[Declude.JunkMail] Per-Domain Virus.CFG?
Hello, Was wondering if there was a way to have a per-domain virus.cfg. The reason I ask is that I have BANEXT lnk in the virus.cfg (which I recently added). Today a client responded saying he distributes McAfee Enterprise anti-virus updates via email using a shortcut (*.lnk) as the attachment. The link points to a file on our their network server. Is it possible to have only his domain allow this extension so he can distribute the file or the only way to change this is to make it globally allowable. Thanks.. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Per-Domain Virus.CFG?
Good point.. Thanks.. I'll forward that inform onto him.. Well, you can never tell with some of these people.. He probably uses Internet Explorer to first find the location of the file and then send it as a link.. Probably one of those types that knows enough about computers that could cause damage, but not know how to fix that damage.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Thursday, April 29, 2004 10:31 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Per-Domain Virus.CFG? Let me get this straight. You have a client that is distributing security updates in a non-security minded way, correct? Tell him to wise up and put the link in the body, not as an attachment. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Jeff Maze - Hostmaster Sent: Thursday, April 29, 2004 7:02 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Per-Domain Virus.CFG? Hello, Was wondering if there was a way to have a per-domain virus.cfg. The reason I ask is that I have BANEXT lnk in the virus.cfg (which I recently added). Today a client responded saying he distributes McAfee Enterprise anti-virus updates via email using a shortcut (*.lnk) as the attachment. The link points to a file on our their network server. Is it possible to have only his domain allow this extension so he can distribute the file or the only way to change this is to make it globally allowable. Thanks.. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelist.txt file
Hello, Can IP addresses in conjunction with e-mail addresses (or domain names) be added to a Whitelists.txt file within a per-domain configuration? Thanks.. -Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelist.txt file
Ok thanks.. And to just re-verify something, if the whitelist.txt file is in the domain folder (per-domain config), the GLOBAL.CFG is skipped and the whitelist.txt file is used instead for whitelisting e-mail addresses. Or are they used in conjunction with each other? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, April 28, 2004 12:20 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Whitelist.txt file Can IP addresses in conjunction with e-mail addresses (or domain names) be added to a Whitelists.txt file within a per-domain configuration? No, currently the whitelistfiles can only use domains or E-mail addresses. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelist.txt file
Ooops.. Sorry about that.. I meant to say $default$.junkmail file.. Just trying to get a domain configured correct in a per-domain config with the whitelist.txt file (having problems and hearing about it from the client). So, if there is a whiltelistip entry in the $default$.junkmail file and the message originates from that IP, it's whitelisted (as it normally and should do). And if an e-mail comes from [EMAIL PROTECTED], that e-mail is first checked for the WHITELIST FROM in the GLOBAL.CFG file, if it's not there then it's checked again the WHITELIST.TXT file within the per-domain configuration. Is this correct? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, April 28, 2004 1:59 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist.txt file And to just re-verify something, if the whitelist.txt file is in the domain folder (per-domain config), the GLOBAL.CFG is skipped and the whitelist.txt file is used instead for whitelisting e-mail addresses. Or are they used in conjunction with each other? That's handled the same regardless of whether whitelistfiles are used or not. If there is per-user config file, it will be used. Otherwise, if a per-domain config file, that will be used. If neither are present, the \IMail\Declude\$default$.JunkMail file will be used if the E-mail is incoming, or the \IMail\Declude\global.cfg file will be used if the E-mail is outgoing. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPAMDOMAINS Failure
Hello, Had a client forward me an e-mail that failed the SPAMDOMAIN test (along with a couple others). Below are the internet headers of the SPAMDOMAINs failure (I can post the full inet headers if desired): X-RBL-Warning: SPAMDOMAINS: Spamdomain 'att.net' found: Address of [EMAIL PROTECTED] sent from invalid emhmta02.cdpd.airdata.com. X-Declude-Sender: [EMAIL PROTECTED] [199.88.234.47] I have an entry of: att.net in our spamdomains.txt file. Now to add this entry to the spamdomains.txt file, I would make the following entry, correct? att.net .airdata.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] WHITELISTFILE for per-domain
Hello, Just a quick question about this option. In the domain that has a separate configuration file, I would edit the $default$.junkmail file and add the following line, correct? WHITELISTFILE c:\imail\declude\domain.com\whitelist.txt And then put in the e-mail addresses or domains I wish to have whitelisted for that domain in the whitelist.txt file. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WHITELISTFILE for per-domain
Thanks.. That works.. One quick question.. If that entry is in for the per-domain $default$.junkmail file, I assume it will not use the main $default$.junkmail file within the main declude sub-folder for whitelists, correct? Or do they work in tandum. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, April 23, 2004 3:30 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] WHITELISTFILE for per-domain Just a quick question about this option. In the domain that has a separate configuration file, I would edit the $default$.junkmail file and add the following line, correct? WHITELISTFILE c:\imail\declude\domain.com\whitelist.txt And then put in the e-mail addresses or domains I wish to have whitelisted for that domain in the whitelist.txt file. Correct. :) -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] This too got through.. No spamdomains?
Hello, I got this message in one of my main accounts. It first came through our sec mail server, but then nothing appears to have been flagged by Declude. Weird thing is, I'm running SPAMDOMAINS. So shouldn't this message have failed at least SPAMDOMAINS? I have IPBYPASS 67.17.218.70 within the GLOBAL.CFG file and running Declude v.1.79. SPAMDOMAIN.TXT Entries: comcast.net msn.com hotmail.com Internet Headers: Received: from secmail.crescentdigital.com [67.17.218.70] by mail.crescentdigital.com with ESMTP (SMTPD32-6.06) id A9E6D4010A; Wed, 21 Apr 2004 19:55:18 -0400 Received: from c-67-169-68-81.client.comcast.net (c-67-169-68-81.client.comcast.net [67.169.68.81]) by secmail.crescentdigital.com (8.12.8/8.12.8) with SMTP id i3LNvYoi026730; Wed, 21 Apr 2004 19:57:37 -0400 Received: from 133.226.240.152 by 67.169.68.81; Thu, 22 Apr 2004 02:46:47 +0200 Message-ID: [EMAIL PROTECTED] From: Rose Acevedo [EMAIL PROTECTED] Reply-To: Rose Acevedo [EMAIL PROTECTED] To: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: Re: Cc:Lôw Côst Term Life ins. - Free Quôtes Date: Wed, 21 Apr 2004 20:45:47 -0400 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=--25203145111901053 X-Originating-IP: 67.17.218.70 X-Declude-Sender: [EMAIL PROTECTED] [67.169.68.81] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: None [0] X-Note: This E-mail was sent from (timeout) ([67.169.68.81]). X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 382031063 Status: U --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] This too got through.. No spamdomains?
Ok.. Thanks.. I'll have to look into this more.. Sorry to be a pain, but most of the messages that got through (14 of them between 12am and 5am) last night were caused by this problem. Thanks again.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, April 22, 2004 8:27 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] This too got through.. No spamdomains? Hmmm.. Ok.. And this timeout is because of our DNS servers, correct? The timeout could be caused by a number of factors -- it could be your DNS server, theirs, or it is possible that the DNS packet was dropped somewhere along the way. But, didn't it already do a lookup in order to get this line: Received: from c-67-169-68-81.client.comcast.net (c-67-169-68-81.client.comcast.net [67.169.68.81]) No. That line was added by the mailserver that handled the E-mail before IMail. Either it was able to get the reverse DNS entry (if it is a legitimate mailserver), or it didn't try (if that is a forged header, or it was sent via spamware). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Comcast.net Spam
Hello, Yeah, I too have notice A LOT of spam originating from ComCast networks lately. You could implement SPAMDOMAINS that would check the from and where the message came from to add weight to the message. Seems to work well when you don't get DNS timeouts (which I have been having problems with lately). -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Paul Fuhrmeister Sent: Thursday, April 22, 2004 10:12 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Comcast.net Spam An email is from [EMAIL PROTECTED] [24.5.121.88] AND was received from cib.co.za (c-24-5-121-88.client.comcast.net [24.5.121.88] Is there a way to add weight when - received from client.comcast.net BUT sender is not @comcast.net Here are example headers: Received: from cib.co.za (c-24-5-121-88.client.comcast.net [24.5.121.88]) by mail17.**.com (Postfix) with SMTP id 858D630F4B; Wed, 21 Apr 2004 21:25:31 -0500 (CDT) (envelope-from [EMAIL PROTECTED]) Message-ID: [EMAIL PROTECTED] From: Tim Salazar [EMAIL PROTECTED] To: [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: Pain Pills V.icodin Hy.drocodone Lortab Lorcet Norco Date: Thu, 22 Apr 2004 01:00:15 + MIME-Version: 1.0 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 8bit X-RBL-Warning: DSBL: http://dsbl.org/listing?ip=24.5.121.88; X-RBL-Warning: BLOCKTEXT: Message failed BLOCKTEXT test (line 394, weight 7) X-Declude-Sender: [EMAIL PROTECTED] [24.5.121.88] X-Declude-Spoolname: D2d2c2f4000be40bf.SMD X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 1049636097 Paul Fuhrmeister [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] CMDSPACE Test
Hello, I was wondering what exactly the CMDSPACE test is. I wasn't able to find anything about it in the Junkmail manual.. Thanks.. -Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] US Treasury cannot do it right?
