Re: [Declude.JunkMail] XOUTHEADER shows up in the body
When I use an XOUTHEADER or turn XSENDER ON, it places the text at the end of the body, not in the header. Has anyone seen this before? What is the last header that is in the E-mail headers? What is the first header in the E-mail body? Those headers should provide some clues. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] IP Blacklists
The manual is pretty clear about how to setup IP blacklists, but it doesn't specifically say what IP's you are blacklisting. Is this the source IP of the message, or the mailserver it was sent from / mailserver it hopped through? Rob Salmond Ontario Die Company (519)-576-8950 ext. 132 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] IP Blacklists
Add the following line to your global.cfg file: BLACKLISTIP ipfile x:\IMail\Declude\ipfile.txt x 20 (edit the x:\IMail\Declude to the location of your IMail directory location) And then put the attached file into your Declude directory.. I've built this list over the last 8-10 months now. Hope this helps.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rob Salmond Sent: Thursday, July 17, 2003 7:42 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] IP Blacklists The manual is pretty clear about how to setup IP blacklists, but it doesn't specifically say what IP's you are blacklisting. Is this the source IP of the message, or the mailserver it was sent from / mailserver it hopped through? Rob Salmond Ontario Die Company (519)-576-8950 ext. 132 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ipfile.zip Description: Zip compressed data
Re: [Declude.JunkMail] IP Blacklists
The manual is pretty clear about how to setup IP blacklists, but it doesn't specifically say what IP's you are blacklisting. Is this the source IP of the message, or the mailserver it was sent from / mailserver it hopped through? The IP blacklists will be run on the same IP(s) that the IP-based spam databases are run on. With the default settings, this is just the IP address of the mailserver that connected to your IMail server. However, if you use the HOP, HOPHIGH, or IPBYPASS settings, the IP(s) will vary. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Best Practices question
All, Being a 2 months-old user of JunkMail I'm trying to find out best practices for dealing with spam. Sorry in advanced if this topic has been to death, but I couldn't find any helpful threads on the archives. Anyhow, I'm using the following rules but a TON of spam still making it through: WEIGHT10WARN WEIGHT15HOLD WEIGHT20HOLD Of course, the spam comes through because it doesn't meet the HOLD criteria. For example, I have spam emails with a weight of 7, others with 11, etc. My question is, what WEIGHT do you guys use to HOLD email? My configuration is still sub optimal. TIA, Jose --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Best Practices question
Being a 2 months-old user of JunkMail I'm trying to find out best practices for dealing with spam. Sorry in advanced if this topic has been to death, but I couldn't find any helpful threads on the archives. Anyhow, I'm using the following rules but a TON of spam still making it through: WEIGHT10WARN WEIGHT15HOLD WEIGHT20HOLD Of course, the spam comes through because it doesn't meet the HOLD criteria. My first question would be Is there a ton of spam being caught? If you're blocking 1,000 spams to your personal account a day and 50 spams get through, that's not too bad. If you're only blocking 100 spams and 50 get through, that's a problem. If it's the later -- where a large percentage of spam is getting through -- there is probably a problem with some of the tests. Does the log file report a lot of warnings or errors? Does the first DNS server listed in the IMail SMTP settings work properly? Do you have a gateway or backup mailservers that run in front of the IMail server? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices question
How can I determine the amount of caught/received emails with JunkMail? It would take me an eternity to go through each log file. Thanks -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Thursday, July 17, 2003 10:01 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Best Practices question Being a 2 months-old user of JunkMail I'm trying to find out best practices for dealing with spam. Sorry in advanced if this topic has been to death, but I couldn't find any helpful threads on the archives. Anyhow, I'm using the following rules but a TON of spam still making it through: WEIGHT10WARN WEIGHT15HOLD WEIGHT20HOLD Of course, the spam comes through because it doesn't meet the HOLD criteria. My first question would be Is there a ton of spam being caught? If you're blocking 1,000 spams to your personal account a day and 50 spams get through, that's not too bad. If you're only blocking 100 spams and 50 get through, that's a problem. If it's the later -- where a large percentage of spam is getting through -- there is probably a problem with some of the tests. Does the log file report a lot of warnings or errors? Does the first DNS server listed in the IMail SMTP settings work properly? Do you have a gateway or backup mailservers that run in front of the IMail server? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Imail v6 and Windows Update
Hello, Was wondering if anyone knew what the Microsoft update it was that caused the display of the IMail manager to be shifted and un-readable. Dang new people installed it and now I can't edit any of the entries, etc. Thanks.. Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Imail v6 and Windows Update
Was wondering if anyone knew what the Microsoft update it was that caused the display of the IMail manager to be shifted and un-readable. Dang new people installed it and now I can't edit any of the entries, etc. It's probably the Windows 2000 SP4 that was installed. It includes the update that caused the IMail Administrator screen to be shifted. Unfortunately, the only ways to fix it seem to be either to not install SP4, or to upgrade IMail. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Imail v6 and Windows Update
Q328310 At 10:05 AM 7/17/2003, Jeff Maze - Hostmaster wrote: Hello, Was wondering if anyone knew what the Microsoft update it was that caused the display of the IMail manager to be shifted and un-readable. Dang new people installed it and now I can't edit any of the entries, etc. Thanks.. Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ___ Scott MacLean [EMAIL PROTECTED] ICQ: 9184011 http://www.nerosoft.com
RE: [Declude.JunkMail] Best Practices question
