulnerability detection in Declude Virus (which is not recommended). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] entry in log but not in header
Title: Message I am trying to understand why the headers have no indication of being scanned by declude yet I do see an entry in the declude logs. Anyone know of a reason? thank you 03/08/2004 07:50:59 Q6c210a5f00cceb07 Tests failed [weight=4]: REVDNS=WARN CATCHALLMAILS=IGNORE\ Received: from SMTP32-FWD by intown.net (SMTP32) id A04F401D6; Mon, 8 Mar 2004 07:51:00 -0500Received: from mail.finred.net.mx [82.166.2.58] by intown.net (SMTPD32-8.05) id AC21A5F00CC; Mon, 08 Mar 2004 07:50:41 -0500Received: (from [EMAIL PROTECTED]) by mail.finred.net.mx (sccrmhc13) with ESMTP id J87Gz002357269 for [EMAIL PROTECTED]; Mon, 8 Mar 2004 12:38:57 + (GMT) (envelope-from www)Message-ID: [EMAIL PROTECTED]From: "Charlsie Paul" [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: Custom Logo DesignDate: Mon, 8 Mar 2004 12:38:57 + (GMT)X-AntiAbuse: This header was added to track abuse, please include it with any abuse reportX-AntiAbuse: Primary Hostname - mail.finred.net.mxX-AntiAbuse: Original Domain - mail.finred.net.mxX-AntiAbuse: Originator/Caller UID/GID - [80 80] / [80 80]X-AntiAbuse: Sender Address Domain -MIME-Version: 1.0Content-Type: multipart/alternative; boundary="=_NextPart_000_0222_01C3C64F.FBD71A00" Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2519-741-1222
RE: [Declude.JunkMail] entry in log but not in header
Is there a way to fix this or catch it as spam? I am running declude 178i15 and imail 8.05HF1 Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 519-741-1222 Did you know we offer: - Province wide dial-up and high speed internet access - Web accessible email with anti-spam\antivirus protection - Computer hardware sales and service - Experienced website developers -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Monday, March 08, 2004 9:05 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] entry in log but not in header I am trying to understand why the headers have no indication of being scanned by declude yet I do see an entry in the declude logs. Anyone know of a reason? The key here is the end of the headers: X-AntiAbuse: Sender Address Domain - MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_000_0222_01C3C64F.FBD71A00 There are 2 things that I notice here. First is that there are no IMail headers, either (X-RCPT-To:, X-UIDL). The second is that this E-mail appears to contain the Blank Folding vulnerability (the last line of the headers contains just a single space). So the E-mail is not RFC-compliant. That blank folding is most likely what is causing the problems. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] entry in log but not in header
Is there a way to fix this or catch it as spam? I am running declude 178i15 and imail 8.05HF1 Declude Virus should automatically block this, as it appears to contain a mailserver AV vulnerability. That is what I thought. Can you think of any reason why it did not catch it? The log entry for the virus scan follows: 03/08/2004 07:50:50 Q6c210a5f00cceb07 MIME file: [text/html][7bit; Length=2931 Checksum=241661] 03/08/2004 07:50:50 Q6c210a5f00cceb07 Scanned: Virus Free [Prescan OK][MIME: 2 4314] You might want to set up a filter in Declude JunkMail for custom logo in the subject, which would block this one. It seems that these custom logo people aren't doing anything to try to hide the fact that they are selling custom logos, which makes it relatively easy to block them. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] scrambled url in source of e-mail
Title: Message How does one deal with scrambles source in the e-mail. For example I find the following address: www.%3982%30%37.biz I like to us the address in my filter file but am not sure if the scrambled form will work as I assume there must be a translation going on when this code gets processed thanks Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark SmithSent: Thursday, September 04, 2003 8:43 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Placing Weight in Header Duuuh.. Why didn't I think of that. FWIW, if you just put Weight: %WEIGHT% in the header then you might be breaking RFC's. There should be an X- before your "Weight"linewhich will denote a comment line. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of GlobalWeb.net WebmasterSent: Thursday, September 04, 2003 8:25 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Placing Weight in Header we use , in our global.cfg file, XINHEADERWeight: %WEIGHT% so you could out in yours: XINHEADERX-DECLDUE-WEIGHT:%WEIGHT% Sincerely,Randy ArmbrechtGlobal Web Solutions, Inc.804-346-5300 ext. 1877-800-GLOBAL (4562) ext. 1http://globalweb.net -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark SmithSent: Thursday, September 04, 2003 7:39 AMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Placing Weight in Header Is there any way to place the total weight in the SMTP header? Something like: X-DECLUDE-WEIGHT: yyy
