Re: [Declude.JunkMail] What is this about ??
I've gotten serveral of these the past few minutes. Below are the full headers ..I'm assuming they are trying to relay ??? It's hard to say what spammers are doing when they aren't sending a real spam to someone. They may be making relay attempts, they may be checking to see if you have blocked a certain IP, they may be trying to get people to reply... Also it seems that declude is claiming that 216.204.154.7 has no MX. DnsStuff.com reports: Actually, that's a server of yours, which you've let Declude JunkMail know about. The confusion is that the spammer is doing something really stupid: He's claiming that his computer is an Internet host with the same name as your IP (that's about as silly as giving out a phone number when asked for a credit card -- it just doesn't work). Received: from 216.204.154.7 [24.241.184.85] by maineconnect.net (SMTPD32-8.01) id A524B75700F8; Mon, 01 Dec 2003 18:56:20 -0500 This is the Received: header that Declude JunkMail is looking at -- Declude uses the IP 24.241.184.85 for scanning, and a host name of 216.204.154.7 (which isn't a valid host name, so the E-mail fails the HELOBOGUS test). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] What is this about ??
I've got an IMGate machine in front of my imail/declude, and ive set it up to drop any connection where anywhere in the SMTP header/banner it claims an IP or a domain of mine. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Tuesday, December 02, 2003 2:57 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] What is this about ?? I've gotten serveral of these the past few minutes. Below are the full headers ..I'm assuming they are trying to relay ??? It's hard to say what spammers are doing when they aren't sending a real spam to someone. They may be making relay attempts, they may be checking to see if you have blocked a certain IP, they may be trying to get people to reply... Also it seems that declude is claiming that 216.204.154.7 has no MX. DnsStuff.com reports: Actually, that's a server of yours, which you've let Declude JunkMail know about. The confusion is that the spammer is doing something really stupid: He's claiming that his computer is an Internet host with the same name as your IP (that's about as silly as giving out a phone number when asked for a credit card -- it just doesn't work). Received: from 216.204.154.7 [24.241.184.85] by maineconnect.net (SMTPD32-8.01) id A524B75700F8; Mon, 01 Dec 2003 18:56:20 -0500 This is the Received: header that Declude JunkMail is looking at -- Declude uses the IP 24.241.184.85 for scanning, and a host name of 216.204.154.7 (which isn't a valid host name, so the E-mail fails the HELOBOGUS test). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
AW: AW: [Declude.JunkMail] More ATTACH and MAILBOX questions
Title: AW: AW: [Declude.JunkMail] More ATTACH and MAILBOX questions thank you, great news!! mfg i.a. gez. guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: R. Scott Perry [mailto:[EMAIL PROTECTED]] Gesendet am: Montag, 1. Dezember 2003 16:18 An: [EMAIL PROTECTED] Betreff: Re: AW: [Declude.JunkMail] More ATTACH and MAILBOX questions since more then 2000 of my users use web messaging the attach action is no real option for me. i use declude virus as well and there i use the emailnotifikation for the recipient when an email is hold because of a vulnerability. in this notification i give the queue file name of the hold email to the recipient and let him decide if he wants the message to be delivered (right now we do this by hand, but we working on an other way). if there would be a notification based an the hold action in jm, i could use it in a similar way (at least for those messages with a weight on the edge between legal and spam). the best thing would be, if i had something like skipifweightishigher in the eml for this! We are actually looking into notifications for Declude JunkMail (where the notifications could be batched, too, such as daily notifications). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Subject Starts with
I recommend a simple scheme of simple characters and escape sequences. Borrowing from our Message Sniffer rule coding, how about _ as a space, and if you really need the _ character itself then you use \_. Then you also have to use \\ when you want the \, but that's a small price to pay and it's easy to code. Just a thought. _M |-Original Message- |From: [EMAIL PROTECTED] |[mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan |Sent: Monday, December 01, 2003 5:54 PM |To: [EMAIL PROTECTED] |Subject: RE: [Declude.JunkMail] Subject Starts with | | |[Bill] [stranger] [things] [have] [happened] [in] [the] [past]. | |[space] [may] [not] [be] [used] [but] [starting] [reserve] |[words] [can] [start] [a] [precedent] [that] [could] [make] |[filtering] [and] [debugging] [a] [nightmare]. | |[Regards,] [:)] |[Kami] | | |-Original Message- |From: [EMAIL PROTECTED] |[mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry |Sent: Monday, December 01, 2003 5:32 PM |To: [EMAIL PROTECTED] |Subject: Re: [Declude.JunkMail] Subject Starts with | |It's not really a reserved word since the suggestion was |space enclosed in square brackets - how often have you seen |that used in a sentence: wow, I really [space] out sometimes... ;-) | |Bill |- Original Message - |From: John Tolmachoff (Lists) [EMAIL PROTECTED] |To: [EMAIL PROTECTED] |Sent: Monday, December 01, 2003 1:27 PM |Subject: RE: [Declude.JunkMail] Subject Starts with | | | I have to agree with Kami. I would rather not define reserved words. | | John Tolmachoff | Engineer/Consultant/Owner | eServices For You | | | -Original Message- | From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- | [EMAIL PROTECTED] On Behalf Of Kami Razvan | Sent: Monday, December 01, 2003 12:36 PM | To: [EMAIL PROTECTED] | Subject: RE: [Declude.JunkMail] Subject Starts with | | Matt.. | | This is scary .. Now you are suggesting we start defining reserve |words.. | | This way, if it starts a trend, we can not filter on [space] | anymore.. | | Just a thought. | | Kami | | | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED] On Behalf Of Matthew | Bramble | Sent: Monday, December 01, 2003 3:23 PM | To: [EMAIL PROTECTED] | Subject: Re: [Declude.JunkMail] Subject Starts with | | Scott, | | Instead of adding it a command, how about you just create a | substitution string for space, i.e. [space]. This way it could be | used in this fashion, as well as before some words (as a delimiter | in the sense that Bill earlier | suggested). | | SUBJECT 0 BEGINSWITH [space] | BODY 0 CONTAINS [space]ass | | Matt | | | | R. Scott Perry wrote: | | | Scott, feature request. (Sigh, another one.) | | Can you add something like this: | | SUBJECT 0 STARTSWITHSPACE | | I am seeing a good amount of spam where the subject line starts | with a space and then some character and then the subject. | | | Ah, good idea -- I'll see if we can add that. | | -Scott | | | --- | [This E-mail was scanned for viruses by Declude Virus | (http://www.declude.com)] | | --- | This E-mail came from the Declude.JunkMail mailing list. To |unsubscribe, | just send an E-mail to [EMAIL PROTECTED], and type unsubscribe | Declude.JunkMail. The archives can be found at | http://www.mail-archive.com. | | --- | [This E-mail was scanned for viruses by Declude Virus | (http://www.declude.com)] | | --- | This E-mail came from the Declude.JunkMail mailing list. To | unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type | unsubscribe Declude.JunkMail. The archives can be found at | http://www.mail-archive.com. | | --- | [This E-mail was scanned for viruses by Declude Virus |(http://www.declude.com)] | | --- | This E-mail came from the Declude.JunkMail mailing list. To | unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type | unsubscribe Declude.JunkMail. The archives can be found at | http://www.mail-archive.com. | | .com. | | |--- |[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be
