Re: [Declude.JunkMail] BODY STARTSWITH
Matt, I was noticing that you are using END in this file. How is that feature enabled? When I add END to any of my files, it seems that JunkMail just skips the entire files. Is there something that you need to add to the global.cfg to enable this filter feature? Bill - Original Message - From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 25, 2003 4:12 PM Subject: Re: [Declude.JunkMail] BODY STARTSWITH Munged twice so far, so I am resending this time without the zip file attachment in the event that there is some sort of restriction on this. The referenced file can be downloaded from the following link: http://www.mailpure.com/software/decludefilters/gibberish/Gibberish_v2-0-0.txt Matt Original Message Subject: Re: [Declude.JunkMail] BODY STARTSWITH Date: Tue, 25 Nov 2003 18:39:22 -0500 From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Scott, I've attached a new copy of the GIBBERISH filter that makes use of the END and MAXPOINTS functionality that was discussed previously. Am I correct that these can also be used now with Declude JunkMail Pro v1.76i27? And if so, did I follow the implemented methodology? Essentially, I'm using the functionality to simplify into one file and save on processing. I tried to order things within the file so that the most common END statements would be hit first, and I scored the Main Filter hits at 1000 so that it would be easy for an administrator to modify the scoring by just adjusting the MAXPOINTS entry. The MAXPOINTS entry should keep the filter from adding points incrementally, and it should end the test after one hit, producing no more score than the MAXPOINTS entry allows. Scoring isn't applied to the filter in the Global.cfg file since it is all handled internal to the filter. Note to fellow admins: This file also hasn't been tested because I am not yet using the proper release. I'm really just putting it out there to see if Scott can tell me if I got the idea right. I must stress that this is not intended to be used for any versions of Declude JunkMail Pro prior to v1.76i27 because it could result in assessing 1000 or more points without proper software support, and it may have other issues. Please do not put this into a production environment unless you understand what you are doing and are going to monitor it closely. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] BODY STARTSWITH
Bill, I haven't seen an absolute confirmation that this functionality works yet as I haven't yet integrated this filter into my system using the new code. The END functionality though is something that Scott said he would include along with MAXWEIGHT, MINWEIGHT, SKIPIFWEIGHT, and some logging options for weighting, and he described how it works in his response to my question for added functionality in his message on 11/14. I'll explain it further if that message doesn't do it for you. Matt Bill Landry wrote: Matt, I was noticing that you are using END in this file. How is that feature enabled? When I add END to any of my files, it seems that JunkMail just skips the entire files. Is there something that you need to add to the global.cfg to enable this filter feature? Bill - Original Message - From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 25, 2003 4:12 PM Subject: Re: [Declude.JunkMail] BODY STARTSWITH Munged twice so far, so I am resending this time without the zip file attachment in the event that there is some sort of restriction on this. The referenced file can be downloaded from the following link: http://www.mailpure.com/software/decludefilters/gibberish/Gibberish_v2-0-0.txt Matt Original Message Subject: Re: [Declude.JunkMail] BODY STARTSWITH Date: Tue, 25 Nov 2003 18:39:22 -0500 From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Scott, I've attached a new copy of the GIBBERISH filter that makes use of the END and MAXPOINTS functionality that was discussed previously. Am I correct that these can also be used now with Declude JunkMail Pro v1.76i27? And if so, did I follow the implemented methodology? Essentially, I'm using the functionality to simplify into one file and save on processing. I tried to order things within the file so that the most common END statements would be hit first, and I scored the Main Filter hits at 1000 so that it would be easy for an administrator to modify the scoring by just adjusting the MAXPOINTS entry. The MAXPOINTS entry should keep the filter from adding points incrementally, and it should end the test after one hit, producing no more score than the MAXPOINTS entry allows. Scoring isn't applied to the filter in the Global.cfg file since it is all handled internal to the filter. Note to fellow admins: This file also hasn't been tested because I am not yet using the proper release. I'm really just putting it out there to see if Scott can tell me if I got the idea right. I must stress that this is not intended to be used for any versions of Declude JunkMail Pro prior to v1.76i27 because it could result in assessing 1000 or more points without proper software support, and it may have other issues. Please do not put this into a production environment unless you understand what you are doing and are going to monitor it closely. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] BODY STARTSWITH
