[Declude.JunkMail] Outlook SCL X-header
Does anyone know if there's a valid X-note header that can be placed in the message body that will cause Outlook to automatically route emails to the Junk-email folder? I wanted to use this approach rather than tagging the subject line and relying on users to build their own rules in Outlook. Thx --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Imail
I know this belongs on the IMAIL forum but I'm not subscribed there -- apologies in advance. Does anyone know of a way to globally disable the information manager so I can prevent users from setting up auto-responders? Thx --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Imail Aliases
Sorry about the Off-Topic question... I use Imail/Declude as a gateway system only for a large Exchange org. To avoid the dictionary attacks, we do some scripting magic to put the Exchange SMTP addresses in the Imail Alias setup. Here's the problem. Our Exchange org has two domains associated with it due to a merger -- let's say @apple.com and @orange.com We've run into a problem with a generic mailbox for each of these domains -- info. There has always been an [EMAIL PROTECTED] and [EMAIL PROTECTED] Since the Imail Alias only contains the mailbox name (info) we have no way to email directly into both domains through this gateway server. Any ideas on how to get around this? --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Inject SCL value into header with Declude
Has anyone ever tried to inject an Outlook/Exchange IMF SCL value into the header with Declude? The header looks like this: x-sender: [EMAIL PROTECTED] x-receiver: [EMAIL PROTECTED] X-SCL: 7 93.4% Basically I wanted to see if I could use this as an action to force spam into the Outlook junkmail folder. Obviously this would depend on the IMF settings for the Exchange organization.. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Checking country so many times...
Just moved to 3.05.22 and my server's can't keep up with the queue (but they can with 2.06). Threads=20 CPU's fine. Anyway, I set Declude logs to debug and I'm seeing this for every message. Anyone know why Declude would check the country so many times? 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking
RE: [Declude.JunkMail] Checking country so many times...
Matt, Thanks for the info but no dice. I reverted back to 2.6 and blazing fast processing. There's just something about 3.05 on my servers that runs slow. And I've got 3 servers doing the same thing.. SysInternals Process explorer shows that DecludeProc really isn't calling that many instances of spamchk, sniffer, etc. It's like the files go into the work folder but just hang out there for a while. It's almost as if there's a pause between each test. Odd.. Had to go back to 2.6 again. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, December 12, 2005 1:01 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Checking country so many times... Mark, I believe that most people that are seeing backups have reported that raising their THREADS to something like 75 and lowering their WAITFORTHREADS to something like 1 will clean up their performance issues. This seems to be common for those around here that get more than 50,000 messages a day on a server and/or report that they are backing up E-mail but have spare CPU. I'm not sure why these settings are manually adjustable, or at least not having the defaults targeted at the higher volume servers where it matters the most. It seems that the critical piece is the CPU utilization and not the threads, and of course all threads are not created equally. A single thread could result in 100% CPU utilization on it's own on my beefy server, but on the other hand a message that doesn't get virus scanned (passes PRESCAN) and gets to the DELETE weight from RBL's alone is hardly a blip. My biggest issue with getting slammed are bounce messages since they are mostly being scanned for viruses, and when the bounces come from a client's server and are legitimate (and pass spam scanning), every single filter needs to be run, and these messages typically come in real fast. It would make so much more sense to monitor the CPU utilization and adjust the WAITBETWEENTHREADS number according to how high the CPU is. For instance, if the CPU is at 100% for the last 5 seconds, one should maybe wait 1 second before processing the next E-mail until it drops again, but if the CPU is at 50% for the last 5 seconds, the wait should be 0. So anyway, I would just leave your threads in an area that could be impractical for your server to handle and just hope that it stays stable under heavy load. That at least seems to be the net result of changing these settings to the values that others have described doing. Matt Mark Smith wrote: Just moved to 3.05.22 and my server's can't keep up with the queue (but they can with 2.06). Threads=20 CPU's fine. Anyway, I set Declude logs to debug and I'm seeing this for every message. Anyone know why Declude would check the country so many times? 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries: US . 12/12/2005 12:14:26.837
RE: [Declude.JunkMail] ANN: Availability of 5xxSink 0.5.00, IIS SMTP event sink for text-file recipient validation
I've always wondered why Declude can't use IIS SMTP as its MTA? Seems like a pretty big market for the people who want a gateway only system -- or even Exchange. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman Sent: Saturday, December 03, 2005 7:29 AM To: Declude.JunkMail@declude.com; IMail_Forum@list.ipswitch.com; Declude.Virus@declude.com; sniffer@SortMonster.com Subject: [Declude.JunkMail] ANN: Availability of 5xxSink 0.5.00, IIS SMTP event sink for text-file recipient validation All, I've posted 5XXSINK, an IIS SMTP event sink (freeware) that allows you to block unknown recipients at your IIS 5.0 or 6.0 MX by populating a barebones textfile. Those who use the powerful IIS SMTP engine as an MX have no built-in method of preventing brute-force spam runs from overwhelming their internal content scanning and mailbox servers with wasted message processing and double-bounce generation. Several commercial anti-abuse products can add this functionality, but they can add undue cost to a large server farm, and seem like overkill when a well-tuned content scanning engine (IMail's, Declude's, etc.) already exists internally, save for the fact that it sees messages that should never get that far. While it is debatable whether having envelope recipient validation at your MXs will reduce the number of spammers making initial connections to you, it cannot be denied that having such validation will save your hardware and bandwidth resources beyond the first part of the SMTP conversation. Recipient validation at the MX can make the difference between a workable anti-spam content scanner and one that fails because it's overwhelmed by messages it should never see. 5XXSINK is designed to do one thing, do it well, and do it for free: to look up full e-mail addresses in a locally stored text file and reject all RCPT TO commands that do match a line in the file. That's it. 5XXSINK is NOT designed to do any of the following: connection throttling, tarpitting, greylisting, sender validation, HELO interpretation, or DNSBL lookups. It expects that a robust content scanning solution exists behind, or perhaps on, the IIS SMTP server (although commercial IIS SMTP integrations solutions usually duplicate 5XXSINK's recipient validation functionality -- and then some). Again, the sole function is to keep messages that absolutely, positively do not need to be scanned out of the scanning path. There are no false positives with recipient validation, so it's an obvious first step in an anti-abuse chain. 5XXSINK is multithreaded and likely performs its very particular function as fast as practically possible. * * * Download: http://www.imprimia.com/products/software/freeutils/5xxsink/do wnload/release Be sure to go over the README in-depth. That's where it's at. Support: Through the IMail and Declude support lists, as the communities primarily served by the product. Please post support questions as [OT] to create a public archive and to encourage knowledge sharing. --Sandy --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Anyone at Exchange and Windows Connections This week?
Here in San Diego?
