Here's another email with a problem, the comments test has been fired
but there is no html portion, there are ! in the winmail.dat attached
file that seems to be triggering it.
Is it possible to make this test just look inside Content-Type:
text/html sections or even html open and close tags?
Here's another email with a problem, the comments test has been fired
but there is no html portion, there are ! in the winmail.dat attached
file that seems to be triggering it.
Is it possible to make this test just look inside Content-Type:
text/html sections or even html open and close tags?
Not
Ok, I'll add a minimum number in to help in this case.
Cheers
Jools
On Wed, 25 Jun 2003 08:51:16 -0400, you wrote:
Here's another email with a problem, the comments test has been fired
but there is no html portion, there are ! in the winmail.dat attached
file that seems to be triggering it.
Apparently, this means Generic Viagra as revealed in the Declude Log
file:
=?iso-8859-1?B?R2VuZXJpYyBWaWFncmE=?=
What can you do about obfuscated subjects using ISO character sets? I
was thinking of filtering them based on partial string, like this:
SUBJECT 30 CONTAINS =?iso-8859
For those considering upgrade to MS Windows 2003 I strongly recommend
setting the phantom heap to 2048 in the system registry as follows:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\
SubSystems\
The default entry is SharedSection=1024,3072,2048(Default 512). After making
Can you please elaborate on why this should be done, and if this setting is
an all recommendation or something specific to imail/declude
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Terry Parks
Sent: Wednesday, June 25, 2003 5:27 PM
To: [EMAIL
shaw.ca shawcable.net
Best Regards
Andy
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The
We are of the If it ain't broke, don't fix it house. Meaning, we ONLY do
this when necessary. We found that this change WAS REQUIRED anytime we ran
Imail with Declude on ANY MS WINDOWS server box (NT 4.0, 2000, now 2003). We
had hoped MS would have addressed the issue of undocumented memory space,
I have not had any problems with the Imail 6,7,8/Windows 2000
Server/Declude combination at all. It's the only damn server I
generally don't worry about!!
Thank you,
Aaron Caviglia
[EMAIL PROTECTED]
VanTech.Net
www.vantech.net
Toll Free 800-872-3359
Phone 559-732-3952
Fax 559-732-1509
6707
unsubscribe
Yesterday I posted that ameritech.net was coming from a yahoo mail server.
Today this one os coming from adelphia.net... as a result I have removed
amertiech.net from the sd.txt file.
Received: from Hyperion.tenforward.com [65.161.10.61] by tenforward.com with
ESMTP
(SMTPD32-7.15) id
I any one else having delivery probems to the Imail forum
Kevin Bilbee
Network Administrator
Standard Abrasives, Inc.
Changing the way industry works.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail
Yesterday I posted that ameritech.net was coming from a yahoo
mail server. Today this one os coming from adelphia.net... as
a result I have removed amertiech.net from the sd.txt file.
Is this not only because there is some user with an ameritech.net
address using the adelphia smtp-server?
I have a file in the .\declude directory called headblock.txt
The contents of the file are:
My first question would be whether or not you are running Declude JunkMail
Pro, which is required for filtering?
The next question: Does the Declude JunkMail log file show that the
E-mails are failing
Would you mind sharing your two lists? I would like to be more
aggressive with SPAMDOMAINS, but I know the FP potential.
Thanks,
Chuck Frolick
ArgoNet, Inc.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler
Sent: Wednesday, June 25, 2003
If the console is not being used at all, how does Hijack keep track of IP
addresses?
If the console is not being used, how can HOLD2 be cleared other than
restarting the computer?
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
---
[This E-mail was
I notice this kind of entry on either web messaging messages or auto notices
created by Declude or Imail:
06/25/2003 14:55:17 Q05fba2a0764 Warning: Could not find IP3 end on first
line of datafile (bound)?
06/25/2003 14:55:18 Q05fba2a0764 is not local.
06/25/2003 14:55:18 Q05fba2a0764 Outgoing
At the moment I haven't moved any domain from Bill's list to the low
file.
I've also some .it-domains in the spamdomains file because we've a lot
of italian traffic here. In the last days we've had a lot of fp's with
some of this it-domains and some spam getting trough because the weight
for
Scott-
I really would like to be able to have a way to see what line in my
filter triggered an action. Looking through the log file is a very time
consuming way to do this. Any way to show this in the headers?
Thanks,
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]
If the console is not being used at all, how does Hijack keep track of IP
addresses?
It does not. Without the Declude console running, Declude Hijack will not
work. However, if the \IMail\Deccon.exe file exists, then it will
automatically get started by Declude Hijack as needed.
I notice this kind of entry on either web messaging messages or auto notices
created by Declude or Imail:
06/25/2003 14:55:17 Q05fba2a0764 Warning: Could not find IP3 end on first
line of datafile (bound)?
