Re: [Declude.JunkMail] Simple Warning?
I am trying to simply set a rule in Outlook that looks for a special text to sort the e-Mails that have failed. Currently with the basic configuration the warning lists the tests that have failed so I am to filter the failed ones I have to search for the text associated with all tests rather than a simple text such as *** SPAM You could search for X-RBL-Warning:, which (unless you changed it) appears in the headers for any test that fails. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Bogging Down Totally
I have seen a reference either on this list or documentation somewhere that there is a queing function or addon software for Declude? Is this for when the server gets totally bogged down and almost not responding under a heavy load. It's called Declude Queue, and is part of all the Declude programs (if you are running a recent version of Declude, it includes Declude Queue). It does not help specifically if the server is bogged down or not responding, however. It is designed for heavy SMTP traffic, where IMail has all the available SMTP processes being used, but more incoming E-mail arrives. Normally in this case, the E-mail would get sent to the spool, to be delivered much later. With Declude Queue, it is stored in a temporary queue that has priority over the standard queue, and as soon as free processes are available, Declude will start new processes to handle the new mail. I implemented Junkmail a couple of days ago. ( Have been running Declude Antivirus a long time) and since doing so our machine is getting totally brought to a crawl. We have had to restart it several times just to get it going again. Junkmail is catching around 5,000 spam emails every three or four hours so I know we are getting slammed but the load it is putting on our mail server is tremendous. That is unusual. In most cases, Declude JunkMail does not cause a noticeable load on the server (unlike Declude Virus, which uses a lot of CPU time). Is is CPU usage that is high? If so, which processes have the highest CPU usage? My server is a 1.5 gigahertz machine with a gig of ram. Cheetah SCSI drive and normally just screams. It doesn't now. The behavior we are seeing is the machine has no resources (watching Qslice.exe shows this) What resources are you running out of (memory, handles, hard drive space...)? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
IPWHOIS:RE: [Declude.JunkMail] Declude v1.51 (beta) released
Hey Scott, Does this mean that if a virus sends itself out through a mailing list, the virus will not be stopped on the way out? David Roush Technical Services Director Diocese of Austin 512-476-1009, ext. 237 512-469-9537, fax -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Wednesday, May 01, 2002 8:41 AM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude v1.51 (beta) released We have just released Declude v1.51 (beta). This includes another change to ensure that mailing list E-mails are not scanned, but instead sent out immediately. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Declude v1.51 (beta) released
Does this mean that if a virus sends itself out through a mailing list, the virus will not be stopped on the way out? It will get caught (on the way in, instead of on the way out). If you have a mailing list with 10,000 users on it, and someone sends an E-mail to the list, Declude only needs to scan it once. Even though there will be 10,000 outgoing E-mails, they can only contain a virus if the incoming E-mail contained one. So instead of scanning 10,000 E-mails, Declude only needs to scan 1, saving huge amounts of resources (which still catching the viruses). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
IPWHOIS:RE: [Declude.JunkMail] Declude v1.51 (beta) released
That is great Scott. Thanks, David Roush Technical Services Director Diocese of Austin 512-476-1009, ext. 237 512-469-9537, fax -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Wednesday, May 01, 2002 9:47 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude v1.51 (beta) released Does this mean that if a virus sends itself out through a mailing list, the virus will not be stopped on the way out? It will get caught (on the way in, instead of on the way out). If you have a mailing list with 10,000 users on it, and someone sends an E-mail to the list, Declude only needs to scan it once. Even though there will be 10,000 outgoing E-mails, they can only contain a virus if the incoming E-mail contained one. So instead of scanning 10,000 E-mails, Declude only needs to scan 1, saving huge amounts of resources (which still catching the viruses). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] hotmail !?