In my view, the best thing to do is examine spam that got through. When you find a pattern in several messages, use that info to tweak Declude. I've been tweaking ours for months, to the point that each day I find less than 30 messages in our hold box. First I look through those for any legitimate mail that got caught (rare). Then I delete any spam that only shows up once; no time to mess with it. Of the remaining items that are multiple messages from the same spammer, I look at the header and body to find out what I should be filtering on. Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) Email: [EMAIL PROTECTED] CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Thursday, July 17, 2003 9:01 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Best Practices question Being a 2 months-old user of JunkMail I'm trying to find out best practices for dealing with spam. Sorry in advanced if this topic has been to death, but I couldn't find any helpful threads on the archives. Anyhow, I'm using the following rules but a TON of spam still making it through: WEIGHT10WARN WEIGHT15HOLD WEIGHT20HOLD Of course, the spam comes through because it doesn't meet the HOLD criteria. My first question would be Is there a ton of spam being caught? If you're blocking 1,000 spams to your personal account a day and 50 spams get through, that's not too bad. If you're only blocking 100 spams and 50 get through, that's a problem. If it's the later -- where a large percentage of spam is getting through -- there is probably a problem with some of the tests. Does the log file report a lot of warnings or errors? Does the first DNS server listed in the IMail SMTP settings work properly? Do you have a gateway or backup mailservers that run in front of the IMail server? -Scott --- --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail v6 and Windows Update
Should have all of what you need to know: http://support.ipswitch.com/kb/IM-20021218-DM01.htm -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze - Hostmaster Sent: Thursday, July 17, 2003 4:05 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: Imail v6 and Windows Update Hello, Was wondering if anyone knew what the Microsoft update it was that caused the display of the IMail manager to be shifted and un-readable. Dang new people installed it and now I can't edit any of the entries, etc. Thanks.. Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices question
How can I determine the amount of caught/received emails with JunkMail? It would take me an eternity to go through each log file. There are several ways that you can do this. For example, you can do a directory of the \IMail\spool\spam directory, where the held E-mails are. To find out how many are to you, you can use find with the /C switch. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail v6 and Windows Update
Because the new person read there was an security update and ran Windows Update and downloaded and installed everything. I found the link in Ipswich's web site. It has something to do with Q328310 and version 6.06 and 7.07 of Imail. Update iMail to 7.15 and all is well. BUT since we're running version 6, there's no fix from Ipswich besides uninstalling that Microsoft update. Hope all goes well. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jose Gosende Sent: Thursday, July 17, 2003 9:12 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update wow, and I thought it was a terminal services issue. I've had this problem for quite some time and would love to hear a workaround. BTW, how do you know a Windows update caused this problem? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Maze - Hostmaster Sent: Thursday, July 17, 2003 10:05 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: Imail v6 and Windows Update Hello, Was wondering if anyone knew what the Microsoft update it was that caused the display of the IMail manager to be shifted and un-readable. Dang new people installed it and now I can't edit any of the entries, etc. Thanks.. Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Imail v6 and Windows Update
If you remove Critical Update # Q328310, the problem goes away. This does work, I have experienced it. Ipswitch issued a patch for this problem for versions 7.x and above, but stated they will never issue one for Ver. 6. This is per Ipswitch KB article IM-20021218-DM01 HTH, Denny - Original Message - From: Jose Gosende [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:12 AM Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update wow, and I thought it was a terminal services issue. I've had this problem for quite some time and would love to hear a workaround. BTW, how do you know a Windows update caused this problem? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Maze - Hostmaster Sent: Thursday, July 17, 2003 10:05 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: Imail v6 and Windows Update Hello, Was wondering if anyone knew what the Microsoft update it was that caused the display of the IMail manager to be shifted and un-readable. Dang new people installed it and now I can't edit any of the entries, etc. Thanks.. Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail v6 and Windows Update
Yea, and expose my server's security to fix some GUI issue? Sounds like Ipswitch should provide a maintenance release for v6.0 users to eradicate this problem. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Denny Jodeit Sent: Thursday, July 17, 2003 10:27 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Imail v6 and Windows Update If you remove Critical Update # Q328310, the problem goes away. This does work, I have experienced it. Ipswitch issued a patch for this problem for versions 7.x and above, but stated they will never issue one for Ver. 6. This is per Ipswitch KB article IM-20021218-DM01 HTH, Denny - Original Message - From: Jose Gosende [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:12 AM Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update wow, and I thought it was a terminal services issue. I've had this problem for quite some time and would love to hear a workaround. BTW, how do you know a Windows update caused this problem? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Maze - Hostmaster Sent: Thursday, July 17, 2003 10:05 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: Imail v6 and Windows Update Hello, Was wondering if anyone knew what the Microsoft update it was that caused the display of the IMail manager to be shifted and un-readable. Dang new people installed it and now I can't edit any of the entries, etc. Thanks.. Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail v6 and Windows Update