FW: [Declude.JunkMail] Headers showing up in the body on 3.05.10
David, Just for follow-up. As I posted earlier we reverted back to 2.6 from 3.6.11 and 99% of these headers in the body messages are gone. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark Smith Sent: Tuesday, October 25, 2005 4:54 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Headers showing up in the body on 3.05.10 David, Thanks for the explanation! However, I have yet to see a message with SMTP headers in the body if I remove Declude and send mail directly into Exchange. Maybe Exchange will just not deliver? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, October 25, 2005 3:27 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Headers showing up in the body on 3.05.10 In every instance that we have observed so far the headers in the body are caused by broken mail clients. This is not only an issue for Declude but for mail servers as well. To illustrates the difficulty coming up with a single algorithm that will detect all instances of these broken emails to prevent headers from appearing at the end of a message or within the body of a message. RFC dictates all lines must end with a CR/LF sequence, with a double sequence CR/LF/CR/LF separating the headers from the body. Technically, that would be a 0D 0A 0D 0A sequence. In the byte sequence below, the sixth line contains: 22 0A 20 0D 0A 49 20 73-74 61 72 74 65 64 20 68 where a single 0A is followed by a space and then the required 0D 0A sequence. When this problem was first reported, changes were made in the source to detect a simple 0A as a line terminator, followed by another line terminator sequence. However, this example would not get detected because they inserted a space, which is invisible, between the two line termination sequences. They could have inserted a tab (09) also, so checking only for a space would not have caught all possibilities. In addition, checking only for spaces at the beginning of a line would not solve the problem because certain header lines can be continued on the next line, which requires spaces and then non-blank characters prior to the next line termination sequence. 30 38 3A 35 37 3A 31 33-20 2D 30 35 30 30 0D 0A 4D 49 4D 45 2D 56 65 72-73 69 6F 6E 3A 20 31 2E 30 0D 0A 43 6F 6E 74 65-6E 74 2D 54 79 70 65 3A 20 74 65 78 74 2F 70 6C-61 69 6E 3B 0D 0A 09 63 68 61 72 73 65 74 3D 22-75 73 2D 61 73 63 69 69 22 0A 20 0D 0A 49 20 73-74 61 72 74 65 64 20 68 61 76 69 6E 67 20 61 6E-20 61 66 66 61 69 72 20 77 69 74 68 20 61 20 79-6F 75 6E 67 65 72 2C 20 Often from the outset these issues look extremely simple. However, because all eventualities that have to be covered it becomes quite complex. I am providing this example because things are rarely as simple as they may at first appear. With all that said we are looking into providing a solution for this problem. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, October 24, 2005 9:07 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Headers showing up in the body on 3.05.10 This looks like Declude was expecting to see an occurrence of Blank Folding, but it is making the mistake of detecting headers in the MIME segments or the body as a continuation of the real headers, either that or they changed the code that detects where to throw in the Declude generated headers in order to handle Blank Folding. IMO, Declude should just throw the headers just before the location of the first CRLFCRLF or possibly following a mistaken LFLF. I haven't seen any Declude headers in the body using 2.0.6.16 and earlier. Matt Robert Grosshandler wrote: This has been a problem for awhile (happened with the move to the new architecture, but Declude says it's not connected.) The headers are bad when they make it to Declude, and Declude doesn't handle them right. Fortunately, in our setup, they all still get treated as very heavily weighted spam, so they never make it to users. Rob -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark Smith Sent: Monday, October 24, 2005 6:17 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Headers showing up in the body on 3.05.10 Ever since I went to 3.05.10 (now on 3.05.11) I've been receiving hundreds of complaints of spam making it to my users. After inspection, Declude is subject line marking the messages but it's moving the SMTP headers to the body of the email. This results in user's Outlook rules not firing on the subject line keywords. Here's an example of the ACTUAL MESSAGE BODY. Anyone
RE: [Declude.JunkMail] Headers showing up in the body on 3.05.10
David, Thanks for the explanation! However, I have yet to see a message with SMTP headers in the body if I remove Declude and send mail directly into Exchange. Maybe Exchange will just not deliver? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, October 25, 2005 3:27 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Headers showing up in the body on 3.05.10 In every instance that we have observed so far the headers in the body are caused by broken mail clients. This is not only an issue for Declude but for mail servers as well. To illustrates the difficulty coming up with a single algorithm that will detect all instances of these broken emails to prevent headers from appearing at the end of a message or within the body of a message. RFC dictates all lines must end with a CR/LF sequence, with a double sequence CR/LF/CR/LF separating the headers from the body. Technically, that would be a 0D 0A 0D 0A sequence. In the byte sequence below, the sixth line contains: 22 0A 20 0D 0A 49 20 73-74 61 72 74 65 64 20 68 where a single 0A is followed by a space and then the required 0D 0A sequence. When this problem was first reported, changes were made in the source to detect a simple 0A as a line terminator, followed by another line terminator sequence. However, this example would not get detected because they inserted a space, which is invisible, between the two line termination sequences. They could have inserted a tab (09) also, so checking only for a space would not have caught all possibilities. In addition, checking only for spaces at the beginning of a line would not solve the problem because certain header lines can be continued on the next line, which requires spaces and then non-blank characters prior to the next line termination sequence. 30 38 3A 35 37 3A 31 33-20 2D 30 35 30 30 0D 0A 4D 49 4D 45 2D 56 65 72-73 69 6F 6E 3A 20 31 2E 30 0D 0A 43 6F 6E 74 65-6E 74 2D 54 79 70 65 3A 20 74 65 78 74 2F 70 6C-61 69 6E 3B 0D 0A 09 63 68 61 72 73 65 74 3D 22-75 73 2D 61 73 63 69 69 22 0A 20 0D 0A 49 20 73-74 61 72 74 65 64 20 68 61 76 69 6E 67 20 61 6E-20 61 66 66 61 69 72 20 77 69 74 68 20 61 20 79-6F 75 6E 67 65 72 2C 20 Often from the outset these issues look extremely simple. However, because all eventualities that have to be covered it becomes quite complex. I am providing this example because things are rarely as simple as they may at first appear. With all that said we are looking into providing a solution for this problem. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, October 24, 2005 9:07 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Headers showing up in the body on 3.05.10 This looks like Declude was expecting to see an occurrence of Blank Folding, but it is making the mistake of detecting headers in the MIME segments or the body as a continuation of the real headers, either that or they changed the code that detects where to throw in the Declude generated headers in order to handle Blank Folding. IMO, Declude should just throw the headers just before the location of the first CRLFCRLF or possibly following a mistaken LFLF. I haven't seen any Declude headers in the body using 2.0.6.16 and earlier. Matt Robert Grosshandler wrote: This has been a problem for awhile (happened with the move to the new architecture, but Declude says it's not connected.) The headers are bad when they make it to Declude, and Declude doesn't handle them right. Fortunately, in our setup, they all still get treated as very heavily weighted spam, so they never make it to users. Rob -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark Smith Sent: Monday, October 24, 2005 6:17 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Headers showing up in the body on 3.05.10 Ever since I went to 3.05.10 (now on 3.05.11) I've been receiving hundreds of complaints of spam making it to my users. After inspection, Declude is subject line marking the messages but it's moving the SMTP headers to the body of the email. This results in user's Outlook rules not firing on the subject line keywords. Here's an example of the ACTUAL MESSAGE BODY. Anyone else seeing this? -0- -Original Message- From: Jon Addison [mailto:[EMAIL PROTECTED] Sent: Monday, October 24, 2005 6:06 AM To: Smith, Mark E. Subject: Re: Hello. You've seen it on 60 Minutes and read the BBC News report -- now find out just what everyone is talking about. Message-Id: [EMAIL PROTECTED] Subject: [WARNING-SPAM]:[333]: X-RBL-Warning: CATCHALLMAILS: X-RBL-Warning: FIVETEN-SPAM: 225.72.226.221.blackholes.five-ten-sg.com. X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL
RE: [Declude.JunkMail] DecludeProc crashing still