Yeah, I got sick of modifying my setups for others mistakes.. I've just ended up forwarding them the message with the internet headers telling them what the problem is, how to fix it, and that messages from them will be blocked/reviewed until the problems are fixed.. Haven't gotten any respsonses though.. Goes with the normal IT mentality.. It's not our problem, its yours.. Your setup is wrong.. Ours is perfect.. UGH! I hate hearing that.. Right there I know they don't even want to look at their logs, etc to try and resolve the problem.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, April 20, 2004 11:30 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] US Treasury cannot do it right? My personal oppioion is that ISP's, government agencies, Technology companies should be held to a higher standard than the average business. If they are not following standards then they should be held for review. They can be comprimized by zombies just like everyone else. After reviwing the held messages then notify the admin of the problem. I think part of the problem with false positives are the people finding the misconfigurations are modifying their rule sets to accomidate the failure of other mail admins to configure their systems correctly. When they should be notifying them of their problems so they can fix them. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic Sent: Tuesday, April 20, 2004 8:11 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] US Treasury cannot do it right? OK if I am right the US Treasury Department needs help! They identified themselves as 10.0.7.238 instead of a host.domain !!?? This is very bad. There is a REVDNS for the sending IP 66.77.65.238 PTR record: lists.qai.irs.gov What am I asking here? Perhaps it is just amazement that the e-mail got out like this. I suppose there is nothing that we can do from this end except build enough room in our tests to prevent legit stuff from getting caught. The more I look into this SPAM stuff the scarier it gets. - Received: from 10.0.7.238 [66.77.65.238] by tlsonline.com (SMTPD32-8.10 ) id A63E11DB00DA; Tue, 20 Apr 2004 12:56:30 -0400 Date: Tue, 20 Apr 2004 12:55:42 -0400 (EDT) Message-Id: [EMAIL PROTECTED] ts.treas.g ov From: US Treasury Release: News [EMAIL PROTECTED] To: US Treasury Release: News [EMAIL PROTECTED] Subject: [US Treasury] Treasury and IRS Address Foreign Tax Credit, Partnership Transactions List-Unsubscribe: mailto:[EMAIL PROTECTED] List-Subscribe: mailto:[EMAIL PROTECTED] Reply-To: US Treasury Release: News [EMAIL PROTECTED] X-Message-Id: [EMAIL PROTECTED] Sender: [EMAIL PROTECTED] X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: HELOBOGUS: Domain 10.0.7.238 has no MX or A records [0301]. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-Declude-Sender: [EMAIL PROTECTED] [66.77.65.238] X-Declude-Spoolname: D563e11db00dae005.SMD X-Note: This E-mail was sent from lists.qai.irs.gov ([66.77.65.238]). X-Spam-Tests-Failed: NOABUSE, HELOBOGUS, IPNOTINMX, NOLEGITCONTENT, HELOISIP, HELOISIPX [7] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Note: Total spam weight of this E-mail is 7. X-Country-Chain: Organization: The LAN Shoppe Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] This got through.. -Question-
Just a question.. The message below (internet headers listed only) got through and only failed on the CMDSPACE test.. But one of the X-Notes states the there was a timeout looking up the IP address (it's 24-51-32-177.kntnny.adelphia.net).. Anyway, I was wondering if there was a test could be added that would add a low-weight (say 2 or 3) for timeouts during DNS lookups? Only bad thing, if your DNS server fails, so will a majority of your messages.. Any thoughts? __ Received: from emailaddresses.com [24.51.32.177] by mail.crescentdigital.com (SMTPD32-6.06) id ABBD117012A; Wed, 21 Apr 2004 01:50:53 -0400 Message-ID: [EMAIL PROTECTED] From: Cheapest Only Shop [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Your Doctor say no? We will say yes! 82928 Date: Wed, 21 Apr 2004 00:50:40 -0500 Mime-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_600_2990_759E2990.759E2990 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1158 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command . X-Declude-Sender: [EMAIL PROTECTED] [24.51.32.177] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: CMDSPACE [8] X-Note: This E-mail was sent from (timeout) ([24.51.32.177]). X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 382030971 Status: U --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamdomains.txt file
Thanks.. I've received a couple so far, so if you don't wish to send it, it's ok.. But I do have another question for the list.. Pretty much the entries for Global.CFG and the junkmail config for the spamdomains tests.. Which weight seems to work best, etc. This weekend, I've seen A LOT of spam that wasn't caught that would if SPAMDOMAINS was being run (messages from Argentina but listing Yahoo as the e-mail account).. Thanks... -Jeff -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Sent: Monday, April 19, 2004 2:19 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Spamdomains.txt file Jeff, I see no one has answered you on this. Spamdomains is a very useful test and I think you will like the results. We get an average of 14% weekdays and 26% on weekends of our email fail Spamdomains and there are not a lot of FPs. I will send you a spamdomains file tomorrow. Todd Hunter Smart Mail - Original Message - From: Jeff Maze - Hostmaster [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, April 16, 2004 11:15 AM Subject: RE: [Declude.JunkMail] Spamdomains.txt file Anyone? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze - Hostmaster Sent: Friday, April 16, 2004 8:26 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spamdomains.txt file Hello, I think I'm going to implement the spam domains tests. Anyone have a file they would like to share that works well for them? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Global.CFG file for separate domains
Hello, I was wondering if it's possible with the standard version to create a Global.cfg file or that type of file (whitelist and other configs) for separate domains (like the $default$.junkmail file).. Thanks.. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamdomains.txt file
I'd post the one I received off list, but am not sure if the original person who sent it to me would like if I did.. I'll contact them and see if it would be ok.. Just don't want to make anyone angry.. I'm sure they won't care, but it would stink to post it and then have them come back bitchin' that I did.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, April 19, 2004 10:09 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamdomains.txt file Me three. ;) John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Rick Hogue Sent: Monday, April 19, 2004 6:56 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamdomains.txt file Me too. Rick Hogue www.intent.net Web Hosting 1-800-866-2983 www.prosperity.com Featured web site -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Doug McKee Sent: Monday, April 19, 2004 8:55 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamdomains.txt file Me too, Thanks, Doug -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Goran Jovanovic Sent: Monday, April 19, 2004 7:38 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamdomains.txt file Todd, Would you mind sending me a copy of the spamdomain.txt file as well? I would like to see what you have as a starting point. Thanx Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Todd Sent: Monday, April 19, 2004 2:19 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Spamdomains.txt file Jeff, I see no one has answered you on this. Spamdomains is a very useful test and I think you will like the results. We get an average of 14% weekdays and 26% on weekends of our email fail Spamdomains and there are not a lot of FPs. I will send you a spamdomains file tomorrow. Todd Hunter Smart Mail - Original Message - From: Jeff Maze - Hostmaster [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, April 16, 2004 11:15 AM Subject: RE: [Declude.JunkMail] Spamdomains.txt file Anyone? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze - Hostmaster Sent: Friday, April 16, 2004 8:26 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spamdomains.txt file Hello, I think I'm going to implement the spam domains tests. Anyone have a file they would like to share that works well for them? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [South Texas Internet scanned this E-mail for viruses using Declude Virus] --- [South Texas Internet scanned this E-mail for viruses using Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
RE: [Declude.JunkMail] Spamdomains.txt file