RE: [Declude.JunkMail] Subject Starts with
Ha ha ha! plop... (laughs his head off) |-Original Message- |From: [EMAIL PROTECTED] |[mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry |Sent: Monday, December 01, 2003 6:22 PM |To: [EMAIL PROTECTED] |Subject: Re: [Declude.JunkMail] Subject Starts with | | |Oh, yes, now it get it... [eye rolling out of head onto floor] ;-) | |Bill |- Original Message - |From: Kami Razvan [EMAIL PROTECTED] |To: [EMAIL PROTECTED] |Sent: Monday, December 01, 2003 2:53 PM |Subject: RE: [Declude.JunkMail] Subject Starts with | | | [Bill] [stranger] [things] [have] [happened] [in] [the] [past]. | | [space] [may] [not] [be] [used] [but] [starting] [reserve] [words] | [can] [start] [a] [precedent] [that] [could] [make] [filtering] [and] |[debugging] | [a] [nightmare]. | | [Regards,] [:)] | [Kami] | | | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry | Sent: Monday, December 01, 2003 5:32 PM | To: [EMAIL PROTECTED] | Subject: Re: [Declude.JunkMail] Subject Starts with | | It's not really a reserved word since the suggestion was space | enclosed |in | square brackets - how often have you seen that used in a sentence: | wow, I really [space] out sometimes... ;-) | | Bill | - Original Message - | From: John Tolmachoff (Lists) [EMAIL PROTECTED] | To: [EMAIL PROTECTED] | Sent: Monday, December 01, 2003 1:27 PM | Subject: RE: [Declude.JunkMail] Subject Starts with | | | I have to agree with Kami. I would rather not define |reserved words. | | John Tolmachoff | Engineer/Consultant/Owner | eServices For You | | | -Original Message- | From: [EMAIL PROTECTED] |[mailto:Declude.JunkMail- | [EMAIL PROTECTED] On Behalf Of Kami Razvan | Sent: Monday, December 01, 2003 12:36 PM | To: [EMAIL PROTECTED] | Subject: RE: [Declude.JunkMail] Subject Starts with | | Matt.. | | This is scary .. Now you are suggesting we start defining reserve | words.. | | This way, if it starts a trend, we can not filter on [space] | anymore.. | | Just a thought. | | Kami | | | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED] On Behalf Of Matthew |Bramble | Sent: Monday, December 01, 2003 3:23 PM | To: [EMAIL PROTECTED] | Subject: Re: [Declude.JunkMail] Subject Starts with | | Scott, | | Instead of adding it a command, how about you just create a |substitution | string for space, i.e. [space]. This way it could be |used in this | fashion, as well as before some words (as a delimiter in |the sense | that Bill earlier | suggested). | | SUBJECT 0 BEGINSWITH [space] | BODY 0 CONTAINS [space]ass | | Matt | | | | R. Scott Perry wrote: | | |Scott, feature request. (Sigh, another one.) | |Can you add something like this: | |SUBJECT 0 STARTSWITHSPACE | |I am seeing a good amount of spam where the subject |line starts |with |a space and then some character and then the subject. | | |Ah, good idea -- I'll see if we can add that. | | -Scott | | | --- | [This E-mail was scanned for viruses by Declude Virus | (http://www.declude.com)] | | --- | This E-mail came from the Declude.JunkMail mailing list. To | unsubscribe, | just send an E-mail to [EMAIL PROTECTED], and type |unsubscribe | Declude.JunkMail. The archives can be found at | http://www.mail-archive.com. | | --- | [This E-mail was scanned for viruses by Declude Virus | (http://www.declude.com)] | | --- | This E-mail came from the Declude.JunkMail mailing list. To | unsubscribe, just send an E-mail to |[EMAIL PROTECTED], and type | unsubscribe Declude.JunkMail. The archives can be found at | http://www.mail-archive.com. | | --- | [This E-mail was scanned for viruses by Declude Virus | (http://www.declude.com)] | | --- | This E-mail came from the Declude.JunkMail mailing list. To | unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type | unsubscribe Declude.JunkMail. The archives can be found at | http://www.mail-archive.com. | | .com. | | | --- | [This E-mail was scanned for viruses by Declude Virus | (http://www.declude.com)] | | --- | This E-mail came from the Declude.JunkMail mailing list. To | unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type | unsubscribe Declude.JunkMail. The archives can be found at | http://www.mail-archive.com. | | --- | [This E-mail was scanned for viruses by Declude Virus |(http://www.declude.com)] | | --- | This E-mail came from the Declude.JunkMail mailing list. To | unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type | unsubscribe Declude.JunkMail. The archives can be found at | http://www.mail-archive.com. | | |--- |[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from
[Declude.JunkMail] Interesting.. Now PGP is used
Title: Interesting.. Now PGP is used Hi; Interesting spam Now they are using PGP code Just in case you are adding negative weight for PGP - something to keep in mind. Regards, Kami -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, your request for notification for the ZONE (sites i need to see)of pfb2 has been scheduled. You will get another notification shortly after your request has been processed. If you do not get any further notification during the next 24 hours, don't hesitate to contact our support team. She is way too fine for this ugly dude: http://gnome30.route.antipuff.nom.br/?f=5666/dm_ff.htm In case of any questions regarding your request please visit our support area on http://vju3.com Best regards, your qrvn7-Team - -- - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- p3.com is a division of The cheese factory 650 N Peko Lane Arka, TX 65002 https://l8.net - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- -BEGIN PGP SIGNATURE- Version: GnuPG v1.0.7 (GNU/Linux) iQCVAwUBP77qAybd4TQRROIjAQICiQP/fnqutz0cwYHBt5cxaQEBusyf+d4tY29S Q1eFIk1Vv63o7uOkX2TrpZyU64kSM0wtjIBeNMvT1JFZg8vmULRS/bboENAWxqqD Vq/nJt3Eiax99vL93i9HY8z266SkcZiZFKlQN2puUjEPrUkvJQGOiH1m+G7ySDCN lPwio5dVVkY= =ElyI -END PGP SIGNATURE% ===
RE: [Declude.JunkMail] sniffer
It's not worth paying the subscription fee, in my opinion. I have a client that's paying for it, and it doesn't catch very much that isn't already caught somewhere else. I am considering Maps too. But it's $1500/yr. Anyone using them? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] sniffer
Sniffer's well worth the $300.00 per year. That breaks down to less than $1.00 per day. It catches content that some RBLs don't catch. Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Anderson Sent: Tuesday, December 02, 2003 10:28 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] sniffer It's not worth paying the subscription fee, in my opinion. I have a client that's paying for it, and it doesn't catch very much that isn't already caught somewhere else. I am considering Maps too. But it's $1500/yr. Anyone using them? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spamchk fine tuning?
