Re: [Declude.JunkMail] Dell Mailings
Hi Goran, The domain email-link.ca belongs to Digital Cement a company from Toronto ON that does permission marketing = nicer SPAM in behalf of Dell. Here's their whois info: Whois email-link.ca Domain email-link.ca Status: EXIST Organization: Digital Cement Co. Date approved: 2002/01/24 Last changed: 2003/12/01 Renewal Date: 2006/01/24 Registrar: easyDNS Technologies Inc. Description: DNS1: ns1.easydns.com DNS2: ns2.easydns.com Administrative Contact Name: Digital Cement Job Title: Postal Address: 100 Liberty St. Toronto ON M6K 3L7 Canada Phone: 416-537-3237 Fax: 416-537-9899 Email: [EMAIL PROTECTED] Technical Contact Name: Digital Cement Job Title: Postal Address: 100 Liberty St. Toronto ON M6K 3L7 Canada Phone: 416-537-3237 Fax: 416-537-9899 Email: [EMAIL PROTECTED] It is legit in a sense that the recipient has subscribed to their mailing list. Hope it helps... Cheers, Adrian --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Where is ARIN?
Hey Scott, I can't find them either, I have tried through two different pipes. Calling from Ontario, Canada :) Adrian R. Scott Perry wrote: Is it me or did ARIN drop of the face of the Internet today? It might be you -- http://www.dnsstuff.com/tools/traversal.ch?domain=104.161.233.64.in-addr.arpatype=PTR shows that all their DNS servers are responding, and in a very reasonable time. And http://www.arin.net is reachable from here with no problem. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] === Confidentiality Notice: This e-mail message and any attachment to same contains confidential information intended only for the person(s) to whom the said e-mail is intended to be sent. Any review, retransmission, dissemination or other use of or the taking of any action and reliance upon this information by persons or entities other than the intended recipient violates confidentiality and is prohibited. If you have received this e-mail message in error, please notify the sender immediately and delete the e-mail message from your computer. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Weird characters in email
Hi guys, Has anyone seen weird characters in an email like that: --- snip --- Your message Cc: Test User+ADs- Subject: May New Release Sleeves Sent:Wed, 28 Apr 2004 14:39:37 -0500 did not reach the following recipient(s): Subject: May New Release Sleeves Date: Wed, 28 Apr 2004 14:39:37 -0500 From: a x [EMAIL PROTECTED] +ACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKg- MAY NEW RELEASE SLEEVES +ACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKg- --- snip --- Any clue where they might come from? Netscape Messenger 4.8 has been used on IMail 7.15 with Declude 1.79i4. Thanks, Adrian --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weird characters in email
Scott, Can I send you the complete message (with headers) off list, to have a look at it? It's not the firs one I've seen and punching part of the string into Google returned some findings. I still have to dig through them, but maybe if you have a look at the complete message, you'll get a better understanding of what's going on. Thanks Adrian R. Scott Perry wrote: Has anyone seen weird characters in an email like that: Your message did not reach the following recipient(s): +ACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKg- MAY NEW RELEASE SLEEVES +ACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACoAKg- That's a bounce message from the remote end. Those characters look a lot like some type of encoding (base64/uuencode/BinHex), but I think they are just random characters that are repeating (unless it is something very odd that is encoded). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] === Confidentiality Notice: This e-mail message and any attachment to same contains confidential information intended only for the person(s) to whom the said e-mail is intended to be sent. Any review, retransmission, dissemination or other use of or the taking of any action and reliance upon this information by persons or entities other than the intended recipient violates confidentiality and is prohibited. If you have received this e-mail message in error, please notify the sender immediately and delete the e-mail message from your computer. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
Nice little utility Bill. Thanks a bunch. Adrian Bill wrote: Hi, I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. If anyone would like to use it, I have it available for free from my website: http://www.wamusa.com/wamtools The program is designed for LOGLEVEL MID but it may work for other levels. My system analyzed this 120Mb decMMDD.log in less than one minute. This is a sample output: Message Recipient Test Name Fail Count %Fail Count % WEIGHT10116362 96 169684 96 SNIFFER2114790 94 167322 95 WEIGHT15112700 93 165299 94 WEIGHT20108443 89 159758 91 WEIGHTDEL108443 89 159758 91 SPAMCOP 84740 70 129602 73 SBL 52552 43 53879 30 AHBL 48506 40 57094 32 CBL 46445 38 89827 51 DSBL 39527 32 77743 44 SORBS-DUHL 29673 24 58427 33 REVDNS 28996 23 41544 23 BADHEADERS 27493 22 34922 19 SORBS-SPAM 25119 20 27995 15 