Nothing like posting on your own post. Also seems atleast one AOL server and one prodidgy server also been OSSRC listed. Got a chunk of legit mail that was caught this morning and tonight thanks to OSSRC. Guess I really need to go all the way with the weighted system consider I'm using a combination weighted and hardcoded tests. Wednesday, May 01, 2002, 10:38:25 AM, you wrote: EG Seems like hotmail been ossrc listed !? Found it in our hold queue EG this morning. There was a bunch from this person sent to this same EG person and you can see in the message that it's a continues thread. EG Received: from hotmail.com [64.4.30.124] by imail.fament.com with ESMTP EG (SMTPD32-7.07) id ACB422910122; Wed, 01 May 2002 09:33:24 -0500 EG Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; EG Wed, 1 May 2002 07:30:20 -0700 EG X-Originating-IP: [12.147.72.21] EG From: [EMAIL PROTECTED] EG To: [EMAIL PROTECTED] EG References: 003201c1f114$05edb930$291bbdd0@rene EG Subject: Re: thoughts EG Date: Wed, 1 May 2002 08:32:29 -0600 EG MIME-Version: 1.0 EG Content-Type: multipart/alternative; EG boundary==_NextPart_000_0083_01C1F0EA.BACDFD80 EG X-Priority: 3 EG X-MSMail-Priority: Normal EG X-Mailer: Microsoft Outlook Express 6.00.2600. EG X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600. EG Message-ID: [EMAIL PROTECTED] EG X-OriginalArrivalTime: 01 May 2002 14:30:20.0920 (UTC) FILETIME=[B90E8780:01C1F11C] EG X-Declude-Sender: [EMAIL PROTECTED] [64.4.30.124] EG X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. EG X-Note: This E-mail was sent from oe20.pav1.hotmail.com. ([64.4.30.124]). EG X-Tests-Failed: OSSRC. EG Best regards, EG Eje Gustafsson mailto:[EMAIL PROTECTED] EG --- EG The Family Entertainment Network http://www.fament.com EG Phone : 620-231- Fax : 620-231-4066 EG eBay UserID : macahan EG - Your Full Time Professionals - EG --- EG [This E-mail scanned for viruses by Declude Virus] EG --- EG [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] EG --- EG This E-mail came from the Declude.JunkMail mailing list. To EG unsubscribe, just send an E-mail to [EMAIL PROTECTED], and EG type unsubscribe Declude.JunkMail. You can E-mail EG [EMAIL PROTECTED] for assistance. You can visit our web EG site at http://www.declude.com . EG --- EG [This E-mail scanned for viruses by Declude Virus] Best regards, Eje Gustafsson mailto:[EMAIL PROTECTED] --- The Family Entertainment Network http://www.fament.com Phone : 620-231- Fax : 620-231-4066 eBay UserID : macahan - Your Full Time Professionals - --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] hotmail !?
Actually - you need to disable OSSRC for now. SPEWS has an error in their database instead of listing 64.x.x.x to 64.x.y.z - they accidentally omitted the second 6 - so currently their database is blocking: 64.x.x.x to 4.x.y.z Of course, just like Spammers, SPEWS does NOT provide true contact information. They play god we don't need anyone to ever contact us, we are always without fault. Makes you appreciate, why outfits like them get sued into the ground eventually. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Eje Gustafsson Sent: Wednesday, May 01, 2002 11:38 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] hotmail !? Seems like hotmail been ossrc listed !? Found it in our hold queue this morning. There was a bunch from this person sent to this same person and you can see in the message that it's a continues thread. Received: from hotmail.com [64.4.30.124] by imail.fament.com with ESMTP (SMTPD32-7.07) id ACB422910122; Wed, 01 May 2002 09:33:24 -0500 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Wed, 1 May 2002 07:30:20 -0700 X-Originating-IP: [12.147.72.21] From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] References: 003201c1f114$05edb930$291bbdd0@rene Subject: Re: thoughts Date: Wed, 1 May 2002 08:32:29 -0600 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_000_0083_01C1F0EA.BACDFD80 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600. X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600. Message-ID: [EMAIL PROTECTED] X-OriginalArrivalTime: 01 May 2002 14:30:20.0920 (UTC) FILETIME=[B90E8780:01C1F11C] X-Declude-Sender: [EMAIL PROTECTED] [64.4.30.124] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Note: This E-mail was sent from oe20.pav1.hotmail.com. ([64.4.30.124]). X-Tests-Failed: OSSRC. Best regards, Eje Gustafsson mailto:[EMAIL PROTECTED] --- The Family Entertainment Network http://www.fament.com Phone : 620-231- Fax : 620-231-4066 eBay UserID : macahan - Your Full Time Professionals - --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] One more novice question...