I just set up spamchk and was wondering if anyone can share some fine-tuning info with me? Updated keyword lists and such? I tried subscribing to their list but all I get back is an Invalid Syntax email from their mail server. Cheers, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Problems with Errors in Logs
It appears that you may have forgotten to mention the TEXT of the error message that appears in the logs. Knowing what error is reported may be the key in pin-pointing the cause. Best Regards Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Problems with Errors in Logs
The messages are as follows: Error; failure opening (message ID) in the declude junkmail file Error opening mime file (message ID) in the declude antivirus file Sorry for the generic message, but the log files are gone. === Daniel Ivey GCR Company / GCR Online Voice: 434 - 570 - 1765 Fax: 434 - 572 - 1981 [EMAIL PROTECTED] -Original Message- From: Andy Schmidt [mailto:[EMAIL PROTECTED] Sent: Tuesday, December 02, 2003 12:13 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Problems with Errors in Logs It appears that you may have forgotten to mention the TEXT of the error message that appears in the logs. Knowing what error is reported may be the key in pin-pointing the cause. Best Regards Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Problems with Errors in Logs
The messages are as follows: Error; failure opening (message ID) in the declude junkmail file Error opening mime file (message ID) in the declude antivirus file Sorry for the generic message, but the log files are gone. The best way to determine what is happening here is to use the debug mode. To use the debug mode, you can change the LOGLEVEL LOW line in \IMail\Declude\global.cfg to LOGLEVEL DEBUG. Then, after about a minute, you can then switch back to LOGLEVEL LOW (the debug mode adds huge amounts of information to the log file). You can then send me the \IMail\spool\dec.log file (as an attachment, NOT sent from web messaging), and I can take a look at it to see what is happening. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] possible request for feature
Can there be a way for a filter to fail all or nothing. For instance, everyone seems to be receiving spam with no subject, and fake tags such as gkslthsjewl. I receive thousands of these messages a day, all from different spammers. I have been filtering on the two characteristics, and it usually gets to my hold weight. I don't want to set a very high weight for blank subjects because I'm sure of FP's. If I could combine the two I would feel comfortable deleting on just this test. If I could somehow define a filter that will only fail if all instances in the filter are true I could set up... SUBJECT 0 ISBLANK BODY0 STARTSWITH g and delete on this filter file alone. Maybe some statement at the top to define it, similar to the features you are adding with the maxweight and skipifweight. If it is for some reason it is not a good idea to do with a filter, maybe a new type of test could be created to do this. This could cut down on spam, but also save some resources if the test could be run first. No dns request would have to be made or any other filters run. If this has already been covered I apologize. If there is already a way to do this please let me know how. BTW, has anyone else seen the ridiculous increase in spam that I have? A few days before Thanksgiving my inbound mail increased from around 400,000 a day to over 2 million messages a day. I died back down over the holiday weekend but has picked back up now. I guess the spammers took Thanksgiving off too. Over the years it has been common for us to get more spam during Christmas, but not like this. I guess everyone is taking up spamming as a way to make extra Christmas money. -Daniel --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Problems with Errors in Logs
Scott, The problem seems to have corrected itself. However if the problem occurs again, this will be the first thing that I do and I will email them to you. Thanks for the help Scott. Daniel === Daniel Ivey GCR Company / GCR Online Voice: 434 - 570 - 1765 Fax: 434 - 572 - 1981 [EMAIL PROTECTED] -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Tuesday, December 02, 2003 12:56 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Problems with Errors in Logs The messages are as follows: Error; failure opening (message ID) in the declude junkmail file Error opening mime file (message ID) in the declude antivirus file Sorry for the generic message, but the log files are gone. The best way to determine what is happening here is to use the debug mode. To use the debug mode, you can change the LOGLEVEL LOW line in \IMail\Declude\global.cfg to LOGLEVEL DEBUG. Then, after about a minute, you can then switch back to LOGLEVEL LOW (the debug mode adds huge amounts of information to the log file). You can then send me the \IMail\spool\dec.log file (as an attachment, NOT sent from web messaging), and I can take a look at it to see what is happening. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamchk fine tuning?
Matt: At what weights do you hold and delete? I will share my config file with you with the caveat that I am still fine tuning. I have been running Spamchk in production mode for about a month and have had excellant results. I turned it off for a day when I was trying to reduce some of the false positives and I received comments from customers that they noticed something had changed so I turned it back on. Chuck Schick Warp 8, Inc. 303-421-5140 www.warp8.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Matt Robertson Sent: Tuesday, December 02, 2003 10:03 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spamchk fine tuning? I just set up spamchk and was wondering if anyone can share some fine-tuning info with me? Updated keyword lists and such? I tried subscribing to their list but all I get back is an Invalid Syntax email from their mail server. Cheers, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] possible request for feature
If I could somehow define a filter that will only fail if all instances in the filter are true I could set up... SUBJECT 0 ISBLANK BODY0 STARTSWITH g and delete on this filter file alone. This is something that we are looking into. :) -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamchk fine tuning?