NOPOSTMASTER 22488 18 46530 26 NOABUSE 21746 17 42732 24 SPAMHEADERS 19613 16 20587 11 SPAM-DOMAINS 15263 12 33776 19 ROUTING 120419 25060 14 FOREIGN 100988 163309 GIBBERISH 90727 99325 DSN 84847 137557 SORBS-HTTP 65845 124597 SORBS-SOCKS 65085 126977 SPFFAIL 49544 65273 BLITZEDALL 33502 59913 BASE64 22521 29561 MAILFROM 16841 28411 COMMENTS 13281 20561 MYFILTERFAIL 11590 17230 WAMO 58506090 MYFILTERPASS 5120 12390 SORBS-MISC 50409230 SORBS-SMTP 4450 11320 OBFUSCATION 36004570 ORDB 31606540 SORBS-WEB 31605140 SORBS-ZOMBIE 28002800 SPFPASS 20802340 BONDEDSENDER620 620 @LINKED100 140 HABEAS 40 40 WAMCHECK 10 20 Message Count120934 175163 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Paul Fuhrmeister Sent: Monday, April 12, 2004 5:11 PM To: [EMAIL PROTECTED] Subject: [Declude.Virus] Scott, what do you use to generate this report Thanks Scott, While I have your attention, what do you use to generate this report from your log files? Each month, we go through our spamtraps (E-mail addresses designed to collect spam), to find out which spam tests were most effective at catching spam. snip WEIGHT1099.48% WEIGHT2095.45% NOLEGITCONTENT 95.43% SNIFFER 94.06% SPAMCHK 93.20% IPNOTINMX 90.76% SPAMCOP 79.83% CMDSPACE77.37% snip [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] === Confidentiality Notice: This e-mail message and any attachment to same
[Declude.JunkMail] Link to download the Interim Release
Hi Scott, It seems that the link used for downloading the Interim releases doesn't work anymore since the site has been updated. Can you send me the new link, please. Thanks, Adrian --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] X-Mailer: journey sale 7
John, It looks like a header introduced by the mail server for the domain gmx.com. If you punch it in a browser you'll see that it's a German provider specialized in messaging. Now, what are they using it for I wouldn't know... I have found mentions of it in the following context X-GMX-Antivirus: -1 on some forums (try Google...) but as my German is not good enough, I could only guess that it might be used as a flag to enable/disable the virus scanning for some messages/customers of theirs. I don't think there's any reason to consider it suspicious. Cheers, Adrian John Tolmachoff (Lists) wrote: What about this one: X-GMX-Antivirus John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Friday, March 26, 2004 7:05 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] X-Mailer: journey sale 7 Any one see this as a legitimate mailer? John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] === Confidentiality Notice: This e-mail message and any attachment to same contains confidential information intended only for the person(s) to whom the said e-mail is intended to be sent. Any review, retransmission, dissemination or other use of or the taking of any action and reliance upon this information by persons or entities other than the intended recipient violates confidentiality and is prohibited. If you have received this e-mail message in error, please notify the sender immediately and delete the e-mail message from your computer. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Fprot
Hi Kevin, You're using the wrong exe. Try using the 32-bit application FPCMD.EXE as per manual: SCANFILE C:\Progra~1\Comman~1\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt VIRUSCODE 3 VIRUSCODE 6 REPORTInfection: Cheers, Adrian Kevin Shimwell wrote: Off Topic I get this error very frequently. Any Help on how to fix it. Fprot site had no information I could find. Running windows 2000 server Application popup: 16 bit MS-DOS Subsystem : C:\scanner\FSI\F-prot\F-Prot.exe X#=0D, CS=01CF IP=5703. The NTVDM CPU has encountered an unhandled exception. Choose 'Close' to terminate the application. Kevin Shimwell Link Brokers Group, LLC ( Support ) 1600 Hwy 17 South North Myrtle Beach, SC 29582 Phone: 843-663-1004 Fax: 843-663-1007 Email: [EMAIL PROTECTED] 24/7 Support http://www.linkbrokers.com/support_ticket.cfm Support M-F 1-888-546-5631 -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] === Confidentiality Notice: This e-mail message and any attachment to same contains confidential information intended only for the person(s) to whom the said e-mail is intended to be sent. Any review, retransmission, dissemination or other use of or the taking of any action and reliance upon this information by persons or entities other than the intended recipient violates confidentiality and is prohibited. If you have received this e-mail message in error, please notify the sender immediately and delete the e-mail message from your computer. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Fprot 3.14d