If I dump the files in the proc\review folder back into the proc folder they process ok. I've given up and went back to 2.06.x Immediately I'm processing 3-4 times faster with less CPU time and no crashing. Can't continue to run 3.0 anymore so I'll wait until the bugs are worked out -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Tuesday, October 25, 2005 8:11 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] DecludeProc crashing still Nothing in my logs. When these events occur, you need to do the following: Check for DrWatson logs. Check for files in the proc\review directory Check the logs for that time period. What do the above 3 indicate? John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Mark Smith Sent: Tuesday, October 25, 2005 1:45 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] DecludeProc crashing still I'm not 100% sure if people aren't noticing Decludeproc crashing. The installer sets the service recovery to restart in 0 seconds. So, would a few of you mind checking your System event logs and look for Event ID 7031 and 26. I want to triple check that I'm the only one getting these. Here's what happens... ALL FOUR of my declude servers are seeing this. I've renamed virus.cfg to virus.bak, I've removed all external tests, removed the biggest body filter test. Still crashes. Every version of Declude Proc is crashing AND CPU time is always at 100% with DecludeProc usually at the top. Windows 2003 Server STD, Imail Dell PowerEdge 1650 Dual Proc 1.4Ghz, 2GB RAM. VERSION 3.05.11 THREADS 15 WAITFORMAIL 2000 = === === Event Type: Information Event Source: Application Popup Event Category: None Event ID: 26 Date: 10/25/2005 Time: 2:24:40 PM User: N/A Computer: CTCMX02 Description: Application popup: decludeproc.exe - Application Error : The instruction at 0x7c8120d0 referenced memory at 0x018e. The memory could not be read. Click on OK to terminate the program Click on CANCEL to debug the program For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. = === === Event Type: Error Event Source: Service Control Manager Event Category: None Event ID: 7031 Date: 10/25/2005 Time: 2:13:58 PM User: N/A Computer: CTCMX02 Description: The Decludeproc service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 12 milliseconds: Restart the service. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Headers showing up in the body on 3.05.10
Ever since I went to 3.05.10 (now on 3.05.11) I've been receiving hundreds of complaints of spam making it to my users. After inspection, Declude is subject line marking the messages but it's moving the SMTP headers to the body of the email. This results in user's Outlook rules not firing on the subject line keywords. Here's an example of the ACTUAL MESSAGE BODY. Anyone else seeing this? -0- -Original Message- From: Jon Addison [mailto:[EMAIL PROTECTED] Sent: Monday, October 24, 2005 6:06 AM To: Smith, Mark E. Subject: Re: Hello. You've seen it on 60 Minutes and read the BBC News report -- now find out just what everyone is talking about. Message-Id: [EMAIL PROTECTED] Subject: [WARNING-SPAM]:[333]: X-RBL-Warning: CATCHALLMAILS: X-RBL-Warning: FIVETEN-SPAM: 225.72.226.221.blackholes.five-ten-sg.com. X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: SORBS-DUL: Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml?221.226.72.225; X-RBL-Warning: IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 221.226.72.225 with no reverse DNS entry. X-RBL-Warning: MS-SNAKEOIL: Message failed MS-SNAKEOIL: 52. X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 3. X-RBL-Warning: SPAMDOMAINS: Spamdomain '@yahoo.' found: Address of [EMAIL PROTECTED] sent from invalid [No Reverse DNS]. X-RBL-Warning: FALSE-YAHOO: Message failed FALSE-YAHOO test (line 2, weight 30) X-RBL-Warning: WEIGHT120349CP: Total weight between 120 and 349. X-Declude-Sender: [EMAIL PROTECTED] [221.226.72.225] X-Declude-Spoolname: Ddba001ae99e2.smd X-Note: X-Note: == X-Note: Spam Score: 333 [SUBJECT STRING ON 120-349 DELETED ON 350+] X-Note: Scan Time: 09:03:36 on 24 Oct 2005 X-Note: Spool File: Ddba001ae99e2.smd X-Note: Server Name: netrends.com X-Note: SMTP Sender: [EMAIL PROTECTED] X-Note: Reverse DNS IP: [No Reverse DNS] [221.226.72.225] X-Note: Organization: popmail.netrends.com X-Note: Recipient(s): [EMAIL PROTECTED] X-Note: Country Chain: CHINA-destination X-Note: Tests Failed: CATCHALLMAILS [0], FIVETEN-SPAM [30], NOABUSE [10], SORBS-DUL [50], IPNOTINMX [0], NOLEGITCONTENT [0], REVDNS [40], MS-SNAKEOIL [150], SPAMCHK [3], SPAMDOMAINS [20], FALSE-YAHOO [30], WEIGHT120349 [120], WEIGHT120349CP [120] X-Note: In or Out: outgoing X-Note: == X-Note: This E-mail was scanned filtered X-Note: filter [3.0.5.10] for SPAM virus. X-Note: == X-Note: # Suppress your appetite and feel full and satisfied all day long # Increase your energy levels # Lose excess weight # Increase your metabolism # Burn body fat # Burn calories # Attack obesity And more.. http://coolhoodia.com/ # Suitable for vegetarians and vegans # MAINTAIN your weight loss # Make losing weight a sure guarantee # Look your best during the summer months http://coolhoodia.com/ Regards, Dr. Jon Addison --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Headers showing up in the body on 3.05.10
Ever since I went to 3.05.10 (on Friday) I've been receiving hundreds of complaints of spam making it to my users. After inspection, Declude is subject line marking the messages but it's moving the SMTP headers to the body of the email. This results in user's Outlook rules not firing on the subject line keywords. Here's an example of the ACTUAL MESSAGE BODY. Anyone else seeing this? -0- -Original Message- From: Jon Addison [mailto:[EMAIL PROTECTED] Sent: Monday, October 24, 2005 6:06 AM To: Smith, Mark E. Subject: Re: Hello. You've seen it on 60 Minutes and read the BBC News report -- now find out just what everyone is talking about. Message-Id: [EMAIL PROTECTED] Subject: [WARNING-SPAM]:[333]: X-RBL-Warning: CATCHALLMAILS: X-RBL-Warning: FIVETEN-SPAM: 225.72.226.221.blackholes.five-ten-sg.com. X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: SORBS-DUL: Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml?221.226.72.225; X-RBL-Warning: IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 221.226.72.225 with no reverse DNS entry. X-RBL-Warning: MS-SNAKEOIL: Message failed MS-SNAKEOIL: 52. X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 3. X-RBL-Warning: SPAMDOMAINS: Spamdomain '@yahoo.' found: Address of [EMAIL PROTECTED] sent from invalid [No Reverse DNS]. X-RBL-Warning: FALSE-YAHOO: Message failed FALSE-YAHOO test (line 2, weight 30) X-RBL-Warning: WEIGHT120349CP: Total weight between 120 and 349. X-Declude-Sender: [EMAIL PROTECTED] [221.226.72.225] X-Declude-Spoolname: Ddba001ae99e2.smd X-Note: X-Note: == X-Note: Spam Score: 333 [SUBJECT STRING ON 120-349 DELETED ON 350+] X-Note: Scan Time: 09:03:36 on 24 Oct 2005 X-Note: Spool File: Ddba001ae99e2.smd X-Note: Server Name: netrends.com X-Note: SMTP Sender: [EMAIL PROTECTED] X-Note: Reverse DNS IP: [No Reverse DNS] [221.226.72.225] X-Note: Organization: popmail.netrends.com X-Note: Recipient(s): [EMAIL PROTECTED] X-Note: Country Chain: CHINA-destination X-Note: Tests Failed: CATCHALLMAILS [0], FIVETEN-SPAM [30], NOABUSE [10], SORBS-DUL [50], IPNOTINMX [0], NOLEGITCONTENT [0], REVDNS [40], MS-SNAKEOIL [150], SPAMCHK [3], SPAMDOMAINS [20], FALSE-YAHOO [30], WEIGHT120349 [120], WEIGHT120349CP [120] X-Note: In or Out: outgoing X-Note: == X-Note: This E-mail was scanned filtered X-Note: filter [3.0.5.10] for SPAM virus. X-Note: == X-Note: # Suppress your appetite and feel full and satisfied all day long # Increase your energy levels # Lose excess weight # Increase your metabolism # Burn body fat # Burn calories # Attack obesity And more.. http://coolhoodia.com/ # Suitable for vegetarians and vegans # MAINTAIN your weight loss # Make losing weight a sure guarantee # Look your best during the summer months http://coolhoodia.com/ Regards, Dr. Jon Addison --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Decludeproc getting caught in Data Execution Prevention
Extended period of run. Happened on all three of my servers. AND they're all crashing the decludeproc service about once an hour. I've got dual proc 1.5Ghz servers with 2GB ram, one AV FPROT scanner and I'm down to 10 threads. I think I'm going back to 2.9 which was bulletproof for me. From: Mike Nice [mailto:[EMAIL PROTECTED] Sent: Friday, October 21, 2005 1:19 AMTo: Mark SmithSubject: Re: [Declude.JunkMail] Decludeproc getting caught in Data Execution Prevention Did the DEP alert come up immediately or after an extended run period? If after an extended run period, I'd say that there is a buffer overflow in Declude. - Original Message - From: Mark Smith To: Declude.JunkMail@declude.com Sent: Thursday, October 20, 2005 4:40 PM Subject: [Declude.JunkMail] Decludeproc getting caught in Data Execution Prevention Has anyone seen this before?
[Declude.JunkMail] Somewhat OT: SMTP message size with Gateway config
I think this has been covered before but does anyone have any ideas on how to restrict message size with Gateway only configs? I'm trying to prevent the 20mb message attachments from bogging down the system. Using IMAIL
[Declude.JunkMail] Declude as a service and global.cfg
Now that the declude engine runs as a service, do you need to restart the decludeproc service when making changes to global.cfg? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Decludeproc getting caught in Data Execution Prevention
3.0.5.9 Just got this pre-release yesterday because of another issue where decludeproc keeps crashing on all 3 of my servers. The guys at Declude have been helping. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Thursday, October 20, 2005 5:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Decludeproc getting caught in Data Execution Prevention Mark, Which version of decludeproc is this - cause 3.0.5.7 has not tripped it on my 2K3 server. Darrell -- -- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Mark Smith writes: Has anyone seen this before? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Windows Telnet mail syste
Sorry for the OT post but I'm looking for a telnet Windows PINE mail type client. We have a number of users who need to access email via a 2400baud SAT phone. So we're looking to put up a PINE mail windows based solution where the users would telnet in to read email, and the PINE server would connect to the email server via IMAP. Any ideas on this one? Thx --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] 3.05.5 TempLog/Concatanate Log issues
Any word from Declude on the issue in 3.05.5 that fills up the /templogs folder? To recap, if Concatenate logs is turned on AND the decludeproc service crashes, declude "forgets" about the temp. logs. (Concatenate Log Threshold is reset to 0). This results in the /templog eventually growing and, when the folder reaches 10,000+ messages slows down declude. The problem snowballs until the server crashes.