Matt - What I did was in the beta version set a max weight and a min weight to be returned. [I have it set now at 8 and -2 respectivly.] Then let it run and check the log file to see what is failing - adjust accordingly. I ended up reducing the scores for failures in the ini by ~50+% since I hold on 15 and delete on 30. -Nick From: Matt Robertson [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject:[Declude.JunkMail] Spamchk fine tuning? Date sent: Tue, 2 Dec 2003 09:03:18 -0800 Send reply to: [EMAIL PROTECTED] I just set up spamchk and was wondering if anyone can share some fine-tuning info with me? Updated keyword lists and such? I tried subscribing to their list but all I get back is an Invalid Syntax email from their mail server. Cheers, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] possible request for feature
I actually noticed ramp up to the holiday, followed by a large increase over the holiday weekend. The most popular single spam involved a city in France and a hotel chain. This even beat out the ever popular enhancement of body parts category. Burzin At 12:09 PM 12/2/2003, you wrote: BTW, has anyone else seen the ridiculous increase in spam that I have? A few days before Thanksgiving my inbound mail increased from around 400,000 a day to over 2 million messages a day. I died back down over the holiday weekend but has picked back up now. I guess the spammers took Thanksgiving off too. Over the years it has been common for us to get more spam during Christmas, but not like this. I guess everyone is taking up spamming as a way to make extra Christmas money. -Daniel -- Burzin Sumariwalla Phone: (314) 994-9411 x291 [EMAIL PROTECTED] Fax: (314) 997-7615 Pager: (314) 407-3345 Networking and Telecommunications Manager Information Technology Services St. Louis County Library District 1640 S. Lindbergh Blvd. St. Louis, MO 63131 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] BODY STARTSWITH
Matt, I was noticing that you are using END in this file. How is that feature enabled? When I add END to any of my files, it seems that JunkMail just skips the entire files. Is there something that you need to add to the global.cfg to enable this filter feature? Bill - Original Message - From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 25, 2003 4:12 PM Subject: Re: [Declude.JunkMail] BODY STARTSWITH Munged twice so far, so I am resending this time without the zip file attachment in the event that there is some sort of restriction on this. The referenced file can be downloaded from the following link: http://www.mailpure.com/software/decludefilters/gibberish/Gibberish_v2-0-0.txt Matt Original Message Subject: Re: [Declude.JunkMail] BODY STARTSWITH Date: Tue, 25 Nov 2003 18:39:22 -0500 From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Scott, I've attached a new copy of the GIBBERISH filter that makes use of the END and MAXPOINTS functionality that was discussed previously. Am I correct that these can also be used now with Declude JunkMail Pro v1.76i27? And if so, did I follow the implemented methodology? Essentially, I'm using the functionality to simplify into one file and save on processing. I tried to order things within the file so that the most common END statements would be hit first, and I scored the Main Filter hits at 1000 so that it would be easy for an administrator to modify the scoring by just adjusting the MAXPOINTS entry. The MAXPOINTS entry should keep the filter from adding points incrementally, and it should end the test after one hit, producing no more score than the MAXPOINTS entry allows. Scoring isn't applied to the filter in the Global.cfg file since it is all handled internal to the filter. Note to fellow admins: This file also hasn't been tested because I am not yet using the proper release. I'm really just putting it out there to see if Scott can tell me if I got the idea right. I must stress that this is not intended to be used for any versions of Declude JunkMail Pro prior to v1.76i27 because it could result in assessing 1000 or more points without proper software support, and it may have other issues. Please do not put this into a production environment unless you understand what you are doing and are going to monitor it closely. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Subject Starts with
newbieOooh! Scott, how about you *just* implement in the next interim full regexp text processing like product X along with MIME decoding like product Y, MIME error handling like product Z, with a whole new filtering grammar that lets us specify the layer of decoding at which the text filter line is run?/newbie Andrew ;) -Original Message- From: Pete McNeil [mailto:[EMAIL PROTECTED] Sent: Tuesday, December 02, 2003 6:50 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Subject Starts with I recommend a simple scheme of simple characters and escape sequences. Borrowing from our Message Sniffer rule coding, how about _ as a space, and if you really need the _ character itself then you use \_. Then you also have to use \\ when you want the \, but that's a small price to pay and it's easy to code. Just a thought. _M |-Original Message- |From: [EMAIL PROTECTED] |[mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan |Sent: Monday, December 01, 2003 5:54 PM |To: [EMAIL PROTECTED] |Subject: RE: [Declude.JunkMail] Subject Starts with | | |[Bill] [stranger] [things] [have] [happened] [in] [the] [past]. | |[space] [may] [not] [be] [used] [but] [starting] [reserve] |[words] [can] [start] [a] [precedent] [that] [could] [make] |[filtering] [and] [debugging] [a] [nightmare]. | |[Regards,] [:)] |[Kami] | | |-Original Message- |From: [EMAIL PROTECTED] |[mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry |Sent: Monday, December 01, 2003 5:32 PM |To: [EMAIL PROTECTED] |Subject: Re: [Declude.JunkMail] Subject Starts with | |It's not really a reserved word since the suggestion was |space enclosed in square brackets - how often have you seen |that used in a sentence: wow, I really [space] out sometimes... ;-) | |Bill |- Original Message - |From: John Tolmachoff (Lists) [EMAIL PROTECTED] |To: [EMAIL PROTECTED] |Sent: Monday, December 01, 2003 1:27 PM |Subject: RE: [Declude.JunkMail] Subject Starts with | | | I have to agree with Kami. I would rather not define reserved words. | | John Tolmachoff | Engineer/Consultant/Owner | eServices For You | | | -Original Message- | From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- | [EMAIL PROTECTED] On Behalf Of Kami Razvan | Sent: Monday, December 01, 2003 12:36 PM | To: [EMAIL PROTECTED] | Subject: RE: [Declude.JunkMail] Subject Starts with | | Matt.. | | This is scary .. Now you are suggesting we start defining reserve |words.. | | This way, if it starts a trend, we can not filter on [space] | anymore.. | | Just a thought. | | Kami | | | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED] On Behalf Of Matthew | Bramble | Sent: Monday, December 01, 2003 3:23 PM | To: [EMAIL PROTECTED] | Subject: Re: [Declude.JunkMail] Subject Starts with | | Scott, | | Instead of adding it a command, how about you just create a | substitution string for space, i.e. [space]. This way it could be | used in this fashion, as well as before some words (as a delimiter | in the sense that Bill earlier | suggested). | | SUBJECT 0 BEGINSWITH [space] | BODY 0 CONTAINS [space]ass | | Matt | | | | R. Scott Perry wrote: | | | Scott, feature request. (Sigh, another one.) | | Can you add something like this: | | SUBJECT 0 STARTSWITHSPACE | | I am seeing a good amount of spam where the subject line starts | with a space and then some character and then the subject. | | | Ah, good idea -- I'll see if we can add that. | | -Scott | | | --- | [This E-mail was scanned for viruses by Declude Virus | (http://www.declude.com)] | | --- | This E-mail came from the Declude.JunkMail mailing list. To |unsubscribe, | just send an E-mail to [EMAIL PROTECTED], and type unsubscribe | Declude.JunkMail. The archives can be found at | http://www.mail-archive.com. | | --- | [This E-mail was scanned for viruses by Declude Virus | (http://www.declude.com)] | | --- | This E-mail came from the Declude.JunkMail mailing list. To | unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type | unsubscribe Declude.JunkMail. The archives can be found at | http://www.mail-archive.com. | | --- | [This E-mail was scanned for viruses by Declude Virus |(http://www.declude.com)] | | --- | This E-mail came from the Declude.JunkMail mailing list. To | unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type | unsubscribe Declude.JunkMail. The archives can be found at | http://www.mail-archive.com. | | .com. | | |--- |[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude
RE: [Declude.JunkMail] Subject Starts with
ROLLING EYES Of course, I have to take blame for this since I started the thread. NOT! John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Tuesday, December 02, 2003 12:12 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Subject Starts with newbieOooh! Scott, how about you *just* implement in the next interim full regexp text processing like product X along with MIME decoding like product Y, MIME error handling like product Z, with a whole new filtering grammar that lets us specify the layer of decoding at which the text filter line is run?/newbie Andrew ;) -Original Message- From: Pete McNeil [mailto:[EMAIL PROTECTED] Sent: Tuesday, December 02, 2003 6:50 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Subject Starts with I recommend a simple scheme of simple characters and escape sequences. Borrowing from our Message Sniffer rule coding, how about _ as a space, and if you really need the _ character itself then you use \_. Then you also have to use \\ when you want the \, but that's a small price to pay and it's easy to code. Just a thought. _M |-Original Message- |From: [EMAIL PROTECTED] |[mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan |Sent: Monday, December 01, 2003 5:54 PM |To: [EMAIL PROTECTED] |Subject: RE: [Declude.JunkMail] Subject Starts with | | |[Bill] [stranger] [things] [have] [happened] [in] [the] [past]. | |[space] [may] [not] [be] [used] [but] [starting] [reserve] |[words] [can] [start] [a] [precedent] [that] [could] [make] |[filtering] [and] [debugging] [a] [nightmare]. | |[Regards,] [:)] |[Kami] | | |-Original Message- |From: [EMAIL PROTECTED] |[mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry |Sent: Monday, December 01, 2003 5:32 PM |To: [EMAIL PROTECTED] |Subject: Re: [Declude.JunkMail] Subject Starts with | |It's not really a reserved word since the suggestion was |space enclosed in square brackets - how often have you seen |that used in a sentence: wow, I really [space] out sometimes... ;-) | |Bill |- Original Message - |From: John Tolmachoff (Lists) [EMAIL PROTECTED] |To: [EMAIL PROTECTED] |Sent: Monday, December 01, 2003 1:27 PM |Subject: RE: [Declude.JunkMail] Subject Starts with | | | I have to agree with Kami. I would rather not define reserved words. | | John Tolmachoff | Engineer/Consultant/Owner | eServices For You | | | -Original Message- | From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- | [EMAIL PROTECTED] On Behalf Of Kami Razvan | Sent: Monday, December 01, 2003 12:36 PM | To: [EMAIL PROTECTED] | Subject: RE: [Declude.JunkMail] Subject Starts with | | Matt.. | | This is scary .. Now you are suggesting we start defining reserve |words.. | | This way, if it starts a trend, we can not filter on [space] | anymore.. | | Just a thought. | | Kami | | | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED] On Behalf Of Matthew | Bramble | Sent: Monday, December 01, 2003 3:23 PM | To: [EMAIL PROTECTED] | Subject: Re: [Declude.JunkMail] Subject Starts with | | Scott, | | Instead of adding it a command, how about you just create a | substitution string for space, i.e. [space]. This way it could be | used in this fashion, as well as before some words (as a delimiter | in the sense that Bill earlier | suggested). | | SUBJECT 0 BEGINSWITH [space] | BODY 0 CONTAINS [space]ass | | Matt | | | | R. Scott Perry wrote: | | | Scott, feature request. (Sigh, another one.) | | Can you add something like this: | | SUBJECT 0 STARTSWITHSPACE | | I am seeing a good amount of spam where the subject line starts | with a space and then some character and then the subject. | | | Ah, good idea -- I'll see if we can add that. | | -Scott | | | --- | [This E-mail was scanned for viruses by Declude Virus | (http://www.declude.com)] | | --- | This E-mail came from the Declude.JunkMail mailing list. To |unsubscribe, | just send an E-mail to [EMAIL PROTECTED], and type unsubscribe | Declude.JunkMail. The archives can be found at | http://www.mail-archive.com. | | --- | [This E-mail was scanned for viruses by Declude Virus | (http://www.declude.com)] | | --- | This E-mail came from the Declude.JunkMail mailing list. To | unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type | unsubscribe Declude.JunkMail. The archives can be found at | http://www.mail-archive.com. | | --- | [This E-mail was scanned for viruses by Declude Virus |(http://www.declude.com)] | | --- | This E-mail came from the Declude.JunkMail mailing list. To
Re: [Declude.JunkMail] BODY STARTSWITH
Bill, I haven't seen an absolute confirmation that this functionality works yet as I haven't yet integrated this filter into my system using the new code. The END functionality though is something that Scott said he would include along with MAXWEIGHT, MINWEIGHT, SKIPIFWEIGHT, and some logging options for weighting, and he described how it works in his response to my question for added functionality in his message on 11/14. I'll explain it further if that message doesn't do it for you. Matt Bill Landry wrote: Matt, I was noticing that you are using END in this file. How is that feature enabled? When I add END to any of my files, it seems that JunkMail just skips the entire files. Is there something that you need to add to the global.cfg to enable this filter feature? Bill - Original Message - From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 25, 2003 4:12 PM Subject: Re: [Declude.JunkMail] BODY STARTSWITH Munged twice so far, so I am resending this time without the zip file attachment in the event that there is some sort of restriction on this. The referenced file can be downloaded from the following link: http://www.mailpure.com/software/decludefilters/gibberish/Gibberish_v2-0-0.txt Matt Original Message Subject: Re: [Declude.JunkMail] BODY STARTSWITH Date: Tue, 25 Nov 2003 18:39:22 -0500 From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Scott, I've attached a new copy of the GIBBERISH filter that makes use of the END and MAXPOINTS functionality that was discussed previously. Am I correct that these can also be used now with Declude JunkMail Pro v1.76i27? And if so, did I follow the implemented methodology? Essentially, I'm using the functionality to simplify into one file and save on processing. I tried to order things within the file so that the most common END statements would be hit first, and I scored the Main Filter hits at 1000 so that it would be easy for an administrator to modify the scoring by just adjusting the MAXPOINTS entry. The MAXPOINTS entry should keep the filter from adding points incrementally, and it should end the test after one hit, producing no more score than the MAXPOINTS entry allows. Scoring isn't applied to the filter in the Global.cfg file since it is all handled internal to the filter. Note to fellow admins: This file also hasn't been tested because I am not yet using the proper release. I'm really just putting it out there to see if Scott can tell me if I got the idea right. I must stress that this is not intended to be used for any versions of Declude JunkMail Pro prior to v1.76i27 because it could result in assessing 1000 or more points without proper software support, and it may have other issues. Please do not put this into a production environment unless you understand what you are doing and are going to monitor it closely. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] BODY STARTSWITH