Here's the spamdomains.txt file I received off-list (for our setup, I left out the outblaze domains).. Don't forget to add the needed entries to the Global.cfg file and the $default$.junkmail files (see below).. Global.cfg _ SPAMDOMAINS spamdomains C:\IMail\Declude\spamdomains.txtx 15 0 $default$.junkmail _ SPAMDOMAINS WARN spamdomains.txt _ @paypal.com .paypal. citibank.com.ssmb.com fleet.com .bkb.com wellsfargo.com .norwest.com .ebay.com .emailebay.com @ebay.com .ebay.com amazon.com att.net attbi.com bellatlantic.netverizon.net bellsouth.net charter.net china.com comcast.net compuserve.com concentric..cnchost.com cox.net earthlink. excite.com excitenetwork.com gte.net verizon.net hotmail.com msn.com juno.com untd.com @lycos.co.uklycos. @lycos.com mac.com apple.com mailcity.comlycos.com mindspring. earthlink. msn.com hotmail.com netscape.netaol.com netzero.com untd.com prodigy.net qwest.net .rr.com sympatico.cabellnexxia.net usa.net mx.net wanadoo.fr yahoo. rocketmail.com yahoo.com zzn.com mailcentro.com shaw.ca shawcable.net icq.com google.com @2die4.com outblaze.com @accountant.com outblaze.com @adexec.com outblaze.com @africamail.com outblaze.com @allergist.com outblaze.com @alumnidirector.com outblaze.com @archaeologist.com outblaze.com @arcticmail.com outblaze.com @artlover.com outblaze.com @asia.com outblaze.com @australiamail.com outblaze.com @berlin.com outblaze.com @bikerider.com outblaze.com @catlover.com outblaze.com @cheerful.com outblaze.com @chemist.comoutblaze.com @clerk.com outblaze.com @cliffhanger.comoutblaze.com @columnist.com outblaze.com @comic.com outblaze.com @consultant.com outblaze.com @counsellor.com outblaze.com @cutey.com outblaze.com @deliveryman.comoutblaze.com @diplomats.com outblaze.com @doctor.com outblaze.com @doglover.com outblaze.com @dr.com outblaze.com @dublin.com outblaze.com @earthling.net outblaze.com @email.com outblaze.com @engineer.com outblaze.com @europe.com outblaze.com @execs.com outblaze.com @financier.com outblaze.com @gardener.com outblaze.com @geologist.com outblaze.com @graphic-designer.com outblaze.com @hairdresser.netoutblaze.com @hot-shot.com outblaze.com @iname.com outblaze.com @inorbit.comoutblaze.com @insurer.comoutblaze.com @japan.com outblaze.com @journalist.com outblaze.com @lawyer.com outblaze.com @legislator.com outblaze.com @lobbyist.com outblaze.com @london.com outblaze.com @loveable.com outblaze.com @mad.scientist.com outblaze.com @madrid.com outblaze.com @mail.com outblaze.com @mindless.com outblaze.com @minister.com outblaze.com @moscowmail.com outblaze.com @munich.com outblaze.com @musician.org outblaze.com @myself.com outblaze.com @nycmail.comoutblaze.com @optician.com outblaze.com @paris.com outblaze.com @pediatrician.com outblaze.com @playful.comoutblaze.com @poetic.com outblaze.com @popstar.comoutblaze.com @post.com outblaze.com @presidency.com outblaze.com @priest.com outblaze.com @programmer.net outblaze.com @publicist.com outblaze.com @realtyagent.comoutblaze.com @registerednurses.com outblaze.com @repairman.com outblaze.com @representative.com outblaze.com @rescueteam.com outblaze.com @rome.com outblaze.com @saintly.comoutblaze.com @samerica.com outblaze.com @sanfranmail.comoutblaze.com @scientist.com outblaze.com @seductive.com outblaze.com @singapore.com outblaze.com @sociologist.comoutblaze.com @soon.com outblaze.com @teacher.comoutblaze.com @techie.com outblaze.com @tokyo.com outblaze.com @umpire.com outblaze.com @usa.comoutblaze.com @whoever.comoutblaze.com @winning.comoutblaze.com @witty.com outblaze.com @writeme.comoutblaze.com @yours.com outblaze.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPAMDOMAINS - Netscape.com
Hello, I got a message that was from [EMAIL PROTECTED] but came from RoadRunners networks. There isn't a netscape entry in my SPAMDOMAINS.TXT file. I was just wondering what I would enter to make it so. I did a NSLOOKUP on netscape.com and the MX record points to mail.nescape.everyone.net. So the entry I would enter would be: netscape.comnetscape.everyone.net Is this correct? Just want to make sure if there are more later. I want to understand this so I don't keep asking. Thanks.. -Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPAMDOMAINS - Netscape.com
Ok.. Makes sense.. Thanks.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Monday, April 19, 2004 2:29 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] SPAMDOMAINS - Netscape.com Jeff, the main problem with figuring out spamdomains entries is that you really have to receive valid mail from the domain to really know. If they have an SPF record, that's the easiest way to research them, but you can also try the website at http://www.SenderBase.org to see what they've noticed. They've noticed one more host: dust.netscape.com The problem with checking the MX record is that it is only for recording inbound mail to Netscape.com, it doesn't necessarily say anything about outbound mail from them, which is what you're after. I suspect that your suggestion will work fine, as I think that they keep their corporate domain for netscape.com separate from the customer business as netscape.net ... Andrew 8) -Original Message- From: Jeff Maze - Hostmaster [mailto:[EMAIL PROTECTED] Sent: Monday, April 19, 2004 11:07 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SPAMDOMAINS - Netscape.com Hello, I got a message that was from [EMAIL PROTECTED] but came from RoadRunners networks. There isn't a netscape entry in my SPAMDOMAINS.TXT file. I was just wondering what I would enter to make it so. I did a NSLOOKUP on netscape.com and the MX record points to mail.nescape.everyone.net. So the entry I would enter would be: netscape.comnetscape.everyone.net Is this correct? Just want to make sure if there are more later. I want to understand this so I don't keep asking. Thanks.. -Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spamdomains.txt file
Hello, I think I'm going to implement the spam domains tests. Anyone have a file they would like to share that works well for them? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamdomains.txt file
Anyone? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze - Hostmaster Sent: Friday, April 16, 2004 8:26 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spamdomains.txt file Hello, I think I'm going to implement the spam domains tests. Anyone have a file they would like to share that works well for them? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Ipfile.txt
One other thing.. If there are changes made to the ipfile.txt file, does the SMTP server need to be restarted for Declude to see and use these changes? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, April 15, 2004 1:22 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Ipfile.txt In the global.cfg file I would enter the following entry: IPTEST ipfile C:\IMail\Declude\ipfile.txt x 10 0 And then in the $default$.junkmail file, I would enter the following entry: IPTEST ROUTETO [EMAIL PROTECTED] (or whatever I want) This appear as being correct, right? That looks good to me. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] all_list.date
Hello, Was just wondering what this file was? I missed a few days and didn't see anything in the archives.. Thanks.. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Updating Global.CFG
Hello, I'm also updating my Global.CFG file and noticed something new. What is WHITELIST AUTH? I checked the online manual, but there's nothing listed for it. There's an entry for WHITELIST HABEAS, but not AUTH. Thanks.. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Ipfile.txt
Hello, I accidentally overwrote my ipfile.txt test when I upgraded my Declude config files (global.cfg $default$.junkmail). Just wanted to make sure I get this right (would like to add this as well even though the latest-greatest global.cfg file is catching A LOT of spam). In the global.cfg file I would enter the following entry: IPTEST ipfile C:\IMail\Declude\ipfile.txt x 10 0 And then in the $default$.junkmail file, I would enter the following entry: IPTEST ROUTETO [EMAIL PROTECTED] (or whatever I want) This appear as being correct, right? Thanks.. -Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Updating Global.CFG
We're running iMail v6.06 and I've been running the SMTP AUTH for about 2 years (only way to remove our server from open-relay lists; started the job to find this out).. This is a very nice feature since I've had a number of people saying messages they they've sent from home being seen as SPAM and not being delivered.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mike Hyslip Sent: Thursday, April 15, 2004 4:25 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Updating Global.CFG There's a checkbox under the properties of the SMTP service, something about disabling the AUTH function. This was on 7.x I am pretty sure, probably supported for quite some time. The introduction into declude I believe has been much more recent. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick Sent: Thursday, April 15, 2004 4:18 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Updating Global.CFG Doesn't that only work with Imail 8.x and not the earlier versions. I got the impression somewhere, sometime. Chuck Schick Warp 8, Inc. 303-421-5140 www.warp8.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Mike Hyslip Sent: Thursday, April 15, 2004 8:22 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Updating Global.CFG It is for user SMTP authentication. To bypass relay settings and show you're really a user of the server when sending an email (so you can relay while off the local network) - since you're an authenticated user, you can choose to whitelist any emails from that particular session. Mike -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze - Hostmaster Sent: Thursday, April 15, 2004 10:15 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Updating Global.CFG Hello, I'm also updating my Global.CFG file and noticed something new. What is WHITELIST AUTH? I checked the online manual, but there's nothing listed for it. There's an entry for WHITELIST HABEAS, but not AUTH. Thanks.. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Test
Haven't received messages from here nor Declude.Virus since Friday.. Just doing a test.. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Subject Line FIlter
And this only works in the Pro version, correct? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, March 24, 2004 2:26 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Subject Line FIlter Scott... Am I correct that case is also a factor?? No. Such as CONTAINSHello World will not catch hello world CONTAINSHello World *will* catch hello world. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How do they do it?