MINWEIGHT How does that work? - Original Message - From: Bill Landry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, December 02, 2003 5:12 PM Subject: Re: [Declude.JunkMail] BODY STARTSWITH Thanks Matt, I was able to accomplish what I wanted using MINWEIGHT. Bill - Original Message - From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, December 02, 2003 1:59 PM Subject: Re: [Declude.JunkMail] BODY STARTSWITH Bill, I haven't seen an absolute confirmation that this functionality works yet as I haven't yet integrated this filter into my system using the new code. The END functionality though is something that Scott said he would include along with MAXWEIGHT, MINWEIGHT, SKIPIFWEIGHT, and some logging options for weighting, and he described how it works in his response to my question for added functionality in his message on 11/14. I'll explain it further if that message doesn't do it for you. Matt Bill Landry wrote: Matt, I was noticing that you are using END in this file. How is that feature enabled? When I add END to any of my files, it seems that JunkMail just skips the entire files. Is there something that you need to add to the global.cfg to enable this filter feature? Bill - Original Message - From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 25, 2003 4:12 PM Subject: Re: [Declude.JunkMail] BODY STARTSWITH Munged twice so far, so I am resending this time without the zip file attachment in the event that there is some sort of restriction on this. The referenced file can be downloaded from the following link: http://www.mailpure.com/software/decludefilters/gibberish/Gibberish_v2-0-0. txt Matt Original Message Subject: Re: [Declude.JunkMail] BODY STARTSWITH Date: Tue, 25 Nov 2003 18:39:22 -0500 From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Scott, I've attached a new copy of the GIBBERISH filter that makes use of the END and MAXPOINTS functionality that was discussed previously. Am I correct that these can also be used now with Declude JunkMail Pro v1.76i27? And if so, did I follow the implemented methodology? Essentially, I'm using the functionality to simplify into one file and save on processing. I tried to order things within the file so that the most common END statements would be hit first, and I scored the Main Filter hits at 1000 so that it would be easy for an administrator to modify the scoring by just adjusting the MAXPOINTS entry. The MAXPOINTS entry should keep the filter from adding points incrementally, and it should end the test after one hit, producing no more score than the MAXPOINTS entry allows. Scoring isn't applied to the filter in the Global.cfg file since it is all handled internal to the filter. Note to fellow admins: This file also hasn't been tested because I am not yet using the proper release. I'm really just putting it out there to see if Scott can tell me if I got the idea right. I must stress that this is not intended to be used for any versions of Declude JunkMail Pro prior to v1.76i27 because it could result in assessing 1000 or more points without proper software support, and it may have other issues. Please do not put this into a production environment unless you understand what you are doing and are going to monitor it closely. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] BODY STARTSWITH
Fred, It's probably best to go back and reference the follow up posts to that thread. This isn't going to be anywhere near as common as MAXWEIGHT, but it provides the same sort of functionality for negative weighted tests (limits total scoring and ends processing of a filter when that threshold is reached). Matt Frederick Samarelli wrote: MINWEIGHT How does that work? - Original Message - From: Bill Landry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, December 02, 2003 5:12 PM Subject: Re: [Declude.JunkMail] BODY STARTSWITH Thanks Matt, I was able to accomplish what I wanted using MINWEIGHT. Bill - Original Message - From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, December 02, 2003 1:59 PM Subject: Re: [Declude.JunkMail] BODY STARTSWITH Bill, I haven't seen an absolute confirmation that this functionality works yet as I haven't yet integrated this filter into my system using the new code. The END functionality though is something that Scott said he would include along with MAXWEIGHT, MINWEIGHT, SKIPIFWEIGHT, and some logging options for weighting, and he described how it works in his response to my question for added functionality in his message on 11/14. I'll explain it further if that message doesn't do it for you. Matt Bill Landry wrote: Matt, I was noticing that you are using END in this file. How is that feature enabled? When I add END to any of my files, it seems that JunkMail just skips the entire files. Is there something that you need to add to the global.cfg to enable this filter feature? Bill - Original Message - From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 25, 2003 4:12 PM Subject: Re: [Declude.JunkMail] BODY STARTSWITH Munged twice so far, so I am resending this time without the zip file attachment in the event