The MAILFROM filter test is seperate from anything in the headers. It is the
envelope sender.
If you want to test on the header from (I call it display from because
that's what Outlook displays), you need to check the HEADERS.
----- Original Message -----
From: "Kevin Rogers" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Friday, June 03, 2005 3:26 AM
Subject: Re: [Declude.Virus] Newbie question
Great. Exactly what I needed.
I was also confused about the MAILFROM. Does MAILFROM mean what is
displayed as the FROM: in the headers or what it says in the "X-Note: This
E-mail was sent from 206-72-95-86.wi.skypipeline.com ([206.72.95.86])" or
in the X-Declude-Sender field?
Maybe I should just use the HEADERS 0 CONTAINS.... instead.
Thanks again.
Scott Fisher wrote:
One caveat. The MAILFROM uses the envelope mailfrom, which is different
than the ones displayed in the headers.
If the below doesn't stop it, add
HEADERS 0 CONTAINS [EMAIL PROTECTED]
HEADERS 0 CONTAINS [EMAIL PROTECTED]
----- Original Message ----- From: "Kevin Rogers" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Thursday, June 02, 2005 10:37 PM
Subject: Re: [Declude.Virus] Newbie question
I looked up the filter section at the manual. This is what I did.
I made a file called filter.txt. This contains:
MAILFROM 0 CONTAINS [EMAIL PROTECTED]
MAILFROM 0 CONTAINS [EMAIL PROTECTED]
etc.....
I then added this line in global.cfg:
MYFILTER filter C:\Imail\Declude\filter.txt x 20 0
In my $default$.junkmail file there was already this line:
WEIGHT20 HOLD
Do I need to do anything else to the junkmail file to reference MYFILTER
or does the WEIGHT20 take care of everything?
Thanks.
Kevin
Darin Cox wrote:
Nope... add a "filter" test and put those lines in it. The same thing
I
mentioned without pro applies here for adding test names to the
global.cfg
and $default$.junkmail.
The manual at http://declude.com/junkmail/manual.htm decribes adding
filter
files pretty well.
Darin.
----- Original Message ----- From: "Kevin Rogers"
<[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Thursday, June 02, 2005 7:09 PM
Subject: Re: [Declude.Virus] Newbie question
I have pro. How do I add filters?
Should I add that line "MAILFROM10 CONTAINS [EMAIL PROTECTED]" in
virus.cfg or global.cfg? Do I need to use another file?
If I use the HEADERS option "HEADERS 10 CONTAINS [EMAIL PROTECTED]"
- where would I put that?
Sorry for the newbie questions.
Kevin
Scott Fisher wrote:
If you've got pro, you could add a filter:
MAILFROM10 CONTAINS [EMAIL PROTECTED]
that will check the envelope mailfrom.
To check for those addresses in the headers:
HEADERS 10 CONTAINS [EMAIL PROTECTED]
Another option is to update your virus software more often to minimize
the opportunity window for the virus.
----- Original Message ----- From: "Kevin Rogers"
<[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Thursday, June 02, 2005 5:15 PM
Subject: [Declude.Virus] Newbie question
How do I ban certain email addresses?
Some viruses have gotten through lately (first that I know about
since installing Declude) sent from forged email addresses using our
own domain. We do not whitelist our domain. I'd like to ban some of
these common addresses (e.g., [EMAIL PROTECTED],
[EMAIL PROTECTED], etc.)
Thanks.
---
[This E-mail was scanned for viruses.]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses.]
---
[This E-mail was scanned for viruses.]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses.]
---
[This E-mail was scanned for viruses.]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses.]
---
[This E-mail was scanned for viruses.]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