One problem we've recently had is that a mail server we were trying to send messages to would die intermittently.. Came to discover there were filters on their router that when a certain incident happened, it blocked everything from that computer IP for 4 hours.. Maybe this is something you'd like to look into.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Friday, February 06, 2004 7:10 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] How do they do it? I have no practical solution but you would need something that parses your SMTP logfile in realtime (like unixtool's tail or the new baretail) and track occurences of invalid user messages. If there are more then X connection attempts from one single IP in Y minutes causing an invalid user log entry this IP (or at least port 25 from this IP) should be blocked immediatly for Z minutes. Blocking the IP in Imail is problematic because you have to restart the service every time the IP-list is updated. I don't know if some SW firewalls like BlackIce or ZoneAlarm allow external updates for IP-filter tables. Maybe there is also some HW appliance that can do this. Filtering by IP in declude junkmail is too late because this will not block the connection attempts. Are you sure this joe jobs are the real reason why the amount of spam seems to increase after you transfer the domain to your own server? What registrar do you use? There was an intersting argument on this list some days ago about certain registrars that seems to be here specially for spammers. Or are you inserting your clients email adress in the whois information after during transfer? Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joe Wolf Sent: Saturday, February 07, 2004 12:39 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] How do they do it? I called the Black Ice tech support people today and discussed this issue. They told me that Black Ice will not stop a dictionary attack that is in progress, but it would shut the spammer down for a second attempt. He also had major concerns about backup mail spoolers. He said that you have to whitelist your backup spoolers and that will still allow the spammer to run their dictionary attacks. He didn't think Black Ice was a good product for such use. He seemed like he knew what he was talking about. -Joe - Original Message - From: Jeff Kratka [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, February 06, 2004 5:17 PM Subject: RE: [Declude.JunkMail] How do they do it? Are there others suggestion for firewall software for the server. Does Zonealarm have a server version and if so does it work as well as Black Ice. Jeff Kratka * TymeWyse Internet P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] * --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] [OT] A lot of messages from in queue
Hello, Anyone know what lately (the last week or so) we've been getting a lot of message building up in queue with as the from address (according to the queue) and a to address listed as domains and other listings different that what we host. Any clues or iMail configuration (6.06) changes that I can change so it automatically dumps these messages and not hold them in queue. Thanks.. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelisted
Hello, One of our clients has been forwarding e-mails that have made it through the cracks and found something interesting. I have our network whitelisted, and have the secdns entry so that it checks the ip of the originating server when it comes through the sec mail server. But today, I noticed something (I don't have the original message or headers; but printed out the message). The IP of our secondary mail server is 67.17.218.70. I received a message that had its IP put in as the hostname. So Declude saw this IP and whitelisted. I'll type a couple lines of the headers: Received: from secmail.crescentdigital.com [67.17.218.70] by mail.crescentdigital.com with ESMTP (SMTPD32-6.06) id ADFD3B007E; Fri, 14 Nov 2003 08:51:57 -0500 Received: from 67.17.218.70 ([211.219.196.240]) by secmail.crescentdigital.com (8.12.8/8.12.5) with SMTP id hAEEpdwo012904; Fri, 14 Nov 2003 09:51:41 -0500 Received: from [135.4.188.96] by 67.17.218.70 SMTP id 1fYH8RwA83HJQ7; Wed, 19 Nov 2003 19:45:46 -0700 X-Mailer: AOL 7.0 for Windows US sub 118 X-Spam-Tests-Failed: Whitelisted I have Declude Standard (one of the latest version, but not the latest). Is there anyway to fix this? The 211.219 IP is a Korean IP and the 135.4 is Lucent (?). Thanks.. Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spammer wanting servers?
Yeah, really.. 2,000 IP's, dedicated network for one $2,000 a month.. Uh, yeah right.. And the providers profit on that? hahahaha -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jonathan Sent: Wednesday, November 12, 2003 6:36 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spammer wanting servers? He wants 2,000 IPs? Sure, no problem .. in fact, I'll give him a whole class B. 10.123.x.x :) Jonathan At 05:22 PM 11/12/2003, you wrote: Hi Scott- Where on the tools page is this nifty test located? :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, November 12, 2003 2:47 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spammer wanting servers? offer me such service please call me at: 1617-901-4129, Leave me a message Number is a Sprint PCS cell phone in Boston. ... or an ATT wireless phone in Boston, per http://www.dnsstuff.com/tools/dophone.ch?name=1617-901-4129 . -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Outbound failing IPNOTINMX
Hello, I have a client that is concerned because every message he sends out, Deculde states that it's failing the IPNOTINMX test. He's used dnsreport on his domain and replied to me with this line: Messages I send out are failing IPNOTINMX spam test. This is report from DNSreport.com you can run again since this seems to have formatting that email doesn't like. I found this on Declude's web site. I don't understand exactly what he means or what he wants me to do with this, but is there something I can tell him to try and have him not worry about it? The IPNOTINMX test is still set to the default weight, so none of his messages should be bounced, etc. Is this test failing because he is sending the messages from home and Declude is running the tests on this IP address? Just was wondering.. Thanks.. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] [OT] WEIRD Problem!
Hello, I've recently discovered something interesting happening with my laptop. Just a little FYI about it. I have all spam messages that fail the Declude Tests forwarded to a [EMAIL PROTECTED] account, which I download and review on my computer. I have NIS 2004 running on my laptop as well. I'm also running NIS Anti-virus 2004 and it's updated with Virus defs dated 10/15/2003 and a full system scan was just completed (attempted liveupdate this morning, but it's just sitting there). Anyway, the other day I received 3 Undeliverable Mail messages in this spam account and upon reviewing the message, saw that it was coming from the WAN IP address of my laptop (cable providers IP address when at home (2), and the firewall WAN IP when at work (1)). So I setup NIS to inform me whenever Outlook 2002 tried to send out messages; NIS is also configured to only allow Outlook to connect to our mail server to send and receive messages. Well, it happened again this morning; I knew because NIS popped up a window stating such. I've included the Undeliverable Mail message as well as the iMail log entry. I attempted to lookup the D*.SMD and Q*.SMD (to see what the message contained), but iMail has already deleted them and even though I have Outlook setup to store all sent messages in the sent items folder, there is nothing there as well. I got the alert while receiving messages from the spam account. Anyone every hear of anything like this before? Thank you for your time and attention.. -Jeff undeliverable to [EMAIL PROTECTED] Original message follows. Received: from %computername% [67.17.218.x] by crescentdigital.com with ESMTP (SMTPD32-6.06) id A30560E0134; Tue, 21 Oct 2003 08:13:57 -0400 From: DO NOT REPLY TO THIS ACCOUNT - Please reply to original sender [EMAIL PROTECTED] To: 'Catalina' [EMAIL PROTECTED] Date: Tue, 21 Oct 2003 08:13:40 -0400 Message-ID: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: application/ms-tnef; name=winmail.dat Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename=winmail.dat X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.4510 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-MS-TNEF-Correlator: A762BD7065A7A046BC679108E78E7F89447F2800 Subject: Not read: This is not loan j X-Declude-Sender: [EMAIL PROTECTED] [67.17.218.x] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. eJ8+Ii4MAQaQCAAEAAABAAEAAQeQBgAI5AQAAADoAAEIgAcAFwAAAFJFUE9S eJ8+VC5J UE0uTm90ZS5JUE5OUk4AtwYBDYAEAAICAAIAAQqAAQAhQTA2MEZEM0Q4MzEwQUI0MjhB MjYwNDEyREVBMkYwNjQAEQcBA5AGAIQDAAAaCwAjAAALACkAAEAAMgDgQjiyzJfD AR4ASQABJgAAAFtOb3J0b24gQW50aVNwYW1dIFRoaXMgaXMgbm90IGxvYW4gIGoCAUwA AQAAADUAgSsfpL6jEBmdbgDdAQ9UAgAAAQBBbGx5c3NhAFNNVFAAY3B5dXNAeWFob28u Y29tAEAATgAAvK6jApjDAUAAVQCAuMGTv5fDAR4AcAABJgAAAFtOb3J0b24gQW50aVNw YW1dIFRoaXMgaXMgbm90IGxvYW4gIGoCAXEAAQAAABYBw5fMsjhj1+r3oAhAD5a+slvd v2KaAAAeAHIAAQEAHgBzAAEBAB4AdAABDgAAAFN1YnNjcmli ZXIgMzcLAAgMAAIBHQwBHgAAAFNNVFA6U1BBTUBDUkVTQ0VOVERJR0lUQUwuQ09N CwABDgEDABQOAB4AKA4BOwAAADAwMDAwMDA1AXNwYW1AY3Jlc2NlbnRkaWdp dGFsLmNvbQFzcGFtQGNyZXNjZW50ZGlnaXRhbC5jb20AAB4AKQ4BOwAAADAwMDAwMDA1AXNw YW1AY3Jlc2NlbnRkaWdpdGFsLmNvbQFzcGFtQGNyZXNjZW50ZGlnaXRhbC5jb20AAB4AARAB GQAAAE1lc3NhZ2Ugd2FzIG5vdCByZWFkIGJ5OgACAfgPAQAAABCnYr1wZaegRrxnkQjn jn+JAgH6DwEQp2K9cGWnoEa8Z5EI545/iQIB+w8BkgA4obsQBeUQ jn+GqG7 [message truncated] iMail Log Entry: 10:21 08:13 SMTPD(060E0134) [67.17.218.5] connect 67.17.218.x port 1371 10:21 08:13 SMTPD(060E0134) [67.17.218.x] EHLO %computername% 10:21 08:13 SMTPD(03E0) Authenticated [EMAIL PROTECTED], session treated as local. 