Re: [Declude.JunkMail] Damaged Image Files

[Matt]

Title: Message

Eric, Forwarded E-mail that goes outside of your server is handled by actions contained within the Global.cfg instead of a JunkMail file.  This causes a lot of confusion.  This would explain some of the issues.  If you have questions about this, just post them to the list and I or someone else will help out. Forwarded E-mail within the same server I believe is always handled by a JunkMail file.  This is clearly the case in the sample that you sent me off-list.  Your logs on that sample shows the SUBJECT action should have been called and it seems that it wasn't.  I believe that the message is using non-compliant line breaks based on other reports for this spammer, and this is probably why it didn't put the SUBJECT in (or rather the bugs in Declude in handling poorly formated messages). You should forward what you sent me to Declude's support and let them know that this is in reference to the discussion on the list about missing/broken headers and zombie spam.  Even though the messages are broken, Declude is clearly not handling them properly and it should be fixed. Thanks for following up.  Please share whatever else you find with the list. Matt Erik wrote: Matt, I have emailed you off-list with an example of this type of email that Declude fails to "mark".   Let me know if you receive it.  I attached the email along with our Imail log and Declude log.   -Erik   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Tuesday, February 28, 2006 8:18 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Damaged Image Files Erik, I don't doubt the possibility of a bug causing the scanning of such a message to fail, but there is a possibility of this also just simply being a spam that passed, and a failure to insert the headers in the correct place.  It would be great if you guys could supply the full source of one such E-mail and check your logs for an entry that matches, and clarify which version you are running. Thanks, Matt Erik wrote: Yes, they are passing SNIFFER and Darrell's INV-URIBL at this time.  But what Evans wrote is true.  Either this "spammer" has corrected "his" image.. the fact remains that in the past when it was a corrupted; Declude failed in our version. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Colbeck, Andrew Sent: Tuesday, February 28, 2006 7:34 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Damaged Image Files Ditto.   I've received and held 24 messages with the same title.  Re-queuing 3 of these to myself, they had an image that was intact.   They fail the usual RBL tests plus Message Sniffer.   Andrew 8)   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Harry Vanderzand Sent: Tuesday, February 28, 2006 10:10 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Damaged Image Files Judgement is quick to pass for some around here.   These are getting caught by my system   X-Note: Spam Tests Failed: SBL [28], SORBS-DUHL [4], HELOBOGUS [3], SNIFFER [13]   Harry Vanderzand inTown Internet & Computer Services 519-741-1222   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Erik Sent: Tuesday, February 28, 2006 12:49 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Damaged Image Files The problem that we've seen this "spammer" is that the image is corrupted as you mentioned... and Declude is exiting; thus why it's being allowed to be delivered. "Smart" coding on the spammer... Not so smart on Declude. -Erik   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Dave Beckstrom Sent: Tuesday, February 28, 2006 6:41 PM To: Declude.JunkMail@declude.com Cc: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Damaged Image Files We’re getting the same.  Also using Declude with smartermail.  Because Declude doesn’t appear to be scanning the headers there is no way for us to stop them. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Evans Martin Sent: Tuesday, February 28, 2006 12:38 AM To: Declude.JunkMail@declude.com Cc: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Damaged Image Files I’m getting a lot of messages that have only a graphic in them.  The graphic appears to have been damaged as only about ½ of it displays.  Declude has not modified the headers at all so I’m not sure if these are being scanned or not.  I don’t know how it could be bypassing Declude.  I have attached the .msg file.  Anyone have any ideas what might be causing this? I’m running Declude 3.0.5.22 and SmarterMail 2.6. The header is as follows: Return-Path: <[EMAIL PROTECTED]> Tue Feb 28 00:24:32 2006 Received: from 225-65-10-72.planters.net [72.10.65.225] by matrix.martek.net with SMTP;    Tue, 28 Feb 2006 00:24:32 -0600 Date: Tue, 28 Feb 2006 01:24:22 +0100 Return-path: <[EMAIL PROTECTED]> From: "Abrahams"<[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: C1alis 10 Pills 20 mg $89.95 Message-ID: <[EMAIL PROTECTED]> MIME-Version: 1.0 Content-Type: multipart/related;             type="multipart/alternative";             boundary="------------ms020700070106060404020304" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 Thanks, Evans Martin EVANS MARTIN  [EMAIL PROTECTED] HOSTING:  http://www.martek.net PROGRAMMING:  http://www.martekware.com iPlus Info Browser – IPB’s IMail Migration Tool, password browser, reporting suite make IPlus Info Browser something no IMail administrator should be without.  http://www.martek.net/Default.aspx?tabid=96