RE: [Declude.JunkMail] How can I filter this...?
Isn't the mailfrom in this case [EMAIL PROTECTED] and not the vigara part? Chuck is looking for a way to filter based on the name attached to the address and not the specific address proper, isn't that right Chuck? I'm butting in here because I'm trying to capture something similar using the same logic, and using a headers specification in the filter is too broad for what I'm trying to do. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Friday, 08 February 2008 3:56 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] How can I filter this...? How so, can you show the X-Declude-Sender line that it did not work on ? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick Sent: Friday, February 08, 2008 3:50 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] How can I filter this...? David: The first one does not work. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, February 06, 2008 12:25 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] How can I filter this...? Chuck you have several options: MAILFROM5 STARTSWITH Viagra MAILFROM5 CONTAINSViagra MAILFROM5 PCRE (?i:.*viagra.*@) David Barker VP Operations Declude Your Email security is our business 978.499.2933 x 7007 office 978.988.1311 fax [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick Sent: Wednesday, February 06, 2008 2:17 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] How can I filter this...? Spam email is sent and the from line is vigara [EMAIL PROTECTED] Now the declude sender is [EMAIL PROTECTED] but I want to filter the sender name of vigara. Seems like it should be simple but it is eluding me. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Image spam
Where does the .HDB file need to end up? I'm not familiar with that extension. _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, 21 February 2007 1:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Image spam Declude and Image based spam - 4 methods 2. CLAMWIN Using ClamAV as a virus scanner with Declude you can download the MSRBL-Images.hdb file which has additional signatures (MD5 sigs) which contains signatures created from images contained within spam emails. http://www.msrbl.com/site/msrblimagesdownload --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Blank Bkgrd.gif Description: GIF image
RE: [Declude.JunkMail] OT: CBL Blocking
I'm going through the exact same situation with CBL this week. If you go into the Advanced section of the SMTP service properties, there's a box to fill with the text of your HELO response text. The problem I'm having with them is that even though I already only have only one HELO/EHLO hostname, they are detecting whitespace at the end of that string. I think that's the heart and soul of the Imail aspect, and I'm hoping that I can get them to permanently whitelist me. The kicker is that they have me on a 5-day temporary whitelist while they check for a bug on their end. I wonder if they just amped up their probe process and that's why they're tripping over us poor Imail people all of a sudden like. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Craig Edmonds Sent: Friday, 29 September 2006 8:33 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] OT: CBL Blocking Importance: High Sensitivity: Confidential Thanks Darell and Jay, I am in contact with CBL now and they have given me 3 days to sort everything out (how nice of them!!) Jay, how do I set imail so that it will only use one helo/ehlo hostname? Sorry if its an idiot question but I cant find anything on it. Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com E : [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Friday, September 29, 2006 2:38 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] OT: CBL Blocking Sensitivity: Confidential Have you setup iMail so that it will only use one helo/ehlo hostname? -Jay From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Craig Edmonds Sent: Thursday, September 28, 2006 6:54 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] OT: CBL Blocking Importance: High Sensitivity: Confidential Can anyone help me with this CBL blocking problem/imail?. Twice today they have blacklisted me and trust me I have done absolutely everything they have said. I have run all the tools they have suggested, my server is patched, I have 3 firewalls yet still they find reason to blacklist. This is driving me nuts and costing me headaches becasue all my clients emails are bouncing. This of course translates to thousands of dollars in losses everyday I am blacklisted. Yes, I am running Imail. Does anyone have any ideas? Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com E : [EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Crisis after upgrade to 4.3.14 from 4.3.7
Why wouldn't the defaults in the upgrade be to mimic the current behavior? That's potentially a major change from trying to maintain backwards compatibility, isn't it? If the upgrade is adding new switches, then the default switch shouldn'tshouldn't radically alter the status quo. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami RazvanSent: Friday, 29 September 2006 9:32 AMTo: declude.junkmail@declude.comSubject: RE: [Declude.JunkMail] Crisis after upgrade to 4.3.14 from 4.3.7 Harry.. In the upgrade there is a new feature that you can set in the .cfg file. OUTBOUNDSCANNINGSPAMONINBOUNDSCANNINGSPAMON In declude.cfg add the following two lines and change the outbound to on. The default in the example was off and if you are forwarding messages then that can cause the problem. We ran into the same problem and discovered what was going on. Regards, Kami From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Friday, September 29, 2006 9:15 AMTo: declude.junkmail@declude.comSubject: [Declude.JunkMail] Crisis after upgrade to 4.3.14 from 4.3.7 Last night at 8:11PM I upgraded from 4.3.7 to 4.3.14 From that point on we stopped catching all spam for these clients that have their own mail server. We just filter their mail for spam and pass it on. I just reverted back to 4.3.7 and now we are catching spam again for them We catch over 4000 spam messages per dayfor one of these clients alone so you can imagine their complaint this morning. Anyone know what would have caused this? Thank you Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222 ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
[Declude.JunkMail] CBL:CBL
I've discovered that my mailserver has been listed on CBL. I asked to be delisted, and they complied, but I'm right back on *SNAP* just like that. Assuming for the moment that I'm not at risk for the vulnerability covered by MS06-040, and that nothing infected me before I loaded that patch, what else puts us at risk? John. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] CBL:CBL
Well, I looked in our archive but I forgot to look in the Imail list archive. This appears to be exactly what I'm not experiencing. They've been prompt to reply, so at least I'm not sitting dead in certain waters in the meantime. Thanks, Darrell. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, 26 September 2006 12:48 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] CBL:CBL If you run Imail that puts you at risk for being listed on the CBL :) See- http://www.mail-archive.com/imail_forum@list.ipswitch.com/msg106753.html Darrell --- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. John Shacklett writes: I've discovered that my mailserver has been listed on CBL. I asked to be delisted, and they complied, but I'm right back on *SNAP* just like that. Assuming for the moment that I'm not at risk for the vulnerability covered by MS06-040, and that nothing infected me before I loaded that patch, what else puts us at risk? John. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Razor
Thank you, Sandy. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman Sent: Friday, 21 July 2006 2:49 AM To: John Shacklett Subject: Re: [Declude.JunkMail] Razor Do you need SA or something similar to invoke Razor or does it come into play more directly? As I was mentioning in my exchange with Bill, the Razor client portion is distributed as a few Perl apps (separate ones for checking, reporting, whitelisting, etc.) with numerous supporting .pm modules; the heavy-lifting is done in the .pms, which can also be called directly. As a clearly Perl-centric suite, it fits naturally into SpamAssassin, where it is, by far, most often deployed; SA users are assumed to be using Razor, or are told to do so before complaining about their catch rates! Under Unix variants, the apps such as razor-check can also be forked on their own, and wrapper scripts can be written to return results to a variety of calling MTAs. Unfortunately, it is not at all easy to get razor-check to work on Windows Perl interpreters; I think I'm one of the few to have gotten it working at all, but its reliability is still questionable (i.e. it frequently times out, though it does return correct results whenever it connects). I think this has to do with Perl's socket support, which is not equivalent on Windows and *nix (even though a vast number of other Perl areas work just as well on either platform). So the only reliable way that I know of to run Razor on Windows is to use one of the compiled (really, more like assembled) spamassassin.exe binaries that have the socket issues fixed up and Razor support inside. These exes, however, are necessarily bloated with Perl runtimes and the whole SpamAssassin enchilada, which means you are talking _major_ scan times per fork, even with all other SA tests turned off except for the Razor interface. Spamassassin.exe is simply a wrapped-up executable assembly of spamassassin.pl, and will not execute any faster than the .pl (it's just easier to roll out). Spamassassin.pl/.exe is the a standalone version of SA -- where a new spamassassin process is forked for every incoming mail -- which is not the way it should be run, even on Unix, though it appears to be even worse on Windows. Rather, SA should be launched via spamd, the client-server daemon, since that eliminates the huge overhead of Perl startup and module and rulebase loads; spamd is the only way to scale SA (okay, there are also third-party filtering daemons that support SA as well as other scanners, and replicate spamd's preloading functionality, but that's a whole other topic and completely on the *nix side). SPAMC32, a free Declude external test whose URL is in my sig, is a Windows client for spamd that was designed especially for Declude integration. It requires that you have a spamd running somewhere, and if you're going to need Razor support in your spamd, that somewhere is going to have to be a *nix box, as far as I know. OTOH, you could certainly demo Razor's accuracy by forking a bulky spamassassin.exe only against a corpus of false negatives. There are also a couple of (to my mind) dubious, low-adoption open-source SMTP proxies that claim to integrate Razor without SpamAssassin, but those are unproven in my book, and are likely too competitive to be appropriate on this list if they even work... but those might be another way to at least preview accuracy. HTH. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release / Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/downloa d/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/re lease/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Razor
I'd like to break the flow of the current discussion and circle back a number of posts to ask a question. I'm not familiar with either Razor or Cloudmark and Bill's mention of that service caught me unprepared. How does Razor fit into your analysis? Do you need SA or something similar to invoke Razor or does it come into play more directly? -- John --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Side effect of no action taken
I just noticed that when I run domlist.exe against the logfile from the day before yesterday, which was a day of the oft-discussed stock scam spams, it just bombs out. On a day with almost 10,000 emails domlist quit and reported 3 of them. So whatever else is the impact that control character is that's setting things in disarray, it's being logged at log_level mid. -- John Shacklett [EMAIL PROTECTED] [EMAIL PROTECTED] www.continentaloffice.com [This E-mail scanned for viruses by Declude EVA] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] No Tests Run
Actually, Matt, it's worse than that. I have made several observations about issues I'm having with the current release [for example: built-in AVG does NOT work for me, not ever, not even once; newest release version has a virus logging change that broke my daily activity summary report script], and I get "we've relayed your problem to engineering" as a response and that's the end of it. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Monday, 05 June 2006 5:47 PMTo: declude.junkmail@declude.comSubject: Re: [Declude.JunkMail] No Tests Run John,I guess my point is more about how to use a list for support. I'm sure that Declude wouldn't want to deal with dozens of people separately when they can deal with them (and learn from them) all at once.They reverted to responding to such things posted on the list in private in many cases for some reason that totally escapes me. Not only that, but not all support requests are answered, or answered in a timely manner. Things would work much better if they were open and responsive to this list. They might not prefer this, but I'm virtually certain that I speak for almost everyone here.MattJohn Shacklett wrote: Matt, I did get a reply from Gerry earlier and I resubmitted my earlier support email to him, and he indicated they would escalate things, but that's it. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of MattSent: Monday, 05 June 2006 4:29 PMTo: declude.junkmail@declude.comSubject: Re: [Declude.JunkMail] No Tests RunGlenn,I understand that logs might be difficult for you to post, but I would like to suggest that everyone experiencing such issues should attempt to share log entries if at all feasible. That would go a long way, especially when there could be multiple issues occurring that people are speaking about in one thread.So far it looks like every message was sent from a null sender that was reported to the list.Could people also confirm if they have settings for weight-based tests configured with actions in their Global.cfg? Something like: WEIGHT10 SUBJECT [SPAM] WEIGHT20 HOLD WEIGHT30 DELETENeedless to say, when a half dozen people post about issues like this, it would be nice to get some list feedback from Declude within 8 hours. There's no sense in keeping this all a secret. Since I haven't heard anything back about this stuff, I have to now go on a goose chase in my system trying to figure out if there is an issue without even knowing exactly what it is. That wastes a lot of time when multiplied by the dozens of people that might react the same way on this list to such reports.Thanks,MattGlenn \ WCNet wrote: I've had a swarm of stock-quote spam in the last few days. Declude 1.81, Imail 7.15. Appears from the headers there are no Declude tests running at all on these msgs, but there are Declude headers added. Majority are null senders. Various IPs. Some have my addy referenced as an X-RCPT, some do not. Majority also have an SMTP-FWD header. Those that are to legitimate recipients on my host, none of them (that I've checked thus far) have a fowarding addyset. Some but not all are being sentusing The Bat! client. My Declude logs runup to 800MB per day, difficult to search them for details. Received: from SMTP32-FWD by wcnet.net (SMTP32) id A0E38; Mon, 5 Jun 2006 00:48:32 -0500Received: from SMTP32-FWD by wcnet.net (SMTP32) id A0F48; Mon, 5 Jun 2006 00:48:32 -0500Received: from ZIA [203.81.233.129] by wcnet.net with ESMTP (SMTPD32-7.15) id A5A187B7034E; Mon, 05 Jun 2006 00:48:17 -0500Date: Mon, 5 Jun 2006 05:48:33 -0300From: "Blair Montano" [EMAIL PROTECTED]X-Mailer: The Bat! (3.78.20) PersonalReply-To: [EMAIL PROTECTED]X-Priority: 3 (Normal)Message-ID: [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: You Too Can Profit From MicrocapsMIME-Version: 1.0Content-Type: text/plain; charset=us-asciiContent-Transfer-Encoding: 7bitX-Declude-Sender: [203.81.233.129]X-Declude-Spoolname: Dc5a187b7034ef2f2.SMDStatus: RX-UIDL: 323778081 ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just
RE: [Declude.JunkMail] No action taken