Thanks for all the replies.. I went to uninstall it and it came up saying that some or all of the following may not work after uninstall and gave a list of five things including the network adapter. Time for a back up and hope for a quick reinstall if it crashes hard. hahaha -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Denny Jodeit Sent: Thursday, July 17, 2003 9:27 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Imail v6 and Windows Update If you remove Critical Update # Q328310, the problem goes away. This does work, I have experienced it. Ipswitch issued a patch for this problem for versions 7.x and above, but stated they will never issue one for Ver. 6. This is per Ipswitch KB article IM-20021218-DM01 HTH, Denny - Original Message - From: Jose Gosende [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:12 AM Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update wow, and I thought it was a terminal services issue. I've had this problem for quite some time and would love to hear a workaround. BTW, how do you know a Windows update caused this problem? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Maze - Hostmaster Sent: Thursday, July 17, 2003 10:05 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: Imail v6 and Windows Update Hello, Was wondering if anyone knew what the Microsoft update it was that caused the display of the IMail manager to be shifted and un-readable. Dang new people installed it and now I can't edit any of the entries, etc. Thanks.. Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail v6 and Windows Update
Yea, and expose my server's security to fix some GUI issue? Sounds like Ipswitch should provide a maintenance release for v6.0 users to eradicate this problem. Uh, trying reading through the many posts in the archives on the Imail forum. This is the Declude JunkMail list. The pros and cons have been discussed there and a good read of the KB article reveals what it is. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail v6 and Windows Update
That's true.. Version 6 works just fine for what we use it for and don't need to spend the $1500 it'll take to upgrade to version 8 (running version 6 unlimited). I guess that's just business though.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jose Gosende Sent: Thursday, July 17, 2003 9:38 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update Yea, and expose my server's security to fix some GUI issue? Sounds like Ipswitch should provide a maintenance release for v6.0 users to eradicate this problem. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Denny Jodeit Sent: Thursday, July 17, 2003 10:27 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Imail v6 and Windows Update If you remove Critical Update # Q328310, the problem goes away. This does work, I have experienced it. Ipswitch issued a patch for this problem for versions 7.x and above, but stated they will never issue one for Ver. 6. This is per Ipswitch KB article IM-20021218-DM01 HTH, Denny - Original Message - From: Jose Gosende [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:12 AM Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update wow, and I thought it was a terminal services issue. I've had this problem for quite some time and would love to hear a workaround. BTW, how do you know a Windows update caused this problem? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Maze - Hostmaster Sent: Thursday, July 17, 2003 10:05 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: Imail v6 and Windows Update Hello, Was wondering if anyone knew what the Microsoft update it was that caused the display of the IMail manager to be shifted and un-readable. Dang new people installed it and now I can't edit any of the entries, etc. Thanks.. Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices question
Not to bash Scott, who is the freaking GOD of SMTP traffic.. but EEWWW.. yuck. FIND will work, but I'd have to wash my hands afterwards. My computer is supposed to do my work FOR me, on a daily basis, and mail me my checks at home ! ( I wish ! )... Just write up a quick PERL/WSH/Shell script to parse the info, then schedule it with AT to run whenever you want. I wrote mine up a few weeks ago. If people want I'll post it. It's in PERL, so you'll need active PERL installed, and you might need to tweak it for your local settings. It's not as clean as Scott or another professional programmer might make it, but it's quick, dirty, and gets the job done. Here's a sample of what mine does ( on a pretty slow day for SPAM ): Total number of messages 665 Total Passed, including whitelisted, 523,percentage : 78.6 Total HELD 21, percentage : 3.2 Total BOUNCED 121,percentage : 18.2 Total of Whitelisted 218 Total of SPAMCOP 25 Total of NOABUSE 66 Total of NOPOSTMASTER58 Total of BADHEADERS 38 Total of BASE64 1 Total of HELOBOGUS 99 Total of MAILFROM1 Total of PERCENT 0 Total of REVDNS2 34 Total of ROUTING 13 Total of SPAMHEADERS 40 Total of FILTERWORDS 248 Total of BLACKLIST 34 Total of REVDNSPROBLEM 77 Total of IPBlacklist 31 Karl Drugge, Systems Network Engineer -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:21 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Best Practices question How can I determine the amount of caught/received emails with JunkMail? It would take me an eternity to go through each log file. There are several ways that you can do this. For example, you can do a directory of the \IMail\spool\spam directory, where the held E-mails are. To find out how many are to you, you can use find with the /C switch. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail v6 and Windows Update
If you remove Critical Update # Q328310, the problem goes away. This does work, I have experienced it. Yea, and expose my server's security to fix some GUI issue? The only security issue with Q328310 is if you already have security problems. Specifically, someone needs physical access to the server for Q328310 to be useful. If a hacker has physical access to your mailserver, you've got security problems. :) -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Imail v6 and Windows Update
I got the same message. Everything works. Good Luck, but I'm confident you'll be fine. - Original Message - From: Jeff Maze - Hostmaster [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:47 AM Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update Thanks for all the replies.. I went to uninstall it and it came up saying that some or all of the following may not work after uninstall and gave a list of five things including the network adapter. Time for a back up and hope for a quick reinstall if it crashes hard. hahaha -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Denny Jodeit Sent: Thursday, July 17, 2003 9:27 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Imail v6 and Windows Update If you remove Critical Update # Q328310, the problem goes away. This does work, I have experienced it. Ipswitch issued a patch for this problem for versions 7.x and above, but stated they will never issue one for Ver. 6. This is per Ipswitch KB article IM-20021218-DM01 HTH, Denny - Original Message - From: Jose Gosende [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:12 AM Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update wow, and I thought it was a terminal services issue. I've had this problem for quite some time and would love to hear a workaround. BTW, how do you know a Windows update caused this problem? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Maze - Hostmaster Sent: Thursday, July 17, 2003 10:05 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: Imail v6 and Windows Update Hello, Was wondering if anyone knew what the Microsoft update it was that caused the display of the IMail manager to be shifted and un-readable. Dang new people installed it and now I can't edit any of the entries, etc. Thanks.. Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices question
