Matt
I understand the logic and I think it can be very usefull
for certain IP Blacklist a having relative high FP rate.
From my reports I can see that XBL has had a FP (or "wrong
result") in the last 14 days and 123000 messages only in 54 cases. This is a
very low FP-rate.
But there are
I have some old e-mail addresses like that. Between 3 or 4 of them I can
get up to 500 SPAM mail a day. I assigned all the ids as aliases to a
SPAMTrap id and I use that id to gauge how Declude is doing. It is very
helpful to me. Then I just clean out the messages. Right now there are
5079
For the folks using multiple scanners, do you have any stats on how
often the secondary scanner found a virus that the first one missed?
I realize that the cost of F-Prot (which I am using) is quite low and
others might be as well, so it is not a cost issue but rather a Do I
really need it?.
Matt,
But if you rename the tests to DYN
than how you are configuring non-DUL tests twice?
Darrell
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Matt
Sent: Saturday, May 15, 2004 6:42
PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail]
DUL skipping
GJ For the folks using multiple scanners, do you have any stats on how
GJ often the secondary scanner found a virus that the first one missed?
I run f-prot as #1, NAI as #2, and ClamAV as #3. I do keep daily
stats for my Imail/Declude server. I'm not sure what you want to
know but
Hello, All,
Is "spamdomains" one of the tests that permits
comments on the same line as it's entries or not?
For example, if I have a "spamdomains" file that
looks like...
@adelphia.net.adelphia.net
# Added:
05/17/2004@att.net
# Added: 05/17/2004@attbi.com
Thank you so much, Kami! I can definitely understand your concise
explanation and it sounds like a great way to handle what I am trying to do
or at least add another trick in the bag. I'll have to see how I can
incorporate this into my current setup.
Thanks, Again!
Dan
- Original Message
On 17 May 2004 at 9:13, Goran Jovanovic wrote:
For the folks using multiple scanners, do you have any stats on how
often the secondary scanner found a virus that the first one missed?
Hi Goran,
Here are my latest stats:
Virus Totals:
441 F-Prot
412 AVG
446 McAfee
To my recollection, you can not have comments
on the same lines in SpamDomains.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
Sent: Monday, May 17,
2004 6:39
My 1 year McAfee VirusScan Command Line license was $11 through CDW. I think only
CLAM-AV can beat that price.
On Sunday McAfee caught these that F-Prot did not catch:
1 Exploit MHTRedir
4 Exploit-ObjectData Trojan
2 W32 Bagle pwdzip (typically catches more of these)
3 Netsky P
F-Prot caught 1
Was just wondering if anyone else can bring up the Declude website. I'm
updating my favorites (gonna giving FireFox a run) and the Declude site
isn't coming up for me.
Anyone else having that same problem?
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
Title: Message
You don't have to remove the
tests, you just have to rename them. I renamed mine with DYN, that way
Declude doesn't see them as matching DUL/DYNA/DUHL and therefore will not skip
them when the Mail From matches a local address.
But
Matt - please correct me if I'm wrong.I
Nope. It's up.
Darin.
- Original Message -
From: Jeff Maze [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, May 17, 2004 10:30 AM
Subject: [Declude.JunkMail] [OT] Declude Web Site - is it down?
Was just wondering if anyone else can bring up the Declude website. I'm
updating my
I just happened to go to dnsstuff.com and received a 425 error about 15
minutes ago.(same now)
Bruce
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Jeff Maze
Sent: Monday, May 17, 2004 10:31 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] [OT]
Someone have the link to CLAM-AV ?
thanks,
Larry Craddock
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe
Someone have the link to CLAM-AV ?
ClamAV home: http://www.clamav.net/
ClamAV for Windows: http://www.sosdg.org/clamav-win32/index.php
See our utility page
http://www.smartbusiness.com/imail/declude/
for 2 utilities:
a) RunClamd - an nt service which keeps clamd running as a
Andy,
I think there is some confusion here on your part.