[Declude.JunkMail] filter HTML source code
Title: Message Is there a way to filter the HTML source code of an e-mail. If there is then I can filter out more. thanks Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2
RE: [Declude.JunkMail] filter HTML source code
Title: Message with html many are just putting an image in the e-mail. If I can filter on the underlying url then I could stop these kinds of spam. Or is there another way? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus GuflerSent: Friday, July 25, 2003 9:03 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] filter HTML source code Harry What do you want to filter out? Markus -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Friday, July 25, 2003 2:55 PMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] filter HTML source code Is there a way to filter the HTML source code of an e-mail. If there is then I can filter out more. thanks Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2
RE: [Declude.JunkMail] filter HTML source code
Title: Message any ideas on this from anyone? I want to know if I can filter the html source code the same way the body, headers etc., can be filtered. That way when the e-mail just consists of a clickable image then I could check for offending spam web sites in the html source code Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Friday, July 25, 2003 11:06 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] filter HTML source code with html many are just putting an image in the e-mail. If I can filter on the underlying url then I could stop these kinds of spam. Or is there another way? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus GuflerSent: Friday, July 25, 2003 9:03 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] filter HTML source code Harry What do you want to filter out? Markus -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Friday, July 25, 2003 2:55 PMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] filter HTML source code Is there a way to filter the HTML source code of an e-mail. If there is then I can filter out more. thanks Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2
RE: [Declude.JunkMail] filter HTML source code
Great. That is straight forward Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, July 25, 2003 4:37 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] filter HTML source code any ideas on this from anyone? I want to know if I can filter the html source code the same way the body, headers etc., can be filtered. That way when the e-mail just consists of a clickable image then I could check for offending spam web sites in the html source code The Declude JunkMail filters will work fine with HTML source code. So if the HTML source has 'IMG SRC=http://www.example.com/pic.jpg;', you could use: BODY 0 CONTAINS http://www.example.com/pic.jpg BODY 0 CONTAINS .example.com BODY 0 CONTAINS IMG SRC=http://www.example.com; ... -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DSBL Tests - results
Is it possible to have declude do a test on the following: HEADERS 20 CONTAINSX-IMAIL-SPAM-STATISTICS: 1. I have tried this but do cannot get it working. Is this put into the headers after declude is finished? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Tuesday, June 10, 2003 4:51 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] DSBL Tests - results If you want IMail to do these tests then simply create a filter file and add it to your Global statement. FILTER-HEADER-XMAIL filter C:\IMail\Declude\IMail_Filter_Header_XHeader.txt x 0 0 Our header file: IMail_Filter_Header_XHeader.txt has the following entries: == HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-BRAZIL HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-BROADWING HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-CN-KR HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-CW HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-INFLOW HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-JAPAN HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-KOREA HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-LEVEL3 HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BHOLE-YIPES HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (BLARS HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (DELINK HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (DSBL HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (DSBLALL HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (fiveten HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (INTERSIL HEADERS 1 CONTAINS X-IMAIL-SPAM-DNSBL: (KUNDENSERVER HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (NJABL HEADERS 9 CONTAINS X-IMAIL-SPAM-DNSBL: (ORDB HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (SORBS-HTTP HEADERS 10 CONTAINS X-IMAIL-SPAM-DNSBL: (SpamCop HEADERS 8 CONTAINS X-IMAIL-SPAM-DNSBL: (SPAMHAUS HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (WIREHUB-DNSBL HEADERS 5 CONTAINS X-IMAIL-SPAM-DNSBL: (ybl HEADERS 8 CONTAINS X-IMAIL-SPAM-VALFROM: HEADERS 5 CONTAINS X-IMAIL-SPAM-VALHELO: HEADERS 12 CONTAINSX-IMAIL-SPAM-VALREVDNS Hope this helps. Remember that the text search we do is based on our definitions. For example (WIREHUB-DNSBL is what we are calling the test in IMail. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli Sent: Tuesday, June 10, 2003 4:20 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] DSBL Tests - results After I and these checks into the Antispam part of IMAIL 8 what needs to be done to have Delude know they have failed. - Original Message - From: Kami mailto:[EMAIL PROTECTED] Razvan To: [EMAIL PROTECTED] Sent: Tuesday, June 10, 2003 2:32 PM Subject: [Declude.JunkMail] DSBL Tests - results Hi; Just reporting on a finding to-date. We have included all of the ip4r tests on the Declude's site in the IMail 8 IP4r spam section. Since May 18 the following are the only tests that are triggered. We just ran a script on spam log file and the following unique tests are identified. BHOLE-CN-KR:*:cn-kr.blackholes.us BHOLE-CYPERCON:*:cybercon.blackholes.us WIREHUB-DYNA:*:dynablock.easynet.nl BHOLE-CHINA:*:china.blackholes.us WIREHUB-DNSBL:*:blackholes.easynet.nl BHOLE-SKYNETWEB:*:skynetweb.blackholes.us SORBS-HTTP:*:dnsbl.sorbs.net BHOLE-KOREA:*:korea.blackholes.us ybl:*:ybl.megacity.org BHOLE-CW:*:cw.blackholes.us COMPU:*:blackhole.compu.net BLARS:*:block.blars.org DSBL:*:list.dsbl.org NJABL:*:dnsbl.njabl.org SpamCop:*:bl.spamcop.net fiveten:*:blackholes.five-ten-sg.com BHOLE-VERIO:*:verio.blackholes.us DSBLALL:*:unconfirmed.dsbl.org We are not counting how many of each, I guess we can add that easily. For now the above are the results of almost 3 weeks. Regards, Kami --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
[Declude.JunkMail] Filter wuestio
Is there a way to put a copy of the string that matched the filter test into the headers? thanks Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] headers indicate both failed and not failed????
Can anyone tell me what is happening with the following headers? It indicates that tests failed yet at the end it says that test failed is NOINE thanks Received: from SMTP32-FWD by intown.net (SMTP32) id A062012F3; Fri, 30 May 2003 03:12:59 -0400 Received: from mail.escapees.com [207.70.132.66] by intown.net with ESMTP (SMTPD32-8.00) id A46EE000D0; Fri, 30 May 2003 03:12:46 -0400 Received: from SMTP32-FWD by mail.escapees.com (SMTP32) id A03D42CC5; Fri, 30 May 2003 02:06:10 -0500 Received: from compuserve.com [68.58.200.135] by mail.escapees.com (SMTPD32-8.00) id A2DF4E30272; Fri, 30 May 2003 02:06:07 -0500 Date: Fri, 30 May 2003 06:17:29 + From: Hailey [EMAIL PROTECTED] Subject: [SPAM WARNING]Lrosenberg, This XXX area is like no other, real explicit sex as NEVER been seen like this before!!! To: Lrosenberg [EMAIL PROTECTED] References: [EMAIL PROTECTED] In-Reply-To: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_L4GFK710_L0GFLCB7_6AD17CB X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?68.58.200.135 X-RBL-Warning: WEIGHT10: Weight of 13 reaches or exceeds the limit of 10. X-RBL-Warning: DSBL: http://dsbl.org/listing?ip=68.58.200.135 X-Declude-Sender: [EMAIL PROTECTED] [68.58.200.135] X-Note: This E-mail was scanned by Declude. X-Spam-Tests-Failed: SPAMCOP, WEIGHT10, WEIGHTWARN, DSBL X-Note: This E-mail was sent from pcp02799235pcs.goosck01.sc.comcast.net ([68.58.200.135]). X-Declude-Sender: [EMAIL PROTECTED] [207.70.132.66] X-Declude-Spoolname: D046e00e000d0aec7.SMD X-Note: Tests Failed: None Status: U X-UIDL: 354131753 Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] headers indicate both failed and not failed????