This morning I'm seeing a flood of stock spam with scores that are more than double my delete weight getting through with no action taken. I'm looking at one right now with a score of 67, and in my scheme we delete at 30. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Sunday, 04 June 2006 8:21 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] No action taken I was noticing the other day on some version of 4.x that bounce messages for a domain that should have been using the settings in my $Default$.JunkMail failed to take those actions. Typically I do per-domain configs, but a few I just have using my $Default$.JunkMail. I noticed this as soon as I upgraded to 4.x, and I'm pretty sure it is a bug. I am not sure if it only affects bounce messages or all messages for those domains (note that all of my domains are gatewayed from the Declude box so they may be treated differently from locally hosted E-mail. I believe that putting the actions in your Global.cfg would take action on this stuff. Global.cfg is meant for outgoing E-mail actions. While this was clearly incoming E-mail and not the way things used to work with 2.x and before, I'm pretty sure that this will take care of the issue. When I get some time to look into this further I'll probably report the bug to Declude. I'm pretty sure that I have seen several other such posts that might have been caused by this change in behavior. Matt Heimir Eidskrem wrote: Why would no action been taken on this email. We hold on 100. From Declude log: 06/04/2006 17:38:44.987 q60eb0182d92b.smd Triggered COUNTRIES CONTAINS filter COUNTRYFILTER on ES [weight-10]. 06/04/2006 17:38:45.003 q60eb0182d92b.smd Filter: Set max weight to 60. 06/04/2006 17:38:45.112 q60eb0182d92b.smd Filter: Set max weight to 70. 06/04/2006 17:38:45.159 q60eb0182d92b.smd Filter REVDNSBLACKLIST: Skipping E-mail with a current weight of 245 (=80) 06/04/2006 17:38:45.159 q60eb0182d92b.smd Filter BADWORDFILTER: Skipping E-mail with a current weight of 245 (=30) 06/04/2006 17:38:45.159 q60eb0182d92b.smd SPAMCOP:70 FIVETENSRC:30 SORBS-DUL:35 COUNTRYFILTER:10 SNIFFERGETRICH:100 . Total weight = 245. 06/04/2006 17:38:45.159 q60eb0182d92b.smd Cumulative action(s) taken on this email = NO ACTIONS WERE TAKEN Received: from jose-mih7wjftkx [62.42.134.246] by xxx with ESMTP (SMTPD-8.22) id A0EC1404; Sun, 04 Jun 2006 17:38:36 -0500 Date: Sun, 4 Jun 2006 22:38:39 -0060 From: Rene Benjamin [EMAIL PROTECTED] X-Mailer: The Bat! (3.69.9) Personal Reply-To: [EMAIL PROTECTED] X-Priority: 3 (Normal) Message-ID: [EMAIL PROTECTED] To: Subject: Under The Radar Equity Alert MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Declude-Sender: [62.42.134.246] X-Declude-Spoolname: D60eb0182d92b.smd X-Spam-Tests-Failed: SPAMCOP, FIVETENSRC, SORBS-DUL, NOLEGITCONTENT, IPNOTINMX, COUNTRYFILTER, SNIFFERGETRICH, WEIGHT75, WEIGHT100, CATCHALLMAILS [245] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 440029386 X-IMail-ThreadID: 60eb0182d92b --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] No action taken
I sent a good sample to support, but like most of my questions and complaints lately, I haven't gotten a meaningful reply. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Carter Sent: Monday, 05 June 2006 9:04 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] No action taken I'm seeing the same thing. However the headers show all of the tests failed and the score - well above my delete weight. John C -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Shacklett Sent: Monday, June 05, 2006 6:37 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] No action taken This morning I'm seeing a flood of stock spam with scores that are more than double my delete weight getting through with no action taken. I'm looking at one right now with a score of 67, and in my scheme we delete at 30. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Sunday, 04 June 2006 8:21 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] No action taken I was noticing the other day on some version of 4.x that bounce messages for a domain that should have been using the settings in my $Default$.JunkMail failed to take those actions. Typically I do per-domain configs, but a few I just have using my $Default$.JunkMail. I noticed this as soon as I upgraded to 4.x, and I'm pretty sure it is a bug. I am not sure if it only affects bounce messages or all messages for those domains (note that all of my domains are gatewayed from the Declude box so they may be treated differently from locally hosted E-mail. I believe that putting the actions in your Global.cfg would take action on this stuff. Global.cfg is meant for outgoing E-mail actions. While this was clearly incoming E-mail and not the way things used to work with 2.x and before, I'm pretty sure that this will take care of the issue. When I get some time to look into this further I'll probably report the bug to Declude. I'm pretty sure that I have seen several other such posts that might have been caused by this change in behavior. Matt Heimir Eidskrem wrote: Why would no action been taken on this email. We hold on 100. From Declude log: 06/04/2006 17:38:44.987 q60eb0182d92b.smd Triggered COUNTRIES CONTAINS filter COUNTRYFILTER on ES [weight-10]. 06/04/2006 17:38:45.003 q60eb0182d92b.smd Filter: Set max weight to 60. 06/04/2006 17:38:45.112 q60eb0182d92b.smd Filter: Set max weight to 70. 06/04/2006 17:38:45.159 q60eb0182d92b.smd Filter REVDNSBLACKLIST: Skipping E-mail with a current weight of 245 (=80) 06/04/2006 17:38:45.159 q60eb0182d92b.smd Filter BADWORDFILTER: Skipping E-mail with a current weight of 245 (=30) 06/04/2006 17:38:45.159 q60eb0182d92b.smd SPAMCOP:70 FIVETENSRC:30 SORBS-DUL:35 COUNTRYFILTER:10 SNIFFERGETRICH:100 . Total weight = 245. 06/04/2006 17:38:45.159 q60eb0182d92b.smd Cumulative action(s) taken on this email = NO ACTIONS WERE TAKEN Received: from jose-mih7wjftkx [62.42.134.246] by xxx with ESMTP (SMTPD-8.22) id A0EC1404; Sun, 04 Jun 2006 17:38:36 -0500 Date: Sun, 4 Jun 2006 22:38:39 -0060 From: Rene Benjamin [EMAIL PROTECTED] X-Mailer: The Bat! (3.69.9) Personal Reply-To: [EMAIL PROTECTED] X-Priority: 3 (Normal) Message-ID: [EMAIL PROTECTED] To: Subject: Under The Radar Equity Alert MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Declude-Sender: [62.42.134.246] X-Declude-Spoolname: D60eb0182d92b.smd X-Spam-Tests-Failed: SPAMCOP, FIVETENSRC, SORBS-DUL, NOLEGITCONTENT, IPNOTINMX, COUNTRYFILTER, SNIFFERGETRICH, WEIGHT75, WEIGHT100, CATCHALLMAILS [245] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 440029386 X-IMail-ThreadID: 60eb0182d92b --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED
RE: AW: [Declude.JunkMail] No action taken
I think that Matt's reply to Markus is right on track. I went back and looked at some headers from my sneaky stock scamspam and it appears that whatever is happening incorrectly is causing these messages to be treated as outgoing and I had a typo in my global.cfg that was preventing my HOLD and DELETE actions from taking place. I haven't seen any slip through since making that repair. That doesn't answer Heimir's basic question about official response. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Heimir Eidskrem Sent: Monday, 05 June 2006 2:53 PM To: declude.junkmail@declude.com Subject: Re: AW: [Declude.JunkMail] No action taken It seems to be obvious that this is a Declude problem with so many reports. Why no response from Declude yet? H. Matt wrote: Markus, Your headers show that it was also a null sender for the messages that bypassed your weights. Also curiously, you are logging in your headers the inorout variable and it shows the message as being outgoing: X-Note: Sent from - [No Reverse DNS] ([210.212.188.106]) outgoing. It appears that Declude is treating all null senders as outgoing, which would then use actions contained in your Global.cfg instead of a JunkMail file, and I'm guessing that you don't have any actions defined in your Global.cfg? Maybe that is the source of the bug. I don't recall this ever happening with 2.x and before, so maybe it's a change of behavior in 3+. Declude??? Matt Markus Gufler wrote: (reposting the same message without attachments) Hi After reading this thread and have seen 3 spam messages in my inbox who has final results-lines in the header with more then 200% of my hold weight I've made some research: Exactly the same is happening here with Declude 3.1.0 and Imail 8.15 from 2006-06-04 20:00:00 GMT+1 on. I have the same actions for in- and outgoing messages in my config files. Normaly a message in v3+ is (MID) logged with 6 lines. Each message with the final action NO ACTIONS WERE TAKEN has only 2 lines in the logfile 06/04/2006 20:00:37.719 q1fa255d9003021bd.smd CBL:10 SPAMCOP:20 ... . Total weight = 360. 06/04/2006 20:00:37.719 q1fa255d9003021bd.smd Cumulative action(s) taken on this email = NO ACTIONS WERE TAKEN With this final weight the defined action is HOLD. I've noted also that this two lines are looking nearly like a whitelisted message: 06/04/2006 19:31:27.015 q18de1b3b00b21c63.smd Action(s) taken for [EMAIL PROTECTED] = WHITELISTED [LAST ACTION=WHITELISTED] 06/04/2006 19:31:27.015 q18de1b3b00b21c63.smd Cumulative action(s) taken on this email = NO ACTIONS WERE TAKEN So it seems to me that something is whitelisting this type of message but I don't know what. Following my logfiles arround 400 spam each one with a final result between 200 and 400% of the defined hold weight has passed the filter instead of being HOLD. Markus -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von John Shacklett Gesendet: Montag, 5. Juni 2006 13:37 An: Declude.JunkMail@declude.com Betreff: RE: [Declude.JunkMail] No action taken This morning I'm seeing a flood of stock spam with scores that are more than double my delete weight getting through with no action taken. I'm looking at one right now with a score of 67, and in my scheme we delete at 30. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Sunday, 04 June 2006 8:21 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] No action taken I was noticing the other day on some version of 4.x that bounce messages for a domain that should have been using the settings in my $Default$.JunkMail failed to take those actions. Typically I do per-domain configs, but a few I just have using my $Default$.JunkMail. I noticed this as soon as I upgraded to 4.x, and I'm pretty sure it is a bug. I am not sure if it only affects bounce messages or all messages for those domains (note that all of my domains are gatewayed from the Declude box so they may be treated differently from locally hosted E-mail. I believe that putting the actions in your Global.cfg would take action on this stuff. Global.cfg is meant for outgoing E-mail actions. While this was clearly incoming E-mail and not the way things used to work with 2.x and before, I'm pretty sure that this will take care of the issue. When I get some time to look into this further I'll probably report the bug to Declude. I'm pretty sure that I have seen several other such posts that might have been caused by this change in behavior. Matt Heimir Eidskrem wrote: Why would no action been taken on this email. We hold on 100. From Declude log: 06/04/2006 17:38:44.987 q60eb0182d92b.smd Triggered COUNTRIES CONTAINS filter COUNTRYFILTER on ES [weight-10]. 06/04
RE: [Declude.JunkMail] No Tests Run
Matt, I did get a reply from Gerry earlier and I resubmitted my earlier support email to him, and he indicated they would escalate things, but that's it. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Monday, 05 June 2006 4:29 PMTo: declude.junkmail@declude.comSubject: Re: [Declude.JunkMail] No Tests Run Glenn,I understand that logs might be difficult for you to post, but I would like to suggest that everyone experiencing such issues should attempt to share log entries if at all feasible. That would go a long way, especially when there could be multiple issues occurring that people are speaking about in one thread.So far it looks like every message was sent from a null sender that was reported to the list.Could people also confirm if they have settings for weight-based tests configured with actions in their Global.cfg? Something like: WEIGHT10 SUBJECT [SPAM] WEIGHT20 HOLD WEIGHT30 DELETENeedless to say, when a half dozen people post about issues like this, it would be nice to get some list feedback from Declude within 8 hours. There's no sense in keeping this all a secret. Since I haven't heard anything back about this stuff, I have to now go on a goose chase in my system trying to figure out if there is an issue without even knowing exactly what it is. That wastes a lot of time when multiplied by the dozens of people that might react the same way on this list to such reports.Thanks,MattGlenn \ WCNet wrote: I've had a swarm of stock-quote spam in the last few days. Declude 1.81, Imail 7.15. Appears from the headers there are no Declude tests running at all on these msgs, but there are Declude headers added. Majority are null senders. Various IPs. Some have my addy referenced as an X-RCPT, some do not. Majority also have an SMTP-FWD header. Those that are to legitimate recipients on my host, none of them (that I've checked thus far) have a fowarding addyset. Some but not all are being sentusing The Bat! client. My Declude logs runup to 800MB per day, difficult to search them for details. Received: from SMTP32-FWD by wcnet.net (SMTP32) id A0E38; Mon, 5 Jun 2006 00:48:32 -0500Received: from SMTP32-FWD by wcnet.net (SMTP32) id A0F48; Mon, 5 Jun 2006 00:48:32 -0500Received: from ZIA [203.81.233.129] by wcnet.net with ESMTP (SMTPD32-7.15) id A5A187B7034E; Mon, 05 Jun 2006 00:48:17 -0500Date: Mon, 5 Jun 2006 05:48:33 -0300From: "Blair Montano" [EMAIL PROTECTED]X-Mailer: The Bat! (3.78.20) PersonalReply-To: [EMAIL PROTECTED]X-Priority: 3 (Normal)Message-ID: [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: You Too Can Profit From MicrocapsMIME-Version: 1.0Content-Type: text/plain; charset=us-asciiContent-Transfer-Encoding: 7bitX-Declude-Sender: [203.81.233.129]X-Declude-Spoolname: Dc5a187b7034ef2f2.SMDStatus: RX-UIDL: 323778081 ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
[Declude.JunkMail] OT: Imail queue viewing
Here's my second off-topic question. Thank you again for all the great suggestions on handling the port forwarding question on Wednesday and for all the great discussion that spun off of that original thread. Question two: I'm making the jump from Imail 6 on NT4 clear up to Imail 2006.03 on 2kServer. After all these years of living on and dying by the functionality of the Imail administration interface on port 8181, I see that the new Iadmin doesn't even show you what's going on with the \Spool queue. I'm stunned in complete disbelief. How are people managing the queue in the absence of that information? Thanks again, John S --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail queue viewing
The new spool info is limited to how many messages and a single Send All button that I frankly don't believe actually sends anything. I think they bought the button from the office supply store that's giving the big red buttons away. The old spool info showed all the messages in the queue, to and from address info for each, and a counter on how many attempts had been made for each. Showed the messages being held and the messages being actively sent or received in separate groups. We used that display to allow us to massage messages sent to incorrect addresses by fumble-fingered executives [we have one who STILL insists that his friend is at home.com] and other similarly thankless tasks. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Saturday, 25 March 2006 4:28 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Imail queue viewing John, Exactly what are you looking to do in terms of insight into the spool? Monitor files? See who the messages are too? Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: John Shacklett [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, March 25, 2006 4:12 PM Subject: [Declude.JunkMail] OT: Imail queue viewing Here's my second off-topic question. Thank you again for all the great suggestions on handling the port forwarding question on Wednesday and for all the great discussion that spun off of that original thread. Question two: I'm making the jump from Imail 6 on NT4 clear up to Imail 2006.03 on 2kServer. After all these years of living on and dying by the functionality of the Imail administration interface on port 8181, I see that the new Iadmin doesn't even show you what's going on with the \Spool queue. I'm stunned in complete disbelief. How are people managing the queue in the absence of that information? Thanks again, John S --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: port forwarding
