RE: [Declude.JunkMail] Cardscan.net Opinions?
I use Plaxo. Wonderful little program. Craig. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Webmaster Oilfield Directory Sent: Tuesday, November 18, 2003 4:29 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Cardscan.net Opinions? i've gotten quite a few of these too... but from people i know that is... - Original Message - From: Marc Catuogno [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 18, 2003 11:04 AM Subject: [Declude.JunkMail] Cardscan.net Opinions? I'm tempted to block this as I'm not sure I like this kinda info in other people's hands. I'm updating my address book. Would you please take a moment to review your contact information? Your updates help to keep me current, as well as other people like me who already have your email address. To update your contact information, please visit the following link: https://www.cardscan.net --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude Updater
Use RunAS? Craig. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Burzin Sumariwalla Sent: Friday, November 14, 2003 3:38 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Declude Updater Hi Markus, I know it's not an active process issue, because I created a bogus folder and bogus declude.exe for DU to act upon. That leads me to also believe its also a rights issue. However, I can't figure it out. I'm logged on as Administrator, the DU folder and its contents owned by Administrator. The contents of the folder inherit Administrator ownership, and same holds true for the bogus target folder and executable. Any other ideas? Of note may be the fact that I get the update email after downloads, but regardless of the fact that the target updated. Burzin At 10:14 AM 11/13/2003, you wrote: You've set up DU to install only release versions. DU will do the following: 1.) Download the file http://www.declude.com/version.txt This file at them moment contains - Release: 1.75 http://www.declude.com/release/175/Declude.exe Beta: 1.76 http://www.declude.com/release/176/Declude.exe - 2.) Now DU will now check if there is already a downloaded release and beta file with this versions. If not it will download this files and save them in the appropriate folder. 3.) Depending on what you've selected to update (release or beta) it will look if there is a new file and if yes DU will copy this file to the indicated Imail path. In your case only look to the subfolder release if you delete the folder 175 and run the DU manualy it should download, save and copy release 175. If not I can only expect that your logon account has no right to overwrite in the imail path or that any time you've tried to overwrite this file it was looked because a process whas active. Markus --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Do you use ColdFusion? - Java?
The neat thing about Posini though is that my delivery load PrePostini was 220,000 emails AFTER Declude sorted. PostPostini it is now 35,000. Postini stops DHA and SPAM DOS as well. They use Postfix. It really is neat and I would prefer if I could have the staff and resources to build a redundant infrastructure like that but I don't so we will do this for now. Perhaps they will one day integrate it with mail suites like Imail and Brightmail but that is the only drawback I see ATM. Maybe you should bite the bulllet and offer the service to your customers as well. (The ROI makes sense if you are inundated with SPAM. BW savings is a factor if your BW is expensive.) Craig. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Sheldon Koehler Sent: Thursday, November 06, 2003 10:39 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Do you use ColdFusion? - Java? I'd gladly pay for something that worked. I did not expect it for free. I have the KWM price in mind as a point I could get my partners to go for. Any higher than this and it would be a very hard sell for me. So this means a lot of people need to be interested in it! Our local competition uses Postini. And I have lost a few customers over to them as people do seem to like that interface. However, I have thrown out the security thing to muddy the waters ;-) We do not send their email out to someone else's servers... I let them draw their own wrong conclusions... But if I could lighten my own load and give users an easy to use interface, I would be extremely happy! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Sniffer Declude logs