MINWEIGHT How does that work? - Original Message - From: Bill Landry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, December 02, 2003 5:12 PM Subject: Re: [Declude.JunkMail] BODY STARTSWITH Thanks Matt, I was able to accomplish what I wanted using MINWEIGHT. Bill - Original Message - From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, December 02, 2003 1:59 PM Subject: Re: [Declude.JunkMail] BODY STARTSWITH Bill, I haven't seen an absolute confirmation that this functionality works yet as I haven't yet integrated this filter into my system using the new code. The END functionality though is something that Scott said he would include along with MAXWEIGHT, MINWEIGHT, SKIPIFWEIGHT, and some logging options for weighting, and he described how it works in his response to my question for added functionality in his message on 11/14. I'll explain it further if that message doesn't do it for you. Matt Bill Landry wrote: Matt, I was noticing that you are using END in this file. How is that feature enabled? When I add END to any of my files, it seems that JunkMail just skips the entire files. Is there something that you need to add to the global.cfg to enable this filter feature? Bill - Original Message - From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 25, 2003 4:12 PM Subject: Re: [Declude.JunkMail] BODY STARTSWITH Munged twice so far, so I am resending this time without the zip file attachment in the event that there is some sort of restriction on this. The referenced file can be downloaded from the following link: http://www.mailpure.com/software/decludefilters/gibberish/Gibberish_v2-0-0. txt Matt Original Message Subject: Re: [Declude.JunkMail] BODY STARTSWITH Date: Tue, 25 Nov 2003 18:39:22 -0500 From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Scott, I've attached a new copy of the GIBBERISH filter that makes use of the END and MAXPOINTS functionality that was discussed previously. Am I correct that these can also be used now with Declude JunkMail Pro v1.76i27? And if so, did I follow the implemented methodology? Essentially, I'm using the functionality to simplify into one file and save on processing. I tried to order things within the file so that the most common END statements would be hit first, and I scored the Main Filter hits at 1000 so that it would be easy for an administrator to modify the scoring by just adjusting the MAXPOINTS entry. The MAXPOINTS entry should keep the filter from adding points incrementally, and it should end the test after one hit, producing no more score than the MAXPOINTS entry allows. Scoring isn't applied to the filter in the Global.cfg file since it is all handled internal to the filter. Note to fellow admins: This file also hasn't been tested because I am not yet using the proper release. I'm really just putting it out there to see if Scott can tell me if I got the idea right. I must stress that this is not intended to be used for any versions of Declude JunkMail Pro prior to v1.76i27 because it could result in assessing 1000 or more points without proper software support, and it may have other issues. Please do not put this into a production environment unless you understand what you are doing and are going to monitor it closely. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] BODY STARTSWITH
Fred, It's probably best to go back and reference the follow up posts to that thread. This isn't going to be anywhere near as common as MAXWEIGHT, but it provides the same sort of functionality for negative weighted tests (limits total scoring and ends processing of a filter when that threshold is reached). Matt Frederick Samarelli wrote: MINWEIGHT How does that work? - Original Message - From: Bill Landry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, December 02, 2003 5:12 PM Subject: Re: [Declude.JunkMail] BODY STARTSWITH Thanks Matt, I was able to accomplish what I wanted using MINWEIGHT. Bill - Original Message - From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, December 02, 2003 1:59 PM Subject: Re: [Declude.JunkMail] BODY STARTSWITH Bill, I haven't seen an absolute confirmation that this functionality works yet as I haven't yet integrated this filter into my system using the new code. The END functionality though is something that Scott said he would include along with MAXWEIGHT, MINWEIGHT, SKIPIFWEIGHT, and some logging options for weighting, and he described how it works in his response to my question for added functionality in his message on 11/14. I'll explain it further if that message doesn't do it for you. Matt Bill Landry wrote: Matt, I was noticing that you are using END in this file. How is that feature enabled? When I add END to any of my files, it seems that JunkMail just skips the entire files. Is there something that you need to add to the global.cfg to enable this filter feature? Bill - Original Message - From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 25, 2003 4:12 PM Subject: Re: [Declude.JunkMail] BODY STARTSWITH Munged twice so far, so I am resending this time without the zip file attachment in the event that there is some sort of restriction on this. The referenced file can be downloaded from the following link: http://www.mailpure.com/software/decludefilters/gibberish/Gibberish_v2-0-0. txt Matt Original Message Subject: Re: [Declude.JunkMail] BODY STARTSWITH Date: Tue, 25 Nov 2003 18:39:22 -0500 From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Scott, I've attached a new copy of the GIBBERISH filter that makes use of the END and MAXPOINTS functionality that was discussed previously. Am I correct that these can also be used now with Declude JunkMail Pro v1.76i27? And if so, did I follow the implemented methodology? Essentially, I'm using the functionality to simplify into one file and save on processing. I tried to order things within the file so that the most common END statements would be hit first, and I scored the Main Filter hits at 1000 so that it would be easy for an administrator to modify the scoring by just adjusting the MAXPOINTS entry. The MAXPOINTS entry should keep the filter from adding points incrementally, and it should end the test after one hit, producing no more score than the MAXPOINTS entry allows. Scoring isn't applied to the filter in the Global.cfg file since it is all handled internal to the filter. Note to fellow admins: This file also hasn't been tested because I am not yet using the proper release. I'm really just putting it out there to see if Scott can tell me if I got the idea right. I must stress that this is not intended to be used for any versions of Declude JunkMail Pro prior to v1.76i27 because it could result in assessing 1000 or more points without proper software support, and it may have other issues. Please do not put this into a production environment unless you understand what you are doing and are going to monitor it closely. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- === Matthew S. Bramble President and Technical Coordinator iGaia Incorporated, Operator of
Re: [Declude.JunkMail] BODY STARTSWITH
I use it the exact opposite to MAXWEIGHT, which allows me to set a minimum
weight that I do not want a filter weight to go below. For example:
MINWEIGHT-5
will tell JunkMail not to apply a weight lower then -5 to the message, even
if the actual weight is lower then -5.
HTH,
Bill
- Original Message -
From: Frederick Samarelli [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, December 02, 2003 2:28 PM
Subject: Re: [Declude.JunkMail] BODY STARTSWITH
MINWEIGHT
How does that work?
- Original Message -
From: Bill Landry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, December 02, 2003 5:12 PM
Subject: Re: [Declude.JunkMail] BODY STARTSWITH
Thanks Matt, I was able to accomplish what I wanted using MINWEIGHT.
Bill
- Original Message -
From: Matthew Bramble [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, December 02, 2003 1:59 PM
Subject: Re: [Declude.JunkMail] BODY STARTSWITH
Bill,
I haven't seen an absolute confirmation that this functionality works
yet as I haven't yet integrated this filter into my system using the
new
code. The END functionality though is something that Scott said he
would include along with MAXWEIGHT, MINWEIGHT, SKIPIFWEIGHT, and some
logging options for weighting, and he described how it works in his
response to my question for added functionality in his message on
11/14. I'll explain it further if that message doesn't do it for you.
Matt
Bill Landry wrote:
Matt, I was noticing that you are using END in this file. How is
that
feature enabled? When I add END to any of my files, it seems that
JunkMail just skips the entire files. Is there something that you
need
to
add to the global.cfg to enable this filter feature?
Bill
- Original Message -
From: Matthew Bramble [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, November 25, 2003 4:12 PM
Subject: Re: [Declude.JunkMail] BODY STARTSWITH
Munged twice so far, so I am resending this time without the zip
file
attachment in the event that there is some sort of restriction on
this.