I'm making the jump to a new mailserver this weekend, and I've hit two snags. I know that the answers to both of these questions are in the archives, but the search feature on the list archive appears to be broken currently. My apologies to all, both for the OT question as well as for reasking. Question one: Many, many of our users have existing shortcuts and bookmarks to webmail on our old Imail machine at the webserver:8383 address. The new machine will have the same FQDN, but the webclient won't run on 8383 any more, it will run on 80. We won't have time to track down every user and update those links, so we're looking for ways to accommodate them. What are people using for port forwarding? I tried using stunnel last night to intercept an 8383 session and redirect it to 80, with dismal results. There must be a smarter and more elegant solution. Thanks, John S --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude 3.0 / 4.0
I'm in a fairly unique position in that I actually have a brand new system sitting on the bench as part of our LONG delayed migration away from NT4/Imail6 and into the new millennium. So timing is everything, and a Version 3/Version 4 decision had to be made in fairly short order to be considered at all. At least as part of the initial build. I received a call from Barry today in response to a routine support@ email request for information about the upgrade pricing [I have EVAPro and JMPro already, so I also only needed Hijack to round out the set]. Except for the actual pain of doing the upcoming migration itself, everything declude-related worked out to my satisfaction [and even exceeded my expectations]. I think there's a fair case of Ipswitch Fever going around, seemingly as bad as Bird Flu, but I think the treatment in this case is much more tolerable than the IMail situation was. Now, Barry, having giving credit where credit it due, let me reiterate the statement that has been given a couple of times on the list previously: we need a recognized-as-stable version out, and we [as the users] need to feel that development efforts match somewhat with identified needs and feature requests. The fact that long-time users feel the need to stay back as far as Version 1.8x in order to run stable installations has been a serious breakdown of the expectations of the group. It's a genuine opportunity for the company, not a threat. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Anton Sent: Monday, 13 February 2006 2:31 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Declude 3.0 / 4.0 Now that I know more about the switch, I am more comfortable with the changes. I think that we collectively jumped to some conclusions. I am interested to see how the whole thing plays out. -Anton --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AOL Now blocking Port 25
Sorry this is so late. We've used stunnel for a while now, it also was simple to setup and seems flawless in operation. JS -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Friday, 30 September 2005 6:09 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] AOL Now blocking Port 25 I searched the archives but couldn't find what I was looking for. Didn't someone post a link to a small software app that would run on the mail server and would forward all traffic from port 587 to port 25. We are not on the current Imail version so we can't use it's built in feature. Thanks in advance, Don - Original Message - From: Mark Smith [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, September 29, 2005 11:34 PM Subject: RE: [Declude.JunkMail] AOL Now blocking Port 25 Setup Windows IIS SMTP service to listen on port XX (something other than 25). Both can run and won't conflict. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Thursday, September 29, 2005 4:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] AOL Now blocking Port 25 Anybody out there know the Cisco PIX CLI syntax to do port forwarding on the firewall? I'm running Imail 8.15 and I'm stuck with port 25... -Dave Doherty Skywaves, Inc. - Original Message - From: Kevin Bilbee [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, September 29, 2005 3:48 PM Subject: RE: [Declude.JunkMail] AOL Now blocking Port 25 If you are on imail 8.2x you can setup the alternate port. Search for the thread on the how to. No additional software is needed to do port forwarding. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Mark Smith Sent: Thursday, September 29, 2005 11:39 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] AOL Now blocking Port 25 As a web hosting company, we put an SMTP server listening on a different TCP port. We instruct users to modify their SMTP settings in their mail client to use this port. The server listens on this port but relays on 25. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli Sent: Thursday, September 29, 2005 2:20 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] AOL Now blocking Port 25 Has anyone else been told AOL is now enfosing this policy and how do we get around it. a.. 554 IPT:OA http://postmaster.info.aol.com/errors/554iptoa.html EXPLANATION: The message you received is generated from AOL when sending mail through a third party program and connecting through the default port 25. America Online Inc. will no longer accept outgoing connections on port 25 through third party mail programs. SOLUTION: If you are trying to access your America Online e-mail please visit Keyword: Open Mail Access Send third party e-mail through port 587. This port requires you to authenticate and may require a change to your email client settings. Note, the server you are connecting to must support this configuration. If you are trying to get your AOL e-mail visit Keyword Open Mail Access, all others contact your server administrator for further support on this configuration. For more information visit the port 25 FAQ. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail
RE: [Declude.JunkMail] UPGRADE REPEAT
The Declude staff let me know that v3 won't work on WinNT, so I think I can't delay the inevitable any longer. Just for fun, has anyone tried the v3 beta with IMail6 on WinNT? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Wednesday, 21 September 2005 11:48 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] UPGRADE REPEAT FYI, it appears the Beta may be wrapping up soon. So if you can, maybe wait a week or two for version 3.x. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, September 21, 2005 6:20 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] UPGRADE REPEAT Kevin, The version that is compatible with 8.2x is going to be Declude version 3.0 which is still in beta testing. Although others have ran the 2.0.6 train with no issues under 8.2x - however others have not been so fortunate. Upgrading to the 2.0.6 install is fairly easy. Just run a manual install and copy over the new declude.exe to the imail directory. You might also want to go through the global.cfg for 2.0.6 and add any of the tests to your global.cfg that are missing. The installation for 3.0 is a little more involved. If you wanted to go that route you would need to sign up for the beta program. However, from reading your post it sounds like you might not be interested in the beta program. Let us know if you need anymore help, Darrell - DLAnalyzer - Comprehensive reporting for Declude Junkmail and Virus. http://www.invariantsystems.com Kevin Shimwell writes: Declude Teammates Well after several month of not wanting to upgrade. Here goes. Current Imail version 8.21. running 1 month inluding beta. Colaberation Suite IM running also. ( only the IM service portion) Currrent declude version Declude 1.79 (C) Copyright 2000-2004 Computerized Horizons. I also have Processor issues but have been manageable. I have a current service agreement with declude and want to upgrade to the most current declude.exe version. What should my procedure be? and what to look out for. Any helpful links or documentation including wise declude professional opinions welcome. I'm running window 2000 server latest patches and I wan to upgrade my declude. I'm running version: E:\IMaildeclude -diag Declude 1.79 (C) Copyright 2000-2004 Computerized Horizons. Diagnostics ON (Declude v1.79). Declude JunkMail: Config file found (E:\IMail\Declude\global.CFG). Declude Virus: Config file found (E:\IMail\Declude\Virus.CFG). Declude Hijack:Not installed (no E:\IMail\Declude\Hijack.CFG file). Declude Confirm: Not installed (no E:\IMail\Declude\Confirm.CFG file). 50 spam tests defined: AHBL BLITZEDALL CBL DSBL ORDB SBL SORBS-HTTP SORBS-SOCKS SORBS-MISC SORBS-SMTP SORBS-SPAM SORBS-WEB SORBS-BLOCK SORBS- ZOMBIE SORBS-DUHL S PAMCOP DSN NOABUSE NOPOSTMASTER BONDEDSENDER BADHEADERS BASE64 CMDSPACE COMMENTS HELOBOGUS IPNOTINMX MAILFROM NOLEGITCONTENT PERCENT REVDNS ROUTING SPAMHEADERS IPLINKED IPLINKED2 MYFILTER KILLFROM SUBJECTFILTER BODYFILTER GIBBERISH ANTI-GIB BERISH SNIFFER WEIGHT10 WEIGHT20 WEIGHT1-10 WEIGHT11-20 WEIGHT21-34 WEIGHT35-45 WEIGHT46-200 CATCHALLMAILS WHITLIST IMail reports Official Host Name as: scooby.linkbrokers.com. IMail's SendName registry seems OK: E:\IMail\declude.exe. DNS Server: 66.153.205.8 Declude JunkMail Status: PRO version registered. Declude Virus Status:Pro Version Registered. Declude Hijack Status: NOT REGISTERED: No activation code. Kevin Shimwell Link Brokers Group, LLC ( Support ) 1600 Hwy 17 South North Myrtle Beach, SC 29582 Phone: 843-663-1004 Fax: 843-663-1007 Email: [EMAIL PROTECTED] 24/7 Help : http://www.linkbrokers.com/help_ticket.cfm http://www.linkbrokers.com/help_ticket.cfm Support Forum: http://www.linkbrokers.com/chatboard/index.cfm?CFB=1 Support M-F 1-888-546-5631 This message is intended only for the use of the individual or entity towhich it is addressed and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone and/or e-mail. -- -- Check out http://www.invariantsystems.com for utilities for
[Declude.JunkMail] OT: Ipswitch problems
Sorry to waste DJM bandwidth. I just realized that I stopped receiving Imail_Forum Digests on April 26th. I've tried to re-subscribe, but is this just me, or have they somehow scrambled their Digests? Thanks. -- John Shacklett [EMAIL PROTECTED] [EMAIL PROTECTED] www.continentaloffice.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Beta protocols
Once upon a time, not so terribly long ago, there were Declude versions. Declude versions came in release and beta, and a user could run one or the other based on best practices decisions by that local user. It was unique in my [albeit limited] experiences, and it got betas groomed and features disseminated fast fast fast. It appears we have come full circle to a situation where selected insiders are testing betas, and the rest of the forum sees more infrequent releases. I recognize that as an obvious and common model, and I can't find specific fault with the approach ...except to note that it is one more aspect of the conversion of Declude from something unique to just another product. -- John Shacklett [EMAIL PROTECTED] [EMAIL PROTECTED] www.continentaloffice.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Email being released today - Advance Notice
Is there a service on the website where we can look up our complete current software licensing information and expiration dates of current Service Agreements? From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Barry SimpsonSent: Wednesday, December 01, 2004 10:10 AMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Email being released today - Advance Notice This is a preview of an email being shortly released by Declude and being sent to all customers. _
[Declude.JunkMail] OT: IP block tool
I use SamSpade for Windows as my Swiss Army Knife while I'm working, and 99 times out of 100 it proves its worth. Fantastic tool. That 1 time when I'm not pleased, I'm trying to research who owns a given IP Range. The results that SamSpade returns just don't have the granularity I want. Can anyone recommend a tool to quickly look up IP Range assignments that works more strongly than SamSpade? -- John Shacklett [EMAIL PROTECTED] [EMAIL PROTECTED] www.continentaloffice.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] spam review
http://www.mail-archive.com/[EMAIL PROTECTED]/msg17568.html I remember this conversation vividly, but I think it crashed on the rocks quickly. Maybe we need a posse of VB types delegated with the charge of trying to contact Tom again and see if his offer is still good. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, August 18, 2004 10:56 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] spam review Scott, do you know anything about this as a possible addition to your product/tools line? It is something that we were looking into, but I do not believe that we ended up with the source code. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPF sleight of hand
Has anyone tried to construct dummy SPF records locally for domains that are not your own in order to outsmart SPF records in the real world that permit spammers junk to pass? -- John Shacklett [EMAIL PROTECTED] [EMAIL PROTECTED] www.continentaloffice.com There is a theory which states that if ever anyone discovers exactly what the Universe is for and why it is here, it will instantly disappear and be replaced by something even more bizarre and inexplicable. There is another theory which states that this has already happened. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: tmp file residue
Sorry in advance for straying off topic. It's been a week we'll all laugh about someday. Maybe. I've rebuilt my automatic sniffer and f-prot update CMD files this week following a localized brain failure, and I have them working smoothly EXCEPT both processes are leaving the .tmp file behind in the SPOOL directory after the program alias fires off the proper CMD batch. Can someone remind me of some critical part of program alias care and feeding that I've forgotten? -- John Shacklett [EMAIL PROTECTED] [EMAIL PROTECTED] www.continentaloffice.com There is a theory which states that if ever anyone discovers exactly what the Universe is for and why it is here, it will instantly disappear and be replaced by something even more bizarre and inexplicable. There is another theory which states that this has already happened. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: tmp file residue
head hung in shame Of course, I knew I was staring at it too hard to see the obvious answer. /hhis Does the CMD process know the specific name of the tmp file in question, or do I just clean up any and all *.tmp in \spool\? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman Sent: Wednesday, July 14, 2004 4:19 PM To: John Shacklett Subject: Re: [Declude.JunkMail] OT: tmp file residue Can someone remind me of some critical part of program alias care and feeding that I've forgotten? You've found it yourself: it's the removal of the .TMP file. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release / Defuse Dictionary Attacks: Turn Exchange Addresses into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/downloa d/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPACE character