10:21 08:13 SMTPD(060E0134) [67.17.218.x] MAIL FROM: [EMAIL PROTECTED] 10:21 08:13 SMTPD(060E0134) [67.17.218.x] RCPT TO: [EMAIL PROTECTED] 10:21 08:13 SMTPD(060E0134) [67.17.218.x] MAIL FROM: [EMAIL PROTECTED] 10:21 08:13 SMTPD(060E0134) [67.17.218.x] RCPT TO: [EMAIL PROTECTED] 10:21 08:13 SMTPD(060E0134) [67.17.218.x] C:\IMAIL\spool\D2305134.SMD 2267 10:21 08:13 SMTP-(0878) processing C:\IMAIL\spool\Q2305134.SMD 10:21 08:13 SMTP-(0878) Trying yahoo.com (0) 10:21 08:13 SMTP-(0878) Connect yahoo.com [64.157.4.78:25] (1) 10:21 08:13 SMTP-(0878) 220 YSmtp mta109.mail.sc5.yahoo.com ESMTP service ready 10:21 08:13 SMTP-(0878) EHLO crescentdigital.com 10:21 08:13 SMTP-(0878) 250-mta109.mail.sc5.yahoo.com 10:21 08:13 SMTP-(0878) 250-8BITMIME 10:21 08:13 SMTP-(0878) 250-SIZE 10485760 10:21 08:13 SMTP-(0878) 250 PIPELINING 10:21 08:13 SMTP-(0878) MAIL FROM:[EMAIL PROTECTED] 10:21 08:13 SMTP-(0878) 250 sender [EMAIL PROTECTED] ok 10:21 08:13 SMTP-(0878) RCPT To:[EMAIL PROTECTED] 10:21 08:13 SMTP-(0878) 250 recipient [EMAIL
RE: [Declude.JunkMail] [OT] WEIRD Problem!
I have outlook setup so that any messages received from the separate e-mail accounts (6 work e-mail accounts I look into), get automatically moved to folders other than my Inbox. So the host master account gets forwarded to the host master folder, spam to the spam folder, etc. Also, I have two rules setup so that if certain people e-mail me, their messages are moved to a separate folder as well. There aren't any rules that are setup to automatically forward messages. Yes, Norton Anti-Spam is installed (came with NIS 2004; installs automatically) and running on the system. Should I turn this off and see if the problem disappears? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Tuesday, October 21, 2003 10:08 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] [OT] WEIRD Problem! Anyone every hear of anything like this before? Do you have any rules in Outlook to try to bounce E-mails? Are you running any anti-spam software on the laptop? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [OT] WEIRD Problem!
Thanks for the suggestions all.. I had already changed the password when the first time it happened.. But I've since turned off the Norton Anti-Spam and will see if anything else happens.. Thanks again.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Stanley Lyzak Sent: Tuesday, October 21, 2003 10:23 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] [OT] WEIRD Problem! One other thing you can try (I actually think Scott is on the right track if your laptop firewall is showing outbound Outlook access). Try not to save your email password in your outlook. Have it prompt you. Much easier to stop these things when they cannot authenticate. Stan Lyzak, BSEE, CISSP, MCSE², CCNA, Security+, A+ Network Security Engineer ASysTech, Inc. -Original Message- From: Jeff Maze - Hostmaster [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 21, 2003 9:44 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] [OT] WEIRD Problem! Hello, I've recently discovered something interesting happening with my laptop. Just a little FYI about it. I have all spam messages that fail the Declude Tests forwarded to a [EMAIL PROTECTED] account, which I download and review on my computer. I have NIS 2004 running on my laptop as well. I'm also running NIS Anti-virus 2004 and it's updated with Virus defs dated 10/15/2003 and a full system scan was just completed (attempted liveupdate this morning, but it's just sitting there). Anyway, the other day I received 3 Undeliverable Mail messages in this spam account and upon reviewing the message, saw that it was coming from the WAN IP address of my laptop (cable providers IP address when at home (2), and the firewall WAN IP when at work (1)). So I setup NIS to inform me whenever Outlook 2002 tried to send out messages; NIS is also configured to only allow Outlook to connect to our mail server to send and receive messages. Well, it happened again this morning; I knew because NIS popped up a window stating such. I've included the Undeliverable Mail message as well as the iMail log entry. I attempted to lookup the D*.SMD and Q*.SMD (to see what the message contained), but iMail has already deleted them and even though I have Outlook setup to store all sent messages in the sent items folder, there is nothing there as well. I got the alert while receiving messages from the spam account. Anyone every hear of anything like this before? Thank you for your time and attention.. -Jeff undeliverable to [EMAIL PROTECTED] Original message follows. Received: from %computername% [67.17.218.x] by crescentdigital.com with ESMTP (SMTPD32-6.06) id A30560E0134; Tue, 21 Oct 2003 08:13:57 -0400 From: DO NOT REPLY TO THIS ACCOUNT - Please reply to original sender [EMAIL PROTECTED] To: 'Catalina' [EMAIL PROTECTED] Date: Tue, 21 Oct 2003 08:13:40 -0400 Message-ID: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: application/ms-tnef; name=winmail.dat Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename=winmail.dat X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.4510 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-MS-TNEF-Correlator: A762BD7065A7A046BC679108E78E7F89447F2800 Subject: Not read: This is not loan j X-Declude-Sender: [EMAIL PROTECTED] [67.17.218.x] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. eJ8+Ii4MAQaQCAAEAAABAAEAAQeQBgAI5AQAAADoAAEIgAcAFwAAAFJFUE9S eJ8+VC5J UE0uTm90ZS5JUE5OUk4AtwYBDYAEAAICAAIAAQqAAQAhQTA2MEZEM0Q4MzEwQUI0MjhB MjYwNDEyREVBMkYwNjQAEQcBA5AGAIQDAAAaCwAjAAALACkAAEAAMgDgQjiyzJfD AR4ASQABJgAAAFtOb3J0b24gQW50aVNwYW1dIFRoaXMgaXMgbm90IGxvYW4gIGoCAUwA AQAAADUAgSsfpL6jEBmdbgDdAQ9UAgAAAQBBbGx5c3NhAFNNVFAAY3B5dXNAeWFob28u Y29tAEAATgAAvK6jApjDAUAAVQCAuMGTv5fDAR4AcAABJgAAAFtOb3J0b24gQW50aVNw YW1dIFRoaXMgaXMgbm90IGxvYW4gIGoCAXEAAQAAABYBw5fMsjhj1+r3oAhAD5a+slvd v2KaAAAeAHIAAQEAHgBzAAEBAB4AdAABDgAAAFN1YnNjcmli ZXIgMzcLAAgMAAIBHQwBHgAAAFNNVFA6U1BBTUBDUkVTQ0VOVERJR0lUQUwuQ09N CwABDgEDABQOAB4AKA4BOwAAADAwMDAwMDA1AXNwYW1AY3Jlc2NlbnRkaWdp dGFsLmNvbQFzcGFtQGNyZXNjZW50ZGlnaXRhbC5jb20AAB4AKQ4BOwAAADAwMDAwMDA1AXNw YW1AY3Jlc2NlbnRkaWdpdGFsLmNvbQFzcGFtQGNyZXNjZW50ZGlnaXRhbC5jb20AAB4AARAB GQAAAE1lc3NhZ2Ugd2FzIG5vdCByZWFkIGJ5OgACAfgPAQAAABCnYr1wZaegRrxnkQjn jn+JAgH6DwEQp2K9cGWnoEa8Z5EI545/iQIB+w8BkgA4obsQBeUQ jn+GqG7 [message truncated] iMail Log Entry: 10:21 08:13 SMTPD(060E0134) [67.17.218.5] connect 67.17.218.x port 1371 10:21 08:13 SMTPD(060E0134) [67.17.218.x] EHLO %computername% 10:21 08:13 SMTPD(03E0) Authenticated [EMAIL PROTECTED], session treated as local. 10:21 08:13 SMTPD(060E0134) [67.17.218.x] MAIL FROM: [EMAIL PROTECTED] 10:21 08:13 SMTPD(060E0134) [67.17.218.x] RCPT
RE: [Declude.JunkMail] Imail/Web mail
Where do you get Kill Web Mail? Does it come with iMail 8? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli Sent: Thursday, October 16, 2003 3:01 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Imail/Web mail I use Killer Web Mail but how do you show and sort by TO: Address. - Original Message - From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 16, 2003 3:36 PM Subject: Re: [Declude.JunkMail] Imail/Web mail I do pretty much the same thing, though I use Killer Web Mail for this purpose. I think you are talking about the list of messages, in which case you might have to re-code your Web Mail templates to get that to work. You can though do things like add the weight to the subject and probably even the To address using the SUBJECT functionality in your Default.$Junkmail$ file. I append the weight to the messages with SUBJECT [%WEIGHT%] for a redundant fail weight test, and then sort by subject since I never see FP's above a certain score. This comes in real handy for testing new filters. The only drawback of course is that all BCC data is lost when you block with Declude. Matt Frederick Samarelli wrote: Does anyone know of a way you can display the sender in the Web Mail for IMAIL. I am Routing email to a Web account and would like to display both the TO: and FROM: Thanks. Fred --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- === Matthew S. Bramble President and Technical Coordinator iGaia Incorporated, Operator of NYcars.com --- Office Phone: (518) 862-9042 Cellular: (518) 229-3375 Fax: (518) 862-9044 E-mail: [EMAIL PROTECTED] or [EMAIL PROTECTED] === --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] [OT] Signed Spam..