Karl -- I would be very interested in using your PERL script. Can you send it to me? Thanks, Jose -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of IS - Systems Eng. (Karl Drugge) Sent: Thursday, July 17, 2003 10:55 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Best Practices question Not to bash Scott, who is the freaking GOD of SMTP traffic.. but EEWWW.. yuck. FIND will work, but I'd have to wash my hands afterwards. My computer is supposed to do my work FOR me, on a daily basis, and mail me my checks at home ! ( I wish ! )... Just write up a quick PERL/WSH/Shell script to parse the info, then schedule it with AT to run whenever you want. I wrote mine up a few weeks ago. If people want I'll post it. It's in PERL, so you'll need active PERL installed, and you might need to tweak it for your local settings. It's not as clean as Scott or another professional programmer might make it, but it's quick, dirty, and gets the job done. Here's a sample of what mine does ( on a pretty slow day for SPAM ): Total number of messages 665 Total Passed, including whitelisted, 523,percentage : 78.6 Total HELD 21, percentage : 3.2 Total BOUNCED 121,percentage : 18.2 Total of Whitelisted 218 Total of SPAMCOP 25 Total of NOABUSE 66 Total of NOPOSTMASTER58 Total of BADHEADERS 38 Total of BASE64 1 Total of HELOBOGUS 99 Total of MAILFROM1 Total of PERCENT 0 Total of REVDNS2 34 Total of ROUTING 13 Total of SPAMHEADERS 40 Total of FILTERWORDS 248 Total of BLACKLIST 34 Total of REVDNSPROBLEM 77 Total of IPBlacklist 31 Karl Drugge, Systems Network Engineer -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:21 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Best Practices question How can I determine the amount of caught/received emails with JunkMail? It would take me an eternity to go through each log file. There are several ways that you can do this. For example, you can do a directory of the \IMail\spool\spam directory, where the held E-mails are. To find out how many are to you, you can use find with the /C switch. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Imail v6 and Windows Update
Yes, the tech installed the whole boat-everything Microsoft had to offer, then I uninstalled Q328310 only and the problem was gone. I had also had the problem in Dec 2002 when Q328310 was first released, so I knew where to look. - Original Message - From: Scott MacLean To: [EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:56 AM Subject: Re: [Declude.JunkMail] OT: Imail v6 and Windows Update Did you install Q328310, then install SP4, then uninstall Q328310 and it fixed it?At 10:33 AM 7/17/2003, Denny Jodeit wrote: I did not uninstall SP4, just Critical Update Q328310 and it fixed theproblem.- Original Message - From: "R. Scott Perry" [EMAIL PROTECTED]To: [EMAIL PROTECTED]Sent: Thursday, July 17, 2003 10:23 AMSubject: Re: [Declude.JunkMail] OT: Imail v6 and Windows Update Was wondering if anyone knew what the Microsoft update it wasthat caused the display of the IMail manager to be shifted and un-readable. Dang new people installed it and now I can't edit any of the entries, etc. It's probably the Windows 2000 SP4 that was installed. It includes the update that caused the IMail Administrator screen to be shifted. Unfortunately, the only ways to fix it seem to be either to not install SP4, or to upgrade IMail. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus(http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.---[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.___Scott MacLean[EMAIL PROTECTED]ICQ: 9184011http://www.nerosoft.com
RE: [Declude.JunkMail] Best Practices question
Looks like a script we would like to use Karl, thanks for the offer to share. Thank You, JR Tatum, President Performance Dimensions, Inc. (336) 774-1849 mailto:[EMAIL PROTECTED] http://www.triadnetwork.com * This message and any included attachments are from PERFORMANCE DIMENSIONS, INC. and are intended only for the addressee(s). The information contained herein may include trade secrets or privileged or otherwise confidential information. Unauthorized review, forwarding, printing, copying, distributing, or using such information is strictly prohibited and may be unlawful. If you received this message in error, or have reason to believe you are not authorized to receive it, please promptly delete this message and notify the sender by e-mail. * -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS - Systems Eng. (Karl Drugge) Sent: Thursday, July 17, 2003 10:55 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Best Practices question Not to bash Scott, who is the freaking GOD of SMTP traffic.. but EEWWW.. yuck. FIND will work, but I'd have to wash my hands afterwards. My computer is supposed to do my work FOR me, on a daily basis, and mail me my checks at home ! ( I wish ! )... Just write up a quick PERL/WSH/Shell script to parse the info, then schedule it with AT to run whenever you want. I wrote mine up a few weeks ago. If people want I'll post it. It's in PERL, so you'll need active PERL installed, and you might need to tweak it for your local settings. It's not as clean as Scott or another professional programmer might make it, but it's quick, dirty, and gets the job done. Here's a sample of what mine does ( on a pretty slow day for SPAM ): Total number of messages 665 Total Passed, including whitelisted, 523,percentage : 78.6 Total HELD 21, percentage : 3.2 Total BOUNCED 121,percentage : 18.2 Total of Whitelisted 218 Total of SPAMCOP 25 Total of NOABUSE 66 Total of NOPOSTMASTER58 Total of BADHEADERS 38 Total of BASE64 1 Total of HELOBOGUS 99 Total of MAILFROM1 Total of PERCENT 0 Total of REVDNS2 34 Total of ROUTING 13 Total of SPAMHEADERS 40 Total of FILTERWORDS 248 Total of BLACKLIST 34 Total of REVDNSPROBLEM 77 Total of IPBlacklist 31 Karl Drugge, Systems Network Engineer -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:21 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Best Practices question How can I determine the amount of caught/received emails with JunkMail? It would take me an eternity to go through each log file. There are several ways that you can do this. For example, you can do a directory of the \IMail\spool\spam directory, where the held E-mails are. To find out how many are to you, you can use find with the /C switch. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices question