That makes sense thanks Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, May 30, 2003 9:10 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] headers indicate both failed and not failed Can anyone tell me what is happening with the following headers? It indicates that tests failed yet at the end it says that test failed is NOINE Received: from mail.escapees.com [207.70.132.66] by intown.net with ESMTP (SMTPD32-8.00) id A46EE000D0; Fri, 30 May 2003 03:12:46 -0400 Received: from compuserve.com [68.58.200.135] by mail.escapees.com (SMTPD32-8.00) id A2DF4E30272; Fri, 30 May 2003 02:06:07 -0500 It looks like the E-mail passed through 2 IMail servers, yours and mail.escapees.com. X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?68.58.200.135 X-RBL-Warning: WEIGHT10: Weight of 13 reaches or exceeds the limit of 10. X-RBL-Warning: DSBL: http://dsbl.org/listing?ip=68.58.200.135 X-Declude-Sender: [EMAIL PROTECTED] [68.58.200.135] X-Note: This E-mail was scanned by Declude. X-Spam-Tests-Failed: SPAMCOP, WEIGHT10, WEIGHTWARN, DSBL These are the headers that their Declude JunkMail added, and: X-Note: This E-mail was sent from pcp02799235pcs.goosck01.sc.comcast.net ([68.58.200.135]). X-Declude-Sender: [EMAIL PROTECTED] [207.70.132.66] X-Declude-Spoolname: D046e00e000d0aec7.SMD X-Note: Tests Failed: None These are the ones that your Declude JunkMail added. Since the server that sent you the E-mail (207.70.132.66) is not listed in any spam databases, it didn't fail any tests on your server. This is a problem inherent in E-mail forwarded from one server to another. One option in this case would be to add a line IPBYPASS 207.70.132.66 to your \IMail\Declude\global.cfg file, which will let Declude JunkMail see the IP address that actually sent the E-mail (so it will fail the SPAMCOP and DSBL tests on your server). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Is there a content test available yet?
Is there a test to can mark an item as spam based on a string match in the message. There is some spam that repeatedly comes from different hotmail addresses but the message is identical. A content spam would allow me to get rid of it Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Is there a content test available yet?
Thank you What test is it and does it put a lot more load on the system? Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, April 02, 2003 4:50 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Is there a content test available yet? Is there a test to can mark an item as spam based on a string match in the message. There is some spam that repeatedly comes from different hotmail addresses but the message is identical. A content spam would allow me to get rid of it Yes -- with Declude JunkMail Pro, you can set up a filter, that will let you check various parts of the E-mail (such as the body) for specific content. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude in front of exchange servers.
We just set up a large client who uses Exchange and set our server up as a gateway as
described by ipswitch.
It now has been 18 hours and we have prevent 100 items of Spam going to them and
trapped 5 virus occurrences (all KLEZ)
The client is very happy with having Spam removed as he knows the difference it will
make in productivity
Declude SPAM and Virus are very worthwhile
Thank you Scott for your speedy and informative responses
Harry Vanderzand
inTown Internet
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Johnson, Mike
Sent: Thursday, May 16, 2002 11:05 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Declude in front of exchange servers.
Has anyone used declude (with iMail) infront of exchange servers to filter mail? How
well does this option work?
I~
I~ II~
)_) )_) )_)
)___))___))___)\
)))_)\\
_III\\\__
-\ Venture Computer /-
^^^ \ Systems / ^ ^^
^ ^ ^^^
^^^^^
Michael Johnson, MCSE
(507) 252-5944
[EMAIL PROTECTED]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
winmail.dat