I have had to nix Sniffer. After disabling it, my processor dropped by about 25% and mail stopped being backed up in the Overflow directory. Instead of having a constant over 100 smtp connections we now have less than 20 most of the time. Mail is now being delivered again instantly. I think I might test it with Postfix. Craig. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Pete McNeil Sent: Thursday, October 23, 2003 5:22 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Sniffer Declude logs The current version of Message Sniffer has no feature to turn off logging. I recommend that you schedule a task to delete/archive the log periodically. An interim release is in the works that will implement new logging features. It will be a few weeks before this is available though. Hope this helps, _M |-Original Message- |From: [EMAIL PROTECTED] |[mailto:[EMAIL PROTECTED] |Sent: Thursday, October 23, 2003 3:49 PM |To: [EMAIL PROTECTED] |Subject: [Declude.JunkMail] Sniffer Declude logs | | |Guys, | |Is there a way I can Sniffer to not log? I am testing the |Sniffer2 but the log is very large.over a GB a day. I have |been under attack for the past couple weeks and Declude spam |log file is nearly 800MB a day with LOG_OK NONE set. | | |Craig. | --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Sniffer Declude logs
Guys, Is there a way I can Sniffer to not log? I am testing the Sniffer2 but the log is very large.over a GB a day. I have been under attack for the past couple weeks and Declude spam log file is nearly 800MB a day with LOG_OK NONE set. Craig. attachment: winmail.dat
[Declude.JunkMail] Countries test
Scott, With the countries test, can it fail more that one country? If so, can you change it so that it lists every line it failed? For example, I have the following: COUNTRIES 1 CONTAINS*A COUNTRIES 1 CONTAINS*B COUNTRIES 1 CONTAINS*E COUNTRIES 5 CONTAINS*I COUNTRIES 10 CONTAINS*L COUNTRIES 10 CONTAINS*M COUNTRIES 1 CONTAINS*P COUNTRIES 10 CONTAINS*R COUNTRIES 10 CONTAINSCH So it would fail IANA reserved and then fail china and only list china in the headers warning? X-RBL-Warning: COUNTRIES: Message failed COUNTRIES test (234) shouldn't it go (8,234) ? Craig. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Results with our configuration
Things like hotmail, yahoo and other free email services are not that good at catching virii I have found. Also on the Island we have one other main competitor and a few smaller ones, none of which have virus scanning or can't get it implemented correctly. People switch ISPs looking for better service and since we have better email service they tend to keep their email accounts. Virus programs and their updates AND upgrades are ignored and seen as unimportant. Craig. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Markus Gufler Sent: Friday, January 24, 2003 2:09 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Results with our configuration From your website: Total Emails Clean = 3,464,084 Total Emails Infected = 19,565Inbound=9,556 / Outbound=10,009 Not bad, not bad! but 10,000 outgoing viri ??? What are your user's doing? We catch only around 15 viri/day found in 2,500 incoming outgoing messages/day (0,6%) More then 99% of the infected messages are inbound. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Results with our configuration
LOL My log level is MID and I run at 100MB a day. Craig. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of John TolmachoffSent: Thursday, January 23, 2003 6:39 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Results with our configuration Currently, our log level is set to HIGH and run about 4.5 mg on weekdays. Once I have added one more set of files, Kamis, and watch that for about a week, then I may go back down to MID. I will always be at MID or above. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darrell L.Sent: Thursday, January 23, 2003 2:00 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Results with our configuration John, From your post I gathered that your log level is atleast mid. Is this a normal configuration or just a one time deal to look at the mail. Darrell Darrell LaRock Information Systems Analyst Gannett Television 716-849-2272 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John TolmachoffSent: Thursday, January 23, 2003 1:22 PMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Results with our configuration I wanted to post yesterdays results of Declude Junkmail: We hold on a weight of 20 and delete at 40. Messages held are reviewed using Spam Review software. There were no False Positives in the messages deleted. This was reviewed by manually going through the Declude Junkmail log for all messages deleted and looking at the subject line and sender and recipient. 3485 messages were processed by Declude Junkmail. 889 were deleted. 85 were held. Of the held, 16 were False Positives. Total found and deleted: 958 (27.49%) Individual tests like SPAMCHECK and NOXMAIL generate a number of false positives, but that is what the while filters and MATCH program is for. However, those tests are also responsible for the majority of the messages deleted. Tests used: (numbers after action is weight we use) ORDB WARN 2 OSDUL WARN 2 OSFORM WARN 2 OSLIST WARN 2 OSPROXY WARN 2 OSRELAY WARN 2 OSSMART WARN 2 OSSOFT WARN 2 OSSRC WARN 10 SPAMCOP WARN 12 DSN WARN 10 NOABUSE WARN 3 NOPOSTMASTER WARN 3 BADHEADERS WARN 5 BASE64 WARN 12 HELOBOGUS WARN 3 IPNOTINMX LOG 0 -3 MAILFROM WARN 15 PERCENT WARN 15 REVDNS WARN 2 ROUTING WARN 10 SPAMHEADERS WARN 5 ADULT1 WARN 50 JUNK WARN 30 SPAMCHECK WARN Weight NOXSPAM1 WARN 20 NOXSPAM2 WARN 15 NOXSPAM3 WARN 15 NOXADULT1 WARN 20 NOXADULT2 WARN 15 NOXADULT3 WARN 15 REVIEWER1 ROUTETO [EMAIL PROTECTED] WHITEFILTER1 WARN WHITEFILTER2 WARN WHITEFILTER3 WARN WHITEFILTER4 WARN GRAYFILTER1 WARN GRAYFILTER2 WARN GRAYFILTER3 WARN GRAYFILTER4 WARN MATCH WARN -40 Kami, I have not yet had time to try your lists. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com