I'll give it a try an let you know. Adrian Serge wrote: Anyone cares to test this ? FRISK Software has released version 3.14d of F-Prot Antivirus for Windows. In order to further increase the security and peace of mind we provide our customers, we have now released a new version of F-Prot Antivirus for Windows. Version 3.14d of F-Prot Antivirus for Windows provides users with improved scanning of encrypted executables in password protected ZIP archives. Improved scanning techniques allow F-Prot Antivirus for Windows to better detect potentially damaging executables hidden in such password protected archives and warn users of the danger -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] === Confidentiality Notice: This e-mail message and any attachment to same contains confidential information intended only for the person(s) to whom the said e-mail is intended to be sent. Any review, retransmission, dissemination or other use of or the taking of any action and reliance upon this information by persons or entities other than the intended recipient violates confidentiality and is prohibited. If you have received this e-mail message in error, please notify the sender immediately and delete the e-mail message from your computer. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Fprot 3.14d
Hey Serge, I've downloaded and tested it with the declude/tools and it seems to do its job. The time will tell... I'll let you know if I notice anything... Adrian Serge wrote: Anyone cares to test this ? FRISK Software has released version 3.14d of F-Prot Antivirus for Windows. In order to further increase the security and peace of mind we provide our customers, we have now released a new version of F-Prot Antivirus for Windows. Version 3.14d of F-Prot Antivirus for Windows provides users with improved scanning of encrypted executables in password protected ZIP archives. Improved scanning techniques allow F-Prot Antivirus for Windows to better detect potentially damaging executables hidden in such password protected archives and warn users of the danger -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] === Confidentiality Notice: This e-mail message and any attachment to same contains confidential information intended only for the person(s) to whom the said e-mail is intended to be sent. Any review, retransmission, dissemination or other use of or the taking of any action and reliance upon this information by persons or entities other than the intended recipient violates confidentiality and is prohibited. If you have received this e-mail message in error, please notify the sender immediately and delete the e-mail message from your computer. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Fprot 3.14d
Hi Don, I don't see any error in my log (which is set to MID). Here are my config lines for F-Prot: # F-Prot - 1st Scanner SCANFILE1 C:\Progra~1\FSI\F-Prot\FPcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOBOOT /DUMB /REPORT=report.txt VIRUSCODE1 3 VIRUSCODE1 6 REPORT1 Infection: Hope it helps, Adrian Don Hickey wrote: Adrian, Are you seeing any errors in the virus log file? Like this - 03/10/2004 08:46:35 Q2a4000b700e8a069 Could not find parse string Infection: in report.txt 03/10/2004 08:46:35 Q2a4000b700e8a069 Error 5 in virus scanner 1. 03/10/2004 08:46:36 Q2a4000b700e8a069 Scanned: Error in virus scanner. Don - Original Message - From: Adrian Titei [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, March 15, 2004 4:00 PM Subject: Re: [Declude.JunkMail] Fprot 3.14d Hey Serge, I've downloaded and tested it with the declude/tools and it seems to do its job. The time will tell... I'll let you know if I notice anything... Adrian Serge wrote: Anyone cares to test this ? FRISK Software has released version 3.14d of F-Prot Antivirus for Windows. In order to further increase the security and peace of mind we provide our customers, we have now released a new version of F-Prot Antivirus for Windows. Version 3.14d of F-Prot Antivirus for Windows provides users with improved scanning of encrypted executables in password protected ZIP archives. Improved scanning techniques allow F-Prot Antivirus for Windows to better detect potentially damaging executables hidden in such password protected archives and warn users of the danger -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] === Confidentiality Notice: This e-mail message and any attachment to same contains confidential information intended only for the person(s) to whom the said e-mail is intended to be sent. Any review, retransmission, dissemination or other use of or the taking of any action and reliance upon this information by persons or entities other than the intended recipient violates confidentiality and is prohibited. If you have received this e-mail message in error, please notify the sender immediately and delete the e-mail message from your computer. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] === Confidentiality Notice: This e-mail message and any attachment to same contains confidential information intended only for the person(s) to whom the said e-mail is intended to be sent. Any review, retransmission, dissemination or other use of or the taking of any action and reliance upon this information by persons or entities other than the intended recipient violates confidentiality and is prohibited. If you have received this e-mail message in error, please notify the sender immediately and delete the e-mail message from your computer. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Why did this get through?