We get a fair amount of SPACE subjects from our webmail users. Imail's webmail interface gets upset if you try and send an email with both a blank subject and a blank body [for example, an unsubscribe message to an address that does all of the processing based on the To: address alone], so a spacebar in the subject field appears to be a common choice here. I still like this idea and I implemented Rick's approach with a small weight. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Davidson Sent: Tuesday, July 06, 2004 4:19 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] SPACE character most of them look like web mailers or automated systems that have the subject coded incorrectly with an extra leading space. Rick Davidson National Systems Manager North American Title Group - - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, July 06, 2004 3:46 PM Subject: RE: [Declude.JunkMail] SPACE character I would be interested to know why the legit messages have a subject line that starts with a space. One of the servers I maintain is for a real estate company. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Rick Davidson Sent: Tuesday, July 06, 2004 11:48 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] SPACE character yea it works, but I have been running a test with that today and havent caught a single spam message but have caught over 30 legit messages... Rick Davidson National Systems Manager North American Title Group - - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, July 06, 2004 1:52 PM Subject: RE: [Declude.JunkMail] SPACE character AH, interesting work around. Thanks, I will try that. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Rick Davidson Sent: Tuesday, July 06, 2004 10:11 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] SPACE character I messed around with this and found you can do the following HEADERS 0 CONTAINS Subject: -- with two spaces after it The header formating is Subject: with one space after it so theoreticly add a second space in your filter rule and it will do what you want. Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, July 06, 2004 12:11 PM Subject: Re: [Declude.JunkMail] SPACE character I see a small amount of valid e-mail that starts with a space. Perhaps SUBJECT 15 ISSPACE Similiar to the ISBLANK option? Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 07/06/04 10:59AM I have been seeing more spam where the subject line is a single space. Feature request, add something like this; SUBJECT 15 STARTSWITHSPACE John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail
RE: [Declude.JunkMail] Updated SURBL filter script
Roger, this version works on my NT4 machine like a champ. Thanks again. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Roger Eriksson Sent: Thursday, April 15, 2004 10:57 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Updated SURBL filter script Hi, The SURBL filter script has been updated and should now run under both Windows NT 4 and Windows 2000. The updated script can be downloaded at http://www.botany.gu.se/download/decludescript/SURBL_filter.zip. Those of you that downloaded the previous version and use it on Windows 2000 don't need to update. /Roger --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help
I had a problem with Sniffer earlier this week that turned out to be a corrupt update. There was a consistent error in the log for the time period when that botched update was in place. I've noted since then that several others have complained of similar issues with their sniffer updates, although not at the same time as mine was buggered. I assume that the situation is getting some madscientific attention because it appears there may be a little more than just random chance at work. When that particular failure occurs there is a particular fail-safe error code returned, and I created a new SNIFFER-FAILSAFE test that looks for that code and performs some bells and whistles to warn me of the problem so I can manually update. Although the spam storm symptoms were a pretty good indication. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Butch Andrews Sent: Thursday, March 25, 2004 1:36 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Help I think that your sniffer update is corrupt. Do a manual update by executing the autoSNF.cmd file from a dos prompt and get a fresh download. In addition if you are trying the new beta version with a persistent instance, you might consider going back to the original version. The problem might be either or both but occurred for me last night and this is what it took to get sniffer back up. -Butch *** REPLY SEPARATOR *** On 3/25/2004 at 10:23 AM John Tolmachoff \(Lists\) wrote: DNS problem? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Richard Farris Sent: Thursday, March 25, 2004 9:58 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Help I just did a Windows NT update and now all mail is failing the Sniffer test...any ideas... Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, March 25, 2004 10:52 AM Subject: RE: [Declude.JunkMail] something is up help Subject: Re: Brochure X-RBL-Warning: SUBJECTFILTER: Message failed SUBJECTFILTER test (332) If you look at line 332 in the subjectfilter.txt file, it should have the text that caused the SUBJECTFILTER test to be triggered. This is whats on line 332 SUBJECT 30 CONTAINS room I would try checking the lines just before and after that one, in case of a line numbering discrepancy. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Email Marketing
I know this suggestion was kind of tongue-in-cheek, but we did exactly this for one of our Marketing wonderboys. After 3 days, just three days, he came into my office waving his white handkerchief and begging for mercy. The message was sent better than any discussion could have, technical or not. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Markus Gufler Sent: Friday, January 23, 2004 10:05 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Email Marketing Ok let me resume: 1.) it's a non-tecnical person 2.) his task is to sell more 3.) he don't know what means being flooded with marketing mails because you filter them out all of this trash. Solution: disable spam filtering for this guy (or bether the entire marketing dept) Say nothing to anyone until they ask you. Then explain that this are the same mails he want to send out in the future. Markus ;-) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Sorting log
text to columns using a space as the delimiter -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff (Lists) Sent: Tuesday, 30 December 2003 2:22 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Sorting log Importance: High Any ideas on the fastest way to do this? Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] EASYNET tests going away December 1
I think this might be on http://www.ahbl.org/using.php in the rhsbl section. I have been trying AHBL-DOMAINSrhsbl rhsbl.ahbl.org * 5 0 for a couple of days, but I don't have any stats to share today. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff (Lists) Sent: Friday, 28 November 2003 11:31 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] EASYNET tests going away December 1 AHBLDOMAINS710.95% AHBLPROXIES...7359.82% AHBLSOURCES...3514.69% (reliable, so far) NJABLDUL..2743.66% (many duplicates with SORBS-DUL) NJABLPROXIES1,085...14.49% NJABLRELAYS...1181.58% NJABLSOURCES..2653.54% (reliable, so far) For clarification, can you please post what you exact configuration is for those, in other words what return codes? Example, what exactly is AHBLDOMAINS as there is no test in the sample Global.cfg file and on the AHBL site, there is no code name that. http://www.ahbl.org/responsecodes.php John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] merging three threads from two lists
So, I took the learning that I gained from Bill and Scot and Chuck and a couple more of you, and I have been teaching myself more about unxutils. And, in another part of my mind, I'm looking at discussions on the Sniffer list about leveraging power from Sniffer by using the result codes to be aggressive with weighting. Seems good, because I'm reading about losing easynet and I'm already falling behind in my war. So what, you ask, what is he going on about this time? Good question. I'll cut to the chase: I ran something like: grep failed SNIFFER: g:\imail\spool\dec1116.log | cut -d ( -f 2 | cut -d ) -f 1 | tr -d . | usort | uniq -c Just for fun. And I get this: 43 Message failed SNIFFER: 47 103 Message failed SNIFFER: 48 7 Message failed SNIFFER: 49 46 Message failed SNIFFER: 50 3 Message failed SNIFFER: 51 615 Message failed SNIFFER: 52 197 Message failed SNIFFER: 54 2 Message failed SNIFFER: 55 31 Message failed SNIFFER: 56 122 Message failed SNIFFER: 57 191 Message failed SNIFFER: 58 16 Message failed SNIFFER: 59 19 Message failed SNIFFER: 60 34 Message failed SNIFFER: 61 109 Message failed SNIFFER: 62 191 Message failed SNIFFER: 63 So far so good. Here's where I need help: what I really need now isn't this list at all, what I really need is to somehow correlate this information with the total weights on the messages that SNIFFER finds, because that's going to help me. I have a boatload of spam, more and more everyday, that fails SNIFFER, getting those messages held, but which doesn't trip enough other tests to get the messages deleted. Losing ip4r tests, as we have been, loses some of that extra value, so I wonder what categories of SNIFFER failures generate HOLDs that I end up manually deleting. I'm sorry, I think I'm talking in circles, but I think it's a circular problem. It feels like we're headed to a time [soon] when we'll have content analysis, and manually crafted blacklists, and joint/private efforts at blacklists, and nothing else in the arsenal. Thanks for listening, see you next week. -- John Shacklett www.continentaloffice.com [EMAIL PROTECTED] [EMAIL PROTECTED] They say that genius is 99 percent perspiration and 1 percent inspiration. Then again, so is mowing the lawn. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Parse Log File
I'm not very good with these unix tools in general, but my set of unxutils
doesn't include usort, and if I try using sort instead, I get a steady
stream of errors from gawk.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Bill Landry
Sent: Thursday, 20 November 2003 12:00 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Parse Log File
If you have the Win32 UNIX tool (if not, you can get them at:
http://unxutils.sourceforge.net/), you can run the following script:
grep From: spam\dec1119.log | gawk {print $(NF-2)} | usort | uniq -c |
usort
which will produce output like:
86 38.113.200.29
88 38.113.200.28
94 207.244.68.34
95 66.111.231.82
98 205.157.110.11
100 66.111.231.76
106 66.35.250.206
113 64.253.207.50
125 65.168.38.245
126 209.239.38.196
with the count in the first column followed by the IP address. If you want
the IP address only, remove the -c from the script above.
Bill
- Original Message -
From: Chuck Cahill [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, November 20, 2003 8:18 AM
Subject: [Declude.JunkMail] Parse Log File
I'm hoping someone can point me in the right direction. I'm looking for a
way to parse the IP Address out of the Spam Log file, DecMMDD.log. Then,
I
would like to tally the amount of messages received from each unique IP
address.
I'm using the option LOG_OK NONE in the config file so only those
messages marked as spam should have their IP addresses in the log file
By getting this information I can place the largest violators IP address
into IMail's Control file to offset some of the overhead with processing
messages.
Anyone have something like this in place? Does this sound logical or
flawed?
Thanks
Chuck Cahill
Visit us at www.yfcs.com
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
RE: [Declude.JunkMail] TextFilter file, how many entries ?
I posted a question two weeks ago asking if anyone knew a way to calculate the amount of time it takes for individual messages to clear the entire receive/virusscan/junkmailscan/deliver process, and this exactly why I asked. My system doesn't have any filters quite as large as 140kb, or even 70k, but I keep adding steadily to them and it feels like things are somewhat slower. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Markus Gufler Sent: Thursday, 30 October 2003 3:54 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] TextFilter file, how many entries ? My question is, How many entries can I put in the file before Declude slow down ? I think this depends on -what HW-ressources you have in use (CPU, storage,...) -how much mail traffic you have during peak times I've had a problem some days ago by adding two filter files having both around 140 kB (one for body one for header filtering) At midnight all worked fine but next morning at around 9:00 AM it was almost not more possible to logon to the server. Ping whas ok, but it has taken over a minute to display the Terminal services login screen. After logging on I've had to wait for over 5 Minutes to see the desktop. Other 2 Minutes to open the taskmanager and see that there was a lot of declude.exe's having CPU-times of over 60 seconds and consuming all disponible CPU-resources. We've running Imail v7.15 on a Intel P4 2,6 GHz and IDE Raid mirroring Declude Junkmail and Virus with 2 scan engines. First I've tried to disable the second AV engine without a result. After removing the two filter files all become normal. We process around 4000 msgs/day. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] speed and complexity
I'm curious how long it takes for average messages to clear the entire scan and pass/fail process. The complexity of the testing as well as the size and number of my filters have grown steadily over time, and I haven't been watching closely to see what's happened to delivery speed. I was rereading Pete's ideas about holding messages in limited circumstances to allow virus scanning and spam testing to catch up with new threats, and I started asking myself what delay is 'normal' now. What kinds of methodology are people using to time things? -- John Shacklett www.continentaloffice.com [EMAIL PROTECTED] [EMAIL PROTECTED] They say that genius is 99 percent perspiration and 1 percent inspiration. Then again, so is mowing the lawn. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How does this spam trick work
And I'm seeing more and more of these messages with the text section crafted cleverly to try and avoid blocks, and with more and more of them with these text sections large enough to defeat scanning of the message proper by the usual battery of content-based tests. I think Kami pointed this out recently, and I see that this is rapidly getting worse; we're going to need a new way to approach these, I think. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Smart Business Lists Sent: Sunday, 12 October 2003 5:44 AM To: Jonas Subject: Re: [Declude.JunkMail] How does this spam trick work Jonas, Saturday, October 11, 2003 you wrote: J I assume that they must do this to try to avoid content filtering. I J was never aware of that they could fake messages like this. I think you are viewing a message that is in multipart mime. In web mail you are viewing the html part of the message. In Imail client you are viewing the text part. These do not have to be the same and frequently the text part will be something like your client doesn't support html messages. Well crafted messages will have a text part of the message customized for those who see only text and vice versa. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ERROR: SOMEONE CRUMBLED MY MAGIC COOKIE
Doesn't the installed.bin file contain the current version number? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Monday, 13 October 2003 3:32 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] ERROR: SOMEONE CRUMBLED MY MAGIC COOKIE Just out of curiousity, is there anyway you folks could include a version resource in declude.exe to make it possible to determine the version number without having to use declude -diag? IMHO, being able to use explorer file properties would be very handy. It would be nice, but unfortunately Microsoft doesn't have any way of incorporating our version numbering system into the .exe resources. In order to do have the version in the resources, we would need to change our numbering system, and we would need to change the internal controls for version numbers. Note that with v1.76, you can just run the Declude.exe file without any arguments and it will display the version. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spammers take a Holiday?
I had a funny thing happen over the weekend, I had more items in spool/virus than in spool/spam at one point. I'm speechless. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Todd - Smart MailSent: Tuesday, 02 September 2003 8:33 AMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Spammers take a Holiday? Spam we caught yesterday was down by about 30% - 40%. Anyone else notice this? Todd Hunter Progressive Systems
RE: [Declude.JunkMail] Is the list down?
The eerie stillness was nerve wracking. I wondered who would cave in first. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Sheldon Koehler Sent: Thursday, 31 July 2003 11:32 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Is the list down? Anyone on? Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] If a tree falls in the woods [was Is the list down?]