RE: [Declude.JunkMail] Results with our configuration
It's only cause we see 100,000 emails a day. About 80% fail Spamcop alone I think. It takes 7-8 hours to run one log file so I don't do it often. ~12,000 email addresses in a single domain. I can't review email otherwise I would be reviewing +15000 messages a day even after deletes. Read receipts are a bane as far as I am concerned. My setup is really bland but I think one day when I get a little time I will try Sniffer. We are an ISP so NoXmail would seriously inconvenience the guys who sign up for XXX mail. Craig. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Markus Gufler Sent: Friday, January 24, 2003 8:54 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Results with our configuration A very interesting argument. Can you provide us some config-settings and effectivity stats about your system? We all want to have such a large large logfile. ;-) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Craig Gittens Sent: Friday, January 24, 2003 1:19 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Results with our configuration LOL My log level is MID and I run at 100MB a day. Craig. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] An optional web interface for Declude JunkMail?
I don't mean to cross you and it is a question out of it's time seeing as you haven't made any decisions yet but what about functionality and extensibility of your proprietary platform? Are we in for another IWEBMSG and are you going to hire a whole new team to support coding features/upgrades for this? I see this as being your expense where you would have almost none using existing free technologies such as IIS. Remember that you are dealing with Win32 admins here and yes you can't please all the people all the time but you can sure come close by injecting your new project into our Win32 subset of experience. What you could do is just forward to the list the new found bugs and patches for IIS from Microsoft and other 3rd party security companies for those who don't keep up-to-date. *guilty* Craig. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Tuesday, December 17, 2002 11:47 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] An optional web interface for Declude JunkMail? I agree that the flat files work well for Junkmail itself. However, a web GUI will be very hard to do without the 'masters' kept in a database. Without a database you'll run into file locking problems and it will be harder to deal with single records. That's why we try stay away from the bleeding edge technology -- there's a reason they use the word bleeding. It will actually be easier for us to use a flat file than to use a database. use IIS (a lot of people don't want to use it, for security reasons). This is pretty much a moot point as both IIS and Apache have the same security risks. IIS just gets more press. G We won't use Apache either. or any special technologies (such as dot NET, ASP, CF, etc.). We would need to create something that would work on all servers, and not have any special requirements. That's going to be hard. Not for us. G You really only have two choices that could cover most of the bases. ASP or PHP both are available in the Win and Unix worlds. Win32 admins will prefer ASP. Sorry, I should have included PHP in that list (which is amazingly flexible, BTW). We're not talking about something the typical pre-bubble We need to show them something to collect our $10 million funding company would produce. We actually wrote a web scripting language well before ASP was available, and wrote our first web server back when people thought that dynamic content on a web page was a web page that was updated by hand every few hours. If we require ASP or PHP, we're going to require something that a number of our customers either don't have or won't have. Many of our customers would not even think of installing IIS or Apache on a mailserver. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx
I don't know what to say I'm sorry? I was just curious. I wasn't ridiculing you or your list. Craig. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Tom Sent: Thursday, November 14, 2002 9:08 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx Importance: High Well I just wanted to see what the reason was. I assumed since all the entries have a catalogue number that the reason was recorded. In addition I do believe outpost does have removal instructions at the bottom of the emails. Our List: Our list is a private list, however, we do share it with the Declude community. Image`fx is not in the business to stop spam, we are a local ISP/Developer not SpamCop. We don't have the time and/or resources to become one. The idea behind the list was suppose to be for all of us to share or contribute to. Not many people have contributed to our list, but that's ok, we don't need the extra work. We have also indicated to those who use the list to use it at their own risk and to consider using it with a weight value. IDs: The ID's were added to work with our program ReadID to help identify the address inside Declude's log file without using a separate database. The ID's contain a date and unique number as a description. This description only works with Declude's fromfile not Imail's kill list. This unique ID will indicate to ReadID the last time of usage so it can clean out addresses that spammers no longer use after X number of days. Removal: While this may be true for most services I don't feel that we should have to do this, we did not sign up for it, so why the heck should we sign out from it. Why would I or you want to tell them that we actually exist? Why should I have to tell them I don't want their stupid little news letters or pornographic garbage? I did not ask for it in the first place, not only that, it's MY server that they are using to advertise from. Well, guess what, they can kiss my royal spam a$$. They did not pay for my system. I did, my blood, my sweat, my hard earned money. What right do they have? A loop whole the law? Either way I don't care. ok I will calm down now The problem with those so called removal options is that you never know what their intentions actually are. I did try this method and guess what, I got even MORE SPAM. So a word to the wise, don't believe everything you see. It's just as bad a an ANTI SPAM company sending us spam to stop their spam, what the heck do they think they sent us in the first place? Best Regard, Tom Image`fx Productions, Inc. Provider of ExecNet Internet Services --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx
Well I just wanted to see what the reason was. I assumed since all the entries have a catalogue number that the reason was recorded. In addition I do believe outpost does have removal instructions at the bottom of the emails. Craig. REMOVE- If you do not wish to receive future emails at [EMAIL PROTECTED], click this link to send a remove request email. Please be aware the removal process may take 2-3 days to complete. (c)2002 Fry's Ou tp ost, Inc. All rights reserved. Fry's Ou tpo st.co m is a trademark of Fry's O utp os t, Inc. All trademarks depicted are the property of their respective holders or owners. Fry's O ut pos t.co m disclaims liability for editorial, pictorial, or typographical errors in this email. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Tom Sent: Wednesday, November 13, 2002 5:04 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx Any particular reason you are blocking o u t p o s t.com? Although I am blocking it, does not mean you have to. I don't remember every reason for each site added to the list, however, more than likely they were sending us junk mail without permission. If you feel that for some reason I am wrong for placing them into the list then I would like to here it. I am only human and un-like a computer I do make mistakes and unlike a computer I try to rectify them. Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Folder question
Scott, Is declude supposed to use c:\imail\declude\domain.com\$default$.junkmail in preference to c:\imail\declude\$default$.junkmail ? I have a situation where it did but I was confused since I thought it did it the other way around. Craig. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Lets go at this again.....
I have since added this line to my global.cfg: VirusHoax BOUNCE It still doesn't work either for outgoing or incoming messages containing the line in the text file. What am I doing wrong? Craig. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Craig Gittens Sent: Friday, October 25, 2002 3:33 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Declude log test analyzer I need a little help: Does JM scan your own domain outgoing mail? I would like to stop the jdbgmgr.exe hoax emails. i thought this would work but it doesn't. I set this up: Global.cfg: VirusHoax filter c:\Imail\Declude\virhoax.txtx 0 0 $default$.junkmail: VirusHoax BOUNCE virhoax.txt: BODY 0 In the files/folders option, write the name jdbgmgr.exe VirusHoaxbounce.eml: From: postmaster@%LOCALHOST% To: %MAILFROM% Subject: Virus Hoax Delivery Failed: %ALLRECIPS% This is an email that contains a Virus Hoax. It was not delivered. Please see: http://www.symantec.com/avcenter/venc/data/jdbgmgr.exe.file.hoax.html Sunbeach Postmaster. Original message follows: %FULLMSG% --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude log test analyzer