You must have a line like WHITELIST HABEAS in your global.cfg. That's responsible for letting it through. Adrian Timothy Bohen wrote: Any help on why this got through? I see the line about being whitelisted but I cannot find this ip or domain in my whitelist? Thanks Received: from dynamic-ip-cr20011851123.cable.net.co [200.118.51.123] by mail1.cmsinter.net (SMTPD32-8.05) id A5B951D700C0; Tue, 09 Mar 2004 11:50:01 -0500 Received: from 0.39.24.190 by 200.118.51.123; Tue, 09 Mar 2004 08:52:46 -0500 Message-ID: [EMAIL PROTECTED] X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to http://www.habeas.com/report/. From: gita maynard [EMAIL PROTECTED] Reply-To: gita maynard [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: Fwd: V|cod|.n _ [EMAIL PROTECTED] xana_x_ , V.a.lium .Pntermin. ' Som.a. ccvhdqyxnsvl Date: Tue, 09 Mar 2004 08:55:46 -0500 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=--6998711866179180 X-Mailer: mh-e 6.1; nmh 1.1-RC1; Emacs 21.2 X-Priority: 5 X-IP: 216.128.128.48 X-Declude-Sender: [EMAIL PROTECTED] [200.118.51.123] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-RCPT-TO: [EMAIL PROTECTED] Status: R X-UIDL: 378846870 Sent via the CMSInter.Net WebMail system at mail1.cmsinter.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] === Confidentiality Notice: This e-mail message and any attachment to same contains confidential information intended only for the person(s) to whom the said e-mail is intended to be sent. Any review, retransmission, dissemination or other use of or the taking of any action and reliance upon this information by persons or entities other than the intended recipient violates confidentiality and is prohibited. If you have received this e-mail message in error, please notify the sender immediately and delete the e-mail message from your computer. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Why did this get through?
I am not absolutely sure, but I think that it is in the default file. To find out more about HABEAS, go to www.habeas.com. It's supposed to be some kind of certificate for non-spam mail. It is supposed to work, but obviously there are some who abuse it and they're being sued... Cheers, Adrian Timothy Bohen wrote: Yep thatÂ’s there. I don't ever remember putting it in though. Does it come with a default global.cfg file? What is it? Thanks -- Original Message -- From: Adrian Titei [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Tue, 09 Mar 2004 13:14:51 -0500 You must have a line like WHITELIST HABEAS in your global.cfg. That's responsible for letting it through. Adrian Timothy Bohen wrote: Any help on why this got through? I see the line about being whitelisted but I cannot find this ip or domain in my whitelist? Thanks Received: from dynamic-ip-cr20011851123.cable.net.co [200.118.51.123] by mail1.cmsinter.net (SMTPD32-8.05) id A5B951D700C0; Tue, 09 Mar 2004 11:50:01 -0500 Received: from 0.39.24.190 by 200.118.51.123; Tue, 09 Mar 2004 08:52:46 -0500 Message-ID: [EMAIL PROTECTED] X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to http://www.habeas.com/report/. From: gita maynard [EMAIL PROTECTED] Reply-To: gita maynard [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: Fwd: V|cod|.n _ [EMAIL PROTECTED] xana_x_ , V.a.lium .Pntermin. ' Som.a. ccvhdqyxnsvl Date: Tue, 09 Mar 2004 08:55:46 -0500 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=--6998711866179180 X-Mailer: mh-e 6.1; nmh 1.1-RC1; Emacs 21.2 X-Priority: 5 X-IP: 216.128.128.48 X-Declude-Sender: [EMAIL PROTECTED] [200.118.51.123] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-RCPT-TO: [EMAIL PROTECTED] Status: R X-UIDL: 378846870 Sent via the CMSInter.Net WebMail system at mail1.cmsinter.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] === Confidentiality Notice: This e-mail message and any attachment to same contains confidential information intended only for the person(s) to whom the said e-mail is intended to be sent. Any review, retransmission, dissemination or other use of or the taking of any action and reliance upon this information by persons or entities other than the intended recipient violates confidentiality and is prohibited. If you have received this e-mail message in error, please notify the sender immediately and delete the e-mail message from your computer. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Sent via the CMSInter.Net WebMail system at mail1.cmsinter.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] === Confidentiality Notice: This e-mail message and any attachment to same contains confidential information intended only for the person(s) to whom the said e-mail is intended to be sent. Any review, retransmission, dissemination or other use of or the taking of any action