RE: [Declude.JunkMail] AOL Now blocking Port 25
As a web hosting company, we put an SMTP server listening on a different TCP port. We instruct users to modify their SMTP settings in their mail client to use this port. The server listens on this port but relays on 25. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli Sent: Thursday, September 29, 2005 2:20 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] AOL Now blocking Port 25 Has anyone else been told AOL is now enfosing this policy and how do we get around it. a.. 554 IPT:OA http://postmaster.info.aol.com/errors/554iptoa.html EXPLANATION: The message you received is generated from AOL when sending mail through a third party program and connecting through the default port 25. America Online Inc. will no longer accept outgoing connections on port 25 through third party mail programs. SOLUTION: If you are trying to access your America Online e-mail please visit Keyword: Open Mail Access Send third party e-mail through port 587. This port requires you to authenticate and may require a change to your email client settings. Note, the server you are connecting to must support this configuration. If you are trying to get your AOL e-mail visit Keyword Open Mail Access, all others contact your server administrator for further support on this configuration. For more information visit the port 25 FAQ. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Any fix released for the corrupt message character issues in 3.0.5?
My servers are constantly crashing because of this bug! --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Another 3.0.5 bug...
Seem to have found another bug (reported this to David yesterday but we couldn't reproduce) *IF* you have: CONCATENATELOGS ON And decludeproc crashes (in my case because the bad character messages that get dumped to the review folder) it looks like Decludeproc loses track of the single message logs in \spool\proc\work\templogs Note I'm not saving logs -- the folder fills up with .LOG and .DONE files The result is that the folder keeps growing with temp logs. When the folder approaches the high volume (20,000 -- Mine was at 65,000 before I found the problem) DecludeProc has a hard time writing logs to the folder. System slows down, queues build up... Darrel -- hint -- monitor the \templogs and \proc\work folder too. :) -Original Message- From: Mark Smith [mailto:[EMAIL PROTECTED] Sent: Thursday, September 29, 2005 2:40 PM To: 'Declude.JunkMail@declude.com' Subject: Any fix released for the corrupt message character issues in 3.0.5? My servers are constantly crashing because of this bug! --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Any fix released for the corrupt message character issues in 3.0.5?
Just tested it here and it's working. I even dumped my whole /review folder into the /proc folder and it processed them fine. That would crash at will in the past. Any word on the log file issue that I reported? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kim Premuda Sent: Thursday, September 29, 2005 9:48 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Any fix released for the corrupt message character issues in 3.0.5? -- Original Message -- From: John T \(Lists\) [EMAIL PROTECTED] Reply-To: Declude.JunkMail@declude.com Date: Thu, 29 Sep 2005 15:05:10 -0700 Actually, looks they have official released 3.0.5.5 which fixed the problem. Hi, John. Have you tested this? This was supposedly fixed in two prior beta releases, and we both know that wasn't true. Thanks! Kim W. Premuda -- Kim W. Premuda FastWave Internet Services San Diego, CA -- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AOL Now blocking Port 25
Setup Windows IIS SMTP service to listen on port XX (something other than 25). Both can run and won't conflict. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Thursday, September 29, 2005 4:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] AOL Now blocking Port 25 Anybody out there know the Cisco PIX CLI syntax to do port forwarding on the firewall? I'm running Imail 8.15 and I'm stuck with port 25... -Dave Doherty Skywaves, Inc. - Original Message - From: Kevin Bilbee [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, September 29, 2005 3:48 PM Subject: RE: [Declude.JunkMail] AOL Now blocking Port 25 If you are on imail 8.2x you can setup the alternate port. Search for the thread on the how to. No additional software is needed to do port forwarding. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Mark Smith Sent: Thursday, September 29, 2005 11:39 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] AOL Now blocking Port 25 As a web hosting company, we put an SMTP server listening on a different TCP port. We instruct users to modify their SMTP settings in their mail client to use this port. The server listens on this port but relays on 25. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli Sent: Thursday, September 29, 2005 2:20 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] AOL Now blocking Port 25 Has anyone else been told AOL is now enfosing this policy and how do we get around it. a.. 554 IPT:OA http://postmaster.info.aol.com/errors/554iptoa.html EXPLANATION: The message you received is generated from AOL when sending mail through a third party program and connecting through the default port 25. America Online Inc. will no longer accept outgoing connections on port 25 through third party mail programs. SOLUTION: If you are trying to access your America Online e-mail please visit Keyword: Open Mail Access Send third party e-mail through port 587. This port requires you to authenticate and may require a change to your email client settings. Note, the server you are connecting to must support this configuration. If you are trying to get your AOL e-mail visit Keyword Open Mail Access, all others contact your server administrator for further support on this configuration. For more information visit the port 25 FAQ. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] VERY Bad Luck with 3.0.5
We upgraded 4 of our inbound gateway server to 3.0.5 yesterday. This morning our HP Open View alarms on all 4 went off reporting the following similar errors: HELP! From the Event Log: Event Type: Error Event Source: Service Control Manager Event Category: None Event ID: 7031 Date: 9/28/2005 Time: 7:02:39 AM User: N/A Computer: CTCMX01 Description: The Decludeproc service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1 milliseconds: Restart the service. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Event Type: Information Event Source: Application Popup Event Category: None Event ID: 26 Date: 9/28/2005 Time: 5:29:44 AM User: N/A Computer: CTCMX01 Description: Application popup: decludeproc.exe - Application Error : The instruction at 0x77387eac referenced memory at 0x56f9. The memory could not be read. Click on OK to terminate the program Click on CANCEL to debug the program For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. === From the Application Log: Event Type: Error Event Source: Application Error Event Category: (100) Event ID: 1000 Date: 9/28/2005 Time: 5:29:43 AM User: N/A Computer: CTCMX01 Description: Faulting application decludeproc.exe, version 0.0.0.0, faulting module user32.dll, version 5.2.3790.1830, fault address 0x7eac. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: : 41 70 70 6c 69 63 61 74 Applicat 0008: 69 6f 6e 20 46 61 69 6c ion Fail 0010: 75 72 65 20 20 64 65 63 ure dec 0018: 6c 75 64 65 70 72 6f 63 ludeproc 0020: 2e 65 78 65 20 30 2e 30 .exe 0.0 0028: 2e 30 2e 30 20 69 6e 20 .0.0 in 0030: 75 73 65 72 33 32 2e 64 user32.d 0038: 6c 6c 20 35 2e 32 2e 33 ll 5.2.3 0040: 37 39 30 2e 31 38 33 30 790.1830 0048: 20 61 74 20 6f 66 66 73at offs 0050: 65 74 20 30 30 30 30 37 et 7 0058: 65 61 63 eac --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] What is the Reveiw folder for?
There's a folder in the \proc folder called "review" I've got messages building up in it but not sure what they are.
RE: [Declude.JunkMail] Declude 3.05
FYI I'm seeing the same thing. Dell PE 2650's 1.4Ghz Dual Proc 2GB RAM. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Lewis-Waller Sent: Wednesday, September 28, 2005 4:48 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Declude 3.05 Darell, Yes I'm running a dual processor Xenon Dell server. All the best, -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: 27 September 2005 17:43 To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Declude 3.05 David, Are you running a dual proc box - you did not say exactly? If you are let me know and I can help you verify if you are having the same dual proc issue I see. Darrell David Lewis-Waller writes: I didn't take part in the beta of v3 but upgraded yesterday from 1.8x. However, I do notice a considerable CPU usage penalty some 100% more usage than in the previous version and commonly long queues in \proc waiting to be serviced. I have also seen a couple of emails from users with dual procesor boxes having issues. Is this what others are seeing? David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] What is the Reveiw folder for?