Karl, Please do so, I would be interested in it! Aaron Caviglia -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS - Systems Eng. (Karl Drugge) Sent: Thursday, July 17, 2003 7:55 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Best Practices question Not to bash Scott, who is the freaking GOD of SMTP traffic.. but EEWWW.. yuck. FIND will work, but I'd have to wash my hands afterwards. My computer is supposed to do my work FOR me, on a daily basis, and mail me my checks at home ! ( I wish ! )... Just write up a quick PERL/WSH/Shell script to parse the info, then schedule it with AT to run whenever you want. I wrote mine up a few weeks ago. If people want I'll post it. It's in PERL, so you'll need active PERL installed, and you might need to tweak it for your local settings. It's not as clean as Scott or another professional programmer might make it, but it's quick, dirty, and gets the job done. Here's a sample of what mine does ( on a pretty slow day for SPAM ): Total number of messages 665 Total Passed, including whitelisted, 523,percentage : 78.6 Total HELD 21, percentage : 3.2 Total BOUNCED 121,percentage : 18.2 Total of Whitelisted 218 Total of SPAMCOP 25 Total of NOABUSE 66 Total of NOPOSTMASTER58 Total of BADHEADERS 38 Total of BASE64 1 Total of HELOBOGUS 99 Total of MAILFROM1 Total of PERCENT 0 Total of REVDNS2 34 Total of ROUTING 13 Total of SPAMHEADERS 40 Total of FILTERWORDS 248 Total of BLACKLIST 34 Total of REVDNSPROBLEM 77 Total of IPBlacklist 31 Karl Drugge, Systems Network Engineer -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:21 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Best Practices question How can I determine the amount of caught/received emails with JunkMail? It would take me an eternity to go through each log file. There are several ways that you can do this. For example, you can do a directory of the \IMail\spool\spam directory, where the held E-mails are. To find out how many are to you, you can use find with the /C switch. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] IP Blacklists
Hello, Rob, The manual is pretty clear about how to setup IP blacklists, but it doesn't specifically say what IP's you are blacklisting. Is this the source IP of the message, or the mailserver it was sent from / mailserver it hopped through? I've always worked under the assumption that it was the IP address of the server that is connecting to your IMail server. It's the IP address that is show in the X-Declude-Sender: line in the headers of the e-mail message. Rob Salmond Take Care, Dan This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Imail v6 and Windows Update
Hello, Jose, et.al. I believe for someone to take advantage of this exploit they have to have physical access to your server. IPSwitch will never release a patch for IMail for this. So if you want to get access to your GUI back, your choice is either to uninstall Microsoft's patch Q328310 or to upgrade your copy of IMail. I betcha everyone currently running IMail 6 that has uninstalled this patch feels comfortable with the decision. I know I do. Later, Dan - Original Message - From: Jose Gosende [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:37 AM Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update Yea, and expose my server's security to fix some GUI issue? Sounds like Ipswitch should provide a maintenance release for v6.0 users to eradicate this problem. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Denny Jodeit Sent: Thursday, July 17, 2003 10:27 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Imail v6 and Windows Update If you remove Critical Update # Q328310, the problem goes away. This does work, I have experienced it. Ipswitch issued a patch for this problem for versions 7.x and above, but stated they will never issue one for Ver. 6. This is per Ipswitch KB article IM-20021218-DM01 HTH, Denny - Original Message - From: Jose Gosende [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:12 AM Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update wow, and I thought it was a terminal services issue. I've had this problem for quite some time and would love to hear a workaround. BTW, how do you know a Windows update caused this problem? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Maze - Hostmaster Sent: Thursday, July 17, 2003 10:05 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: Imail v6 and Windows Update Hello, Was wondering if anyone knew what the Microsoft update it was that caused the display of the IMail manager to be shifted and un-readable. Dang new people installed it and now I can't edit any of the entries, etc. Thanks.. Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. This E-mail is scanned and free from viruses. www.nexustechgroup.com This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Best Practices question
Hi, Jose, Being a 2 months-old user of JunkMail I'm trying to find out best practices for dealing with spam. Sorry in advanced if this topic has been to death, but I couldn't find any helpful threads on the archives. Anyhow, I'm using the following rules but a TON of spam still making it through: WEIGHT10 WARN WEIGHT15 HOLD WEIGHT20 HOLD First of all, I believe using... WEIGHT15HOLD WEIGHT20HOLD ...in your $default$.junkmail is redundant. Using... WEIGHT15HOLD ...alone encompasses what... WEIGHT20HOLD does as well. Of course, the spam comes through because it doesn't meet the HOLD criteria. For example, I have spam emails with a weight of 7, others with 11, etc. My question is, what WEIGHT do you guys use to HOLD email? My configuration is still sub optimal. Our primary domain, NEXUSTECHGROUP.COM, has a hold weight of 9. But we use per-domain settings so some of our domains also have a hold weight of 5, 7 and 10. The thing is, there is no one one right weight. It all depends on the type of traffic that your IMail server is seeing. To any new Declude JunkMail user, the first thing I would recommend doing is establishing the optimal hold weight for either the server, if you aren't using per-domain settings, of for the domain, if you are. Now different people will have different definitions of optimal. For me, the optimal hold weight is the weight at which most spam is caught and hardly any false positives are generated. Another person might want to set their hold weight so high that zero false positives are caught. And yet another might want to set the weight so low such that zero spam makes it through. I like to have a mixture of both. Once you have established a hold weight you can then take further steps to add points to the weight of any spams making it in under the hold weight, thereby causing that spam to get caught. And you can take steps to subtract points to the weight of any legit e-mails that are over the hold weight, thereby keeping those legit e-mails from being caught. I think a good start for anyone is to establish that hold weight and then have just the one active line... WEIGHTXX HOLD ...in your $default$.junkmail file, where XX is your hold weight and WEIGHTXX is defined in GLOBAL.CFG as... WEIGHTXX weight x x XX 0 That's how I would start if I knew then when I began what I know now. Others may differ with me. TIA, Jose Take Care, Dan This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail v6 and Windows Update
