What made you think I was on IMail? I'm using SmarterMail 2.6. The Declude version I'm running is 2.0.6 (I purchased the product in July 2005).
AUTOWHITELIST is definitely not ON. Here's a little snippet from the log file: 09/26/2005 01:25:17 39819112 Msg failed WEIGHT30 (Weight of 31 reaches or exceeds the limit of 30.). Action=HOLD. 09/26/2005 01:25:17.022 39819112 [2408] actionsdata[ i ] = [26 Sep 2005] 09/26/2005 01:25:17.022 39819112 [2408] ACTION_HOLD - holddir [C:\SMARTERMAIL\SPOOL\spam] 09/26/2005 01:25:17.022 39819112 [2408] ACTION_HOLD - datafile [C:\SMARTERMAIL\SPOOL\proc\39819112.EML] 09/26/2005 01:25:17.022 39819112 [2408] ACTION_HOLD - recipfile [C:\SMARTERMAIL\SPOOL\proc\39819112.HDR] 09/26/2005 01:25:17.022 39819112 [2408] ACTION_HOLD - datahold [C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.EML] 09/26/2005 01:25:17.022 39819112 [2408] ACTION_HOLD - reciphold [C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.HDR] 09/26/2005 01:25:17 39819112 Subject: [EMAIL PROTECTED] ---> $1.56 per dose pmonkz qdvfg ouo 09/26/2005 01:25:17 39819112 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 219.13.84.45 ID: A3FF561BF4 09/26/2005 01:25:17 39819112 Tests failed [weight=31]: CATCHALLMAILS=IGNORE NOLEGITCONTENT=WARN IPNOTINMX=WARN CBL=WARN MXRATE-BLOCK=WARN SORBS-DUHL=WARN SPAMBAG=WARN FIVETENSRC=WARN ROUTING=WARN WEIGHT6=WARN WEIGHT10=HOLD WEIGHT14=HOLD WEIGHT20=HOLD WEIGHT30=HOLD 09/26/2005 01:25:17 39819112 Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN HOLD [LAST ACTION=HOLD] 09/26/2005 01:25:17.022 39819112 [2408] Done Looping 09/26/2005 01:25:17.022 39819112 [2408] RecipFile( C:\SMARTERMAIL\SPOOL\proc\39819112.HDR ); 09/26/2005 01:25:17.022 39819112 [2408] QUEUEFILE_SAVEFILE = newhdrfile = [C:\SMARTERMAIL\SPOOL\proc\39819112.HDR] 09/26/2005 01:25:17.022 39819112 [2408] QUEUEFILE_SAVEFILE = newemlfile = [C:\SMARTERMAIL\SPOOL\proc\39819112.EML] 09/26/2005 01:25:17 39819112 Cumulative action(s) taken on this email = IGNORE WARN HOLD [LAST ACTION=HOLD] 09/26/2005 01:25:17.022 39819112 [2408] AlterMessage 09/26/2005 01:25:17.022 39819112 [2408] Subject = [] 09/26/2005 01:25:17.022 39819112 [2408] Warning = [X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: CBL: "Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=219.13.84.45"; X-RBL-Warning: MXRATE-BLOCK: "http://www.mxrate.com/lookup/refused.asp?ipaddress=219.13.84.45"; X-RBL-Warning: SORBS-DUHL: "Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml?219.13.84.45"; X-RBL-Warning: SPAMBAG: 45.84.13.219.blacklist.spambag.org. X-RBL-Warning: FIVETENSRC: 45.84.13.219.blackholes.five-ten-sg.com. X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam [2000010f]. X-RBL-Warning: WEIGHT6: Weight of 31 reaches or exceeds the limit of 6. X-Declude-Sender: [EMAIL PROTECTED] [219.13.84.45] X-Declude-Spoolname: 39819112.EML X-Declude-Note: Scanned by Declude 2.0.6 (http://www.declude.com/x-note.htm) for spam. X-Declude-Scan: Score [31] at 01:25:17 on 26 Sep 2005 X-Declude-Tests: NOLEGITCONTENT, IPNOTINMX, CBL, MXRATE-BLOCK, SORBS-DUHL, SPAMBAG, F 09/26/2005 01:25:17.022 39819112 [2408] Header = [] 09/26/2005 01:25:17.022 39819112 [2408] Footer = [--- [This E-mail scanned for viruses by Declude Virus] ] 09/26/2005 01:25:17.022 39819112 [2408] MoveFile in AlterMessage - datafile = [C:\SMARTERMAIL\SPOOL\proc\39819112.EML] TempFile = [C:\SMARTERMAIL\SPOOL\proc\39819112.EM$] 09/26/2005 01:25:17.022 39819112 [2408] CreateHoldFolder parameter [C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.EML] 09/26/2005 01:25:17.022 39819112 [2408] Hold directory is [C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005] 09/26/2005 01:25:17.022 39819112 [2408] Moving file to spam hold directory [C:\SMARTERMAIL\SPOOL\proc\39819112.EML][C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.EML] 09/26/2005 01:25:17 39819112 ERROR: Could not move spam to hold! Code: [2] Error String: [The system cannot find the file specified.] [C:\SMARTERMAIL\SPOOL\proc\39819112.EML] [C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.EML] 09/26/2005 01:25:17.022 39819112 [2408] Moving file to spam hold directory [C:\SMARTERMAIL\SPOOL\proc\39819112.HDR][C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.HDR] 09/26/2005 01:25:17 39819112 ERROR: Could not move spam to hold! Code: [2] Error String: [The system cannot find the file specified.] [C:\SMARTERMAIL\SPOOL\proc\39819112.EML] [C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.EML] -------- Original Message -------- > From: Matt <[EMAIL PROTECTED]> > Sent: Tuesday, September 27, 2005 4:10 PM > To: Declude.JunkMail@declude.com > Subject: Re: [Declude.JunkMail] opening a ticket with Declude support > > Gary, > > If you want help resolving this from the list members, it would be best > to post your Declude version and product levels, one such log snippet > for a message, and also your global.cfg and the associated > $default$.junkmail. > > I did note that you are using IMail 8.05, and I am on IMail 8.15 and > have no such issues, though I am not using the HOLD action, but instead > the COPYFILE action. > > There is a