There are 120+ messages in the folder on each server. :) Should I put them back into the proc folder to try reprocessing? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, September 28, 2005 9:05 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] What is the Reveiw folder for? One of more of the messages in the review folder was the cause of the decludeproc service to stop running. You should submit those to Declude or try and isolate which one of them is causing the issue. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Mark Smith writes: There's a folder in the \proc folder called review I've got messages building up in it but not sure what they are. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude 3.05
Exactly. Also, I see the \templogs folder grow a fair amount too. Last night it had 16,000 logs in it despite the fact my declude.cfg file had these settings: THREADS 25 CONCATENATELOGS ON KEEPINDIVIDUALLOGS OFF ADJUSTFORLOAD ON -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, September 28, 2005 9:08 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Declude 3.05 Mark, I just posted about what to look for if you see the same issue. To recap with one addition: Make sure you bump your threads up to 25 or so. Watch the proc directory, decludeproc.exe in task manager, and the logs. Do you see the logs just stop and the decludeproc.exe at zero % cpu for a period of time even through there are messages in the proc directory? Darrell Mark Smith writes: FYI I'm seeing the same thing. Dell PE 2650's 1.4Ghz Dual Proc 2GB RAM. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Lewis-Waller Sent: Wednesday, September 28, 2005 4:48 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Declude 3.05 Darell, Yes I'm running a dual processor Xenon Dell server. All the best, -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: 27 September 2005 17:43 To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Declude 3.05 David, Are you running a dual proc box - you did not say exactly? If you are let me know and I can help you verify if you are having the same dual proc issue I see. Darrell David Lewis-Waller writes: I didn't take part in the beta of v3 but upgraded yesterday from 1.8x. However, I do notice a considerable CPU usage penalty some 100% more usage than in the previous version and commonly long queues in \proc waiting to be serviced. I have also seen a couple of emails from users with dual procesor boxes having issues. Is this what others are seeing? David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- -- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Imail/Declude queues backing up
Charles, We use this on our inbound servers and it's been wonderful. Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Charles Frolick Sent: Tuesday, December 14, 2004 4:29 PM To: DLAnalyzer Support Subject: Re[2]: [Declude.JunkMail] Imail/Declude queues backing up Hello DLAnalyzer, Tuesday, December 14, 2004, 10:01:47 AM, you wrote: DS Because of this issue I wrote a Windows service that not only DS monitors the imail queue it also monitors the declude overflow DS directory. You can setup different types of alerts (size and growth DS percentage) to notify you or run an external script when things DS exceed your thresholds. This has saved me many times. It's always DS better to get an alert when the queue has 1000 Q*.smd files backed up than 50K... I'll take a look at it, that'll save me time from making my own. Since mine hung over the weekend, I had over 250K messages between spool and overflow before any one bothered to call me and say they weren't getting any mail. I average around 300K+ per day and it had been down for over 24 hours over a slow day fortunately. -- Best regards, Charlesmailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Processing order Junkmail or Virus
Note - messages _returned to the queue with this switch ON will not be scanned for a virus Meaning messages that are returned from a JM hold action and not the declude overflow right? IOW Declude Virus will only scan the messages that aren't deleted by Junkmail BUT if JM has a hold action, Declude virus won't scan them after they're placed back into the queue? On 9 Dec 2004 at 16:23, Mark E. Smith wrote: I know this has been asked before but which processes first Junkmail or Virus? If Virus is first, is there a way to change this? AVAFTERJM ON Note - messages _returned to the queue with this switch ON will not be scanned for a virus -Nick --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] DOW test and Spam on specific days
Assuming we wanted to setup a Sat-Sun DOW test with a weight of 2 for the message hitting on the weekend, I guess we would use: DOW dow 6 7 2 0 Correct? Having said that, does anyone have any metrics on what days more spam comes in? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Tests that aren't in the manual...
I'll be the first to admit that I don't keep up on the reading of this list so I'm sure this has been discussed before. Additionally, I did some searching on these topics but the Mail Archive system is spitting back too many results to be effective these days. So that brings me to my point... The new Delude Manual is a great step in documenting this great program, however there are a number of tests that aren't documented. Can someone please explain the following tests, how they're configured, how they work, etc? HEURheuristics SPFPASS spf SPFFAIL spf IPNOTINMX ipnotinmx NOLEGITCONTENT nolegitcontent MAILFROMenvfrom CMDSPACEcmdspace REVDNS revdnsexists COMMENTScomments SUBJECTSPACES subjectspaces Thanks! Mark --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [OT] RE: [Declude.JunkMail] 6.3 Acting as a gateway for domains on other servers
IPSwitch says that Small Business Server is ok for this purpose. Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Tuesday, October 12, 2004 8:28 PM To: [EMAIL PROTECTED] Subject: Re: [OT] RE: [Declude.JunkMail] 6.3 Acting as a gateway for domains on other servers Sandy- Do you know what Ipswitch's position is on licensing the gateway server? It looks like the small business version is limited to five domains, but is that domains with mailboxes only? Will the SB version do OK with several hundred domains when acting only as a gateway? Or do we need to pay the full price for the pro version all over again to set up a gateway? -d - Original Message - From: Sanford Whiteman [EMAIL PROTECTED] To: Mike Wiegers [EMAIL PROTECTED] Sent: Tuesday, October 12, 2004 3:33 PM Subject: Re: [OT] RE: [Declude.JunkMail] 6.3 Acting as a gateway for domains on other servers I have setup the gateway in my hosts file and the MX records for that gateway is pointing to my declude server. It looks like what you are saying is my server will try to process every non-user to the gateway machine, correct?? Yes. Does this script create registry keys for the gateway users, or how does this work? It creates and updates IMail aliases for a remote userbase retrieved over LDAP. You just schedule it to run every 5-10 minutes. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/r elease/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/d ownload/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/downl oad/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Is there a default action?
What is the default action in Junkmail? Is there a way to defaine a default action? For example, all but 3 of my tests use the action WARN but I specify 50 tests with the action WARN. Rather than 'syncing' all of these tests in GLOBAL and DEFAULT it would be easier to just omit and use the 'default action' of WARN and then specify the other 3. Any way to do this? Mark --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Deccon
You can if you're server's running W2003. Use the /console switch in the WTS client. Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Saturday, October 02, 2004 2:02 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Deccon No. Not through terminal services. Only through things like VNC or PCA. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Friday, October 01, 2004 6:23 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Deccon I termserve into the machine. Is there any way I can view the output? -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, October 01, 2004 8:14 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Deccon I have added CONSOLE ON to my global.cfg and virus.cfg and am not getting any output to the console screen? Will it automatically start? Do I need to run it manually? I see it running in my task list but no visible output. What am I doing wrong? It will automatically start when the next E-mail comes in, if you have the \IMail\Deccon.exe file in place. Note that it appears on the local console window, which means that you may or may not see it remotely (if you connect from another computer), depending on what software you use. If that is the case, you'll see deccon.exe in the Task Manager to verify that it is running. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] %TESTDOMAIN% Variable not working
Anyone else having problems with the %TESTDOMAIN% not working?
When I use it in my X-NOTE headers it spits out the string to launch Message
Sniffer.
X-Note: Zone Used for DNS Based Tests: e:\IMail\Sniffer\d{message sniffer
exe name}.exe {key placed here}
X-Note: filter [1.79i4] for SPAM virus.
My Global.CFG is:
X-Note: In or Out: %INOROUT%
X-Note: Zone Used for DNS Based Tests: %TESTDOMAIN%
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
[Declude.JunkMail] Online FTP site with Declude Files...
I believe that it was Kami who had his \declude folder exposed via FTP so you could pull his tests. Anyone remember the URL and is this still online? Thanks! Mark --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Online FTP site with Declude Files...