I need a little help: Does JM scan your own domain outgoing mail? I would like to stop the jdbgmgr.exe hoax emails. i thought this would work but it doesn't. I set this up: Global.cfg: VirusHoax filter c:\Imail\Declude\virhoax.txtx 0 0 $default$.junkmail: VirusHoax BOUNCE virhoax.txt: BODY 0 In the files/folders option, write the name jdbgmgr.exe VirusHoaxbounce.eml: From: postmaster@%LOCALHOST% To: %MAILFROM% Subject: Virus Hoax Delivery Failed: %ALLRECIPS% This is an email that contains a Virus Hoax. It was not delivered. Please see: http://www.symantec.com/avcenter/venc/data/jdbgmgr.exe.file.hoax.html Sunbeach Postmaster. Original message follows: %FULLMSG% --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] HELOBOGUS
Should this not have triggered HELOBOGUS as it normally does? Craig. Received: from name2.sunbeach.net [205.214.199.131] by sunbeach.net with ESMTP (SMTPD32-6.06) id A2C44EDE0148; Sat, 14 Sep 2002 23:47:16 -0400 Received: from host242-39.pool80205.interbusiness.it (host242-39.pool80205.interbusiness.it [80.205.39.242]) by name2.sunbeach.net (8.9.3/8.9.3) with SMTP id XAA05539 for [EMAIL PROTECTED]; Sat, 14 Sep 2002 23:47:45 -0400 From: [EMAIL PROTECTED] X-Authentication-Warning: name2.sunbeach.net: host242-39.pool80205.interbusiness.it [80.205.39.242] didn't use HELO protocol To: [EMAIL PROTECTED] Received: from sunbeach.net by 0721BV7Y63.sunbeach.net with SMTP for [EMAIL PROTECTED]; Sat, 14 Sep 2002 23:52:09 +0500 Message-Id: [EMAIL PROTECTED] Date: Sat, 14 Sep 2002 23:52:09 +0500 Subject: This will be the best email you ever read Reply-To: [EMAIL PROTECTED] X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Sender: [EMAIL PROTECTED] Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?80.205.39.242 X-RBL-Warning: HEUR10: Heuristic spam detection level 10 [1.00] X-RBL-Warning: WEIGHT10: Weight of 11 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [80.205.39.242] X-Declude-Spoolname: D02c4148.SMD X-Spam-Tests-Failed: SPAMCOP, HEUR10, WEIGHT10 X-Note: Total spam weight of this E-mail is 11. X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 318915912 Status: U --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] HELOBOGUS
I spoke in haste, that all makes sense. I am having a tough time with spammers using the mailfrom or return address of the recipient and a wetware problem on the customer end. Is there any way I can stop this? I know, it seems like a catch 22. Craig. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Tuesday, September 17, 2002 8:39 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] HELOBOGUS Should this not have triggered HELOBOGUS as it normally does? Received: from name2.sunbeach.net [205.214.199.131] by sunbeach.net with ESMTP (SMTPD32-6.06) id A2C44EDE0148; Sat, 14 Sep 2002 23:47:16 -0400 name2.sunbeach.net does have an A record, so it should not trigger the HELOBOGUS test. Received: from host242-39.pool80205.interbusiness.it (host242-39.pool80205.interbusiness.it [80.205.39.242]) by name2.sunbeach.net (8.9.3/8.9.3) with SMTP id XAA05539 for [EMAIL PROTECTED]; Sat, 14 Sep 2002 23:47:45 -0400 and host242-39.pool80205.interbusiness.it has an A record, as well. X-Spam-Tests-Failed: SPAMCOP, HEUR10, WEIGHT10 So it looks like the test did work properly. The hostname doesn't need to have an MX record, just an A record is fine. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Fighting the Menace of Unwanted E-Mail
Sorry, just getting around to reading my 700 or so unread messages. Anyone notice Hotmail put in a few new options a while ago and enabled them for everyone? Click on the options link and choose Personal Profile and scoll to the bottom. You will notice that the two options to 1) Share my email address and 2) Share my other registration information are checked. Craig. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Tom Sent: Monday, September 16, 2002 5:21 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Fighting the Menace of Unwanted E-Mail By OREN ETZIONI of the NY TIMES --- A few days ago I created a new e-mail account, and within 24 hours I had received over 25 unsolicited commercial e-mail messages, otherwise known as spam. Even though I'm a professor of computer science, I, like so many others, have failed to protect myself from this daily nuisance. So I welcome t --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT Cold Fusion log parser
Anyone ever wrote a cold fusion log parser for dec.log files? I am thinking of one that will easily search for entries like WEIGHTXX test and return all the info for the particular Q###(or more in Imail7) file. Craig. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] Help!?