possibility that you have AUTOWHITELIST ON in your > global.cfg, and you have users than have themselves or others on their > own domain in their Webmail address books, and the effect of that would > be to whitelist the message if it came from a spammer that forged the > sender to match one of these entries. This is a common thing for people > with AUTOWHITELIST ON to experience, though your description doesn't > match exactly the circumstances here. > > Chances are that your issues can be solved with changing your > configuration and it might well not be a bug. > > Matt > > > > > Gary Steiner wrote: > > >I've been receiving a flurry of spam over the past two days where the spam > >gets delivered with no Declude header in the message. When viewing the log > >files, it seems that Declude scanned the message, found it to have a heavy > >spam weight, tried to move it to the hold directory, and failed with an > >error. > > > >I've reported this problem several times to Declude since I first installed > >the product back in July. Its resolution has not been pressing, since the > >number of spams getting through has been relatively few. However, for some > >reason over the past two days (coincidentally since 3.x came out) the number > >of these spams has increased dramatically, enough so that I've received > >complaints from my customers. > > > >The thing that the spams seem to have in common is that they are sent to > >multiple addreses within the domain. The implication is that when the > >message arrives, it creates a single file in the spool folder, but since it > >is sent to multiple addresses Declude scans it more than once. But since > >the file was already moved to hold from a previous scan, Declude experiences > >the file error and delivers the message anyway. > > > > > > > > -------- Original Message -------- > > > > > >>From: "David Barker" <[EMAIL PROTECTED]> > >>Sent: Tuesday, September 27, 2005 2:12 PM > >>To: Declude.JunkMail@declude.com > >>Subject: RE: [Declude.JunkMail] opening a ticket with Declude support > >> > >>Hi Gary, > >> > >>Currently the we have the ticket response system temporarily disabled. As > >>far as I am aware we have received all your messages. > >> > >>The way to open a ticket is to send an email to support @ declude.com you > >>can also submit a ticket using > >>http://support.declude.com/Customer/SubmitTicket.aspx > >> > >>Under general circumstances, support emails are answered within 24 hours on > >>business days. Which are Mon - Fri. If you feel that support is taking too > >>long to respond please feel free to email me directly dbarker @ declude.com > >> > >>As for your support tickets, > >> > >>1. SmarterMail picking up on RBL's that Declude is not is currently under > >>review and as soon as we have an answer to this I will let you know > >> > >>2. The header in the body is badly formed emails due to broken mail clients. > >>This is not a bug in declude but we are currently looking into a way to > >>bette handle these exceptions. > >> > >>3. AVAFTERJM ON > >>This is the way to have Declude EVA (Virus) run after Declude JunkMail,tthis > >>directive is located in your virus.cfg file. > >> > >>What specific issues are you refering to with 2.x ? I will follow up on this > >>and respond. > >> > >>David B > >>www.declude.com > >> > >> > >>-----Original Message----- > >>From: [EMAIL PROTECTED] > >>[mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner > >>Sent: Tuesday, September 27, 2005 12:01 PM > >>To: Declude.JunkMail@declude.com > >>Subject: [Declude.JunkMail] opening a ticket with Declude support > >> > >>It used to be that when I sent an email to [EMAIL PROTECTED] I would get > >>an automatic reply like the following: > >> > >> > >> > >>>Thank you for submitting a ticket to support. Your ticket number is > >>> > >>> > >>[xxx-xxxxxxxx-xxxx]. > >> > >> > >>>Please keep this ticket number for your records and include it in the > >>> > >>> > >>subject (including brackets) of all future emails regarding this issue. > >> > >> > >>>Thank You. > >>> > >>>Declude Technical Support > >>> > >>> > >>That doesn't happen anymore. If I do get a reply from [EMAIL PROTECTED], > >>it is usually from a specific support person like David Barker. Other > >>messages I have sent to [EMAIL PROTECTED] received no response, and for > >>all I know ended up in the bit bucket. > >> > >>How does one open a ticket with Declude support? Is the email method no > >>longer viable? Should I be using the web site at > >>http://support.declude.com/Customer/SubmitTicket.aspx ? > >> > >>I would love to download the 3.x upgrade, but I don't want to take on 3.x > >>until I see resolution of the issues with 2.x. Or at least a statement from > >>Declude saying that all the problems I've been having with 2.x are fixed in > >>3.x. > >> > >> > >> > >> > >> > > > >--- > >[This E-mail scanned for viruses by Declude Virus] > > > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >type "unsubscribe Declude.JunkMail". The archives can be found > >at http://www.mail-archive.com. > > > > > > > > --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