that there is some sort of restriction on this. The referenced file can be downloaded from the following link: http://www.mailpure.com/software/decludefilters/gibberish/Gibberish_v2-0-0. txt Matt Original Message Subject: Re: [Declude.JunkMail] BODY STARTSWITH Date: Tue, 25 Nov 2003 18:39:22 -0500 From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Scott, I've attached a new copy of the GIBBERISH filter that makes use of the END and MAXPOINTS functionality that was discussed previously. Am I correct that these can also be used now with Declude JunkMail Pro v1.76i27? And if so, did I follow the implemented methodology? Essentially, I'm using the functionality to simplify into one file and save on processing. I tried to order things within the file so that the most common END statements would be hit first, and I scored the Main Filter hits at 1000 so that it would be easy for an administrator to modify the scoring by just adjusting the MAXPOINTS entry. The MAXPOINTS entry should keep the filter from adding points incrementally, and it should end the test after one hit, producing no more score than the MAXPOINTS entry allows. Scoring isn't applied to the filter in the Global.cfg file since it is all handled internal to the filter. Note to fellow admins: This file also hasn't been tested because I am not yet using the proper release. I'm really just putting it out there to see if Scott can tell me if I got the idea right. I must stress that this is not intended to be used for any versions of Declude JunkMail Pro prior to v1.76i27 because it could result in assessing 1000 or more points without proper software support, and it may have other issues. Please do not put this into a production environment unless you understand what you are doing and are going to monitor it closely. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- === Matthew S. Bramble President and Technical Coordinator iGaia Incorporated, Operator
Re: [Declude.JunkMail] BODY STARTSWITH
I use it the exact opposite to MAXWEIGHT, which allows me to set a minimum
weight that I do not want a filter weight to go below. For example:
MINWEIGHT-5
will tell JunkMail not to apply a weight lower then -5 to the message, even
if the actual weight is lower then -5.
HTH,
Bill
- Original Message -
From: Frederick Samarelli [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, December 02, 2003 2:28 PM
Subject: Re: [Declude.JunkMail] BODY STARTSWITH
MINWEIGHT
How does that work?
- Original Message -
From: Bill Landry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, December 02, 2003 5:12 PM
Subject: Re: [Declude.JunkMail] BODY STARTSWITH
Thanks Matt, I was able to accomplish what I wanted using MINWEIGHT.
Bill
- Original Message -
From: Matthew Bramble [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, December 02, 2003 1:59 PM
Subject: Re: [Declude.JunkMail] BODY STARTSWITH
Bill,
I haven't seen an absolute confirmation that this functionality works
yet as I haven't yet integrated this filter into my system using the
new
code. The END functionality though is something that Scott said he
would include along with MAXWEIGHT, MINWEIGHT, SKIPIFWEIGHT, and some
logging options for weighting, and he described how it works in his
response to my question for added functionality in his message on
11/14. I'll explain it further if that message doesn't do it for you.
Matt
Bill Landry wrote:
Matt, I was noticing that you are using END in this file. How is
that
feature enabled? When I add END to any of my files, it seems that
JunkMail just skips the entire files. Is there something that you
need
to
add to the global.cfg to enable this filter feature?
Bill
- Original Message -
From: Matthew Bramble [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, November 25, 2003 4:12 PM
Subject: Re: [Declude.JunkMail] BODY STARTSWITH
Munged twice so far, so I am resending this time without the zip
file
attachment in the event that there is some sort of restriction on
this.
The referenced file can be downloaded from the following link:
http://www.mailpure.com/software/decludefilters/gibberish/Gibberish_v2-0-0.
txt
Matt
Original Message
Subject: Re: [Declude.JunkMail] BODY STARTSWITH
Date: Tue, 25 Nov 2003 18:39:22 -0500
From: Matthew Bramble [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Scott,
I've attached a new copy of the GIBBERISH filter that makes use of
the
END and MAXPOINTS functionality that was discussed previously. Am I
correct that these can also be used now with Declude JunkMail Pro
v1.76i27? And if so, did I follow the implemented methodology?
Essentially, I'm using the functionality to simplify into one file
and
save on processing. I tried to order things within the file so that
the
most common END statements would be hit first, and I scored the Main
Filter hits at 1000 so that it would be easy for an administrator to
modify the scoring by just adjusting the MAXPOINTS entry. The
MAXPOINTS
entry should keep the filter from adding points incrementally, and
it
should end the test after one hit, producing no more score than the
MAXPOINTS entry allows. Scoring isn't applied to the filter in the
Global.cfg file since it is all handled internal to the filter.