Hi; Is it correct to assume that this statement on the manual: - First, you need to create a text file that lists one address or domain per line, followed by the reason for blocking it. For example, @example.com This domain sends spam. or [EMAIL PROTECTED] This guy was mailbombing us. To block a domain, you can either use the format @example.com to block just example.com, or you can use just example.com which would block mail from [EMAIL PROTECTED], [EMAIL PROTECTED], and even [EMAIL PROTECTED] - If I list: Example.com It would include: [EMAIL PROTECTED] But NOT: [EMAIL PROTECTED] This would make sense but if the dash is included in the wild card it can mean something totally different. Am I right to make this assumption? Regards, Kami --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] One more novice question...
If I list: Example.com It would include: [EMAIL PROTECTED] But NOT: [EMAIL PROTECTED] No, it would include both. Anything with Example.com appearing in it would get caught. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] One more novice question...
Try .postmasterdirect.com Including the leading dot ensures you're not getting other domains. Maybe also @postmaster.com for when that gets tried. _M | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of Kami Razvan | Sent: Wednesday, May 01, 2002 12:29 PM | To: [EMAIL PROTECTED] | Subject: RE: [Declude.JunkMail] One more novice question... | | | Good to know.. We have a problem with a domain that keeps | changing its sub-domain. Namely: | | @m-01.postmasterdirect.com | @m-02.postmasterdirect.com | @m-03.postmasterdirect.com | @m-04.postmasterdirect.com | @m-05.postmasterdirect.com | @m-06.postmasterdirect.com | @m-07.postmasterdirect.com | @m-08.postmasterdirect.com | @m-09.postmasterdirect.com | @m-10.postmasterdirect.com | | So for us to block these people in general we have to put: | | postmasterdirect.com | | In the blacklist. | | But then this will block another organization if they come | with a legitimate business that has the domain: | Our-Postmasterdirect.com | | While the only thing we wanted to do was to block all the sub | domain variations of the first one, namely postmasterdirect.com | | Can this be done or we have to list them all individually. | | Regards, | Kami | | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of R. | Scott Perry | Sent: Wednesday, May 01, 2002 12:19 PM | To: [EMAIL PROTECTED] | Subject: Re: [Declude.JunkMail] One more novice question... | | | | If I list: | | Example.com | | It would include: | | [EMAIL PROTECTED] | | But NOT: | | [EMAIL PROTECTED] | | No, it would include both. Anything with Example.com | appearing in it | would get caught. | -Scott | | --- | [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] One more novice question...
So for us to block these people in general we have to put: postmasterdirect.com In the blacklist. But then this will block another organization if they come with a legitimate business that has the domain: Our-Postmasterdirect.com If you're concerned that a legitimate business will appear using a domain name that includes a domain you are blocking, you could instead use .postmasterdirect.com, which would catch user@*.postmasterdirect.com. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] ATTACH
Will the SPAMATTACH.eml accept the %RECIPHOST% varible for the sendto address?? You could do that, but that would only affect what appears in the headers. The E-mail will still get delivered to the original recipient. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] ATTACH
Even replacing the To: %ALLRECIPS% with To: postmaster@%RECIPHOST% will only affect the headers. David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Wednesday, May 01, 2002 12:23 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] ATTACH Will the SPAMATTACH.eml accept the %RECIPHOST% varible for the sendto address?? You could do that, but that would only affect what appears in the headers. The E-mail will still get delivered to the original recipient. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] ATTACH
Even replacing the To: %ALLRECIPS% with To: postmaster@%RECIPHOST% will only affect the headers. That is correct. Declude will not alter the recipient of the E-mail, or even look at the To: header in the spamattach.eml file. Note that if you do go with the %RECIPHOST%, you should use To: postmaster@%RECIPHOST%, to make sure that the header is valid. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
