Coming in late on this thread, and if I understand correctly the recipient of your automated Declude Virus warning message reported your e-mail server to Spamcop. To avoid in the future, perhaps a possible solution would be to change your virus' warning message to read differently? (i.e. "Don't' report us to Spamcop and call us first!). I would not word exactly like that and at a loss to a good copy suggestion for you this early in the morning. However, we use the following wording similar to that suggested by Declude and have had no problems. Just the opposite response and many folks often write how appreciative they are that we caught a virus and alerted them, as they had no idea. As a side note, I would find it difficult that Spamcop would list us or you with the following message especially if they verified that the message did come from our servers (which is in the header and a requirement I believe when reporting there), and seeing we are not an Open Relay and also when we put in our message an e-mail address to write if there are problems. I guess anything is possible, but does not seem to add up.
2 cents, -Don From: postmaster@%LOCALHOST% To: %MAILFROM% Subject: VIRUS WARNING: YOU APPEAR TO HAVE A VIRUS! Anti Virus software running on our E-mail server for, %LOCALHOST%, has reported that you sent an E-mail to %ALLRECIPS%, containing the %VIRUSNAME% virus in the %VIRUSFILE% attachment. The subject of the E-mail was "%SUBJECT%". The E-mail containing the virus has been quarantined by us to prevent further damage. Please check your computer and e-mails for infected files and help stop the spread of virus' to other users. Should you have any questions about our E-mail protection services, please contact us at [EMAIL PROTECTED] Regards, Technical Staff Your Company, Inc. http://www.yourdomain.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of [EMAIL PROTECTED] Sent: Thursday, February 28, 2002 4:48 PM To: [EMAIL PROTECTED] Subject: RE: SPAMCOP:Re: [IMail Forum] Spamcop Would it not be true, that due to the wide subjectivity in defining what exactly is Junk E-Mail, that any Junk Mail (SPAM) filtering solution or black list would have some percentage of false positives. And because of this inherent "flaw" eliminating any one test (that provides a relatively well maintained and stated policy) because of this "flaw" would eliminate most if not all of the black list tests and therefore not a good Idea. Stu At 03:50 PM 02/28/2002 -0500, you wrote: >After digging - since our users send alot of mail out - not sure >how it wasn't getting picked up (if this service actually works) - >since sprint messed up pointing to us as the authority for our >block (seems to have happened a month+ ago, I just never noticed) - > they may not actually base good mail on the ip address but the >domain. Which doesn't make sense to me - but then most of spamcop >does not make sense to me. > >I stand by that it is a flawed system. > >Chet > >---------- Original Message ---------------------------------- >From: "R. Scott Perry" <[EMAIL PROTECTED]> >Reply-To: [EMAIL PROTECTED] >Date: Thu, 28 Feb 2002 15:42:43 -0500 > >> >>>Scott -- any idea how they determine this ratio? >> >> From http://spamcop.net/bl.shtml, we find that "The reports of >spam from a >>system are weighted against the amount of mail from the same >system to >>determine a spam ratio". It also says "If a server has fewer >than 3 spam >>reports against it and neither of these are newer than 24 hours, >then it >>will be delisted, despite any otherwise-high ratio." >> >>>Anyway, what I don't understand is how they determine the >ratio. I >>>don't think there is anybody out there reporting to spamcop >every time >>>(or *any* time!) they receive a legit email from us. So how do >they >>>know what the ratio of spam to legit is??? >> >>That's a good question, that isn't easily answered (or, in other >words, "I >>don't know for sure"). It has been reported that people who pay >for E-mail >>filtering with Spamcop have their E-mail that is unreported count >towards >>the legitimate mail, but that isn't the only source >of "legitimate" mail. >> >>Somehow, they typically know about 50-200 legitimate mails from >our mail >>server each week. It's hard to say how they could know about so >much from >>ours, but they only know about 1 E-mail from the person here that >was >>listed and has 50,000 users. >> >> -Scott >>--- >>Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for >>IMail. http://www.declude.com >> >>--- >>[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] >> >> >>Please visit http://www.ipswitch.com/support/mailing-lists.html >>to be removed from this list. >> >>An Archive of this list is available at: >>http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >> > > >________________________________________________________________ >Get your own evilemail.com address at http://www.evilemail.com > > > > > >Please visit http://www.ipswitch.com/support/mailing-lists.html >to be removed from this list. > >An Archive of this list is available at: >http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > > ------------------------------------------------------------------------ ----- CSOnline Technical Support hours - Monday thru Saturday 7am - 1am CSOnline Technical Support Numbers Seneca 814-677-2447 Clarion 814-227-3638 Meadville 814-425-1696 Parker 724-399-1158 http://www.csonline.net http://www.cshowcase.com http://www.learncenter.com ------------------------------------------------------------------------ ----- Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ ---------- [This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net] Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
