I changed it to HEADERS and still I am receiving emails from these
addresses (got 4 of them personally yesterday). My virus scanner is now
updated every four hours, so F-Prot caught these viruses, but I still am
receiving the virus notifications. Perhaps the scanning takes place
(and the notifications are sent out) before my filter is called?
This is what my filter file contains:
HEADERS 0 CONTAINS [EMAIL PROTECTED]
HEADERS 0 CONTAINS [EMAIL PROTECTED]
etc.....
This is what I have in my global.cfg
MYFILTER filter C:\Imail\Declude\Filter.txt x 20 0
This is in my $default$.junkmail file
WEIGHT20 HOLD
What am I missing?
Thanks.
Scott Fisher wrote:
The MAILFROM filter test is seperate from anything in the headers. It
is the envelope sender.
If you want to test on the header from (I call it display from because
that's what Outlook displays), you need to check the HEADERS.
----- Original Message ----- From: "Kevin Rogers" <[EMAIL PROTECTED]>
To: <Declude.Virus@declude.com>
Sent: Friday, June 03, 2005 3:26 AM
Subject: Re: [Declude.Virus] Newbie question
Great. Exactly what I needed.
I was also confused about the MAILFROM. Does MAILFROM mean what is
displayed as the FROM: in the headers or what it says in the "X-Note:
This E-mail was sent from 206-72-95-86.wi.skypipeline.com
([206.72.95.86])" or in the X-Declude-Sender field?
Maybe I should just use the HEADERS 0 CONTAINS.... instead.
Thanks again.
Scott Fisher wrote:
One caveat. The MAILFROM uses the envelope mailfrom, which is
different than the ones displayed in the headers.
If the below doesn't stop it, add
HEADERS 0 CONTAINS [EMAIL PROTECTED]
HEADERS 0 CONTAINS [EMAIL PROTECTED]
----- Original Message ----- From: "Kevin Rogers"
<[EMAIL PROTECTED]>
To: <Declude.Virus@declude.com>
Sent: Thursday, June 02, 2005 10:37 PM
Subject: Re: [Declude.Virus] Newbie question
I looked up the filter section at the manual. This is what I did.
I made a file called filter.txt. This contains:
MAILFROM 0 CONTAINS [EMAIL PROTECTED]
MAILFROM 0 CONTAINS [EMAIL PROTECTED]
etc.....
I then added this line in global.cfg:
MYFILTER filter C:\Imail\Declude\filter.txt x 20 0
In my $default$.junkmail file there was already this line:
WEIGHT20 HOLD
Do I need to do anything else to the junkmail file to reference
MYFILTER or does the WEIGHT20 take care of everything?
Thanks.
Kevin
Darin Cox wrote:
Nope... add a "filter" test and put those lines in it. The same
thing I
mentioned without pro applies here for adding test names to the
global.cfg
and $default$.junkmail.
The manual at http://declude.com/junkmail/manual.htm decribes
adding filter
files pretty well.
Darin.
----- Original Message ----- From: "Kevin Rogers"
<[EMAIL PROTECTED]>
To: <Declude.Virus@declude.com>
Sent: Thursday, June 02, 2005 7:09 PM
Subject: Re: [Declude.Virus] Newbie question
I have pro. How do I add filters?
Should I add that line "MAILFROM10 CONTAINS [EMAIL PROTECTED]" in
virus.cfg or global.cfg? Do I need to use another file?
If I use the HEADERS option "HEADERS 10 CONTAINS
[EMAIL PROTECTED]"
- where would I put that?
Sorry for the newbie questions.
Kevin
Scott Fisher wrote:
If you've got pro, you could add a filter:
MAILFROM10 CONTAINS [EMAIL PROTECTED]
that will check the envelope mailfrom.
To check for those addresses in the headers:
HEADERS 10 CONTAINS [EMAIL PROTECTED]
Another option is to update your virus software more often to
minimize
the opportunity window for the virus.
----- Original Message ----- From: "Kevin Rogers"
<[EMAIL PROTECTED]>
To: <Declude.Virus@declude.com>
Sent: Thursday, June 02, 2005 5:15 PM
Subject: [Declude.Virus] Newbie question
How do I ban certain email addresses?
Some viruses have gotten through lately (first that I know about
since installing Declude) sent from forged email addresses using
our
own domain. We do not whitelist our domain. I'd like to ban
some of
these common addresses (e.g., [EMAIL PROTECTED],
[EMAIL PROTECTED], etc.)
Thanks.
---
[This E-mail was scanned for viruses.]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses.]
---
[This E-mail was scanned for viruses.]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses.]
---
[This E-mail was scanned for viruses.]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses.]
---
[This E-mail was scanned for viruses.]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses.]
---
[This E-mail was scanned for viruses.]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