So long as Bill didn't pick fights with all of us and drive us all off the list -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Kevin Bilbee Sent: Thursday, 31 July 2003 12:35 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] If a tree falls in the woods [was Is the list down?] I did get tossed from the list and had to resign up. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff (Lists) Sent: Thursday, July 31, 2003 9:28 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Is the list down? I don't want to go home, I want a vacation! Dear Mr. Sheldon Koehler; It is with great pleasure that I can announce that you are hereby granted an official vacation. You MUST take this vacation immediately, or forfeit the right to use it forever. To claim your official vacation, you must call this number within the next 30 seconds, or this vacation will be gone forever. Should you fail to call in time, or to take your vacation once confirmed, you will then be disallowed any further opportunities to take a vacation in the foreseeable future. Good luck and enjoy. John Tolmachoff MCSE CSSA (Moonlighting Travel Agent Extraordinaire) ;-) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelist own IP or domain
Did you enter example.com OR @example.comexample.com in your SPAMDOMAINS list? The second (with your domain, of course) should prevent the false inclusion of mailing lists with your domain on the left. side of the return address. I have a separate issue with SMTP AUTH which is complicating things, so I stuck another domain in that second field on the line for my home domain to try and fix that situation. Thanks for the suggestion though. What I really have is three issues and only two degrees of freedom to try and solve them, and the fix for any pair of issues complicates the third. The ENDSWITH suggestion appeared to me to be the least intrusive way to get all three problems worked out. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelist own IP or domain
The new SPAMDOMAINS test would also be useful, *if* everyone sending mail with a return address on your domain would be doing so from an IP that has a reverse DNS entry that matches your domain. -Scott The struggle I'm having with putting my domain in the SPAMDOMAINS list is the wide amount of inbound mail, spam and ham both, that inserts the recipient address in the address somewhere on the left-hand side of the @. It did manage to trip up a bunch of spam from places foolish enough to try and send as my domain, but I'm catching an array of list traffic now that just makes it over my HOLD threshhold because of failing SPAMDOMAINS. I'm adjusting weights and refining other filters, but if the SPAMDOMAINS test could be limited to only look at the ENDSWITH of the MAILFROM, I'd be golden. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] fresh spamdomains thread
| Are you sure that the line in your sd.txt file is exactly | msn.com hotmail.com (no spaces or other characters after |hotmail.com)? | |Yes. I copied that line and pasted it exactly and I double checked the |whitespace before I composed my questions. | |One last thing to check: Is that the last line in the sd.txt file? If so, |try adding a blank line below it. | |Otherwise, it's time for the debug mode. To use the debug mode, you can |change the LOGLEVEL LOW line in \IMail\Declude\global.cfg to LOGLEVEL |DEBUG. Then, after an E-mail arrives like the one above, you can then |switch back to LOGLEVEL LOW (the debug mode adds huge amounts of |information to the log file). You can then send me the |\IMail\spool\dec.log file (as an attachment, off this list), and I can |take a look at it to see what is happening. I looked through the logs for the rest of the day yesterday and for the early morning hours this morning, and the message that failed to add the five points for the failed SPAMHEADERS test appears to have been a fluke, because all subsequent instances appear to have functioned correctly. The msn.com line is not the last line in the sd.txt file. I can't find another instance of the test misfiring in this manner either, so I'm going to hold off on the DEBUG until I see another weird one. The majority of failures on this test return a line like Msg failed SPAMDOMAINS (Spamdomain 'msn.com' found: Address of [EMAIL PROTECTED] sent from invalid [No Reverse DNS].). which is fine, and all the rest since the message I wrote about have matched up correctly. Thanks, Scott. I'll keep an eye on it. PPS: I stayed at 1.70i2 because of concerns people had raised about i3 and i4. Has that situation been resolved? --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] fresh spamdomains thread
We haven't beaten SPAMDOMAINS sufficiently to death, so here's my contribution. I have two observations: One: I have a line in my sd.txt file that says: msn.com hotmail.com as have several of the submitted spamdomain candidate lists. I just found a message in my HOLD queue that failed SPAMDOMAINS, the header of that message is: Received: from hotmail.com [65.54.169.82] by mail.mydomain.com with ESMTP (SMTPD32-6.05) id A3A93EE1011C; Mon, 09 Jun 2003 11:11:37 -0400 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Mon, 9 Jun 2003 08:11:35 -0700 Received: from 65.128.140.138 by bay3-dav52.bay3.hotmail.com with DAV; Mon, 09 Jun 2003 15:11:35 + X-Originating-IP: [65.128.140.138] X-Originating-Email: [EMAIL PROTECTED] From: Stuff Sender [EMAIL PROTECTED] To: myuser [EMAIL PROTECTED] Subject: Date: Mon, 9 Jun 2003 10:35:27 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_000_0003_01C32E72.D7B7C400 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: MSN Mail 8.00.0022.3100 X-MimeOLE: Produced By Microsoft MimeOLE V8.00.0022.3100 Message-ID: [EMAIL PROTECTED] X-OriginalArrivalTime: 09 Jun 2003 15:11:35.0576 (UTC) FILETIME=[6AF41180:01C32E99] X-RBL-Warning: Spamdomains X-Declude-Sender: [EMAIL PROTECTED] [65.54.169.82] X-Note: Total spam weight of this E-mail is 18. X-Note: QueInControl: Da3a911c.SMD (1) X-Note: Tests failed: NJABL, NOPOSTMASTER, NOABUSE, IPNOTINMX, NOLEGITCONTENT, SPAMDOMAINS, WEIGHT10, WEIGHT14 X-Note: Message followed: UNITED STATES-destination X-Note: RDNS Real Origin: bay3-dav52.bay3.hotmail.com[65.54.169.82] But in the log file I find this line: 06/09/2003 11:12:07 Qa3a911c Msg failed SPAMDOMAINS (Spamdomain 'msn.com' found: Address of [EMAIL PROTECTED] sent from invalid bay3-dav52.bay3.hotmail.com.). Action=WARN. This is not the behavior I expected. Two: Although SPAMDOMAINS is listed in the list of failed tests in my header above, this is a line from the log file: 06/09/2003 11:12:07 Qa3a911c NJABL:8 NOPOSTMASTER:5 NOABUSE:5 . Total weight = 18 Notice the absence of SPAMDOMAINS:5 in that list, which is what I might have expected there. My SPAMDOMAINS test is invoked this way: SPAMDOMAINS spamdomains C:\IMail\Declude\sd.txt x 5 0 It appears that something failed to connect somewhere in processing. I'm guessing that message should have reached 23 points. I'm going to comb the log for more instances of SPAMDOMAINS and see what else is happening, but this little bit was unsettling. -- John Shacklett --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelist after 200 entries
Maybe the declude -diag output could be tweaked to give a quick count of whitelist lines. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Saturday, 31 May 2003 2:28 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Whitelist after 200 entries Does anyone know the behavior of the whitelist feature in the global config file when 200 entries are reached? It appears to randomly ignore whitelist entries. Is this correct? If there are more than 200 whitelist entries in the global.cfg file, the first entries will get overwritten by the later ones. For example, if you have 210 whitelist entries, the first 10 would be ignored. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Reference documents needed
It constantly occurs to me, as it has to many others who have mentioned this previously, that what we really need is a FAQ compilation that covers customization and best-practices for various situations and integration of the add-on tools and who knows what else. Search the archives hasn't proven to be a very effective recommendation all the time. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Wednesday, 26 March 2003 1:31 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Reference documents needed In order to make the most use of Declude's power in the shortest time possible, I would need a couple of documents (hopefully they exist): 1. A reference list (beyond the HTML manual at www.declude.com/JunkMail/manual.html) that lists every single variable available and what it represents (eventually with a short example). The manual should list all the variables (except ones that have been added since the latest beta). I'll see if we can add examples to the manual. 2. A complete list of all the tests available in Declude junk mail with a detailed description of their use? That's impossible, unfortunately, as Declude JunkMail can use spam tests that haven't even been created yet. For DNS-based tests, http://www.declude.com/junkmail/support/ip4r.htm has the list of them all (however, most people will use just the ones that are already defined in Declude JunkMail). When Declude JunkMail was first started, there were really just 2 tests (RBL and ORBS), so there wasn't any need to worry about documenting test types. You could just look in the global.cfg file to see what tests were available. However, as things have progressed, I think we'll need to add a table with a list of all the test types. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Log Analyzer - Comments Needed
Yes, me too please. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff Sent: Friday, 28 February 2003 9:25 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed I have a beta available and I am looking for individuals to test it out. If you are interested the beta will be made available as early as Monday. I would be interested. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude JunkMail v1.66 (beta) released
While we're beating this into the ground like a tentpeg: including, or specifically excluding, $default$.junkmail? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Friday, 17 January 2003 3:41 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Declude JunkMail v1.66 (beta) released Could I possibly ask another question? This is replacing the Whitelist FROM? Whitelist TO? No, those will still work as they have. The WHITELISTFILE option is a new option (for the .junkmail files). New releases are designed to work with older configuration files in almost all cases. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail Forum List Problems?
I'm subscribed to the digest version and didn't receive yesterday's digest either. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Wednesday, 15 January 2003 3:40 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Imail Forum List Problems? I know this is off subject for this forum, but has anyone experienced any problems posting to the Imail Forum list. I have posted several messages, but they have not appeared and I haven't seen anything posted since yesterday around 6pm. Thanks for the info. I thought something wasn't right -- I just checked, and we haven't gotten anything since last night around 6PM either. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Opinion on bulk mailers
Well, I did only say tempted. I have been pretty heavy handed knocking off /24 blocks however. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff Sent: Tuesday, 14 January 2003 10:48 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Opinion on bulk mailers My current question goes in the opposite direction. I'm tempted to blacklist the entire IP range held by rackspace.com. It seems that every third item in my HOLD folder lately comes from an address in rackspace. You would not want to blacklist Scott, would you? I think he said one time one of his servers is there. Or if not him, some one on this list did. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Comments in filters
Here's my take on why I endorse John's request. I understand Dan's suggestion and agree with its intent, I just don't want to raise my log level yet. I'm a MID loglevel person, and happy to be there otherwise. When Declude calls my IPFILE test and nabs a message for failing, the logfile line includes the comment from the line in my IPFILE that failed. When Declude calls my FROMFILE test and nabs the message for failing, the logfile line includes the comment from the line in my FROMFILE that failed. My IPFILE has comments which identify the presumed domain of the IP address, and my FROMFILE has other comments that are similarly relevant and which remind me why I blacklisted them. When Declude runs one of my filter tests and nabs a message for failing, the logfile tells which line in the filter caused the match. [Caused isn't the right word, but work with me here.] So then, if I'm curious, I open the filter file in Notepad and manually count the lines until I find the one that matched, and then I can take corrective action if it's called for. I do this frequently, and I'm saddened that John's suggestion never occurred to me previously. rant And before someone chimes in and tells me that I should be using a better text editor that contains automatic line counting, let me say THAT'S NOT THE POINT. The point is trying to bring Declude's admittedly awesome capabilities into balance. /rant -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Dan Patnode Sent: Friday, 13 December 2002 5:19 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Comments in filters Put your log level to HIGH and it shows each phrase that caught something. While its not intuitive to see which of multiple tests a given phrase belongs to, because a given email can fail multiple tests in the same package, you actually get more info. Dan On Friday, December 13, 2002 12:38, John Tolmachoff [EMAIL PROTECTED] wrote: Or, can the headers or log show what the filter was instead of a test line number? Say, add a comment after the line. Example: SUBJECT 5 CONTAINS FREE Subject contains free. No, that is not possible. Feature request! :)) That could be useful to see in the logs why it was caught instead of just the line number. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Do spammers rank recipients
Our CFO, who has never given his email address out to ANYONE! fills out every reader reply card for a free trade magazine, belongs to the board of something called the Financial Executives Institute, and answers every telephone survey-research phone call that crosses his desk. I suspect your Veep has similar skeletons in his flipper door. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Sean Fahey Sent: Monday, 09 December 2002 2:34 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Do spammers rank recipients Disgruntled employee sign him up for porno? We're trying to figure out why my boss -- a vice president -- receives much more spamthan I do. I get about two spam a day, while he gets 50. His email address is not on any of our public --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Should postmaster or abuse accept all e-mail?
Title: Message I think that misses the point of this thread: If I'm bouncing [or rejecting outright] mail from a host or domain, then they have no appeal recourse unless I can open up a safe channel for _SOME_ mail to flow through. On the other hand, I have abuse@mydomains and postmaster@mydomains both whitelisted and all I get areSPAM solicitations from hosting providers I wouldn't leave Michael Jackson's kids with, much less my domains. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of [EMAIL PROTECTED]Sent: Wednesday, 27 November 2002 3:47 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Should postmaster or abuse accept all e-mail? It has been my findings that most spam that really needs to be deleted comes from servers that have neither a postmaster@ or abuse@. Personally, I feel its a waste of resources to try and bounce it back to those addresses. If they have no A / MX record and are on a blacklists, they need to be completely ignored :). Respectfully,Phillip B. HolmesMedia Resolutions Inc.Macromedia Alliance Partnerhttp://www.mediares.com[EMAIL PROTECTED]1-888-395-4678 | Option 8 Ext. 101972-889-0201 | Option 8 Ext. 101/* Please send support requests to[EMAIL PROTECTED] */ -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darrell L.Sent: Wednesday, November 27, 2002 2:14 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Should postmaster or abuse accept all e-mail? Marc, We actually whitelist the following addresses WHITELIST TO postmaster@ WHITELIST TO abuse@ For the mentioned reasons below. Darrell -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Marc CatuognoSent: Wednesday, November 27, 2002 3:06 PMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Should postmaster or abuse accept all e-mail? I've been using the delete action on a blacklist test for Junkmail. I also have a few ip ranges blocked. I was thinking that if anyone with any brains figured out that they were blocked that maybe they would e-mail postmaster or abuse. Should I have a separate junkmail file for one or both of these address that allows all mail through? This way there is an appeal process. Is there an RFC for this? Thanks - Marc
RE: [Declude.JunkMail] Are spammers idiots??
We just reclaimed an old domain name. We had it for a couple of years, then it expired and some bandits in the Philippines grabbed it and held it hostage, and when it expired again we grabbed it back. The day, and I mean the very day, that I put that domain in as an alias for our primary domain, I started receiving a flood of crap for employees that left more than five years ago. I was astounded. Talk about firing blanks. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Glenn \ WCNetSent: Thursday, 14 November 2002 3:39 PMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Are spammers idiots?? I've been clearing some mail accounts that customers have abandoned, haven't checked their mail for a couple months or longer. It's not unusual to find 4000messages or more, 20 MB or more, ALL of it spam. No one on a dial-up connection is going to wait for all that mail to download, and nobody using WebMail has the patience to wade through all that debris. My point being that spammerscan easilyoverload a mail server, sap up all the drive space if some kind of spam control isn't in place. What would be the point? They're cutting their own throats, so to speak. Glenn Z.