Ok... So what's Kami's domain? You can email me privately. Thanks! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Monday, September 20, 2004 3:46 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Online FTP site with Declude Files... ftp.xyz.com/imail where xyz.com is Kami's domain - Original Message - From: Mark Smith [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, September 20, 2004 3:19 PM Subject: [Declude.JunkMail] Online FTP site with Declude Files... I believe that it was Kami who had his \declude folder exposed via FTP so you could pull his tests. Anyone remember the URL and is this still online? Thanks! Mark --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- - Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan -- - Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Subject Action string
Quick question... What's the string in the global.cfg to change the string stamped in the subject line action? I need to change it from the standard SPAM: string to something else. ...checked mail-archive and the manual but it's no in there. Thanks! --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Subject Action string
Forgive me because I haven't been on the list for some time... The Action File? Are the action definitions now being configured in individual files? Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Sunday, June 20, 2004 8:59 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Subject Action string Quick question... What's the string in the global.cfg to change the string stamped in the subject line action? I need to change it from the standard SPAM: string to something else. ...checked mail-archive and the manual but it's no in there. Search in the action file (not the global.cfg file) for the SUBJECT action and replace the following SPAM: with whatever you want. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Subject Action string
Gotcha... I knew that part,.. Just was looking where to put the string definition. By default it's just SPAM: So I thought it went on its own line in the global.cfg and not tabed after the SUBJECT action. Is there a single line in the global.cfg to change the string for all SUBJECT actions (without specifying the string) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Sunday, June 20, 2004 9:29 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Subject Action string The Action File? Are the action definitions now being configured in individual files? There should be a file $default$.junkmail in your declude folder. In this file are defined all actions (for incomming messages) Search for the line containing WEIGHTxx SUBJECT SPAM: The third parameter is the string that will be added to the subject line. Ya can replace it with whaterver you want. If you've purchased Junkmail Pro you can use also (independent) ACTION lines in the global.cfg file. This actions are used only for outgoing messages Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] More Imail. 8.1 trouble
I've tried everything but I can't get the new Open LDAP service to start. I'm NOT running AD or any other LDAP services on this server. I've changed the port and the damn thing just hangs. Nothing in the Event logs. Also my Imail system admin program now has all of the First and Last name fields grayed out. Can I revert back to 8.05? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] More Imail. 8.1 trouble
Well, Had to revert back to 8.05, rebuild the LDAP database and then re-upgrade. Odd. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark Smith Sent: Sunday, April 11, 2004 12:20 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] More Imail. 8.1 trouble I've tried everything but I can't get the new Open LDAP service to start. I'm NOT running AD or any other LDAP services on this server. I've changed the port and the damn thing just hangs. Nothing in the Event logs. Also my Imail system admin program now has all of the First and Last name fields grayed out. Can I revert back to 8.05? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Email attack could kill servers
http://www.newscientist.com/news/news.jsp?id=ns4858 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail Queue manager and gateway
So should I just disable the DNS Cache and skip list then? Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Wednesday, March 10, 2004 5:45 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] OT: Imail Queue manager and gateway You can not disable the Queue Manager. That is the delivery process, to where ever the message is to be delivered. DNS cache can be disabled if desired, irregardless of Imail configuration or use. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Mark Smith Sent: Wednesday, March 10, 2004 10:27 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: Imail Queue manager and gateway If I'm only using imail as a gateway for Exchange and only one domain is being forwarded to, wouldn't it make sense to disable the DNS cache and Queue manager. In the remote case the receiving Exchange server is put on the skip list that would mean that all email would stop. Right? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Global.cfg and license code
I'm in the process of building a 4 server inbound MX gateway system for our Exchange 2003 environment. Imail/Declude will run on 4 even priority MX relayers and will act as edge virus and spam detection. Our organization receives about 350,000-400,000 inbound messages a day so we're estimating about 100,000 messages per server. All of our config files, filters, whitelists, and blacklists are kept in a SQL server. This allows us to provide a web front end for our admins. Additionally it allows record level (single line in a text file) editing of a filter. The records are saved back to the SQL server and an export program extracts everything from the SQL server and saves them as the text files that Declude requires. All of the files are then copied to each of the 4 MX relayers. The only problem with this is that all 4 of these relayers will have its own license code. As a feature request, would it be possible to put the CODE line of the global.cfg into its own file? License.cfg or something? Right now, I have to parse each global.cfg and write each servers file uniquely and make sure there isn't a mixup. Is there another way that we can do this with the current config? Mark --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: ADVISORY/America Online, EarthLink, Microsoft, and Yahoo! To Make Major Enforcement Announcement Concerning Important New Actions Taken in Fight Against Spam
Wonder what this will be about? http://biz.yahoo.com/bw/040309/95882_1.html --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Imail Queue manager and gateway
If I'm only using imail as a gateway for Exchange and only one domain is being forwarded to, wouldn't it make sense to disable the DNS cache and Queue manager. In the remote case the receiving Exchange server is put on the skip list that would mean that all email would stop. Right? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Imail Versions
I'm working on an Exchange 2003 roll out where I'll use Imail and Junkmail as a spam filter/relay/edge antivirus scanner. Imail will not host any domains and only act as a gateway relayer for the domains that are hosted in the Exchange namespace. I don't think that I'll need Imail Professional so the question is whether or not I need Imail Express or Imail Small Business as the foundation to run the gateway relayer. Thanks. Mark --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WAY OT - Windows gone crazy
Does it happen with all user accounts on the same machine? If not, try deleting the profile and re-creating. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jerod Bennett Sent: Monday, March 01, 2004 2:16 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] WAY OT - Windows gone crazy Hello everyone, I've been trying to solve this problem for the better part of a week and searching the internet has just not helped. I'm running a windows xp pro machine and the context menus for windows have become very terse. For example if I right-click on the Recycle Bin, I get this menu: Create Shortcut -- Properties As you can see the normal Empty the recycle bin option is missing. This is a fairly consistent problem for all OS interaction, .inf files don't give you the option to install, My Computer doesn't list manage... If anyone has seen this or knows of a place that might have a solution, I'd really appreciate it. Thanks, -Jerod --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] TCP/UDP ports
Incorrect 1024-65535 are the random TCP ACK ports.
Just do a netstat -an and you'll see TCP 0.0.0.0:{GT 5000) LISTENING
Also, only a state based firewall will allow the TCP back channel ports by
default.
An access list in a router will need to have GT 1024 explicitly told to pass
the back channel ports.
RE: DNS on port 53.
You only need TCP port 53 if you're doing zone transfers otherwise UDP 53
will be enough.
I guess my question is why you're blocking outbound from your email server?
Also, you said you were shutting them down. How were you doing this?
ON A WINDOWS MACHINE THE OUTGOING PORTS ARE BETWEEN 1024 AND
5000 BY DEFAULT.
However, a firewall won't care about the outgoing ports when
a connection is made to a server.
For example, if you block all outgoing ports except port 80
(to allow WWW connections from local computer to servers on
the Internet), the client will use a port between 1024 and
5000. *But*, the firewall will still allow the connection to
go through (since it is *to* port 80).
Therefore, it is never necessary to tell a firewall about
ports 1024 and 5000.
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
RE: [Declude.JunkMail] Acting as a gateway for domains on other servers
Dan, Or you can pay me to host your Junkmail/Virus scanning for your Exchange server. We have lots of customers we do that for. :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Friday, February 20, 2004 4:09 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Acting as a gateway for domains on other servers Hey, John, et.al., I allocated some time to try again to set it up and test it, to take advantage of your kind offer, and 'lo and behold this time it worked! Doh. Anyway for those who are interested here's my synopsis for using IMail to do spam filtering on external domains, i.e. domains not hosted by IMail. Here is the key KB article at Ipswitch... IMail - How to use IMail as SMTP Gateway for another e-mail server http://support.ipswitch.com/kb/IM-19980116-DM01.htm I broke it down into the following steps: - 1) Add the IP Address of the IMail server on the Destination Server 2) Add the IP Address of the Destination Server on the IMail Server 3) Modify the HOSTS File 4) Change the MX Record - If you read the KB article they actually describe the procedure in almost exactly the reverse of how I ordered it but I think mine is much better for avoiding any down time. In further detail, this is what I had to do to get everything working. - 1) Add the IP Address of the IMail server on the Destination Server The Destination Server is the server that the MX record would normally be pointing to if you weren't going to intercept the e-mail and scan for spam. In my case I was using a Microsoft Exchange Server, so I got on the Destination Server locally and ran Exchange System Manager. I then navigated to Servers - Server Name - Protocols - SMTP and selected the item Default SMTP Virtual Server. Right-click, choose Properties, select the Access tab, click the Relay button. Make sure the Only The List Below radio button is selected and then click Add and then type in the IP address of your IMail server. - - 2) Add the IP Address of the Destination Server on the IMail Server We are running IMail 6.06. I ran IMail Administrator and navigated down one level and selected the localhost branch. I clicked on the SMTP Security tab and verified the Relay mail for underneath Mail Relay Options was selected. I clicked on the Addresses button and clicked the Add button. I then entered the IP address of the Destination Server and clicked OK. Note: Once you are done you have to stop and start the SMTP server for the change to put into play by the IMail Server. - - 3) Modify the HOSTS file with Destination Server IP address and Domain Name We are running IMail 6.06 on a Windows 2000 server. I went to this directory, C:\WINNT\system32\drivers\etc, and located the file called hosts (no file extension). I open the hosts file with notepad and added a line with the format... Destination Server IP Address tab Domain Name - - 4) Change the MX Record On the DNS hosting server the MX record which currently points to the IP Address of the Destination Server to the IP Address of the IMail Server. Once the DNS propogates Internet-wide you should be all set. - At this point I sent a test message from my Hotmail account to a user on the test domain. In very short order the message was received at the Destination Server. To verify that it actually routed through the IMail server I viewed the whole message source and looked for the appropriate hops and there they were. Since Declude sees e-mail routed through IMail this way as outgoing mail, to actually start filtering spam you have to use Declude's domain-specific configuration by creating a directory called domain.com underneath your declude directory and then creating a $default$.junkmail file in the domain.com directory. So that's how I got IMail to act as a gateway for domains on other servers. Take Care, Dan Geiser [EMAIL PROTECTED] - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, February 19, 2004 4:37 PM Subject: RE: [Declude.JunkMail] Acting as a gateway for domains on other servers If it is not urgent, contact me off list and I can help. May take me some time to get back to you on it. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Thursday, February 19, 2004 12:42 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Acting as a gateway for domains on other servers Hello, All, I've never been able to get the Store and Forward capability of IMail to work so I could relay mail and scan external domains. Is there anyone who has this setup who would be willing to lend me a hand? TIA, Dan Geiser [EMAIL PROTECTED] I know this works for