Can someone help me with this please? 205.214.199.131 is a sendmail machine I have rigged to help out Imail with deliveries so it has a secondary MX. People send mail to xxx from xxx which is obviously forged and the only proof is the X-auth warning from my secondary MX. Can anyone see any way of stopping this? I thought of using a filter but the filters afaik does not do HEADERS. Craig. From: [EMAIL PROTECTED] X-Authentication-Warning: name2.sunbeach.net: [203.193.56.230] didn't use HELO protocol Importance: Normal Reply-To: [EMAIL PROTECTED] To: [EMAIL PROTECTED] X-Sender: [EMAIL PROTECTED] Date: Thu, 11 Jul 2002 16:13:58 -0500 Subject: Beasty Babes!! X-Encoding: MIME X-Declude-Sender: [EMAIL PROTECTED] [205.214.199.131] X-Declude-Spoolname: De62c102.SMD X-Spam-Tests-Failed: None X-Note: Total spam weight of this E-mail is 0. X-RCPT-TO: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] test failure, sort of
Do you have qves.com whitelisted? Just checking. I notice that whitelisted domains who fail individual tests are still noted as having a wieght but no failed tests, however it shouldn't trigger WEIGHT15, just the variable %Weight% isn't cleared. Craig. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Friday, May 31, 2002 11:03 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] test failure, sort of The actual hostname of this domain is vwebs.com. I have 9 other custom files that seem to be working as advertised (my personal is much more strict than the others, and changes the subject even more with test failure listings and so forth...). So I think I am in the correct domain folder. How about the length of the email address? This is the only three letter one. The length of the address shouldn't matter. To use the debug mode, you can change the LOGLEVEL LOW line in \IMail\Declude\global.cfg to LOGLEVEL DEBUG. Then, send an E-mail through to [EMAIL PROTECTED], and then switch back to LOGLEVEL LOW (the debug mode adds huge amounts of information to the log file). You can then E-mail me the \IMail\Declude\dec.log file (as an attachment), and I can take a look at it to see what is happening. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] DNS server
Is there a setting in the global.cfg to add a DNS server? Would it use this server instead of the Imail settings? Craig --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Declude scans all emails
Huh? He advocated virus run first. Craig. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Bill Landry Sent: Friday, May 24, 2002 7:45 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Declude scans all emails I rest my case, thanks for supporting my requested feature. Bill -Original Message- From: John Tolmachoff [mailto:[EMAIL PROTECTED]] Sent: Friday, May 24, 2002 2:34 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Declude scans all emails What about this scenerio: A huge company that you receive hundreds of e-mails a day from but with a mail admin not on the ball suddenly finds itself listed in spam bases that cause the e-mails sent to you to be stopped by JunkMail. At the same time, a virus starts spreading by way of that company. You look at the directory and say, well, these are all legitimate. Now you dump 300 mails into the vir directory and suddenly, your server is swamped. I see no reason not to have Declude Virus first. John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Bill Landry Sent: Friday, May 24, 2002 12:26 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Declude scans all emails Well, I guess it's nice to know that it will at least have a place in the unlikely section of the database. It would seem to me that any large IMail installation that is using Declude would want this because of the potential huge CPU savings of not having to virus scan all junk mail, and also being protect from placing legitimate, but possibly virus laden, messages back into the queue for delivery. So, I guess I a just bit confused as to why you would consider it to be an unlikely feature add? Bill -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Friday, May 24, 2002 12:16 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Declude scans all emails I would prefer to JunkMail filter before virus scanning, so would you consider setting up a special queue directory that we could move legitimate e-mail messages that were held as spam so that Declude could periodically parse the directory and virus scan any messages in there, and if clean move them to the IMail spool directory. It's unlikely that this will get added, but it has been added to the suggestion database. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This e-mail was scanned for viruses by Pointshare's Virus Scanning Service] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This e-mail was scanned for viruses by Pointshare's Virus Scanning Service] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Declude scans all emails