http://news.com.com/2100-7344_3-5089977.html?tag=nefd_top --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] [OT] iMail 6.06 behind firewall
I know this is off-topic, but I've attempted numerous times to put our server behind a firewall, but upon doing so, the queue grows to an enormous proportion and the only way to clear it is to remove it from behind the firewall. Besides the normal ports 25, 110 and 80 (for web mail), do I also have to keep 1024-65525 open as well for iMail to work properly? Seems stupid to do since normal standardized e-mail should only use the above mentioned three ports (sendmail does). I've contacted Ipswitch about this, and get the same ol' line about upgrading to the latest version and getting full support. But since my boss is cheap and won't upgrade, it makes my life not too pleasant. Thanks for any help you may offer.. -Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Backup MX / Spam
Use the IPBYPASS %sec mx ip% feature within the GLOBAL.CFG file. It will skip the ip address of your secondary mx record and run the check on the ip address of the originating server. IPBYPASSxxx.xxx.xxx.xxx -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert Grosshandler Sent: Thursday, October 02, 2003 11:34 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Backup MX / Spam Hi Some large percentage of the spam we get comes to the backup MX and then is relayed to the primary MX. Using Declude JM Standard, is there some test I can use to add additional weight to any mail routed through my backup MX? Thanks, Rob == Robert N. Grosshandler www.iGive.com Turn shopping into Philanthropy --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How do I get removed
Yeah, I ran the test and we're also on the BLARSBL. Looked up the secondary mail server and that too is on the list. Looks like he just blocked our whole IP range. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, September 10, 2003 10:10 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] How do I get removed How do I get off this spam list. URBL Im not even sure how I got on. http://www.dnsstuff.com/tools/ip4r.ch?ip=64.118.70.2 If you read the description, you'll see why you are appropriately listed. We usually get several E-mails every day from people asking us. :( -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] [OT] - Subject: URGENT URGENT URGENT
Title: Message Anyone else getting messages such as this? I'm getting them delivered into a number or different e-mail accounts. Could this be the next thing thanks to SoBig? -Original Message-From: Aron [mailto:[EMAIL PROTECTED] Sent: Thursday, September 11, 2003 8:45 AMSubject: URGENT URGENT URGENT Importance: High "GOT YOU"If you were dumb enough to open this email then you will find a WORM has executed itself through your mailboxand by the time you read this into your hard-drive. This is PAYBACK for the Virus you disguised in the email you sentto us recently which destroyed our hard-drive and back-up system. This costs us thousands of dollars and we lost a lotof irreplaceable files on our system.Now it's your turn to have your computer infected. This WORM it is undetectable by AntiVirus software and it will drive your computer crazy because it's always hiding and causing havoc in your system. Using your computer recovery disks will not remove the problem cause it still stays on your computers Motherboard. This will proabably cost you a new computer and I sincerely hope this teaches you a lesson not to send peoplenasty viruses again.Evocash Administration Inc.Phone: +1 767 4499922Fax: +1 767 4499922 ^+Start^=Auto^Execute+^WORM^-^+Start^=Auto^Execute+^WORM^-^+Start^=Auto^Execute+^WORM^-^+Start^=Auto^Execute+^WORM^-^+Start^=Auto^Execute+^WORM^-
RE: [Declude.JunkMail] Using Declude to block Sobig Virus
Title: Message The one thing I've been doing since the "invasion" began was use our secondary mail server to block the IP's of infected machines. Most of the infected messages seem to come through this machine first. We're running Sendmail (with webmin interface; a lot easier to admin a linux box)and just editing /etc/mail/access file and adding the ip's seems to have cut back significantly. I've added the ip's of blocked computers just to show how bad it's gotten for us. 68.198.54.158REJECT68.21.239.190REJECT66.121.151.50REJECT12.24.245.12REJECT65.16.62.133REJECT68.21.234.46REJECT24.159.60.200REJECT206.241.2.71REJECT64.147.6.241REJECT67.81.61.57REJECT64.30.194.34REJECT68.36.190.124REJECT68.52.195.199REJECT63.164.145.33REJECT64.238.101.148REJECT68.156.224.121REJECT24.170.148.211REJECT131.123.194.222REJECT65.106.147.178REJECT64.42.16.202REJECT24.211.10.41REJECT200.71.130.17REJECT167.206.206.195REJECT66.127.198.198REJECT162.40.222.119REJECT208.40.28.196REJECT24.208.129.78REJECT207.225.67.82REJECT159.247.3.210REJECT62.203.100.247REJECT67.121.153.139REJECT61.171.135.186REJECT166.102.18.250REJECT208.191.162.43REJECT66.207.240.194REJECT67.22.187.165REJECT66.0.236.20REJECT67.124.159.88REJECT172.195.161.72REJECT218.74.215.84REJECT218.4.189.195REJECT67.123.8.79REJECT24.192.246.239REJECT67.35.8.41REJECT67.124.156.242REJECT218.154.254.90REJECT68.211.150.190REJECT216.78.60.164REJECT24.56.47.175REJECT209.145.206.61REJECT68.154.104.93REJECT24.51.83.89REJECT61.11.73.184REJECT68.158.221.166REJECT209.114.230.52REJECT207.233.213.6REJECT143.111.23.145REJECT68.42.36.205REJECT12.224.192.252REJECT68.211.189.49REJECT192.216.156.19REJECT24.228.47.53REJECT68.36.3.18REJECT209.42.33.176REJECT67.124.41.187REJECT61.77.77.26REJECT62.56.134.108REJECT68.211.254.102REJECT67.34.231.144REJECT68.154.105.182REJECT68.75.177.204REJECT199.8.235.219REJECT64.204.5.34REJECT24.51.80.32REJECT68.74.150.211REJECT218.148.9.3REJECT68.42.56.220REJECT208.61.30.204REJECT12.248.55.60REJECT202.69.84.212REJECT61.171.70.153REJECT24.53.88.127REJECT64.223.33.234REJECT66.68.84.60REJECT67.34.240.3REJECT68.158.34.212REJECT68.158.98.7REJECT162.40.32.115REJECT66.228.145.47REJECT209.90.85.25REJECT213.136.106.126REJECT217.164.73.133REJECT61.189.204.100REJECT200.67.179.81REJECT61.189.203.191REJECT217.164.72.55REJECT61.189.203.246REJECT217.164.72.29REJECT68.211.224.163REJECT200.67.179.50REJECT68.80.143.188REJECT209.142.243.81REJECT204.117.50.140REJECT68.154.64.14REJECT162.83.176.132REJECT65.73.95.99REJECT196.21.128.1REJECT67.80.139.111REJECT68.154.70.39REJECT139.55.233.177REJECT162.40.37.192REJECT62.80.224.31REJECT203.129.202.18REJECT162.40.38.232REJECT162.40.35.90REJECT217.23.38.139REJECT68.211.233.11REJECT67.64.6.246REJECT208.180.60.231REJECT68.159.166.134REJECT67.86.70.25REJECT24.99.10.242REJECT209.53.213.216REJECT138.88.207.116REJECT66.76.141.52REJECT208.57.145.28REJECT66.123.232.6REJECT66.13.214.118REJECT68.43.11.199REJECT207.232.103.155REJECT208.57.105.248REJECT68.153.69.21REJECT66.190.154.21REJECT4.41.189.36REJECT24.218.40.135REJECT216.170.5.59REJECT68.113.10.240REJECT24.199.82.174REJECT68.58.112.228REJECT172.128.42.74REJECT206.230.185.42REJECT65.57.29.48REJECT156.110.31.162REJECT172.175.113.206REJECT24.126.130.151REJECT208.255.242.58REJECT66.76.135.192REJECT65.64.25.225REJECT67.34.236.66REJECT162.40.37.6REJECT
[Declude.JunkMail] [OT] Weird e-mails..