RE: [Declude.JunkMail] Declude JunkMail v1.78 (beta) released
Scott, Are the additions in the 1.77i release for SKIPIFWEIGHT and MAXWEIGHT included in 1.78 beta? Just want to make sure I don't break my Gibberish tests. :) Thanks! Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, February 18, 2004 2:51 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude JunkMail v1.78 (beta) released We have just released Declude JunkMail v1.78 (beta). See http://www.declude.com/junkmail/manual.htm . Notable changes since the last beta include: o JM FIX IPBYPASS limit increased from 20 to 100 entries. o JM FIX fromfile test type will now stop processing at first match. o JM FIX BADHEADERS test will no longer fail if To: not present but Bcc: is. o JM FIX Tests with DUHL in the name will now be skipped after first hop.. o JM FIX HTML code removal will now work with CRLFs in HTML tags. o JM FIX Fixes an issue with recipients in E-mails sent from IMail v8 web messaging. o JM FIX LOGLEVEL LOW will now have 1 line with tests that fail (HELOBOGUS=WARN SPAMCOP=DELETE, etc.). LOGLEVEL HIGH will have the old one line per test, with the warning message. o JM FIX MAILFROM test will now catch just username. o JM ADD DOMAINWHITELISTS ON option, to allow for per-domain whitelist files at \IMail\Declude\example.com\whitelist.txt. o JM ADD New tests dow and hour, to allow hour and day-of-week detection. IE HOUR hour 9 16 0 0 for local 9AM-4:59PM. DOW dow 1 5 0 0 for Monday through Friday. o JM ADD Adds TESTSFAILED searching for filters (for tests that have already run). For example, TESTSFAILED END CONTAINS SPAMCOP. o JM ADD New test spf added for SPF support. o JM ADD Filters can now have WHITELIST command to whitelist an E-mail (SUBJECT WHITELIST CONTAINS [Declude.JunkMail]) o JM ADD Adds NOTENDSWITH option to filters (REVDNS 0 NOTENDSWITH .aol.com). o JM ADD Adds CIDR option to filters (REMOTEIP 0 CIDR 192.0.2.0/24). o JM ADD Adds CMDSPACE test to help detect spamware in SMTP commands. o JM ADD Now will decode encoded subjects (for use in filters). Other additions and fixes can be found in the release notes, at http://www.declude.com/relnotes.htm . Anyone with an up-to-date Service Agreement is entitled to free upgrades (see http://www.declude.com/agree.htm for information on the Declude Service Agreement). --- Quick Resource Reference: Tech Support: [EMAIL PROTECTED] Mailing List: Send E-mail to [EMAIL PROTECTED] with subscribe declude.junkmail your name in the body New Releases List: Send E-mail to [EMAIL PROTECTED] with subscribe declude.releases your name in the body Troubleshooting: See manual URL above; look at Troubleshooting section Emergency Uninstall: See manual URL above; look at Emergency Uninstall section Urgent Support: urgent @declude.com (for urgent/time-sensitive issues only) Declude Addons/Tools URL: http://www.declude.com/tools Manual: http://www.declude.com/junkmail/manual.htm --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Acting as a gateway for domains on other servers
Look on the Ipswitch site for using iMail as a Gateway. There's an article on it. HINT: Use the HOSTS file. Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Thursday, February 19, 2004 3:42 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Acting as a gateway for domains on other servers Hello, All, I've never been able to get the Store and Forward capability of IMail to work so I could relay mail and scan external domains. Is there anyone who has this setup who would be willing to lend me a hand? TIA, Dan Geiser [EMAIL PROTECTED] I know this works for Declude virus but will this work for filter spam too? I would suspect that it does but I didn't see it in the documentation. Will gateway (store-and-forward) domains get scanned? Yes. However, IMail treats those domains as outgoing E-mail, since they are not stored locally. Therefore, the outgoing actions (from the \IMail\Declude\global.cfg file) will be used. If you want to use different actions for the gateway domains, you can set up per-domain settings for the domain. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- - Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan -- - Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DNS Reports timing out?
I've been running MS DNS since NT 4.0. W2003's DNS is much better but I've NEVER had a problem with any MS DNS. You're being told BIND is much better by a bunch of guys who drink Mountain Dew until 4:30am, hang around the Com-Sci lab, grow long beards, ride those sit-down/fold up bikes, wear Birkenstocks, play roll playing games, and have names like Dr. Kilroy. I know, I used to be one. :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Monday, February 16, 2004 2:08 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] DNS Reports timing out? We've been running MS DNS for years with no problem...except when our upstream DNS started flaking out, at which point we switched to using Verizon's big honking (technical term) DNS servers. Darin. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] GIBBERISH 2.0.1, single file filter with END functionality.
Matt, Just going through some saved items and wanted to follow up on this. Is 2.0.1 your latest version or is there a newer one? Mark -0- -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Monday, December 22, 2003 9:52 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] GIBBERISH 2.0.1, single file filter with END functionality. I've made some huge leaps forward recently in terms of the processing power required to run Declude with the custom filters that I have installed. This was done by way of the SKIPIFWEIGHT functionality introduced in the latest beta, but also by way of re-ordering my filters in the Global.cfg file so that the easiest to process custom filters are run first in the hopes of avoiding the need to run more costly ones. This new version of GIBBERISH makes use of functionality introduced in the 1.77 beta, however the most recent interim release, 1.77i7, should be used in order to guarantee proper operation (initial versions would always end processing, and effectively disabled the filters). The END functionality removes the need to have ANTI filters since the filter can be stopped before it gets to the main filter matches, and it also presents another opportunity to save on the processing power required to run such things. This also makes use of the MAXWEIGHT functionality to limit the max score as well as end processing once a single hit has been scored. Note that the filter will only log (at the LOW setting) and show WARN actions when the filter is tripped and an END was not hit...which is great! No more looking at non-scoring custom filters due to counterbalances :D Please read through the file and follow these instructions if you already have GIBBERISH installed: 1) Comment out the ANTI-GIBBERISH custom filter in your Global.cfg 2) Change the score of the GIBBERISH filter to 0 in your Global.cfg. 3) Change the scoring of the filter to match your system (it is scored by default for base 10 systems). This can be done by changing the MAXWEIGHT and Main Filter lines to reflect the multiple of 10 that your system is based on. 4) Change the SKIPIFWEIGHT score to reflect your delete weight, or whatever weight you would like for the filter to be skipped if the system has already reached it before processing the filter. The file can be downloaded from the following location: http://www.mailpure.com/software/decludefilters/gibberish/Gibb erish_v2-0-1.zip Please report any issues with the new filter format. As soon as bugs stop being reported, I will move to convert the other dual file filters into single file alternatives which make use of the END functionality. Until the functionality goes into a full release, I'm going to continue to primarily provide the old style filters on my site. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] GIBBERISH 2.0.1, single file filter with END functionality.
Matt, Thanks for the response. I did that but the newest file is just 2.0.1 I guessed you might have posted at: http://www.mailpure.com/software/decludefilters/gibberish/Gibberish_v2-1-0.txt but that spit back a 404 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Friday, February 13, 2004 11:57 AMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] GIBBERISH 2.0.1, single file filter with END functionality. I shared 2.1.0 of that filter on this list along with some updates for other filters as well. I don't meant to be flippant by suggesting that you search the archives, because that's what I would probably do in order to figure it out. A good string would probably be a search of the base address "software/decludefilters".MattMark Smith wrote: Matt, Just going through some saved items and wanted to follow up on this. Is 2.0.1 your latest version or is there a newer one? Mark -0- -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matthew Bramble Sent: Monday, December 22, 2003 9:52 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] GIBBERISH 2.0.1, single file filter with END functionality. I've made some huge leaps forward recently in terms of the processing power required to run Declude with the custom filters that I have installed. This was done by way of the SKIPIFWEIGHT functionality introduced in the latest beta, but also by way of re-ordering my filters in the Global.cfg file so that the easiest to process custom filters are run first in the hopes of avoiding the need to run more costly ones. This new version of GIBBERISH makes use of functionality introduced in the 1.77 beta, however the most recent interim release, 1.77i7, should be used in order to guarantee proper operation (initial versions would always end processing, and effectively disabled the filters). The END functionality removes the need to have ANTI filters since the filter can be stopped before it gets to the main filter matches, and it also presents another opportunity to save on the processing power required to run such things. This also makes use of the MAXWEIGHT functionality to limit the max score as well as end processing once a single hit has been scored. Note that the filter will only log (at the LOW setting) and show WARN actions when the filter is tripped and an END was not hit...which is great! No more looking at non-scoring custom filters due to counterbalances :D Please read through the file and follow these instructions if you already have GIBBERISH installed: 1) Comment out the ANTI-GIBBERISH custom filter in your Global.cfg 2) Change the score of the GIBBERISH filter to 0 in your Global.cfg. 3) Change the scoring of the filter to match your system (it is scored by default for base 10 systems). This can be done by changing the MAXWEIGHT and Main Filter lines to reflect the multiple of 10 that your system is based on. 4) Change the SKIPIFWEIGHT score to reflect your delete weight, or whatever weight you would like for the filter to be skipped if the system has already reached it before processing the filter. The file can be downloaded from the following location: http://www.mailpure.com/software/decludefilters/gibberish/Gibb erish_v2-0-1.zip Please report any issues with the new filter format. As soon as bugs stop being reported, I will move to convert the other dual file filters into single file alternatives which make use of the END functionality. Until the functionality goes into a full release, I'm going to continue to primarily provide the old style filters on my site. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
[Declude.JunkMail] 1.77 beta
Scott, Sorry if this has been answered 1000 times but I haven't had much time to read the group lately. Is 1.77 beta stable (for a beta)? I remember seeing something about some log file issues. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] 1.77 beta
Sorry if this has been answered 1000 times but I haven't had much time to read the group lately. Is 1.77 beta stable (for a beta)? I remember seeing something about some log file issues. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT? Best Plattform?