Re: [Declude.JunkMail] Hotmail being bounced as Undeliverable
Hey Chris, Have you tried to peek in the log? The truth should be in there... Try to identify the spoolname and then run a search for that string in the dec.log. See what you find there. Cheers, Adrian Chris Hickey wrote: Anyone have an idea why emails from Hotmail are getting bounced back to the user as undeliverable? I can't make heads or tails of it.. some of the emails go through, some don't. One that didn't was to a single person, no attachment, just a copy/paste of a news article. Any ideas? Thanks! --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] === Confidentiality Notice: This e-mail message and any attachment to same contains confidential information intended only for the person(s) to whom the said e-mail is intended to be sent. Any review, retransmission, dissemination or other use of or the taking of any action and reliance upon this information by persons or entities other than the intended recipient violates confidentiality and is prohibited. If you have received this e-mail message in error, please notify the sender immediately and delete the e-mail message from your computer. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelist file?
Just run declude -diag Cheers, Adrian Agid, Corby wrote: Indeed I also had some blank whitelist from lines to make it easier to cut and paste new entries, without retyping another entry. I cleaned those out at the same time that I fixed the misspelled line. I searched through the archives for the WHITELISTFILE and found many postings about the option, but so far haven't found one that shows the syntax. Perhaps it's time for a manual entry:) I'll get the latest version, which I thought I had. How to tell which version is currently running? C -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 05, 2003 1:52 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist file? Below is a snippet from the log file from that day. I had attempted to whilelist adp.com. Every incoming message had the same result. 07/26/2003 00:10:39 Q2969017b00f264ed E-mail whitelisted - automatically passing all spam tests [] Ah -- I see what happened. It looks like you had a line such as WHITELIST IP or WHITELIST FROM, that didn't contain any information to whitelist on. v1.75 takes care of this (previous versions would do as they were told, and would whitelist any E-mails with appearing in the IP, or appearing in the return address -- which would end up whitelisting all E-mail). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Report System
Hi Darrell, Why don't you post a link to your program so we can all have a look at it. It would avoid another 2000 of me toos. Just a thought. BTW, me too... ;-) Cheers, Adrian Darrell LaRock wrote: Terry, I used delog for awhile, but I needed several other features that did not come with delog. So I developed an application that had all of the features that I needed. Below is a sample report that I generated(tab format). The reports can be in tab, csv, or html format and you have the ability to email them as well. There are many other things that dlanalyzer can report on. You can get reports on domains, users, tests, and different reporting periods. The combinations are endless. Right now I am finishing up database support and a few other miscellaneous features I wanted to add in.. If you would like to try it out let me know and I will make it available.. Darrell Start Time: 6/1/2003 12:00:00 AM End Time: 6/2/2003 12:00:00 AM Total Messages: 25935 Messages That Failed: 18252 Spam Percentage: 70.38% TEST# FAILEDPercentage BADHEADERS 373514.40% BASE64 12034.64% BLACKLIST 13255.11% COMMENTS668 2.58% DECREASEIPWGHT 40 0.15% DECREASEWEIGHT 557 2.15% DECREASEWEIGHTLOW 313 1.21% DSBL380714.68% DSN 12154.68% EASYNET-DNSBL 741828.60% FXBLACKLIST 25749.92% HELOBOGUS 477618.42% HEUR10 289911.18% IPBLACKLIST 5 0.02% MAILFROM385 1.48% NJABL 408 1.57% NOABUSE 334112.88% NONENGLISH 214 0.83% NOPOSTMASTER402015.50% OLDEMPLOYEE 29 0.11% ORDB261 1.01% OSDUL 113 0.44% OSLIST 2 