06/25/2003 14:55:18 Q05fba2a0764 is not local.
06/25/2003 14:55:18 Q05fba2a0764 Outgoing
I really would like to be able to have a way to see what line in my
filter triggered an action. Looking through the log file is a very time
consuming way to do this. Any way to show this in the headers?
At least with the latest beta, the WARN action will add a header that
includes the line
Scott,
My fault. I was not reading the log files correctly. Two things I just
learnt:
1. If there is a rule and there is no defined action (incoming or outgoing)
the rule is ignored.
2. I am getting swamped with junkmail intended for another host whose
secondary MX is my host.
Has anyone
Has anyone noticed this? Spammers sending junkmail to secondary MX's?
Yes -- quite a few spammers do that, with the hope that the backup
mailserver won't have any spam control (and assuming that the primary can't
scan mail from the backup, which is usually the case).
Hi Omar,
You can read some background information about the issue at:
http://www.declude.com/dq.htm
It is in the part about Microsoft's mystery heap
Best regards,
Mike Higgins
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Omar K.
Sent: Wednesday,
If the console is not being used at all, how does Hijack keep track of IP
addresses?
It does not. Without the Declude console running, Declude Hijack will not
work. However, if the \IMail\Deccon.exe file exists, then it will
automatically get started by Declude Hijack as needed.
Thanks.
Along that same line then, as has been discussed before, any thought to
changing deccon.exe so as to be able to access from other than the console,
and other than the lengthy work around we discussed last year but that I
have not had the time to try yet?
The problem is that it must run when the
I updated to the beta, my WARN action for MYFILTER is:
MYFILTERWARNX-Filtered: This email contains words listed in
our filter file.
Is there a variable I need to add to make it display the line number of
the filtered word(s)?
-Original Message-
From: [EMAIL PROTECTED]
I updated to the beta, my WARN action for MYFILTER is:
MYFILTERWARNX-Filtered: This email contains words listed in
our filter file.
Is there a variable I need to add to make it display the line number of
the filtered word(s)?
You would need to use the default warning, by using just:
Will this add X-RBL-Warning to the headers?
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Wednesday, June 25, 2003 5:14 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Filtering Headers
I updated to the beta, my WARN
Yes, it will. It will add the default warning header (which includes the
line number of the match in the filter file).
-Scott
At 08:20 PM 6/25/2003, Mark Brody wrote:
Will this add X-RBL-Warning to the headers?
-Original Message-
From: [EMAIL PROTECTED]
And if there is more than one match from the same filter file? Because the
current behavior is to just display the line number of the last item that
matched from a filter file.
Bill
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, June
Darn, I thought MS would have taken care of that in win2k3 by now.
This is kind of OT, but for the record, we've been running win2k3 ever since
it went gold and are quite happy with it. The machine has not been rebooted
after the initial testing and tweaking. IIS6 has better response while
Unfortunately, we have switched from just adding the WARN action to all
failed tests to a weighting system. We have not told users yet and they are
still filtering on X-RBL-Warning in the headers. There would be way too many
false positives caught by end user rules if I change the action to just
And if there is more than one match from the same filter file? Because the
current behavior is to just display the line number of the last item that
matched from a filter file.
The behavior (by design) is to only include one match. There have been
requests to change this, however.
Scott,
Has anything changed in Imail 8 that changes the
way hijack clears hold 1?
I've had to raise the hold one to a high number to
basically disable hijack. If anything gets caught in 1 and 2 is not reached it
just sits in hold one, closing the console doesn't help. hasn't been much of an
I would like to request that change again, at least in the log file at mid
or higher log level.
Bill
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, June 25, 2003 7:01 PM
Subject: Re: [Declude.JunkMail] Filtering Headers
And if there
Even if it's not Friday evening:
Everyone else noticed that fewer and fewer spams are failing the basic
tests (like REVDNS)?
It seems that spammers can adapt very fast to the new situation but the
known potential false positive candidates (newsletters, web-form-mails,
faulty configured
Hello, All,
I'm getting ready to put SPAMDOMAINS in place on my installation of Declude
JunkMail Pro. Before I flip the switch I had a few questions which I was
hoping that those who are currently using SPAMDOMAINS could answer...
1) Increase message weight or HOLD?
I realize that there are 2
Hi all,
I have a file in the .\declude directory called headblock.txt
The contents of the file are:
HEADERS 10 CONTAINS from 216.220.106.30
HEADERS 10 CONTAINS from 216.220.106.24
In my global.cfg:
HEADBLOCK filter C:\Services\IMail\Declude\headblock.txt x 5 0
In my $default$.junkmail:
40 matches
Mail list logo