Anyone else seeing e-mails such as these:I've received a number of these and they're being caught by Declude as spam.. They also appear to be coming from more than one place, including rr.com.. __ Subject: How you been? Why hello ;) Whats been happening on your side of the woods? We haven't been doing much at all really! Anyways seeya tommorow. __ Received: from 12-217-117-164.client.mchsi.com [12.217.117.164] Subject: Hello Hey, How have you been? What have you been doing lately? Ive just been at home doing nothing :( bored at uni etc. Anyway's lets catch up soon, Luv, You know who ;) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OSRELAY Replacement..
So what are y'all beginning to use instead of the OSRELAY tests? I was using this and one of the other OS tests. Even though I still had 350 messages in my spam account this morning, I would like another test to replace these. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] FW: Attention mail server administrators
Yeah, I've had a number of people calling saying they can receive messages from our server, but get server time-outs when trying to send messages. Trying to talk to these non-IT type people is a pain. Trying to explain to them that it's not our server, but their internet provider and to call them for a solution (the classic question: But aren't you our internet provider?; Uh, we just host your e-mail and web site; But isn't that the same?). As you stated, most of the time just changing their SMTP server settings to the provider usually fixes the problem. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Thursday, August 28, 2003 10:59 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] FW: Attention mail server administrators My father was just blocked by Cox from reaching my SMTP server the other day. They did it without any warning/notice. Their resolution was to use their own mail server for SMTP, but he could still reach my server by way of POP3. It does introduce another potential point of failure into the mix that then becomes more problematic to troubleshoot for E-mail providers, but it's not terrible to have to do. I did ask the customer service rep at Cox why they blocked everyone instead of just the spammers, and he of course didn't have a good answer. Seems these guys don't want to police their network. Naturally the way around this is to set up SMTP on a port other than 25, however IMail I think only has one setting for the entire server. Matt Markus Gufler wrote: Your opinions? Markus -- From: No-IP Alerts [mailto:[EMAIL PROTECTED] To: xxx Subject: Attention mail server administrators Hello , NOTICE: Mail you send from your dynamic IP may not be reaching your customers. Many ISP's including AOL,Road Runner have started rejecting mail sent from residential dynamic IP address blocks in attempt to reduce the amount of unsolicited email that travels through their networks. No-IP.com has been working around the clock to provide a solution, Alternate-Port SMTP. Altnerate-Port SMTP solves a couple of problems our users encounter when trying to send mail from a residential service such as blocked outbound port 25, AOL and other ISPs rejecting mail based on ip, and inability to send mail from email addresses @yourdomain.com For detailed information about this service please visit: http://www.no-ip.com/svc/mail/smtp Some providers that restrict outbound port 25 include - NetZero - Mindspring - MSN - Earthlink - Flashnet - MediaOne - ATT - Verizon - Bell Canada - Cox Note that Alternate-Port SMTP is for outbound mail only. Should your ISP block inbound port 25 you will need our Mail Reflector service (http://www.no-ip.com/svc/mail/reflector). If you are unsure what service you need or have questions please open a support ticket at http://www.no-ip.com/ticket/ Regards, No-IP.com Alerts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Increased SPAM not being blocked.
Maybe start using the BLACKLIST option. I've been doing that for a little while, and it seems to cut back on a lot of spam. I have them setup with a 20 weight and a ROUTETO my spam account so I can review and see if they're legit or not.. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] A good SD.TXT File?
Anyone have one handy that might assist me? Hahaha Thanks.. Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] IP Blacklists
Add the following line to your global.cfg file: BLACKLISTIP ipfile x:\IMail\Declude\ipfile.txt x 20 (edit the x:\IMail\Declude to the location of your IMail directory location) And then put the attached file into your Declude directory.. I've built this list over the last 8-10 months now. Hope this helps.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rob Salmond Sent: Thursday, July 17, 2003 7:42 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] IP Blacklists The manual is pretty clear about how to setup IP blacklists, but it doesn't specifically say what IP's you are blacklisting. Is this the source IP of the message, or the mailserver it was sent from / mailserver it hopped through? Rob Salmond Ontario Die Company (519)-576-8950 ext. 132 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ipfile.zip Description: Zip compressed data
[Declude.JunkMail] OT: Imail v6 and Windows Update
Hello, Was wondering if anyone knew what the Microsoft update it was that caused the display of the IMail manager to be shifted and un-readable. Dang new people installed it and now I can't edit any of the entries, etc. Thanks.. Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail v6 and Windows Update
Because the new person read there was an security update and ran Windows Update and downloaded and installed everything. I found the link in Ipswich's web site. It has something to do with Q328310 and version 6.06 and 7.07 of Imail. Update iMail to 7.15 and all is well. BUT since we're running version 6, there's no fix from Ipswich besides uninstalling that Microsoft update. Hope all goes well. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jose Gosende Sent: Thursday, July 17, 2003 9:12 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update wow, and I thought it was a terminal services issue. I've had this problem for quite some time and would love to hear a workaround. BTW, how do you know a Windows update caused this problem? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Maze - Hostmaster Sent: Thursday, July 17, 2003 10:05 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: Imail v6 and Windows Update Hello, Was wondering if anyone knew what the Microsoft update it was that caused the display of the IMail manager to be shifted and un-readable. Dang new people installed it and now I can't edit any of the entries, etc. Thanks.. Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail v6 and Windows Update
Thanks for all the replies.. I went to uninstall it and it came up saying that some or all of the following may not work after uninstall and gave a list of five things including the network adapter. Time for a back up and hope for a quick reinstall if it crashes hard. hahaha -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Denny Jodeit Sent: Thursday, July 17, 2003 9:27 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Imail v6 and Windows Update If you remove Critical Update # Q328310, the problem goes away. This does work, I have experienced it. Ipswitch issued a patch for this problem for versions 7.x and above, but stated they will never issue one for Ver. 6. This is per Ipswitch KB article IM-20021218-DM01 HTH, Denny - Original Message - From: Jose Gosende [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:12 AM Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update wow, and I thought it was a terminal services issue. I've had this problem for quite some time and would love to hear a workaround. BTW, how do you know a Windows update caused this problem? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Maze - Hostmaster Sent: Thursday, July 17, 2003 10:05 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: Imail v6 and Windows Update Hello, Was wondering if anyone knew what the Microsoft update it was that caused the display of the IMail manager to be shifted and un-readable. Dang new people installed it and now I can't edit any of the entries, etc. Thanks.. Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail v6 and Windows Update
That's true.. Version 6 works just fine for what we use it for and don't need to spend the $1500 it'll take to upgrade to version 8 (running version 6 unlimited). I guess that's just business though.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jose Gosende Sent: Thursday, July 17, 2003 9:38 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update Yea, and expose my server's security to fix some GUI issue? Sounds like Ipswitch should provide a maintenance release for v6.0 users to eradicate this problem. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Denny Jodeit Sent: Thursday, July 17, 2003 10:27 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Imail v6 and Windows Update If you remove Critical Update # Q328310, the problem goes away. This does work, I have experienced it. Ipswitch issued a patch for this problem for versions 7.x and above, but stated they will never issue one for Ver. 6. This is per Ipswitch KB article IM-20021218-DM01 HTH, Denny - Original Message - From: Jose Gosende [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:12 AM Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update wow, and I thought it was a terminal services issue. I've had this problem for quite some time and would love to hear a workaround. BTW, how do you know a Windows update caused this problem? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Maze - Hostmaster Sent: Thursday, July 17, 2003 10:05 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: Imail v6 and Windows Update Hello, Was wondering if anyone knew what the Microsoft update it was that caused the display of the IMail manager to be shifted and un-readable. Dang new people installed it and now I can't edit any of the entries, etc. Thanks.. Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail v6 and Windows Update
Title: Message Thanks Denny.. Removal went well and everything is back to normal.. Good to know that at least someone had gone through the same thing.. hahaha -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Denny JodeitSent: Thursday, July 17, 2003 10:17 AMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] OT: Imail v6 and Windows Update Yes, the tech installed the whole boat-everything Microsoft had to offer, then I uninstalled Q328310 only and the problem was gone. I had also had the problem in Dec 2002 when Q328310 was first released, so I knew where to look. - Original Message - From: Scott MacLean To: [EMAIL PROTECTED] Sent: Thursday, July 17, 2003 10:56 AM Subject: Re: [Declude.JunkMail] OT: Imail v6 and Windows Update Did you install Q328310, then install SP4, then uninstall Q328310 and it fixed it?At 10:33 AM 7/17/2003, Denny Jodeit wrote: I did not uninstall SP4, just Critical Update Q328310 and it fixed theproblem.- Original Message - From: "R. Scott Perry" [EMAIL PROTECTED]To: [EMAIL PROTECTED]Sent: Thursday, July 17, 2003 10:23 AMSubject: Re: [Declude.JunkMail] OT: Imail v6 and Windows Update Was wondering if anyone knew what the Microsoft update it wasthat caused the display of the IMail manager to be shifted and un-readable. Dang new people installed it and now I can't edit any of the entries, etc. It's probably the Windows 2000 SP4 that was installed. It includes the update that caused the IMail Administrator screen to be shifted. Unfortunately, the only ways to fix it seem to be either to not install SP4, or to upgrade IMail. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus(http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.---[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.___Scott MacLean[EMAIL PROTECTED]ICQ: 9184011http://www.nerosoft.com
[Declude.JunkMail] OT: Hackers try to get points this weekend..