0.01% OSRELAY 343 1.32% OSSOFT 326512.59% OSSRC 330812.75% POSTMASTER 12 0.05% REVDNS 423116.31% ROUTING 14875.73% SNIFFER 328512.67% SNIFFERAV 12 0.05% SNIFFERCASINO 159 0.61% SNIFFERDEBT 815 3.14% SNIFFEREXP 269 1.04% SNIFFERGETRICH 630 2.43% SNIFFERGREY 421 1.62% SNIFFERINK 196 0.76% SNIFFERINSURAN 58 0.22% SNIFFEROBFUS350 1.35% SNIFFERPHARM17276.66% SNIFFERPORN 16306.28% SNIFFERSCAM 1 0.00% SNIFFERSPAMWAR 127 0.49% SNIFFERTHEFT138 0.53% SNIFFERTRAVEL 438 1.69% SPAMCOP 417216.09% SPAMHEADERS 416016.04% WEIGHT1010482 40.42% WEIGHT5 769 2.97% WORDFILTER 782630.18% -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Terry Parks Sent: Thursday, July 31, 2003 2:26 PM To: Declude. JunkMail Subject: [Declude.JunkMail] Report System While it's quiet I'd like to know which system is best at reporting status of the email system in terms of most messages sent from/delivered to address, etc. I need a good summary reporting system that will email me these results. I've tried delog but the email feature doesn't work. Terry --- [This E-mail scanned for viruses by Surfside Internet] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] DECLUDE.LOG file in the root of C
Hi Scott, I have just discovered a file DECLUDE.LOG in the root of the C drive on my mail server. I am running IMail 7.15 / JMPro 1.70. I've included the last 2 lines from it: 06/02/2003 08:31:10 Q43660047013224bd Couldn't open headers datafile 06/02/2003 09:08:07 Q4c34000902048825 Couldn't open headers datafile Looking up the corresponding Q* files in the dec0602.log file I found: 06/02/2003 08:31:14 Q43660047013224bd Error: Failed; could not open D:\IMail\spool\D43660047013224bd.SMD 06/02/2003 08:31:16 Q43660047013224bd L1 Message OK and respectively: 06/02/2003 09:08:07 Q4c34000902048825 Error: Failed; could not open D:\IMail\spool\D4c34000902048825.SMD 06/02/2003 09:08:07 Q4c34000902048825 L1 Message OK What is the Couldn't open headers datafile message and what should I do about it? Do you need my config files off-list? Thanks, Adrian --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Reference documents needed
Hi Scott, I am a fairly new user of Declude JunkMail Pro and I'm reading the messages on this list on a daily basis. Excellent discussions and I have already learned a lot. In order to make the most use of Declude's power in the shortest time possible, I would need a couple of documents (hopefully they exist): 1. A reference list (beyond the HTML manual at www.declude.com/JunkMail/manual.html) that lists every single variable available and what it represents (eventually with a short example). 2. A complete list of all the tests available in Declude junk mail with a detailed description of their use? Thanks in advance, PS: If Declude doesn't have such documents, then maybe one of the list subscribers have compiled them. Any help would be much appreciated. -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] === Confidentiality Notice: This e-mail message and any attachment to same contains confidential information intended only for the person(s) to whom the said e-mail is intended to be sent. Any review, retransmission, dissemination or other use of or the taking of any action and reliance upon this information by persons or entities other than the intended recipient violates confidentiality and is prohibited. If you have received this e-mail message in error, please notify the sender immediately and delete the e-mail message from your computer. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] HOWTO use the X-RBL-Warning: Possible ADULT Content
Hi guys, Anybody knows hot to use the X-RBL-Warning: Possible ADULT Content undocumented feature. Is there a manpage for it (even un-official)? Thanks in advance, Adrian -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] === Confidentiality Notice: This e-mail message and any attachment to same contains confidential information intended only for the person(s) to whom the said e-mail is intended to be sent. Any review, retransmission, dissemination or other use of or the taking of any action and reliance upon this information by persons or entities other than the intended recipient violates confidentiality and is prohibited. If you have received this e-mail message in error, please notify the sender immediately and delete the e-mail message from your computer. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