Note to fellow admins: This file also hasn't been tested because I
am
not yet using the proper release. I'm really just putting it out
there
to see if Scott can tell me if I got the idea right. I must stress
that
this is not intended to be used for any versions of Declude JunkMail
Pro
prior to v1.76i27 because it could result in assessing 1000 or more
points without proper software support, and it may have other
issues.
Please do not put this into a production environment unless you
understand what you are doing and are going to monitor it closely.
Matt
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E
Re: [Declude.JunkMail] BODY STARTSWITH
Is there a summary of the new tests, what they do and how to use them? No. Not for interim releases. Interim releases are designed for people who need the latest features/fixes, and are willing to accept some drawbacks (if there are problems, we may require going back to the last beta; we may not have many details to post on this list, etc.). Today I discovered that some of the adjustments I've made to config files were catching legitimate list serv mailand so it goes. Is there a way to not have to learn the hard way? Except by being very, very careful, there isn't a way with filters. Almost everyone learns the hard way that filtering on bad words can catch things like Mr. Hitchcock, Assassin, etc. Then, lots of people learn the hard way not to blacklist mail.com (which blacklists @hotmail.com -- you need @mail.com to blacklist just mail.com. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] BODY STARTSWITH
I have in one of my filter files the following line: BODY 5 STARTSWITH Yet, it is not catching the following: I believe there is an issue (that will be fixed in the next release) where the BODY STARTSWITH might not work properly (I believe it was including the CRLF separator). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BODY STARTSWITH
I know you are busy, but I need to ask. When can we expect that? One of the servers I am working on is getting about 500 of these a day. All from different IPs and domains. Only common characteristic is the body starts with g and has a blank subject line, and I do not want to raise the weight of blank subject line any more, less I get FPs held. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Tuesday, November 25, 2003 5:07 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] BODY STARTSWITH I have in one of my filter files the following line: BODY 5 STARTSWITH Yet, it is not catching the following: I believe there is an issue (that will be fixed in the next release) where the BODY STARTSWITH might not work properly (I believe it was including the CRLF separator). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BODY STARTSWITH
I know you are busy, but I need to ask. When can we expect that? You know the rule -- ask and ye shall receive. :) http://www.declude.com/release/176i/declude.exe has 1.76i27, which has this change in it. Note that this specific interim release will also record one log file entry to C:\Declude.log for each E-mail that is processed (to help prove that Declude.exe is being skipped on rare occasions with IMail 8.04). The next release will not include that log file entry. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BODY STARTSWITH
Scott, For those of us that have had email (daily) skipping Declude calling would it be good for us to move up to the 1.76i27 to have that logged for you? Keith -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Tuesday, November 25, 2003 1:03 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] BODY STARTSWITH I know you are busy, but I need to ask. When can we expect that? You know the rule -- ask and ye shall receive. :) http://www.declude.com/release/176i/declude.exe has 1.76i27, which has this change in it. Note that this specific interim release will also record one log file entry to C:\Declude.log for each E-mail that is processed (to help prove that Declude.exe is being skipped on rare occasions with IMail 8.04). The next release will not include that log file entry. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BODY STARTSWITH
For those of us that have had email (daily) skipping Declude calling would it be good for us to move up to the 1.76i27 to have that logged for you? Yes, that would be a good idea. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BODY STARTSWITH