Still, I thought it was very unprofessional of ipswitch to leave its customers with such an ultimatum. I personally have kept the patch (security priority #1, regardless) and have learned to use the imail admin with the GUI handicap (its doable). -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, July 17, 2003 5:01 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update If you remove Critical Update # Q328310, the problem goes away. This does work, I have experienced it. Yea, and expose my server's security to fix some GUI issue? The only security issue with Q328310 is if you already have security problems. Specifically, someone needs physical access to the server for Q328310 to be useful. If a hacker has physical access to your mailserver, you've got security problems. :) -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices question
Me too! Cris Porter -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of VanTech.Net Sent: Thursday, July 17, 2003 9:38 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Best Practices question Karl, Please do so, I would be interested in it! Aaron Caviglia -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS - Systems Eng. (Karl Drugge) Sent: Thursday, July 17, 2003 7:55 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Best Practices question Not to bash Scott, who is the freaking GOD of SMTP traffic.. but EEWWW.. yuck. FIND will work, but I'd have to wash my hands afterwards. My computer is supposed to do my work FOR me, on a daily basis, and mail me my checks at home ! ( I wish ! )... Just write up a quick PERL/WSH/Shell script to parse the info, then schedule it with AT to run whenever you want. I wrote mine up a few weeks ago. If people want I'll post it. It's in PERL, so you'll need active PERL installed, and you might need to tweak it for your local settings. It's not as clean as Scott or another professional programmer might make it, but it's quick, dirty, and gets the job done. Here's a sample of what mine does ( on a pretty slow day for SPAM ): Total number of messages 665 Total Passed, including whitelisted, 523,percentage : 78.6 Total HELD 21, percentage : 3.2 Total BOUNCED 121,percentage : 18.2 Total of Whitelisted 218 Total of SPAMCOP 25 Total of NOABUSE 66 Total of NOPOSTMASTER58 Total of BADHEADERS 38 Total of BASE64 1 Total of HELOBOGUS 99 Total of MAILFROM1 Total of PERCENT 0 Total of REVDNS2 34 Total of ROUTING 13 Total of SPAMHEADERS 40 Total of FILTERWORDS 248 Total of BLACKLIST 34 Total of REVDNSPROBLEM 77 Total of IPBlacklist 31 Karl Drugge, Systems Network Engineer -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:21 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Best Practices question How can I determine the amount of caught/received emails with JunkMail? It would take me an eternity to go through each log file. There are several ways that you can do this. For example, you can do a directory of the \IMail\spool\spam directory, where the held E-mails are. To find out how many are to you, you can use find with the /C switch. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail v6 and Windows Update
Jeff Maze wrote: Version 6 works just fine for what we use it for and don't need to spend the $1500 Who told you US$1500? That's the full price. Ipswitch charges US$495 for the upgrade if you buy it directly from them. I went to CDW and got mine for US$349. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPAMDOMAINS: No Reverse DNS or Reverse DNS Lookup Times Out
Hello, All, If I am using the SPAMDOMAINS test what happens when it does a reverse DNS lookup and it times out? Does the e-mail message pass or fail the SPAMDOMAINS test? Also, what happens when it does a reverse DNS lookup and there is no reverse DNS entry? Is that even possible for it to not have a reverse DNS entry? (I believe the answer is yes.) If it is possible and it doesn't have one, does the e-mail message pass or fail the SPAMDOMAINS test? Thanks In Advance, Dan Geiser [EMAIL PROTECTED] This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAMDOMAINS: No Reverse DNS or ReverseDNS Lookup Times Out
If I am using the SPAMDOMAINS test what happens when it does a reverse DNS lookup and it times out? Does the e-mail message pass or fail the SPAMDOMAINS test? It will automatically pass the SPAMDOMAINS test. Also, what happens when it does a reverse DNS lookup and there is no reverse DNS entry? Is that even possible for it to not have a reverse DNS entry? (I believe the answer is yes.) If it is possible and it doesn't have one, does the e-mail message pass or fail the SPAMDOMAINS test? If it has no reverse DNS entry (which is possible, and fairly common -- the REVDNS test checks for that), it should fail the SPAMDOMAINS test (assuming the return address uses a domain that is listed in the spamdomains file). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Regarding Obfuscation
I received an emial to day using the span/span tag to Obfuscate the mesage. It looked like this span id=283774span id=283774span id=283774span id=283774span id=283774Message/span/span/span about/span They will continue to come up with ways to block content filters. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Tandem Group Sent: Wednesday, July 16, 2003 11:48 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Regarding Obfuscation Well, Declude certainly works as it caught this message. :-) Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Rob Salmond Sent: Wednesday, July 16, 2003 08:54 To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Regarding Obfuscation There was some talk a while ago about blocking the tags used to make it difficult to parse text in spam. this stuff: !--r7--ou th!--c6--ousands o!--sE--ver the l!--S2--ife of your lo!--J2--an! W!--cJ--hat are you wai!--dR--ting for? !--x2--brbr!--TY--A href=http://mtggreat1.com/4/index.asp?RefID=588897; font size=5Vi!--Ow--sit N!--OC--ow/font/a/font!--iw-- /td!--ZP--/trbr/tablebr!--vz-- Scott suggested this would be impracticle since any number of random tags could be invented and the browser must handle them cleanly so scanning for each one is useless. However it would be possible to add a text comparison function that examines only the text outside of the 's This way you could seperate your rules into those which can work on the entire html body. For instance; CONTAINS 10 charset=windows-1251 and those which must ignore html HTML_CLEAN_CONTAINS 10 pen1s That way you don't burn CPU cycles parsing HTML tags on stuff thats not important, but you can spend them in cases where you want to. Rob Salmond Ontario Die Company (519)-576-8950 ext. 132 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] re: How does this fail routing