What was discovered and initially discussed in this thread though is
that Declude will not test the last hot with such tests when the Mail
>From matches a local address. That was also good design, but if you
can whitelist all local
Markus Gufler wrote:
But there are other tests like
FIVETEN-SRC that has had a wrong result in the same range for 9100
messages. The question is if FIVETEN-SRC allows a %IP4R% lookup.
They are all in fact IP4R lookups (if that is what the test is set
for). If you set Declude to
Darrell LaRock wrote:
Matt,
But if you
rename the tests to DYN
than how you are configuring non-DUL tests twice?
For DUL-type tests, I am only configuring them once, i.e.
DNSRBL-DYN dnsbl %IP4R%.dun.dnsrbl.net
127.0.0.3 0 0
NJABL-DYN-A dnsbl
Dan Geiser wrote:
will those "# Added: 05/17/2004"
comments mess up the functioning of the file?
I believe they will. Declude typically sees anything after the final
delimiter (space or tab) as one full string, even if it has another
space or tab in it.
Matt
--
If you need it, try backup.dnsstuff.com
Darin.
- Original Message -
From: Bruce Loughlin [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, May 17, 2004 11:04 AM
Subject: RE: [Declude.JunkMail] [OT] Declude Web Site - is it down?
I just happened to go to dnsstuff.com and received
Hi Andy,
Look at the example, again and note the %IP4R%. That tests ONLY the
1st HOP (or for clarity, the IP which delivered the mail to your
server).
Change this:
NJABL-DUL ip4r dnsbl.njabl.org 127.0.0.3 10 0
To this:
NJABL-HOP1 dnsbl %IP4R%.dnsbl.njabl.org 127.0.0.3 10 0
Hi,
Can anyone tell me why this one failed the SPAMHEADERS test?
-Dave Doherty
Skywaves, Inc.
Received: from IlanXP [68.236.177.124] by inettec.com with ESMTP
(SMTPD32-8.05) id A69B29201E4; Mon, 17 May 2004 13:30:03 -0400
From: Ilan Cyzner [EMAIL PROTECTED]
To: 'Dave Doherty' [EMAIL
You can use the tool Scott has setup to look up the reason a message has
failed.
http://www.declude.com/tools/header.php?code=420e
Here is the link to your error code.
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Dave Doherty
http://www.declude.com/tools/header.php?code=420e
- Original Message -
From: Dave Doherty [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, May 17, 2004 2:26 PM
Subject: [Declude.JunkMail] SPAMHEADERS?
Hi,
Can anyone tell me why this one failed the SPAMHEADERS test?
-Dave
Being able to whitelist all users is important. This can be done
with Imail 8 and by using WHITELISTED AUTH in Declude's Global.cfg.
However, whether or not all users do actually AUTH, still depends
upon the SMTP SECURITY setting in Imail 8. For instance, if SMTP
SECURITY is set to relay for
- Original Message -
From: Don Brown [EMAIL PROTECTED]
Being able to whitelist all users is important. This can be done
with Imail 8 and by using WHITELISTED AUTH in Declude's Global.cfg.
However, whether or not all users do actually AUTH, still depends
upon the SMTP SECURITY setting
For the latter there is an outstanding request to Scott to
kill additional scanning once a scanner detects a virus..
So right now if you use multiple scanners when you scan with ScannerA
and it finds a virus Declude will still call ScannerB and have it scan
as well?
Scott pointed out that his
Where can we purchase the command line scanner?
Thanks,
Aaron Caviglia
On May 17, 2004, at 8:23 PM, Goran Jovanovic wrote:
For the latter there is an outstanding request to Scott to
kill additional scanning once a scanner detects a virus..
So right now if you use multiple scanners when you scan
Anyone have any experience with SPEWS.ORG? It seems that the IP address
of our server we are using is listed in SPEWS. Has anyone ever got
themselves de-listed?
Goran Jovanovic
The LAN Shoppe
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
The requeue.asp by Markus works great.
Wonder if something similar exists for junkmail where users get an end of
day email listing the senders and subjects of holded spam, and they can
click on a link if they recognize a specific message ?
TIA
- Original Message -
From: Adolfo
31 matches
Mail list logo