Scott: Are all those features recently talked about included in this release? Skip Max weight? Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Tuesday, November 25, 2003 2:43 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] BODY STARTSWITH Scott, For those of us that have had email (daily) skipping Declude calling would it be good for us to move up to the 1.76i27 to have that logged for you? Keith -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Tuesday, November 25, 2003 1:03 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] BODY STARTSWITH I know you are busy, but I need to ask. When can we expect that? You know the rule -- ask and ye shall receive. :) http://www.declude.com/release/176i/declude.exe has 1.76i27, which has this change in it. Note that this specific interim release will also record one log file entry to C:\Declude.log for each E-mail that is processed (to help prove that Declude.exe is being skipped on rare occasions with IMail 8.04). The next release will not include that log file entry. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BODY STARTSWITH
Are all those features recently talked about included in this release? Skip Max weight? Yes. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BODY STARTSWITH
:) How subtle you are... Just YES.. Just like that.. This calls for celebration... This indeed is great news. So I guess we should start ordering our tests in the order we want them executed and then start adding the codes to the top of the filter. When are you planning to elaborate on your YES.. :) Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Tuesday, November 25, 2003 3:12 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] BODY STARTSWITH Are all those features recently talked about included in this release? Skip Max weight? Yes. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BODY STARTSWITH
Wow! Very kool. Thanks Scott! -Nick Date sent: Tue, 25 Nov 2003 15:11:33 -0500 To: [EMAIL PROTECTED] From: R. Scott Perry [EMAIL PROTECTED] Subject:RE: [Declude.JunkMail] BODY STARTSWITH Send reply to: [EMAIL PROTECTED] Are all those features recently talked about included in this release? Skip Max weight? Yes. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BODY STARTSWITH
Scott, Is there an order to which tests are executed in the global config? Are filterfiles read/executed last? Is there any way to determine the order that each filterfile is run ? Thanks -Nick Hayer Date sent: Tue, 25 Nov 2003 15:11:33 -0500 To: [EMAIL PROTECTED] From: R. Scott Perry [EMAIL PROTECTED] Subject:RE: [Declude.JunkMail] BODY STARTSWITH Send reply to: [EMAIL PROTECTED] Are all those features recently talked about included in this release? Skip Max weight? Yes. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] BODY STARTSWITH
Ok, I was reading backwards and just saw this :) I'm going to code up GIBBERISH to work in this fashion so that the functionality as well as the filter modification can be tested out. I'll share it tomorrow probably. Lots of playing around to do though :) At least it still feels something like play... Matt R. Scott Perry wrote: Are all those features recently talked about included in this release? Skip Max weight? Yes. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BODY STARTSWITH
Are filterfiles read/executed last? They are close to the last tests run. Is there any way to determine the order that each filterfile is run ? They will be run in the order they are defined in the global.cfg file. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BODY STARTSWITH
Thanks Scott! Another question: Very kool addition but I'm having trouble with MAXWEIGHT Gotta be simple but I just don't get it: DJMPro v1.76i27 I created a filter called testfilter.txt it contains SKIPIFWEIGHT 40 MAXWEIGHT 20 HEADERS 1 CONTAINSfrom I sent myself an email. Total weight of the email was -5 The above filter did not kick off 11/25/2003 17:40:54 Qda65016600ce1c4c Last action = DELETE. 11/25/2003 17:40:58 Qda67016700ce27c6 nIPNOTINMX:-3 nNOLEGITCONTENT:- 3 REVDNS:1 . Total weight = -5. 11/25/2003 17:40:58 Qda67016700ce27c6 NOT bypassing whitelisting of E- mail with weight =35 (-5) and at least 2 recipients (1). 11/25/2003 17:40:58 Qda67016700ce27c6 Using [incoming] CFG file e:\IMail\Declude\$default$.junkmail. 11/25/2003 17:40:58 Qda67016700ce27c6 Msg failed REVDNS (This E-mail was sent from a MUA/MTA 170.222.200.91 with no reverse DNS entry.). Action=IGNORE. 