RE: Re: [Declude.JunkMail] Adultery
I'd love to give your program a try. Written between the lines of the post I first started this thread with: I have a nagging problem with porn and I have been charged with cleaning it up. My challenge is that the stuff I'm seeing is stuff that my local users are sharing among themselves, so I'm going to need to develop something a little more stern than standard spam filtering. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Brian Milburn Sent: Tuesday, 12 November 2002 12:31 PM To: [EMAIL PROTECTED] Subject: DSN:Re: [Declude.JunkMail] Adultery Hi John, We do not have the docs finished yet, but the program is available if you would care to test it. There is a 'Declude style' configuration file and it is completely commented so it is easy to use without the docs. At this point we are still open to suggestions and comments. We hope to begin the Linux translation by Dec 1, so the feature set and program defaults are not locked down as yet. Let me know and I will send you the files and a license key. Brian On 11/08/02 1:45pm you wrote... Great. Please keep us posted on the progress. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 3rd Party Hold Readers
I like Spam Review, and I use it every single day. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Keith Johnson Sent: Tuesday, 12 November 2002 1:40 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] 3rd Party Hold Readers I've seen several emails come thru referencing 3rd party hold readers/reviewers. Does anyone have a pref on one. Also, I have gotten some feedback from Scott (much apprec.) on what he sees as a initial setup for guarding against spam. I would like to see what options others have unlocked or tweeked in the field (i.e. which tests you hold/bounce/delete, which work for you). Thanks for the aid (Realizing this is a loaded question) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re: [Declude.JunkMail] Adultery
I am a private company, we have an Acceptable Use Policy, I have the backing of Upper Management, I've sent hate mail to our users warning them of dire consequences, I understand the issue and the steps required to deal with it. What I'm working on now is enforcement. This isn't Johnny Cochran, this is the other half of Law and Order. Upper Management has charged me with detection and enforcement. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Bill Beach Sent: Tuesday, 12 November 2002 2:04 PM To: [EMAIL PROTECTED] Subject: RE: Re: [Declude.JunkMail] Adultery My challenge is that the stuff I'm seeing is stuff that my local users are sharing among themselves, so I'm going to need to develop something a little more stern than standard spam filtering. If you're a private company, which it appears that you are, how about starting with an Acceptable Use Policy? Then if that doesn't work get the backing from HR/upper management and let the abusers know that you're watching their e-mail and if they don't cease and desist they will be dismissed (hey look, I'm Johnny Cochran). Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Adultery
Is the late-lamented never made it out of beta ADULT test completely gone now? -- John Shacklett www.continentaloffice.com [EMAIL PROTECTED] [EMAIL PROTECTED] Why is it that if someone tells you there are 1 billion stars in the universe, you will believe them, but if someone tells you a wall has wet paint you will have to touch it to be sure? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] external clarification
Hello. I know this was covered in some detail the other day, but I'm still struggling with my own interpretation. Does this work? Will the actual values of %WEIGHT% and %MAILFROM% be calculated and passed to my blackflag program? BLACKFLAG external nonzero c:\imail\declude\blackflag.exe %WEIGHT% %MAILFROM% 0 0 -- John Shacklett www.continentaloffice.com [EMAIL PROTECTED] [EMAIL PROTECTED] Why is it that if someone tells you there are 1 billion stars in the universe, you will believe them, but if someone tells you a wall has wet paint you will have to touch it to be sure? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] More on: %COUNTRYCHAIN%
I was just in the process of composing EXACTLY the same response when Roger's reply came through. This here all_list.dat file looks odd to me, but who am I to judge. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Roger Heath Sent: Tuesday, 05 November 2002 11:05 AM To: Kami Razvan Subject: Re: [Declude.JunkMail] More on: %COUNTRYCHAIN% Reply to: Kami Razvan Re: [Declude.JunkMail] More on: %COUNTRYCHAIN% on Tuesday 9:57:48 AM I have yet to see any countries shown... it is always: [Unknown]-[APNIC Unlisted]-[ARIN Unlisted]-destination -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - K Hi; K I have: K COUNTRYCHAINX-Country-Chain: %COUNTRYCHAIN% K In the Global.cfg. K Am I to expect the country chain in all eMail headers? If yes.. Then I K am not getting it. K I have downloaded the K file:http://www.declude.com/release/162/all_list.dat and put it in the K declude folder. K Missing something? K Regards, K Kami K --- K [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] K --- K This E-mail came from the Declude.JunkMail mailing list. To K unsubscribe, just send an E-mail to [EMAIL PROTECTED], and K type unsubscribe Declude.JunkMail. The archives can be found K at http://www.mail-archive.com. K -- K ActivatorMail(tm) ver.082302 Scanned for all viruses by K www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Blocking per IP block
I understand the thought process there, but I don't agree. I have noticed a number of bulk mailers, the big commercial ones I guess, that have static and steady IPs. I have an ipfile for those. I also notice a variety of domains that I find rather transient, and I fromfile those. When I scan my spamreview window every morning, I have both the fromfile [see blacklick.txt] and the ipfile [see postgen.txt] open, and I add selected winners to one or the other as I judge appropriate. YMMV. Bear in mind that I run a mailserver for a corporate environment, so the mail sources that send legitimate stuff along with real spam issue isn't as large of a concern as I think it would be for your ISP types. If I block stuff that people are getting at work that I think isn't work-related, I can tell them to get it at home. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of John Tolmachoff Sent: Tuesday, 22 October 2002 11:19 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Blocking per IP block But use at your own risk, and I would suggest a weight system, don't just block. Good idea. Up to know, I have only done blocking by IP address in the Imail SMTP security for only IP addresses that I have tracked as send large amounts of virus over a period of time. I never thought about using a weight assignment to a list of known spammer IP addresses. Although I would like to open a discussion as to just how effective this could be, being that it seems spammers would often change IP addresses. John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. .com.br can't hurt 123greetings.comspam and more 123greetings.info free 7-day spam 1800partyshop.com a special spam 1premio.com more qves.shit 2mbb.comseasilver liquid spam 321send.com prescription spam 330w.comsalealerts 42PROMOTIONS.COMunclaimed spam 4optinonline.comcopy spam like the pros 4optinworld.com win back 20 percent of your spam actionadvertising.net free fullcolor spam addmeat.com too good to leave off admanmail.com open any spam adprosender.net here's your spam adprosolutions.com lowest spam on the web advmailpromo.comyou're being spammed advn.co.jp free spam all you can handle allbestcheapstuff.com got enough thanks allmoneyplace.com which spam is right for you allyouneedhosting.com free spam get off now anglcorp.comyour choice of spam apcxp.com promotional spam cds aps-mailer.net meet 1 million spams apsmailer.net spam is waiting apsoffers.com has to be one or the other aspoffers.com [216.240.138.108] aspnettech.com virtual spam for your friends mailer1.astronet.comyour astronet daily spam autofinancewizard.com stop popup spam now azogle.com spam insurance azoogle.com rates dropping again bargain-jungle.com get paid to spam bbwgroup.comcreditrelief bcentral.comlistbuildercentral bestcasiongambling.net crazy vegas spam bestofferbazaar.com you get a free personal spam blastdirect.com accelerate your career bluerockdove.comyou qualify for a gold spam bnb1.comany credit spam bonustree.com free government cash grants bonzi.com not my buddy bounce.2np.net did you forget spam bounce.etracks.com [209.19.106.91] bounce.x36.net unsecured delete bundlecord.com spam and links as requested buyingfrenzy.comwelcome to spam bvmmailer02.com [64.49.220.236] casinocity.com place your blocks casinoemporium.com collect your spam free casinosurvey.comspam free no purchase required casinowhales.comwho was getting these again cdsteals.comspam closeout chopower.comspam compliments of cho power clickaction.net 12 spam for the price of one clickformail.comurgent lost spam notification closeout-offers.com discount spam notice colonize.comspamize consumer-alert.net we can help you take control of your spam today consumerpackage.net spam gold consumertoday.net flonetwork shit c0olmail.comspam like the pros currentmail.com no mailfrom cuttingedgeoffers.com unclaimed spam customoffers.comautomatic deletion notice cynergen.neteven for free daily-promotions.commillions of spam at your fingertips daily-promotions.netno shipping spam dailydealdepot.com blue spam dealmate.comyour free spam is waiting dailyripple.com you CAN get spam dealdelivery.comprick bastards with no unsub link deals-central.net
RE: [Declude.JunkMail] How does a reverse lookup work from a mail server?
I get email that talks about situations like that all the time, describing mythical joys and riches beyond belief. I call it spam, and I'm looking for something that helps me control it. Do you have any suggestions? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Wednesday, 16 October 2002 1:10 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] How does a reverse lookup work from a mail server? When a message arrives at my mail server, how does the server perform the reverse lookup? It just does. :) LOL. Scott, me thinks it is time for a rest break for you. Hey wait a minute -- I know you -- you're that guy who keeps talking about this mythical thing called a week end, where people can just take a couple days off from work every single week, and find things to do that aren't work! If it sounds too good to be true G -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] More fun with logs
What is the interpretation of these lines in my dec1016.log file? 10/16/2002 16:38:28 Qce29136 R1 Message OK 10/16/2002 16:38:28 Qce29136 R2 Message OK 10/16/2002 16:38:28 Qce29136 R3 Message OK 10/16/2002 16:38:28 Qce29136 R4 Message OK 10/16/2002 16:38:28 Qce29136 R5 Message OK 10/16/2002 16:38:28 Qce29136 R6 Message OK 10/16/2002 16:38:28 Qce29136 L7 Message OK They only show up sporadically. I'm using a LOGLEVEL MID setting. I know I've read the answer before and I can't seem to find the right search term to unearth the answer in the archives. -- John Shacklett www.continentaloffice.com [EMAIL PROTECTED] [EMAIL PROTECTED] I'll keep it short and sweet. Family. Religion. Friendship. These are the three demons you must slay if you wish to succeed in business. - Charles Montgomery Burns --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Suggestion
I'm having a memory failure here. What does the LOG_OK setting in the global.cfg file control and what are its options, or do I have a line left in mine from the deep dark recesses of Declude past? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Thursday, 10 October 2002 1:13 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Suggestion One thing that would be very helpful to us (and maybe others in this forum), would be that a message that passes all tests simply gets marked like: 10/09/2002 00:21:30 Qaec9164 L1 Message OK Is it possible to include the FROM, TO, and SUBJECT for these as well? I know it might add overhead/size to the logging procedure, but I assume you have to read these in anyways prior to the logging. Currently, Declude JunkMail can log the to/from/subject at LOGLEVEL MID, but I believe that only works for E-mails that fail at least one spam test. I'll see if we might be able to add an option that would allow you to have that information logged, even if the E-mail did not fail any tests. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Suggestion
That's what I thought. I just reread the Suggestion posts again and I understand now that the extra functionality being requested is the To:/From:/Subject: part. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Thursday, 10 October 2002 3:47 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Suggestion I'm having a memory failure here. What does the LOG_OK setting in the global.cfg file control and what are its options, or do I have a line left in mine from the deep dark recesses of Declude past? LOG_OK NONE will prevent the Message OK lines from being added to the log (to help keep the size of the log files down). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SpamReview Request - Delete All
The buttons don't seem that useful to me, but I would like to mention that I still see the problem where clicking an existing button too quickly in succession makes SpamReview bomb with an error box that says Run-time error '55': File already open. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Tom Schwarz Sent: Wednesday, 25 September 2002 6:57 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] SpamReview Request - Delete All Roger, Using standard windows select capibilities you may select multiple entries with the Shift and Ctrl keys or select all entries using Ctrl-A. After selecting multiple entries you can use all the normal functions such as Delete or Move just like you would use them on one selected entry. Will this take care of your request or would the buttons be better? Tom -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Roger Heath Sent: Tuesday, September 24, 2002 9:19 PM To: Tom Subject: [Declude.JunkMail] SpamReview Request - Delete All Importance: Low Ok, SpamReview mailFrom is working great for me with the proper string detect...!!! Now for another request. two more buttons: Delete All - Deletes all entries. Delete All and Exit - Deletes all entries then exits (deleting deleted if switch is 'on') This is really want is needed. This way one may inspect select messages and manage them then delete the rest in one blow. This will save me even more time from an already great time saving program. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SpamReview Request - Delete All
I tend to do it the same way, and I've nearly perfected the perfect cadence that avoids the near occasion of crash, but I get into someplace like the doggone yahoo.com messages [I sort by mailfrom domain] where I need to eyeball them individually, and I get trigger happy sometimes. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Tom Schwarz Sent: Wednesday, 25 September 2002 1:55 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] SpamReview Request - Delete All John, I will look into this problem again. I review and don't delete anything until all that is left in the list is email to delete. This resolved my happy finger problem where I was delete email by accident. Regarding the Delete All button... If I add it, it will be optional. I am concerned about space on the screen. Tom -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of John Shacklett Sent: Wednesday, September 25, 2002 11:19 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] SpamReview Request - Delete All Importance: Low The buttons don't seem that useful to me, but I would like to mention that I still see the problem where clicking an existing button too quickly in succession makes SpamReview bomb with an error box that says Run-time error '55': File already open. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Tom Schwarz Sent: Wednesday, 25 September 2002 6:57 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] SpamReview Request - Delete All Roger, Using standard windows select capibilities you may select multiple entries with the Shift and Ctrl keys or select all entries using Ctrl-A. After selecting multiple entries you can use all the normal functions such as Delete or Move just like you would use them on one selected entry. Will this take care of your request or would the buttons be better? Tom -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Roger Heath Sent: Tuesday, September 24, 2002 9:19 PM To: Tom Subject: [Declude.JunkMail] SpamReview Request - Delete All Importance: Low Ok, SpamReview mailFrom is working great for me with the proper string detect...!!! Now for another request. two more buttons: Delete All - Deletes all entries. Delete All and Exit - Deletes all entries then exits (deleting deleted if switch is 'on') This is really want is needed. This way one may inspect select messages and manage them then delete the rest in one blow. This will save me even more time from an already great time saving program. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re: [Declude.JunkMail] Country file and codes
Right, but isn't that the power of the filter tests? I use a complete list of ccTLD codes that I downloaded from IANA and I jiggled the individual weights based on the kind of mail I process here, but I wouldn't imagine that my weight choices would be appropriate for anyone else anywhere else. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Markus Gufler Sent: Tuesday, 24 September 2002 8:30 AM To: [EMAIL PROTECTED] Subject: Re: Re: [Declude.JunkMail] Country file and codes I'm not sure if you realized that this list contains great part of european countries. (Germany, Italy, Austria, France, Finnland, Netherlands...) Do you realy want to stamp all messages from this countries as spam? Or said in other words: Are you sure that in a report of recieved spams this countries are on top? I think a list like this can only be used in a weighting system and there only with 1 to 5 points using 20 as limit. Scott: What about the country-test (IP2Country-lookup)? - I believe you has talked about this some months ago. Markus -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Im Auftrag von Kevin (Linkbrokers Support) Gesendet: Dienstag, 24. September 2002 14:14 An: [EMAIL PROTECTED] Betreff: DSN:Re: [Declude.JunkMail] Country file and codes Hi my name is kevin; I just bought declude a few months back but really haven't had a chance to fine tune it. Tom - I'm curious about this country code file. I filter allot of these in the local mail application and it would be nice if junk mail would just delete these when they come through, My question is this. Do I just copy this example in to my junkmail global.cfg file? and where do I insert it. kevin - Original Message - From: Tom [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, September 24, 2002 3:12 AM Subject: RE: [Declude.JunkMail] Country file and codes We can look into doing a match at the end (ENDSWITH, as the filter would use). Ok, so I made up a filter file. Here is an example if any is curious: - MAILFROM 1 ENDSWITH .ar MAILFROM 1 ENDSWITH .at MAILFROM 1 ENDSWITH .au MAILFROM 1 ENDSWITH .be MAILFROM 1 ENDSWITH .br MAILFROM 1 ENDSWITH .ch MAILFROM 1 ENDSWITH .cn MAILFROM 1 ENDSWITH .de MAILFROM 1 ENDSWITH .dk MAILFROM 1 ENDSWITH .es MAILFROM 1 ENDSWITH .fi MAILFROM 1 ENDSWITH .fr MAILFROM 1 ENDSWITH .gr MAILFROM 1 ENDSWITH .hk MAILFROM 1 ENDSWITH .il MAILFROM 1 ENDSWITH .it MAILFROM 1 ENDSWITH .jp MAILFROM 1 ENDSWITH .kr MAILFROM 1 ENDSWITH .lt MAILFROM 1 ENDSWITH .nl MAILFROM 1 ENDSWITH .no MAILFROM 1 ENDSWITH .ru MAILFROM 1 ENDSWITH .se MAILFROM 1 ENDSWITH .sk MAILFROM 1 ENDSWITH .tw MAILFROM 1 ENDSWITH .ua MAILFROM 1 ENDSWITH .uk MAILFROM 1 ENDSWITH .uy MAILFROM 1 ENDSWITH .za - Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. [Reliable Web Hosting by - http://www.linkbrokers.com/hosting.cfm] [This E-mail scanned for viruses by LinkBrokers EMail Service] [This E-mail scanned for spam mail against orbs and spamcop] [Reliable Web Hosting by - http://www.linkbrokers.com/hosting.cfm] [This E-mail scanned for viruses by LinkBrokers EMail Service] [This E-mail scanned for spam mail against orbs and spamcop] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] I spammed myself again!