It origionates in china and is delivered directly to our server Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com (SMTPD32-7.15) id A3EC467012A; Wed, 16 Jul 2003 20:11:40 -0700 Received: from public.zz.ha.cn ([218.29.0.198]) by ns1.ssc-isp.net (SAVSMTP 3.1.1.32) with SMTP id M2003071620080913586 for [EMAIL PROTECTED]; Wed, 16 Jul 2003 20:08:10 -0700 Received: from public.zz.ha.cn([192.0.0.120]) by public.zz.ha.cn(AIMC 2.9.5.2) with SMTP id jm23f168443; Thr, 17 Jul 2003 11:05:37 +0800 Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] (805) 520-5800 x7332 Changing the way industry works. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices question
Nicely darn, Karl. Please do post your perl script to the list. If you'd rather send it directly to interested parties, please include me in that list. I'm just starting in on perl and VB Script, because (sigh) I have indeed been using find.exe as a crutch. For example, I call this script all too often to split out my from lines in the log to check out issues or track a message without looking at every line. I have a very similar one for subject lines: @echo off if exist from.txt del from.txt nul echo Filtering by from... for %%a in (dec*.log) do find /i From: %%a From.txt echo FROM count= find /i /c From: From.txt Counting the result is a nicety. I usually do this on a subset of my logs after copying them to my workstation. Andrew 8) -Original Message- From: IS - Systems Eng. (Karl Drugge) [mailto:[EMAIL PROTECTED] Sent: Thursday, July 17, 2003 7:55 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Best Practices question Not to bash Scott, who is the freaking GOD of SMTP traffic.. but EEWWW.. yuck. FIND will work, but I'd have to wash my hands afterwards. My computer is supposed to do my work FOR me, on a daily basis, and mail me my checks at home ! ( I wish ! )... Just write up a quick PERL/WSH/Shell script to parse the info, then schedule it with AT to run whenever you want. I wrote mine up a few weeks ago. If people want I'll post it. It's in PERL, so you'll need active PERL installed, and you might need to tweak it for your local settings. It's not as clean as Scott or another professional programmer might make it, but it's quick, dirty, and gets the job done. Here's a sample of what mine does ( on a pretty slow day for SPAM ): Total number of messages 665 Total Passed, including whitelisted, 523,percentage : 78.6 Total HELD 21, percentage : 3.2 Total BOUNCED 121,percentage : 18.2 Total of Whitelisted 218 Total of SPAMCOP 25 Total of NOABUSE 66 Total of NOPOSTMASTER58 Total of BADHEADERS 38 Total of BASE64 1 Total of HELOBOGUS 99 Total of MAILFROM1 Total of PERCENT 0 Total of REVDNS2 34 Total of ROUTING 13 Total of SPAMHEADERS 40 Total of FILTERWORDS 248 Total of BLACKLIST 34 Total of REVDNSPROBLEM 77 Total of IPBlacklist 31 Karl Drugge, Systems Network Engineer -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:21 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Best Practices question How can I determine the amount of caught/received emails with JunkMail? It would take me an eternity to go through each log file. There are several ways that you can do this. For example, you can do a directory of the \IMail\spool\spam directory, where the held E-mails are. To find out how many are to you, you can use find with the /C switch. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] re: How does this fail routing
It origionates in china and is delivered directly to our server Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com (SMTPD32-7.15) id A3EC467012A; Wed, 16 Jul 2003 20:11:40 -0700 Received: from public.zz.ha.cn ([218.29.0.198]) by ns1.ssc-isp.net (SAVSMTP 3.1.1.32) with SMTP id M2003071620080913586 for [EMAIL PROTECTED]; Wed, 16 Jul 2003 20:08:10 -0700 Received: from public.zz.ha.cn([192.0.0.120]) by public.zz.ha.cn(AIMC 2.9.5.2) with SMTP id jm23f168443; Thr, 17 Jul 2003 11:05:37 +0800 The problem here is that it goes from 192.0.0.120 to 218.29.0.198 to 12.9.25.242. 192.0.0.120 isn't assigned to anybody. Most likely, this was a case of a new systems administrator who remember that 10.0.0.0 through 10.255.255.255 were private IPs that he could use, and remembered seeing a 192.168.x.x IP that was a private IP as well, and then assumed that 192.0.0.0 through 192.255.255.255 were all private IPs. This is one of the many dangers of using public IPs that aren't assigned to you as internal IPs. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail v6 and Windows Update
Title: Message Thanks Denny.. Removal went well and everything is back to normal.. Good to know that at least someone had gone through the same thing.. hahaha -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Denny JodeitSent: Thursday, July 17, 2003 10:17 AMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] OT: Imail v6 and Windows Update Yes, the tech installed the whole boat-everything Microsoft had to offer, then I uninstalled Q328310 only and the problem was gone. I had also had the problem in Dec 2002 when Q328310 was first released, so I knew where to look. - Original Message - From: Scott MacLean To: [EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:56 AM Subject: Re: [Declude.JunkMail] OT: Imail v6 and Windows Update Did you install Q328310, then install SP4, then uninstall Q328310 and it fixed it?At 10:33 AM 7/17/2003, Denny Jodeit wrote: I did not uninstall SP4, just Critical Update Q328310 and it fixed theproblem.- Original Message - From: "R. Scott Perry" [EMAIL PROTECTED]To: [EMAIL PROTECTED]Sent: Thursday, July 17, 2003 10:23 AMSubject: Re: [Declude.JunkMail] OT: Imail v6 and Windows Update Was wondering if anyone knew what the Microsoft update it wasthat caused the display of the IMail manager to be shifted and un-readable. Dang new people installed it and now I can't edit any of the entries, etc. It's probably the Windows 2000 SP4 that was installed. It includes the update that caused the IMail Administrator screen to be shifted. Unfortunately, the only ways to fix it seem to be either to not install SP4, or to upgrade IMail. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus(http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.---[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.___Scott MacLean[EMAIL PROTECTED]ICQ: 9184011http://www.nerosoft.com
[Declude.JunkMail] SPAMDOMAINS?
Scott I had this mail fail both SPAMDOMAINS and HELOBOGUS. The message is an OK message the syslog shows the message actually arriving from a hotmail server. Should this not have been OK or do I have something wrong? Received: from hotmail.com [65.54.169.8] by mx2.netraprise.com with ESMTP (SMTPD32-7.15) id A9BB58029C; Wed, 16 Jul 2003 11:13:47 -0500 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Wed, 16 Jul 2003 09:13:46 -0700 Received: from 204.220.153.70 by by3fd.bay3.hotmail.msn.com with HTTP; Wed, 16 Jul 2003 16:13:46 GMT X-Originating-IP: [204.220.153.70] X-Originating-Email: [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Msg failed HELOBOGUS (Domain 204.220.153.70 has no MX or A records.). Action=WARN. Msg failed SPAMDOMAINS (Spamdomain 'msn.com' found: Address of [EMAIL PROTECTED] sent from invalid 70.reverse.microgistix.com.). David Stavert --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAMDOMAINS?