11/25/2003 17:40:58 Qda67016700ce27c6 L1 Message OK 11/25/2003 17:40:58 Qda67016700ce27c6 Subject: test2 11/25/2003 17:40:58 Qda67016700ce27c6 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 170.222.200.91 ID: AA5F2720038 11/25/2003 17:40:58 Qda67016700ce27c6 Last action = IGNORE. *BUT* if I changed the SKIPIFWEIGHT to 400 the filter did execute. 11/25/2003 17:59:05 Qdeb405260116f421 TESTFILTER:-1 nIPNOTINMX:-3 nNOLEGITCONTENT:-3 REVDNS:1 . Total weight = -6. 11/25/2003 17:59:05 Qdeb405260116f421 NOT bypassing whitelisting of E- mail with weight =35 (-6) and at least 2 recipients (1). 11/25/2003 17:59:05 Qdeb405260116f421 Using [incoming] CFG file e:\IMail\Declude\$default$.junkmail. 11/25/2003 17:59:05 Qdeb405260116f421 Msg failed TESTFILTER (Message failed TESTFILTER test (line 3, weight -1)). Action=IGNORE. 11/25/2003 17:59:05 Qdeb405260116f421 Msg failed REVDNS (This E-mail was sent from a MUA/MTA 170.222.200.91 with no reverse DNS entry.). Action=IGNORE. 11/25/2003 17:59:05 Qdeb405260116f421 L1 Message OK 11/25/2003 17:59:05 Qdeb405260116f421 Subject: test3 Do I need a different setting? -Nick Date sent: Tue, 25 Nov 2003 17:13:49 -0500 To: [EMAIL PROTECTED] From: R. Scott Perry [EMAIL PROTECTED] Subject:RE: [Declude.JunkMail] BODY STARTSWITH Send reply to: [EMAIL PROTECTED] Are filterfiles read/executed last? They are close to the last tests run. Is there any way to determine the order that each filterfile is run ? They will be run in the order they are defined in the global.cfg file. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BODY STARTSWITH
Very kool addition but I'm having trouble with MAXWEIGHT Gotta be simple but I just don't get it: DJMPro v1.76i27 I created a filter called testfilter.txt it contains SKIPIFWEIGHT 40 MAXWEIGHT 20 HEADERS 1 CONTAINSfrom This should [1] skip the test completely if the weight is 40 or higher before the test is run, and [2] set the maximum weight for the test to 20 (which will also stop processing and set the weight to 20 if the weight reaches or exceeds 20 during processing of the filter). I sent myself an email. Total weight of the email was -5 The above filter did not kick off What confuses me here is: *BUT* if I changed the SKIPIFWEIGHT to 400 the filter did execute. 11/25/2003 17:59:05 Qdeb405260116f421 Msg failed TESTFILTER (Message failed TESTFILTER test (line 3, weight -1)). Action=IGNORE. This is showing that the test is adding -1 to the weight. Is the TESTFILTER test set up to start with a weight of -2 (in the test definition line in the global.cfg file)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] BODY STARTSWITH
Munged twice so far, so I am resending this time without the zip file attachment in the event that there is some sort of restriction on this. The referenced file can be downloaded from the following link: http://www.mailpure.com/software/decludefilters/gibberish/Gibberish_v2-0-0.txt Matt Original Message Subject:Re: [Declude.JunkMail] BODY STARTSWITH Date: Tue, 25 Nov 2003 18:39:22 -0500 From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Scott, I've attached a new copy of the GIBBERISH filter that makes use of the END and MAXPOINTS functionality that was discussed previously. Am I correct that these can also be used now with Declude JunkMail Pro v1.76i27? And if so, did I follow the implemented methodology? Essentially, I'm using the functionality to simplify into one file and save on processing. I tried to order things within the file so that the most common END statements would be hit first, and I scored the Main Filter hits at 1000 so that it would be easy for an administrator to modify the scoring by just adjusting the MAXPOINTS entry. The MAXPOINTS entry should keep the filter from adding points incrementally, and it should end the test after one hit, producing no more score than the MAXPOINTS entry allows. Scoring isn't applied to the filter in the Global.cfg file since it is all handled internal to the filter. Note to fellow admins: This file also hasn't been tested because I am not yet using the proper release. I'm really just putting it out there to see if Scott can tell me if I got the idea right. I must stress that this is not intended to be used for any versions of Declude JunkMail Pro prior to v1.76i27 because it could result in assessing 1000 or more points without proper software support, and it may have other issues. Please do not put this into a production environment unless you understand what you are doing and are going to monitor it closely. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] BODY STARTSWITH