I thought I had a handle on all this, but this message from Timothy got snagged by my MYFILTER filter test, which is looking for Saf-E Mail in the body and applying punitive weights, but I received a message in my own personal Inbox overnight from Saf-E which didn't trip the word filter, or HELOBOGUS, or BADHEADERS, or SPAMHEADERS, or anything else. X-Note: Tests failed: None. How frustrating. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Timothy C. Bohen Sent: Thursday, July 11, 2002 4:26 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] I spammed myself again! I have the beta installed can someone give me an idiots guide to adding the HELO test to hopefully try and stop these? Thanks Timothy C. Bohen CMSInter.Net LLC / Crystal MicroSystems LLC === web : www.cmsinter.net email : [EMAIL PROTECTED] phone : 989.235.5100 x222 fax : 989.235.5151 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Tom Sent: Friday, July 05, 2002 6:12 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] I spammed myself again! Here's another reason why we get spammed from ourselves, read the following footer from acknowledged spam message: - This email was sent to you via Saf-E Mail Systems. Your email address was automatically inserted into the To and From addresses to eliminate undeliverables which waste bandwidth and cause internet congestion. Your email or webserver IS NOT being used for the sending of this mail. No-one else is receiving emails from your address. You may utilize the removal link below if you do not wish to receive this mailing. Please Remove Me click here so they know it's a good address! Saf-E Mail Systems, PO Box 116-3015 San Rafael de Heredia, CR 011-506-267-7139 - Stick this in your filter list! I guess were all going to have to stick ourselves into the KILL List! Regards, Tom --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] I spammed myself again!
My profound apologies to one and all. I'm not having a good morning [I had an afternoon of hooky planned for the golf course, and it's not going to happen after all], so I'm making bad decisions. I could send the headers, but here are two lines from the declude log that are more to the point: 07/11/2002 20:44:50 Q2676128 DSBL:4 SPAMCOP:8 BADHEADERS:8 FOREIGN:3 SNIFFER:11 MYFILTER:15 . Total weight = 49 07/11/2002 20:44:50 Q2676128 This E-mail was whitelisted - automatically passing all spam tests And of course, I had my own domain whitelisted and the $domain business made it look like my domain. Now I need to go browse the archives and reread the posts from earlier in the week that I just skimmed that discussed this very issue. I'll shut up now. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Friday, July 12, 2002 9:19 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] I spammed myself again! I thought I had a handle on all this, but this message from Timothy got snagged by my MYFILTER filter test, which is looking for Saf-E Mail in the body and applying punitive weights That's one of the major disadvantages to filtering -- you often can't receive E-mail referring to the E-mails that you are trying to block. but I received a message in my own personal Inbox overnight from Saf-E which didn't trip the word filter, or HELOBOGUS, or BADHEADERS, or SPAMHEADERS, or anything else. X-Note: Tests failed: None. How frustrating. Well a generic spam won't necessarily trigger the BADHEADERS or SPAMHEADERS tests. If you post the full headers of the E-mail, I could give you an idea of what tests it should have failed. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: Is there a feature list for the JunkMail beta? Fw: [Declude.JunkMail] New filter test
This is where I shop for new features: http://www.declude.com/relnotes.htm -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Darin T. Cox Sent: Thursday, June 27, 2002 3:24 PM To: [EMAIL PROTECTED] Subject: Re: Is there a feature list for the JunkMail beta? Fw: [Declude.JunkMail] New filter test Thanks, Rick. So to clarify, the difference between 1.53 and 1.55 are these additional filters? Sorry if you've answered this previously, I just joined the list. Darin. - Original Message - From: Rick Davidson [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, June 27, 2002 3:15 PM Subject: Is there a feature list for the JunkMail beta? Fw: [Declude.JunkMail] New filter test Is there a feature list for the JunkMail beta? Sure is Have a great day! Rick Davidson Buckeye Internet Services www.buckeyeweb.com 440-953-1900 - - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, June 18, 2002 3:51 PM Subject: [Declude.JunkMail] New filter test Declude JunkMail v1.55 (beta) now includes the ability to use some basic filtering. First, you need to define the test, by adding a line like the following to your global.cfg file: MYFILTER filter c:\IMail\Declude\myfilter.txt x 5 0 Then, you need to create the filter file (myfilter.txt in the example above). Each line contains one filter, in the format location weight filtertype filtertext, where location is where the filter will be looking (currently, this can be SUBJECT, HELO, BODY, MAILFROM, REMOTEIP or REVDNS), weight is the weight to add to the E-mail if the filter matches (normally 0), filtertype is currently either CONTAINS or STARTSWITH, and filtertext is the text to look for (case insensitive, so hello will match both hello and hELLo). For example: HELO 8 CONTAINS $domain SUBJECT 3 CONTAINS enlarge MAILFROM 3 STARTSWITH $success$@ The first one would look for HELO/EHLO text that contains $domain in it (and if it does, a weight of 10 will be added to the weight of the E-mail), the second one would look for an E-mail that contains enlarge in it and add 3 to the weight of the E-mail, and the last one would look for a return address beginning with $success$@ (and add 3 to the weight of the E-mail if there is a match). Note that the weights are in addition to whatever action you have set for the test, so if you have: MYFILTER WARN X-Warning: This E-mail was filtered. WEIGHT10 HOLD in the \IMail\Declude\$default$.JunkMail, an E-mail with $domain in the HELO/EHLO text would be held and have a warning in the headers, and be held (since the MYFILTER test was defined to have a weight of 5, and the $domain in the HELO/EHLO added 8 to the weight). You can also use negative weights, such as: REVDNS -5 CONTAINS yahoo.com -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Could you explain HELOBOGUS?
I'm getting similar messages for OUTBOUND messages from users of my own domain. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Helpdesk Sent: Friday, June 07, 2002 3:42 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Could you explain HELOBOGUS? Scott, Could you explain HELOBOGUS? I see the following entries in my log file - Msg failed HELOBOGUS (Domain engrmail1.engr.psu.edu has no MX/A records.). Msg failed HELOBOGUS (Domain bur05.standardsteel.com has no MX/A records.). Msg failed HELOBOGUS (Domain mail12.w-advertising.com has no MX/A records.). Msg failed HELOBOGUS (Domain smithers.ltdcommodities.com has no MX/A records.). Msg failed HELOBOGUS (Domain bmailrly01.starwave.com has no MX/A records.). I believe all the domains (psu.edu, standardsteel.com, etc) have MX/A records so I'm not sure what the test is doing. Thanks, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Wish List
Tom, what is the format for the filters? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Tom Schwarz Sent: Monday, May 20, 2002 5:24 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Wish List I'm already doing this. I have a program on the server that runs 24x7 and checks a specific email account every minute. In my case the email account is [EMAIL PROTECTED] This works with IMail Rules file. The process is as follows: You, as an email users, forward the email in question to [EMAIL PROTECTED] This program sees the email, strips it down, and replys to you with information about what email address it is going to add to the IMail rules. If you reply to this email it is added to your Rules and IMail takes care of all email from that address in the future. I could add this to SpamReview, if you like and it would work in the Out-Of-Office Mode, or make it a seperate program. However, as Scott points out it will not be perfect. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Monday, May 20, 2002 4:09 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Wish List Would it not be great if we could assign an e-Mail or a number of e-Mails that if someone sends a message to they will automatically get blacklisted? This would immediately save all the junk they will manage to send through. It is a good idea. The question though is what to block -- the remote mailserver, the return address, or something else? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Spam/Unsolicited Faxes
http://www.moed.uscourts.gov/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Todd Holt Sent: Monday, April 15, 2002 4:50 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spam/Unsolicited Faxes Everyone should advertise whatever it is that you do to them :-))) We need that number! Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Eje Gustafsson Sent: Monday, April 15, 2002 3:51 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spam/Unsolicited Faxes This was posted on a different mailinglist. Anyone has teh fax number for the Eastern District of Missouri handy ? -evil grin- The U.S. District Court for the Eastern District of Missouri has apparently declared unconstitutional the ban on unsolicited faxes contained in the Telephone Consumer Protection Act (TCPA), 47 U.S.C. 227. This decision could be overturned on appeal, particularly if the Court of Appeals begins receiving large numbers of faxed advertisements. If it is upheld, however, anti-spam laws/regulations could also be more difficult to enforce. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] HELP: I just got listed on ORDB
I have a 6.06 installation, and I have a combination of differently-sized subnets in my local address table, and I have never seen this happen. For example, my IMail server itself sits in a 255.255.255.240 netmask. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Scott MacLeanSent: Thursday, March 28, 2002 1:59 PMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] HELP: I just got listed on ORDBI'm running 6.06. Can anyone else running 6.06 confirm this behavior?At 01:46 PM 3/28/2002, R. Scott Perry wrote: oops. Sorry, that's what I meant. 216.13.3.192 for the IP and 255.255.255.192 for the netmask, just as you said. When doing so, it acted as an open relay to any connection.Ah, that's not good. Unless there was an oversight somewhere, that sounds like a bug in IMail. -Scott---[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". You can E-mail[EMAIL PROTECTED] for assistance. You can visit our website at http://www.declude.com .___Scott MacLean[EMAIL PROTECTED]ICQ: 9184011http://www.nerosoft.com
RE: [Declude.JunkMail] SortMonster Sniffer
I had a similar sort of morning, got the sniffer demo, and I've been
watching the mailserver slowly die. My declude log for today has a lot of
external program didn't respond in an hour so skip it messages, so I
commented sniffer back out of my global.cfg. Took a while, but all the gunk
in the queue flushed out and I'm back to more normal speed.
And I am running IMail 6, not 7, and Declude 1.44.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Scott Phelps
Sent: Thursday, March 21, 2002 12:09 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] SortMonster Sniffer
Sorry if this is off-topic, the more direct mailing list is closed to
non-subscribers.
My setup:
Twin 1G proc.
1G RAM
20x5G 10K RPM SCSI RAID 5 for OS + programs + mailboxes (Separate Adaptec
Controller) (C: D:)
20G 10K RPM Mirrored SCSI Set for spool + logging (Separate Adaptec
Controller) (E:)
Running:
Latest Imail + hotfixes/patches
Declude Virus (latest beta)
Declude JunkMail (latest beta)
With the recent demise of ORBZ, I decided to try out Sniffer. My results
were less than pleasing :-(
I first defined SNIFFER as an external test to fit into my weighting scheme:
SNIFFER externalnonzero E:\sniffer\SNFDemo.exe 15 0
It seemed to work right away, there were no errors (immediately) in the logs
of Declude or Sniffer. Sniffer was checking (passing + failing) messages
left and right. Declude was also processing SPAM and VIRUS messages properly
(test messages were sent through and verified for each instance).
After several minutes I noticed that the number of running processes had
jumped a bit, and became concerned. Looking back at a refreshed copy of the
logfiles for both programs (Sniffer + Declude) I saw no problems reported
but an occasional timeout of a virus scanning process. This isn't normal,
and I have more machine than necessary. Processes kept piling up and
eventually everything slowed to a halt eventually killing SMTPD32. There
were so many outstanding declude, smtp32, and SNFDemo processes that I had
to restart the machine for a quick out.
Is there a problem running these 3 (2.5?) products together?
With no errors logged other than virus scanner timeouts, I don't have much
to go on. Declude, and Sniffer were working properly right up until their
demise as far as the logging goes.
** Is it possible Sniffer and Declude Virus were stepping on each others
toes accessing the file for scanning?