The referenced file can be downloaded from the following link:
http://www.mailpure.com/software/decludefilters/gibberish/Gibberish_v2-0-0.
txt
Matt
Original Message
Subject: Re: [Declude.JunkMail] BODY STARTSWITH
Date: Tue, 25 Nov 2003 18:39:22 -0500
From: Matthew Bramble [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Scott,
I've attached a new copy of the GIBBERISH filter that makes use of
the
END and MAXPOINTS functionality that was discussed previously. Am I
correct that these can also be used now with Declude JunkMail Pro
v1.76i27? And if so, did I follow the implemented methodology?
Essentially, I'm using the functionality to simplify into one file
and
save on processing. I tried to order things within the file so that
the
most common END statements would be hit first, and I scored the Main
Filter hits at 1000 so that it would be easy for an administrator to
modify the scoring by just adjusting the MAXPOINTS entry. The
MAXPOINTS
entry should keep the filter from adding points incrementally, and
it
should end the test after one hit, producing no more score than the
MAXPOINTS entry allows. Scoring isn't applied to the filter in the
Global.cfg file since it is all handled internal to the filter.
Note to fellow admins: This file also hasn't been tested because I
am
not yet using the proper release. I'm really just putting it out
there
to see if Scott can tell me if I got the idea right. I must stress
that
this is not intended to be used for any versions of Declude JunkMail
Pro
prior to v1.76i27 because it could result in assessing 1000 or more
points without proper software support, and it may have other
issues.
Please do not put this into a production environment unless you
understand what you are doing and are going to monitor it closely.
Matt
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an
RE: [Declude.JunkMail] Spamchk fine tuning?
I just set up spamchk and was wondering if anyone can share some fine-tuning info with me? Updated keyword lists and such? I tried subscribing to their list but all I get back is an Invalid Syntax email from their mail server. hmm... I've tried to un- and the subscribe without any problem. Try to go on www.spamchk.com and click on the subscribe-link in the center of the page. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SKIPIFWEIGHT possible bug?
Scott, Ok, I have finally gotten around to modifying my filters to use some of the new features. It definitely is having an impact on my processor from what I can see. I think I have uncovered a bug or bugs though in terms of how thresholds are calculated and how it affects processing and logging. I have a SPAMTRAPS filter with a SKIPIFWEIGHT set and a line which got hit as follows: SKIPIFWEIGHT30 ALLRECIPS15CONTAINS[EMAIL PROTECTED] I delete messages at a score of 30, however I found the following message (headers) in my holding account which scored a 29, but didn't get any scoring from hitting my SPAMTRAPS filter with the above address: X-MailPure: X-MailPure: SPAMCOP: Listed in bl.spamcop.net X-MailPure: FIVETEN-SPAMSUPPORT: Listed in blackholes.five-ten-sg.com X-MailPure: MAILPOLICE-BULK: Listed in bulk.rhs.mailpolice.com X-MailPure: MAILPOLICE-PORN: Listed in porn.rhs.mailpolice.com X-MailPure: NOLEGITCONTENT: No legitimate content detected. X-MailPure: RECIPIENTS: [EMAIL PROTECTED] X-MailPure: X-MailPure: Spam Score: 29 X-MailPure: Scan Time: 17:38:53 on 12/02/2003 X-MailPure: Spool File: D147103b1007e35c8.SMD X-MailPure: SMTP Sender: [EMAIL PROTECTED] X-MailPure: Received From: mail117.alukud.com [67.30.133.117] X-MailPure: X-MailPure: Spam and virus blocking services provided by MailPure.com X-MailPure: It seems that the order of adding points is a bit off from what I was expecting. The message should have been processed by the SPAMTRAPS filter (I believe it was), and then another 15 points should have been added which would have pushed it to 44 points and my deletion level. I searched my logs for this message to verify the results and found that there was no entry for this message in my Declude JunkMail log. Yes, really, no entry at all :) I did verify that my custom WARN action was configured for my SPAMTRAPS test and the combination of the positive and negative weighted tests indicated in the headers do equal a score of 29. Feel free to ask for a zip of the supporting files if you need them. Thanks, Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] What is this about ??
Also it seems that declude is claiming that 216.204.154.7 has no MX. DnsStuff.com reports: Actually, that's a server of yours, which you've let Declude JunkMail know about. How do I tell it not to know about it and my web servers as well? So they dont fail the MX test. This stops some mail from our web servers that use email to the customers email box for order processing. Thanks ! Dave - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, December 02, 2003 7:57 AM Subject: Re: [Declude.JunkMail] What is this about ?? I've gotten serveral of these the past few minutes. Below are the full headers ..I'm assuming they are trying to relay ??? It's hard to say what spammers are doing when they aren't sending a real spam to someone. They may be making relay attempts, they may be checking to see if you have blocked a certain IP, they may be trying to get people to reply... Also it seems that declude is claiming that 216.204.154.7 has no MX. DnsStuff.com reports: Actually, that's a server of yours, which you've let Declude JunkMail know about. The confusion is that the spammer is doing something really stupid: He's claiming that his computer is an Internet host with the same name as your IP (that's about as silly as giving out a phone number when asked for a credit card -- it just doesn't work). Received: from 216.204.154.7 [24.241.184.85] by maineconnect.net (SMTPD32-8.01) id A524B75700F8; Mon, 01 Dec 2003 18:56:20 -0500 This is the Received: header that Declude JunkMail is looking at -- Declude uses the IP 24.241.184.85 for scanning, and a host name of 216.204.154.7 (which isn't a valid host name, so the E-mail fails the HELOBOGUS test). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] What is this about ??
Also it seems that declude is claiming that 216.204.154.7 has no MX. DnsStuff.com reports: Actually, that's a server of yours, which you've let Declude JunkMail know about. How do I tell it not to know about it and my web servers as well? So they dont fail the MX test. That's not the problem -- that's a *good* thing that Declude JunkMail knows that the first IP is yours. Otherwise, it would scan that IP, see that it doesn't belong to a spammer, and the spam would go through. It's also a good thing that the E-mail failed the HELOBOGUS test (as it was spam, and legitimate E-mail of yours would not have failed the HELOBOGUS test). This stops some mail from our web servers that use email to the customers email box for order processing. In this case, you'll need to provide the headers for one of the legitimate E-mails that is getting caught. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamchk fine tuning?
Markus wrote: hmm... I've tried to un- and the subscribe without any problem. Thats because you're using the link that works :-O. Go to the installation instructions here http://www.spamchk.com/modules.php?name=Newsfile=articlesid=2 And try the subscribe link on that page. You'll get a nastygram rather than a subscription :-). Just tried the link you sent and it gave me a different format. I'm sure thats the problem. Thx! -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamchk fine tuning?