I had this mail fail both SPAMDOMAINS and HELOBOGUS. The message is an OK message the syslog shows the message actually arriving from a hotmail server. Should this not have been OK or do I have something wrong? The problem here is with your HOP/IPBYPASS settings: Received: from hotmail.com [65.54.169.8] by mx2.netraprise.com with ESMTP (SMTPD32-7.15) id A9BB58029C; Wed, 16 Jul 2003 11:13:47 -0500 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Wed, 16 Jul 2003 09:13:46 -0700 Received: from 204.220.153.70 by by3fd.bay3.hotmail.msn.com with HTTP; Wed, 16 Jul 2003 16:13:46 GMT Here, we see that your mailserver received the E-mail from 65.54.169.8 -- and that's the IP that you want Declude JunkMail to scan, since that isn't a trusted mailserver (one under your control). However: Msg failed HELOBOGUS (Domain 204.220.153.70 has no MX or A records.). Action=WARN. Msg failed SPAMDOMAINS (Spamdomain 'msn.com' found: Address of [EMAIL PROTECTED] sent from invalid 70.reverse.microgistix.com.). Here, Declude JunkMail is looking at the 3rd Received: header for the IP (and HELO/EHLO), which is why it is getting a domain named 204.220.153.70 and a reverse IP of 70.reverse.microgistix.com. In this case, you should use HOP 0 -- I'm guessing you are using HOP 2, which you should not be using (HOP 2 should be used if there are two mailservers of yours in front of your IMail server). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPAMDOMAINS?
Yes indeed. Just changed it. All fixed. The problem here is with your HOP/IPBYPASS settings: Thanks David Stavert --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is SPAMDOMAINS As Great As I Think ItIs?
When I first heard about the SPAMDOMAINS test and was starting to get a grasp of how it worked, I was thinking that its main purpose was to pay special attention to very common and well-known domains which are also commonly used as the sender during the SMTP conversation. Domain names like YAHOO.COM, AOL.COM, MSN.COM, EARTHLINK.NET, etc. That's correct. These are pretty well known domain names that a lot of spammers tend to use. I figured you'd add those types of domains to your SpamDomains.txt file, making sure to add any other servers that legit mail from those domain names come from, e.g. HOTMAIL.COM - MSN.COM. Correct. But as I've been working with it and looking at its results I'm sort of coming to a different realization. In addition to the big name domains as I mentioned in the last paragraph isn't any domain which is ever used the Sender of a spam message a legitimate candidate for inclusion in the SpamDomains.txt list? For example, when I browse the spam with SpamReview. I see a lot of domains like SUPERSTORESPECIALS.COM, POSTALMANAGER.COM, PARA3DS.COM and others. Hardly anyone on the Internet knows about these domain names yet they are attached to quite a lot of the spam. Aren't those good candidates for SPAMDOMAINS as well. Yes, those would probably be good candidates as well. The only thing you need to be careful of is that you don't catch legitimate E-mail from those domains. If those domains could send legitimate E-mail, it may not come from an IP that has their domain in the reverse DNS entry (lots of legitimate E-mail is sent from IPs that have a reverse DNS entry that doesn't correspond to the sender). And I think there might be another added benefit. When someone is sending e-mail to you and they are using your own address as the sending address (which I've been seeing a lot of lately), e.g. NEXUSTECHGROUP.COM. I know that I have control over my mail servers and I can put up whatever Reverse DNS entries that I want. So if I get a message from NEXUSTECHGROUP.COM by having my own domains on the SPAMDOMAINS list I'm ensuring they can't use that technique either. That works very well (assuming that legitimate users of your domains won't be sending E-mail from IPs that don't belong to you). What I'm thinking about doing is adding any domain which shows up in SpamReview, assuming it's not a false positive, to my SpamDomains.txt list. I realize I might catch a little legit e-mail at first but as long as I stay on top of the legit aliases shouldn't SPAMDOMAINS by itself make great strides in eliminating spam regardless of the other tests I have active. Is there any reason I wouldn't want to have a lot of domains on my SpamDomains.txt list? Would that add too much load to the system? Am I just reading too much into the powerfullness of this test? If you do this, you will likely end up with some false positives. However, adding a domain to the SPAMDOMAINS test is a safer than adding it to a blacklist (since the SPAMDOMAINS test can allow a lot of legitimate mail from listed domains to get through). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Is SPAMDOMAINS As Great As I Think It Is?
Is there any reason I wouldn't want to have a lot of domains on my SpamDomains.txt list? Would that add too much load to the system? Am I just reading too much into the powerfullness of this test? Don't forget people that has running their own few mailboxes as one of multiple virtual hosts on the ISPs mailserver. There can be a lot of different domains/hosts on one single IP but this IP can have only one single REVDNS entry. All this virtual hosts will fail the spamdomains test if the domain is listed in the spamdomains file. This test will only work if the sender-domain is contained in the REVDNS entry of all IP's where a legit message can came from. Don't forget also that there can be legit messages send from another IP. For example someone has configured his own email address [EMAIL PROTECTED] in his mail client but connects to the smtp-server of his current dialup-provider. If this smtp-server don't has implemented a mechanism to deny unfamiliar sender addresses this message can come to your server from an IP-Address with an REVDNS-entry that has nothing todo with yahoo.com. (and will fail the test) So I recommend to not overvaluate this test. It helps a lot (like nearly all other test) in a weighting system. My opinion is that we can work in the other direction and give a negative weight if the right part of sender-domain, helo-message and revdns-entry is the same. For example a message from [EMAIL PROTECTED] sent from an host greeting with EHLO mail.domain.com and having an REVDNS-entry smtp1.domain.com seems to be a legit source, a good configured mail system and should receive negative points because a spammer has to comply with a lot of things before he can earn this negative points. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