¤º°`°º¤ø,¸¸,ø¤º°`°º¤øø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤øø¤º°`°º¤ø
splehP ttocS
rotartsinimdA smetsyS TN
secivreS tenretnI renroKbeW
moc.renrokbew@pttocs
moc.renrokbew.www
$a=@ARGV;while($a){$a=~s/(.$)//;$b=$b.$1;}print $b\n;
¤º°`°º¤ø,¸¸,ø¤º°`°º¤øø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤øø¤º°`°º¤ø
---
[ This E-mail scanned for viruses by www.WebKorner.com ]
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
RE: [Declude.JunkMail] Identifying countries
I tried to do exactly this with a fromfile list of TLDs a couple of weeks ago, but crashed miserably on the rocks of .co matching to .com as well. A way to weight individual countries differently would be even better. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Monday, March 18, 2002 1:16 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Identifying countries Several people have requested a way for Declude JunkMail to identify E-mail from certain countries that commonly send a lot of spam. We did not work on this in the past, as most companies can not block all E-mail from certain countries. However, with the weighting system, this may be a useful test. As those who follow the IMail Forum mailing list know, we are working on a way for Declude JunkMail to identify the country/countries that an E-mail travels through to reach its destination. Rather than rely on the host name of the sending mail server (which is often incorrect, or a .com domain), we wanted to find a way to determine the origin of the E-mail based on the IP address. We searched for a long time to find a way to do this, thinking it was nearly impossible, but have finally found a way to do it (without having our customers have to pay over $300/year for the IP/Country data). To see it in action, you can go to http://www.DNSstuff.com and use the Reverse DNS Lookup or IPWHOIS lookup, both of which will return the country the IP is located in. So, the question now becomes, what to do with this data? Right now, we are adding a %COUNTRYCHAIN% variable that allows you to have a header such as X-Country-Chain: Poland-China-Destination (for an E-mail originating in Poland and routed through a mail server in China). I'm guessing the best use would be a way to have a weight set up for certain countries. For example, an E-mail from China or Korea may start off with a weight of 5, whereas an E-mail from Switzerland could start off with a weight of -2 (which would be useful for mail servers located in Switzerland, who likely do not get much spam directly from other mailservers in their country). Is there a better way to handle countries (such as adding an option for a blacklist, similar to the sender blacklists), or other ways the country information might be useful? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] fromfile
I read this: First, you need to create a text file that lists one address or domain per line, followed by the reason for blocking it. For example, @example.com This domain sends spam. or [EMAIL PROTECTED] This guy was mailbombing us. To block a domain, you can either use the format @example.com to block just example.com, or you can use just example.com which would block mail from [EMAIL PROTECTED], [EMAIL PROTECTED], and even [EMAIL PROTECTED]. If I put in example.co or even just .co, will it still block mail from [EMAIL PROTECTED]? I think I read this to mean there was an implied wildcard to the left of whatever is listed, but not to the right; is this a correct interpretation? -- John Shacklett www.continentaloffice.com [EMAIL PROTECTED] [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] fromfile
That makes sense. I was thinking about the question that was posed the other day about having a foreign domains test, so I made a fromfile list of foreign top-level domains. But .co for Colombia catches all of the .com addresses. Back to the drawing board. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Wednesday, February 27, 2002 3:47 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] fromfile If I put in example.co or even just .co, will it still block mail from [EMAIL PROTECTED]? Yes, it will. I think I read this to mean there was an implied wildcard to the left of whatever is listed, but not to the right; is this a correct interpretation? There are no wildcards. Declude just looks for a exact match. If you tell it to look for @example.com, it will only match users with @example.com in their E-mail address. If you tell it to look for .co, it will look for addresses with .co in it ([EMAIL PROTECTED], [EMAIL PROTECTED], etc.). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Spam Review Update v1.0.7
I'm getting the weight just fine. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Grant Griffith Sent: Monday, February 04, 2002 11:40 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spam Review Update v1.0.7 Noticed after updating to v1.0.12 this morning that the weight is no longer appearing. The warnings are showing, but the warning is always blank. Sincerely, Grant Griffith, Vice President EI8HT LEGS Web Management Co., Inc. http://www.getafreewebsite.com 877-483-3393 ||-Original Message- ||From: [EMAIL PROTECTED] ||[mailto:[EMAIL PROTECTED]]On Behalf Of Don Schreiner ||Sent: Monday, February 04, 2002 11:39 AM ||To: [EMAIL PROTECTED] ||Subject: RE: [Declude.JunkMail] Spam Review Update v1.0.7 || || ||I agree the sort feature would be a big help. BTW, love the add to ||kill.lst feature. Used properly it is a big time saver. || ||-Don || ||-Original Message- ||From: [EMAIL PROTECTED] ||[mailto:[EMAIL PROTECTED]] On Behalf Of Todd Holt ||Sent: Monday, February 04, 2002 10:41 AM ||To: [EMAIL PROTECTED] ||Subject: RE: [Declude.JunkMail] Spam Review Update v1.0.7 || ||I second this!! || ||Todd || ||-Original Message- ||From: [EMAIL PROTECTED] ||[mailto:[EMAIL PROTECTED]]On Behalf Of Bennie ||Sent: Sunday, February 03, 2002 3:21 PM ||To: [EMAIL PROTECTED] ||Subject: Re: [Declude.JunkMail] Spam Review Update v1.0.7 || || ||Hey Tom, || ||I have a suggestion... :) || ||On your spam review software.. can you have a button so we can sort by ||sent ||address... then we can select all of those and delete a block at a ||time... || ||I have noticed when I am cleaning it out.. i have a number of spams ||which ||have the same return email address... once I look at one of these.. I ||know ||all the rest are spam... so it would be easier to do a Shift-click and ||select them all.. if they were sorted by return email address... || ||Have I stated this with out confusing anyone... || ||Bennie || ||- Original Message - ||From: Tom Schwarz [EMAIL PROTECTED] ||To: [EMAIL PROTECTED] ||Sent: Saturday, February 02, 2002 11:18 AM ||Subject: [Declude.JunkMail] Spam Review Update v1.0.7 || || || Power is back and life is getting back to normal so I thought I would ||post || an update. The last update I posted the first person that downloaded ||it || found a major problem. I hope that is not the case this time. || || If you are currently using SpamReview all you should need is ||spamreview.exe. || || I know the Add to Kill feature will not make everybody happy but I ||received || a mix bag of requests and this was already in testing so that is what ||you || get for now. I will add other similar features later. I have some ||code ||to || restart the smtp service on a 2000 computer but don't know if it will ||work || on NT. If you are a vb programmer and have code that you know will ||restart || a service on NT and/or 2000 and are willing to share it please email ||it to || me. I am thinking of allowing you to restart the smtp service from || SpamReview. || || http://www.slsoft.com/spamreview.htm || || || v1.0.7 New Features || Add to Kill - You can now add a From email to the IMail kill.lst || file. The SMTP service must be restarted for the changes to kill.lst ||to ||take || effect. (note: future versions may allow you to add to other exclusion || lists). || Virus EMail can now be reviewed. You must specify the path to the || virus hold folder. It's the same path specified in your virus.cfg file ||as || VIRDIR D:\IMail1\spool\virus. You cannot view Virus EMail as HTML ||and ||you || can not Return the email to the Que. The Deleted and Hold folders for ||the || Virus feature are located under your Virus folder. || A new Settings feature allows you to truncate the message to a || given number of bytes. This will speed up your processing when the ||email || includes a large attachment. This setting is Truncate Message Size ||To? ||and || is specified in Bytes. Zero bytes retrieves the entire message. || Clear Spam Deleted Folder and Clear Virus Deleted Folder features || allow you to clear out the Deleted folders. This process cannot be ||reversed. || || || || || ||--- ||[This E-mail scanned for viruses by Declude Virus] || ||--- ||[This E-mail was scanned for viruses by Declude Virus ||(http://www.declude.com)] || ||--- || ||This E-mail came from the Declude.JunkMail mailing list. To ||unsubscribe, just send an E-mail to [EMAIL PROTECTED], and ||type unsubscribe Declude.JunkMail. You can E-mail ||[EMAIL PROTECTED] for assistance. You can visit our web ||site at http://www.declude.com . ||--- ||[This E-mail scanned for viruses by Declude Virus] || || ||--- ||[This E-mail scanned for viruses by Declude Virus] || ||--- ||[This E-mail was scanned for viruses by Declude Virus ||(http://www.declude.com)] || ||--- || ||This E-mail came from the Declude.JunkMail mailing list. To ||unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
[Declude.JunkMail] header confusion
Good morning, all. I have a sequence of XINHEADER lines defined in my global.cfg, many based on suggestions from Roger Heath and others. They look something like: XINHEADER X-Note: Total spam weight of this E-mail is %WEIGHT%. XINHEADER X-Note: QueInControl: %QUEUENAME% (%NRECIPS%) XINHEADER X-Note: Tests failed: %testsfailed% XINHEADER X-Note: RDNS Real Origin: %REVDNS%[%REMOTEIP%] XINHEADER X-Note: SMTP Real From: %MAILFROM% XINHEADER X-Note: SMTP Real To: %ALLRECIPS% In addition, I have several tests defined that use the WARN action and they have $default$.junkmail lines such as: SPAMCOP header X-RBL-Warning: SPAMCOP ADULT header X-RBL-Warning: Possible ADULT Content What I'm seeing in actual message Dxxx.SMD files is a blank line between the X-Notes and the X-RBL-Warnings, so that the X-RBL-Warnings are showing up as visible in the delivered messages. Is this a glitch, or have I done something incorrect in my setups? -- John Shacklett www.continentaloffice.com [EMAIL PROTECTED] [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] header confusion
No, I don't think it is. I'm not using HEADER actions at all, see my response to Tony. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Thursday, January 31, 2002 8:45 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] header confusion The HEADER action is misleading - it does not add a message to the header, it adds it to the beginning of the body of the message. Your setup is actually working as it was designed to. The manual is clear on this, but the name chosen is misleading. Good catch -- that's the problem. By the way, can anyone think of a better names than HEADER/FOOTER when dealing with text added to the body of the E-mail? That *is* very confusing (especially when trying to explain it The HEADER action adds a header (no, not a real header...). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] header confusion
Just the one, as near as I can tell. I sent you a pile of examples, once upon a time. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Thursday, January 31, 2002 9:18 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] header confusion BUT: I have several tests duplicated in order to perform multiple actions, WARNS and HOLDS primarily. So, my presumption is that if TEST and TEST2 are the duplicates, then if TEST fails then TEST2 should fail as well. And I see plenty of cases where that is not happening. I get mail in my Inbox that has the WARN header when the companion test should have held it and I get mail in my SPAM folder that got held but doesn't have the WARN header. When one of these E-mails is delivered that should be held, do the Declude JunkMail logs show whether or not the appropriate test failed? For example, if TEST and TEST2 are defined the same, do the logs show it failing both tests or just one? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: Re[2]: [Declude.JunkMail] Declude v1.35 released
I put this in global.cfg: XINHEADER X-Note: Tests failed: %testsfailed% and I get lines like these in my awesome new Spam Review Message Header box: X-Note: Tests failed: SPAMCOP2, BADHEADERS, SPAMHEADERS, WEIGHT10, WEIGHT18, WEIGHT182 I'm having trouble getting any work done, what with trying to see the screen through copious tears of absolute joy. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Roger Heath Sent: Wednesday, January 30, 2002 12:31 PM To: R. Scott Perry Subject: Re[2]: [Declude.JunkMail] Declude v1.35 released Reply to: R. Scott Perry Re: [Declude.JunkMail] Declude v1.35 released on Wednesday 10:41:02 AM WEIGHT10HOLDX-RBL-Warning: %TESTSFAILED%. We've never seen the WEIGHT10 appear in the header, only WEIGHT20, etc. I just realized these are all HOLD, so I guess I need duplicate tests with WARN? It looks like my error in retrospect... -- Roger Heath - Copy of Original Message(s): - I have already observed that this does not appear when used in XINHEADER. I keep getting weights but no testsfailed.. It is blank every time. R I've just tested it here, and it is working. R Could you show me the exact line from your \IMail\Declude\global.cfg file? R -Scott R --- R [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. You can E-mail R [EMAIL PROTECTED] for assistance. You can visit our web R site at http://www.declude.com . R -- R ActivatorMail(tm) ver.012602 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012602 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] greylist?
AH. Perfect. Thank you. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Thursday, January 03, 2002 2:02 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] greylist? Here's a new problem: I have the following in my global.cfg: whitelist fromintechpark.com I just found a message in my HOLD directory with the following top header: Received: from intechexc01.intechpark.com [216.136.42.245] by mail.continentaloffice.com with ESMTP (SMTPD32-6.05) id AAE52E4F0152; Thu, 03 Jan 2002 12:54:45 -0500 Shouldn't this have gone through? The FROM type in the whitelist only checks the return address (which in this case may have been something very different). You might want to instead use WHITELIST ANYWHERE intechpark.com, which would whitelist all E-mails that contain intechpark.com anywhere in them. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] pm0.net, ossrc, spamcop
Funny you should mention that. I'm sitting here waiting for year-end processing to finish, and I'm typing all of the pm0.net and flowgo IP addresses into a Blacklist file. I hope I'm doing this right. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of andyb@thumpernet Sent: Monday, December 31, 2001 12:53 PM To: R. Scott Perry Subject: [Declude.JunkMail] pm0.net, ossrc, spamcop Hi, In looking at my logs, it looks like a high percentage of the spam being caught (using HOLD) is from pm0.net. It is failing both spamcop and ossrc. I'm thinking about just blacklisting anything from pm0.net Can you please tell me exactly what the syntax would be in global.cfg and $default$.junkmail blacklist pm0.net? I want to delete. Thanks, Andy Baldwin [EMAIL PROTECTED] http://www.thumpernet.com 315-282-0020 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] pm0.net, ossrc, spamcop
I figured as much. I'm building an impressive list of IP addresses, but I haven't seen any logfile entries show up yet. I hope I'm doing this right. I have a test defined this way: POSTGEN ipfile c:\imail\declude\postgen.txt in honor of postmastergeneral, my favorite target, and: POSTGEN delete and the lines in postgen.txt look like: 161.58.202.97 delete s0266.pm0.net Should I be using a space instead of a tab after the address? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Monday, December 31, 2001 1:37 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] pm0.net, ossrc, spamcop Scott, this will generate MYBLACKLIST entries in decxx.log, correct? That is correct. It will define a new test, that will be treated just like the others: You can use it in the per-domain and per-user config files, it will show up in the logs like the other tests, etc. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: re[2]: [Declude.JunkMail] DSN:Heuristics and Weight
Time to add it to the trailer. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Friday, December 28, 2001 11:19 AM To: [EMAIL PROTECTED] Subject: re[2]: [Declude.JunkMail] DSN:Heuristics and Weight In response to your e-mail below This may be a stupid question but The archive is located where? Sorry, I had posted it yesterday. It's at http://www.mail-archive.com . -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] IP Black List
Right, right, right. But the manual tells how to create the txt files, and how to create the test line in the global.cfg. I assume that the final step in this process is to put a matching line in $default$.junkmail telling what the action is. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Friday, December 28, 2001 12:04 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] IP Black List I assume that the final step in this process is to put a matching line in $default$.junkmail telling what the action is. The blacklists work by defining a special test -- you can go to http://www.declude.com/junkmail/manual.htm and look at Your own IP blacklists in the Advanced Configuration section for details. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Inconsistencies
This new beta release has not eliminated the problem. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Thursday, December 13, 2001 1:17 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Inconsistencies Anyway, I get a noticeable number of emails that get through with one or another HEADER line added [I only use HEADER options for the HOLD tests], and I have also seen a variety of held messages without the HEADER added. I've looked at your config files, and it does appear to be the same issue (using the outgoing actions instead of the incoming actions). The next beta release will take care of this. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Declude JunkMail NOT Registered
Did you replace the .cfg file and forget to put your registration code in? I did that to myself once. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Todd Holt Sent: Friday, November 02, 2001 1:07 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude JunkMail NOT Registered 11/02/2001 01:00:01 Q44700ec Declude JunkMail NOT Registered This happened when I upgraded to 1.28 beta. What do I need to do? I'm a paying customer for 1.26a. Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