A couple of posters offered some help on this, where I don't have the original messages (they're at home and I'm at work). The FP rate is fairly heavy on spamchk so far... including bagging about half of the traffic on this list today. I'm sure its something easily fixed. I'd love to see a config file AND see what exactly the penalty weight spots are so I can halve them (its not clear to me sometimes whether I'm looking at a penalty weight or a thresahold on some things). I understand nobody has perfect answers. Just looking for a leg up on the learning curve. Cheers, -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SKIPIFWEIGHT possible bug?
Ok, I have finally gotten around to modifying my filters to use some of the new features. It definitely is having an impact on my processor from what I can see. I think I have uncovered a bug or bugs though in terms of how thresholds are calculated and how it affects processing and logging. The first thing to do is make sure that you are running the latest interim release (1.76i29), and see if the problem continues. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] ATTACH action question
I'm using the attach action rather than holding, bouncing etc. Every month I prepare a report for my customers that tells them how much mail got delivered, how much got blocked etc. If an item is given an ATTACH action, does Imail ever see it? Does Declude attach and deliver directly? Knowing this will make a big difference in my log analysis, which seems to show a big drop in mail that I can only explain if the answers to the above are No and Yes, respectively. -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] My External Plus Program
Hi, I have a per-user external plus program that I wrote that is very handy to whitelist or blacklist based on e-mail addresses or subject lines. The program is very small (54K) and in my case, does not add any processing time to message delivery. If you would like to take a look or give it a try, go to: http://www.wamusa.com/wamcheck There, you will find a one-page text file with instructions and the program. I am also working on a web-base interface where users can manage their own rules file. If anyone would like to demo the on-line manager, please send me an e-mail directly and I will send the URL and user information that you can use. Any comments on the wamcheck program would be greatly appreciated. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ATTACH action question
Thanks for the clarification, Scott. Cheers, -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SKIPIFWEIGHT possible bug?
Scott, I was on 1.76i28 but upgraded as suggested, and I was able to verify that the filter is now hit when the score is within the difference in points from the SKIPIFWEIGHT and it is logged. I'm not totally sure if this perfectly represents the original issue, though I tried to mimic the functionality as best I could (I couldn't add 29 points from DNS based tests before the filters, I had to do it with filters alone). I'm guessing though that this was a known problem and fixed in that release. Thanks. Matt R. Scott Perry wrote: Ok, I have finally gotten around to modifying my filters to use some of the new features. It definitely is having an impact on my processor from what I can see. I think I have uncovered a bug or bugs though in terms of how thresholds are calculated and how it affects processing and logging. The first thing to do is make sure that you are running the latest interim release (1.76i29), and see if the problem continues. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Problems with Errors in Logs
Greetings, I have been having a little problem since about 2:00 pm yesterday afternoon. I noticed that the spool directory was a little large. I then cleaned out the spool. However it started building back up immediately and I noticed that now, I am constantly getting errors in both my declude junkmail and declude antivirus logs. As soon as I delete the logs, they appear again with more errors. Has anyone had this problem before of have some advice as to what the problem may be? I have changed my declude junkmail files to match the default on the website and still no luck. Need some help ASAP! Thanks, Daniel === Daniel Ivey GCR Company / GCR Online Voice: 434 - 570 - 1765 Fax: 434 - 572 - 1981 [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] [Declude.Virus] Problems with Errors in Logs
I am constantly getting errors in both my declude junkmail and declude antivirus logs. What errors? As soon as I delete the logs, they appear again with more errors. Unfortunately, deleting the log files won't fix a problem. Is your hard drive full? Are you processing a much higher volume of E-mail than usual? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spammers unleash e-mail worm
Here we go again: http://www.reuters.co.uk/newsArticle.jhtml?type=internetNewsstoryID=3924996section=news Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Server Gone Wild
A friend of mine at Safe-t.net in Mt. Vernon Ohio just called me and said his spool in Imail is loading up and holding all messages..He thinks the Declude has stopped working...Imail tech support not available.. He has rebooted the server several times with no luck.. Declude log is not showing anything... If anyone on this list has an idea what is going on could you please give Brian Thompson a call at 1.888.895.8648 He can't use email as it just goes to the spool and sits Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Server Gone Wild
possible dns not resolvingtry changing DNS in Imail and restart smtpworks for mine sometimes... gb At 12:06 AM 12/3/2003 -0600, you wrote: A friend of mine at Safe-t.net in Mt. Vernon Ohio just called me and said his spool in Imail is loading up and holding all messages..He thinks the Declude has stopped working...Imail tech support not available.. He has rebooted the server several times with no luck.. Declude log is not showing anything... If anyone on this list has an idea what is going on could you please give Brian Thompson a call at 1.888.895.8648 He can't use email as it just goes to the spool and sits Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Server Gone Wild
Give him a ring and tell him to uninstall declude. Only takes a second or two. I'd ring him but it would be a very very expensive call :-) _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Richard Farris Sent: Wednesday, 3 December 2003 17:06 To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Server Gone Wild A friend of mine at Safe-t.net in Mt. Vernon Ohio just called me and said his spool in Imail is loading up and holding all messages..He thinks the Declude has stopped working...Imail tech support not available.. He has rebooted the server several times with no luck.. Declude log is not showing anything... If anyone on this list has an idea what is going on could you please give Brian Thompson a call at 1.888.895.8648 He can't use email as it just goes to the spool and sits Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Server Gone Wild
He's OK. - Original Message - From: Richard Farris [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, December 03, 2003 1:06 AM Subject: [Declude.JunkMail] Server Gone Wild A friend of mine at Safe-t.net in Mt. Vernon Ohio just called me and said his spool in Imail is loading up and holding all messages..He thinks the Declude has stopped working...Imail tech support not available.. He has rebooted the server several times with no luck.. Declude log is not showing anything... If anyone on this list has an idea what is going on could you please give Brian Thompson a call at 1.888.895.8648 He can't use email as it just goes to the spool and sits Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Server Gone Wild
This is Brian Thompson with an update: Mail server appears to be back up and running. Thanks for all the help. Still don't know what the problem was, but my declude log shows no entries from 4:23 pm until 11:58 pm. - Original Message - From: Glen Harvy [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, December 03, 2003 1:24 AM Subject: RE: [Declude.JunkMail] Server Gone Wild Give him a ring and tell him to uninstall declude. Only takes a second or two. I'd ring him but it would be a very very expensive call :-) _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Richard Farris Sent: Wednesday, 3 December 2003 17:06 To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Server Gone Wild A friend of mine at Safe-t.net in Mt. Vernon Ohio just called me and said his spool in Imail is loading up and holding all messages..He thinks the Declude has stopped working...Imail tech support not available.. He has rebooted the server several times with no luck.. Declude log is not showing anything... If anyone on this list has an idea what is going on could you please give Brian Thompson a call at 1.888.895.8648 He can't use email as it just goes to the spool and sits Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