Scott, Is there a summary of the new tests, what they do and how to use them? It's almost like there needs to be class to go to, for setting up filters. Today I discovered that some of the adjustments I've made to config files were catching legitimate list serv mailand so it goes. Is there a way to not have to learn the hard way? Is there a way to glean the experience/knowledge/setup files from you or others so that the wheel doesn't continually have to be re-invented? I know there is are base config files on your web site, but they are just that, basic. Thanks, Andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 25, 2003 6:41 PM Subject: RE: [Declude.JunkMail] BODY STARTSWITH Very kool addition but I'm having trouble with MAXWEIGHT Gotta be simple but I just don't get it: DJMPro v1.76i27 I created a filter called testfilter.txt it contains SKIPIFWEIGHT 40 MAXWEIGHT 20 HEADERS 1 CONTAINSfrom This should [1] skip the test completely if the weight is 40 or higher before the test is run, and [2] set the maximum weight for the test to 20 (which will also stop processing and set the weight to 20 if the weight reaches or exceeds 20 during processing of the filter). I sent myself an email. Total weight of the email was -5 The above filter did not kick off What confuses me here is: *BUT* if I changed the SKIPIFWEIGHT to 400 the filter did execute. 11/25/2003 17:59:05 Qdeb405260116f421 Msg failed TESTFILTER (Message failed TESTFILTER test (line 3, weight -1)). Action=IGNORE. This is showing that the test is adding -1 to the weight. Is the TESTFILTER test set up to start with a weight of -2 (in the test definition line in the global.cfg file)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] BODY STARTSWITH
I have in one of my filter files the following line: BODY 5 STARTSWITH Yet, it is not catching the following: Received: from kirjastot.fi [213.37.211.14] by mail.localdomain.moc (SMTPD32-8.04) id A6AA5D600B4; Sun, 23 Nov 2003 14:12:42 -0500 Message-ID: [EMAIL PROTECTED] From: Darlene A. Campos [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Date: Mon, 24 Nov 2003 10:29:48 + MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1158 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Content-Type: text/html Content-Transfer-Encoding: 8bit X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 213.37.211.14 with no reverse DNS entry. X-RBL-Warning: BASICFILTER: Message failed BASICFILTER test (1) X-RBL-Warning: SPAMCHECK: Message failed SPAMCHECK: 14. X-Declude-Sender: [EMAIL PROTECTED] [213.37.211.14] X-Declude-Spoolname: D06aa05d600b43c07.SMD X-RBL-Warning: Total weight: 34 X-Tests-Failed: IPNOTINMX, REVDNS, NOLEGITCONTENT, BASICFILTER, SPAMCHECK, WEIGHTRANGE30-34 X-Note: This E-mail was sent from [No Reverse DNS] ([213.37.211.14]). gptnkipczdasfont color=whitecganfdbgnicqisguhqziynlxqc sclzinxihegaca gvzejqcdrqthrlbumxgkectivibpb gkqlgwndrsujkeixluehcwwwzkj qlbbfvcjfeyolb xrahsgbxeslgrethyvbzyty/fontgxcqvtjbdnovgbrgnthmxmdbhtejdc font color=whiterrywumqurzerbq gwotsslslxftusorpeisik gqkdiqictmfdfubjosibzcmwiggjfrcncdibxgud xvhsnxdrtdedncgewkbiqtgwqctc jxektecxqn gcvdbrofavhodlqlpmzibyzklna/fontgsqljltbohycakbrgcwxswuouqtrpd bgwrtuwvdkziLOgwqrpfjbroyiSEguvlfocchwbvlb gaxqphicikvaaWEgeiujqibyypgycqIGgyzibjubmgvdpzdHT gwxicixdjoxmlqiTHgffvsooczjoE gqgkwindoynfjbbEgrtlkbbdbwtvASIgyhhwzpolgeiER WgvgaixrdfkdpAYgldppsebsqythfc/bgwddpzybspnyjbr gksdwmlccxsyziIgyverjtbwzjT'Sgnqsgvswoyeuibt NgpnbsvxdmyxOTgdlzzutcrzzw Agqlrtgychyms gdwkphqwxmnmbjDIgkttlixddjglETgymzrjzcklne .gmoqtcrbkgdjxt..gfscknibkksogf. gqzriiidczwtbITggtubfzcsrb'Sgcxhfjsbhobqx Aghncgopcgled PAgxuhsodcrpcpcoTCgqgsvnykhlxxeclHbr/i br TRUNCATED John Tolmachoff Engineer/Consultant/Owner eServices For You John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BODY STARTSWITH
John, Every one of the thousands that I've seen come through our servers start with g and since I honestly don't remember ever seeing an html tag that starts with g I started filtering on that. BODY 5 STARTSWITH g It's working for me. Anyone else ? Fritz Frederick P. Squib, Jr. Network Operations/Mail Administrator Citizens Telephone Company of Kecksburg http://www.wpa.net () ascii ribbon campaign - against html mail /\- against microsoft attachments --- [This E-mail scanned by Citizens Internet Services with Declude Virus.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