Okay. What you should do now is get a Layer 4 switch that supports unique sessions and have it NAT for the 2 or more Imail servers with one target public IP on the outside. The switch should also have features to detect failed services and switch load balancing off for that one server. Then you can have Legato in an active/active if it's possible. Craig. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Bill Landry Sent: Friday, May 24, 2002 11:10 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Declude scans all emails John, I'm sorry if I came off sounding insulting, I know you're just trying to help. A little about our environment might be helpful. We currently have two RedHat 7.2/Postfix 1.1.10 gateway servers running in our DMZ and they are running equal MX records for load-sharing. They provide first-level spam filtering and virus scanning with RAV antivirus. Our IMail servers are dual proc systems with lots of memory and they run in an active/passive Legato cluster, with the backend mail storage on a storage area network that is dual-fiber connected to the front-end processors. All of the user account information is stored in a SQL database that is setup in another Legato active/passive cluster with the databases store on the SAN. Declude and F-Prot are installed on the IMail virtual drive on the SAN, where they provide the second level spam filtering and virus scanning. The IMail servers forward all outbound e-mail to the gateway servers for final delivery. All of this is to say that we are geared up to handle a lot of e-mail. We try to be as efficient and effective as possible, and optimize wherever we can, thus the desire to keep virus scanning on the IMail server to the absolute minimum necessary. Anyway, we love the Declude JunkMail/Virus package and will work with what we have. Regards, Bill -Original Message- From: John Tolmachoff [mailto:[EMAIL PROTECTED]] Sent: Friday, May 24, 2002 5:50 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Declude scans all emails Well, this is a discussion forum. Very true, I deal with small potatoes compared to most of you out there. Maybe, if I am fortunate, I can work for a larger company in the future. Would help my pocket book too. But I am at where I am at at least for now. ANYWAYS, I am going to think about this and try to understand it from your prospective. One thought I do have in regards to your post after this one, is that what you listed is maybe too much to ask of one server. Just a thought now. I know Len talks about Imgate and it sounds good. I don't know, if I was looking at the volume like you say, I might want to split the load. If there was a gateway of first server receiving all the mail, it could then scan for junkmail and virus, then forward to the main server. Like I said, just random thoughts out of my head. I have only be at this for about a year, so I am trying to learn. John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Bill Landry Sent: Friday, May 24, 2002 5:21 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Declude scans all emails Yep, and I think you are totally off the mark. Virus scanning huge numbers of e-mail messages is very CPU intensive and is wasted by scanning e-mail messages you do not intend to deliver, anyway, because the are spam. I an IMail server running Declude JunkMail and Virus were receiving 500,000 e-mail messages per day, and 25% of those were spam, you wasted massive amounts of CPU cycles virus scanning 125,000 message you have no intention of delivering in the first place. Thus, it is much more efficient and logical to spam filter first and only virus scan those messages you actually intend to deliver. Remember, spam filtering is much less resource intensive then virus scanning is, so do it first and only virus scan what's left. So in this scenario, if 500 of the 125,000 messages you held for meeting spam rules was legit, if there wan a holding directory that I could move these messages into for Declude to pick up and virus scan, and if clean, then have Declude move them into the IMail spool directory. Anyway, this is a non-issue right now since Scott has said that this will not be a feature that will be added anytime soon, so for now we will just have to be careful about what held messages we manually move back into the spool directory for delivery. One option for us will be to move them into a holding directory and then manually virus scan that directory with F-Prot before moving them into the spool directory for delivery - F-Prot seems to have no problem scanning IMail's D files. Bill -Original Message- From: John Tolmachoff [mailto:[EMAIL PROTECTED]] Sent: Friday, May 24, 2002 4:58 PM To: [EMAIL PROTECTED] Subject: RE:
RE: [Declude.JunkMail] whitelisting
I have a question: Would this work to document stuff? WHITELIST FROM @datek.com #revdns,badheaders Craig --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] whitelisting
As per user config goes: I have the default.junkmail file in \imail\declude and a couple of users own in \imail\declude\domain.com Is this correct or do I have to put a default.junkmail file in the \domain.com directory as well or instead? Craig. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: Re[2]: [Declude.JunkMail] Declude v1.35 released
I am now catching up on list mail - Saturday at work.I just had to reply to his one: ROFL ROFL :) Craig. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of John Shacklett Sent: Wednesday, January 30, 2002 1:43 PM To: [EMAIL PROTECTED] Subject: RE: Re[2]: [Declude.JunkMail] Declude v1.35 released I put this in global.cfg: XINHEADER X-Note: Tests failed: %testsfailed% and I get lines like these in my awesome new Spam Review Message Header box: X-Note: Tests failed: SPAMCOP2, BADHEADERS, SPAMHEADERS, WEIGHT10, WEIGHT18, WEIGHT182 I'm having trouble getting any work done, what with trying to see the screen through copious tears of absolute joy. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] DUL questions
I have been reading the JunkMail Manual and I have a couple of questions. We are an ISP and have numerous DULs. How would JunkMail handle that? If the IP was in the DUL DB would Imail Declude not relay for my own IP's? If so, I assume I would have to WHITELIST them, correct? Now, as for travelling persons using SMTP Auth..would the same thing happen? Craig. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