http://www.driverheaven.net/index.php?action=views=6f6fd9a1c35681a95272ecec 6235161darticleid=3793 Copy and paste into web browser to read article.. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Subject Contains test
Hello, I was wondering if there was a subject contains type of test. E.g. A message subject line contains Viagra, kinky, xxx, sex, etc. it will fail the tests. Is there something like this already? Thanks.. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Subject Contains test
Ahh, ok.. Thanks.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Smart Business Lists Sent: Tuesday, July 01, 2003 8:29 AM To: Jeff Maze - Hostmaster Subject: Re: [Declude.JunkMail] Subject Contains test Jeff, Tuesday, July 1, 2003 you wrote: JMH I was wondering if there was a subject contains type of test. JMH E.g. A message subject line contains Viagra, kinky, xxx, sex, etc. JMH it will fail the tests. JMH Is there something like this already? Thanks.. That is filtering and it is available in the pro version. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Unknown Folder
I hope it's because of F-Prot! I noticed these too, but we have maybe 10 or so right now. If anyone knows what they're for or if they can be deleted, I'd be interested.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Saturday, June 28, 2003 3:03 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Unknown Folder In my spool folder this morning are a bunch of .vir folders with 1_1.exe in them. I have not encountered these before. What are they? The \IMail\spool\*.vir directories are temporary directories that Declude Virus uses to scan attachments. It is normal to see those directories come and go; if they remain for more than 2 hours, then there was a problem with the scanning (the log file would have more details). It is safe to delete those directories if they are more than 2 hours old. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Spam Alert: [Declude.JunkMail] For real?
I'm sure there are a couple friends that you could contact on IRC and just see how HACKER-PROOF their system truly are. hahaha -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sean Fahey Sent: Friday, June 06, 2003 9:25 AM To: [EMAIL PROTECTED] Subject: Spam Alert: [Declude.JunkMail] For real? Declude blocked this (thankfully) but because it's so blatant, I went ahead and read it... had to check my blood pressure afterwards. It got me thinking though - would a real spammer send this out or was it the work of a vigilante. The rest of the e-mail posts phone numbers, cell phones, business addresses, web sites a lot of contact info. BEGIN SPAM PITCH Welcome to the 2nd Edition of the Efficient Systems Money Making Newsletter - (And please pass this e-mail along to any interested friends associates who are looking to make THOUSANDS per day doing BULK E-MAIL!) My name is Richard Schuler, I'm a 23 year old Multi-Millionare and I'm inviting you to Learn How to Spam Millions of People Per Day like I do. My Online Pharmacy Business is the single largest E-mail marketing company in the world today. Efficient Systems of Dania, Florida proudly sends OVER 600 MILLION SPAM E-MAILS per day, every single day, through a rapidly growing network of saavy and aggressive worldwide marketing partners and our rapidly growing in-house e-mail marketing team to play an agressive, currently $60 Million dollars per year numbers game. We are directly responsible for up to 70% of the online Viagra and Pharmacy E-Mail SPAM generated sales on the net today and by far the largest E-Mail Marketing operation of this kind in the world, bar none! When it comes to numbers, ours are DEFINATELY the HIGHEST! Why are we so successful?? 1. Because, simply put, NO ONE can bring us down! And 2. Because we KICK ASS with Our HACKER-PROOF and ANTI-SPAMMER-PROOF sales websites and because when you get right down to it, PEOPLE ARE LIKE SHEEP, and if the sheep get enough e-mail shoved at them, the sheep WILL become customers! It's that simple and it's the key to our success and the prosperity of our partners! We've just kicked off a drive to recruit THOUSANDS of new sales partners and affiliates. Some of our largest Spammers are being paid $55,000 per week! Contact us and JOIN US NOW! ...remainder of spam truncated. END SPAM PITCH Ready to Get Started and Start Sending Lots of E-Mail For Us?? Call or E-Mail me NOW! http://wwwmyrxbiz.com/ Sincerely, Richard Schuler E-Mail me by Clicking HERE My Personal Phone numbers are: 1-800-879-6704 954-536-9448 954-650-3364 Get Your Private Website NOW and start getting the E-MAIL out! Contact: Angelo Web Operations Manager Land: 1-800-879-6704 Cell: 954-993-5731 [EMAIL PROTECTED] AIM: ngel http://wwwmyrxbiz.com/ EFFICIENT SYSTEMS 2148 SW 38TH STREET DANIA, FL 33312 1-800-879-6704 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Global.Cfg - IPBYPASS
Hello, I put something on this mailing list earlier about spam messages being forwarded automatically from our secondary mail server because the local subnet is white listed. You said to add the IPBYPASS line with the IP address of the secondary mail server, and Declude would then run the tests on the IP address of the server that sent the message to the secondary mail server. Well, today I received a copy of a spam e-mail from one of our clients. He included the internet headers of the message and it was sent to the primary mail server from the secondary mail server. The person who sent it was on a DSL line from prima.net. The secondary is running Sendmail (with latest patches installed), and it's configured to only allow caching of messages (via the relay-domains file) which we host the clients DNS (secondary MX record) or e-mail accounts (on iMail server). Below is part of the internet header and part of the global.cfg file. Thanks.. Internet Header: Received: from secmail.crescentdigital.com [67.17.218.70] by mail.crescentdigital.com with ESMTP (SMTPD32-6.06) id AE17510152; Mon, 17 Mar 2003 15:20:39 -0500 Received: from dsl-200-42-88-152.prima.net.ar (dsl-200-42-88-152.prima.net.ar [200.42.88.152]) Global.cfg File: #XOUTHEADER Organization: Your Name Here IPBYPASS67.17.218.70 WHITELIST IP67.17.218.0/25 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] ipfiles.txt - Blacklisted IP's
Hello, I created this file and put a new test line in the global.cfg, but have a question. There was a whole class-c bank of porn ad spam mailers that I wish to block. Instead of putting in every IP address, can I just put this entry in the IPFILE.TXT file? xxx.xxx.xxx.xxx/24 Just wanted to make sure this would work. Not quite sure how exactly to test this. Thanks.. Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] High Resource Usage
Wow.. It maybe time to upgrade the server to dual Xeon 3Ghz 533's.. Moving iMail from one machine to another really isn't that hard.. I had to upgrade our server.. The directions Ipswitch provides on their knowledge base is very helpful.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kevin S. Dome Sent: Wednesday, February 19, 2003 4:40 PM To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: [Declude.JunkMail] High Resource Usage I am looking for suggestions to reduce the amount of resources that Imail/Declude use. We are a small ISP and now and then we get hit hard by a spammer mass mailing our users ( which equal ~20,000 ) and we get hit our mail server all but shuts down due to the mass amount of incoming mail and Declude scanning each individual email, etc. Our mail server is a 2u Dell server with 2 pentium 1.13 gHz CPUs and 1 gb of ram. Kevin S. Dome Stic.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