2003. It's MUCH more secure than 2000 because many services are not enabled by default which is the case in 2000. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, February 04, 2004 12:24 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT? Best Plattform? 2000. The newer version is hardly mature, and it appears that just like XP made the 2000 core unstable, 2003 also repeats many of the same mistakes. 2003 is of course fancier, but the apps you are looking to use make little use of what the newer version might provide. Matt Hirthe, Alexander wrote: Hello, what is the better Plattform for Imail / Declude? Windows 2000 oder Windows 2003? Just Imail Declude, Spamcheck, AVG, F-Prot. Alex --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail - DecludeJunkmail/Virus Gateway
Sorry Two drives in RAID 1 (Mirrored) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, January 26, 2004 10:25 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Imail - DecludeJunkmail/Virus Gateway Each of these servers are ONLY relayers. They're Dell Poweredge 1650's Dual Processor 1.2Ghz, 1GB RAM 3x36GB drives in RAID 0 (with the 3rd as a hot-swap). How can you have 2 drives in a RAID 0 with a hot spare? If one drive fails, you lost the logical drive. Why would you even want to use RAID 0 of the OS? John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Multiple inbound Junkmail Gateways for the same domain...
I'm in the process of adding two more inbound MX relayers using iMail/Junkmail. When it's all done we'll have 4 inbound relayers (with equal preference numbers) for a huge Exchange System with iMail/Junkmail doing the upstream filtering. Here's my problem -- how do I easially look through the log files on four equal balanced servers? If we bounce/delete a message, we're going to need to look through the log files on four different servers in order to find out the right one. My though is to write a log parsing program that will run on each server and consolidate all 4 logs into a SQL server. From there I can just search for the message and change the rules accordingly. Before I start on this project, has anyone already done something like this? Mark Smith --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude JunkMail Evaluation
We gave up Brightmail and use Junkmail for an upstream filter on our inbound edge relayers. Mark E. Smith Systems and Technology Manager Associated Press Broadcast Technology 1825 K Street NW Suite 800 Washington, D.C. USA Phone: +1-202-736-9657 (GMT -05:00) Fax: +1-707-202-3957 http://www.enps.com Support Board: http://support.enps.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Spencer Salva Sent: Tuesday, January 20, 2004 7:01 PM To: Declude. JunkMail (E-mail) Subject: [Declude.JunkMail] Declude JunkMail Evaluation My company currently uses Declude JunkMail AntiVirus and we're starting a new project that will require similar software. I was wondering if anyone on here has used other email filtering software that you gave up in favor of Declude, and if so, why? Spencer Salva Systems Analyst Solimar Systems, Inc. tel: (619) 849-2800 [EMAIL PROTECTED] www.solimarsystems.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail - DecludeJunkmail/Virus Gateway
Kris, We have four inbound MX relayers for our Exchange 2003 system. The inbound MX relayers run iMail/Junkmail and each have an equal preference level in the MX records. Each of these servers are ONLY relayers. They're Dell Poweredge 1650's Dual Processor 1.2Ghz, 1GB RAM 3x36GB drives in RAID 0 (with the 3rd as a hot-swap). Logical partitions: 9GB C: (System OS) 7GB D: (Imail/Junkmail) 20GB E: (Junkmail Log Files using NTFS Mount point to d:\Imail\Declude\Spamlogs) Across all 4 relayers we process about 250,000-300,000 inbound messages a day (including spam/viruses). Works perfect for us. Mark E. Smith Systems and Technology Manager Associated Press Broadcast Technology 1825 K Street NW Suite 800 Washington, D.C. USA Phone: +1-202-736-9657 (GMT -05:00) Fax: +1-707-202-3957 http://www.ap.org http://www.enps.com Support Board: http://support.enps.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kris McElroy Sent: Monday, January 26, 2004 12:22 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Imail - DecludeJunkmail/Virus Gateway Sorry what I meant by example setups was the hard drive configuration and what type of hardware. I should have explained myself a little more clearly. Kris -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Sunday, January 25, 2004 10:34 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Imail - DecludeJunkmail/Virus Gateway First off I would like to say thanks to you and thanks to the others on this list and the Imail list that put effort and time in to helping people. If you don't mind me asking I am assuming that you do consulting for companies that run Imail at high volumes. Do you have any example setups of a typical Gateway (Imail/Declude) that sees high volume? Typical is a very obscure word. You can some what describe typical ISP or typical educational, but other than that, each configuration can be different based on the end users. Example, I operate/consult on 5 Imail/Declude servers. Each one is different. 2 are a major regional ISPs, another is a corporate server for a financial company, another is a coporate server for a real estate company, and one is a small ISP which includes a client that deals in electronic parts, hence gets a lot of e-mail from the far east. The one server that I consult on that is high volume is not a gateway, but the actual mail box server. I can not directly share their configuration, but if you read the archives on this list, you will see a lot of work that has gone into optimizing filters. Hopefully soon, I will have a site up and running for members to share filters and such. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Anyone using SSL for POP/SMTP/IMAP and experincing slowdowns?
http://slashdot.org/article.pl?sid=04/01/08/1849245mode=threadtid=126tid= 128tid=172tid=95 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Windows Server 2003
FWIW, We're running Windows 2003 server with imail gateways on 4 inbound MX servers for MS Exchange 2003 We process about 300,000 messages per day. No problems here. Actually, we've been talking about moving the OS back to Windows XP workstation. Since we only use iMail as a gateway relayer, there's no need to run IIS. There's no issue with more than 10 concurrent sessions so why waste the Server license when we can just use a workstation license? Mark Smith -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Friday, December 19, 2003 8:33 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Windows Server 2003 Here is a couple of quick stats from the responses: Of those using Windows Server 2003 at the time; 0-5K messages per day 4 5K-10K messages per day 2 10K-20K messages per day 2 20K-30K messages per day 1 30K-50K messages per day 0 50K-75K messages per day 1 75K-100K messages per day 0 100K or more per day 1 Now, how can you see a pattern with those amounts of respondes with problems on W2K3 compared to W2K? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Omar K. Sent: Friday, December 19, 2003 5:06 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Windows Server 2003 Statistically, a random 10% sample is sufficient on a lot of things. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Saturday, December 20, 2003 2:50 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Windows Server 2003 Hey John they do samples in surveys of less that of your sample as compared to the number of Imail servers. If you consider the number of people that watch TV and the small sample of people that NEILSON users to rate a shows popularity. I bet you have a better sampling than they do. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff (Lists) Sent: Friday, December 19, 2003 4:29 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Windows Server 2003 No. I am saying that only 176 responses to the survey does not give a reliable survey result when there are clearly at least 10 times that many out there, if not way more. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Todd Holt Sent: Friday, December 19, 2003 4:13 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Windows Server 2003 John, Are you saying that small servers are not reliable?? :)) Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Friday, December 19, 2003 3:05 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Windows Server 2003 Unfortunately, there were only 176 responses, mostly from small to mid size setups. Therefore, the results were not reliable. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Omar K. Sent: Friday, December 19, 2003 2:15 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Windows Server 2003 Yeah, whatever happened to that, I poured my heart out there :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of DLAnalyzer Support Sent: Friday, December 19, 2003 11:52 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Windows Server 2003 John, I remember you did a survey awhile back on problems with Imail/etc. Were the results of that ever posted? Darrell Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.dlanalyzer.com John Tolmachoff (Lists) writes: For the majority, W2K3 is the way to go if you are able to. Ipswitch does support running Imail on W2K3. There are some possible issues. 1. Running MS DSN service on W2K3 WITH Imail Anti-Spam DNS tests is a problem. 2. Some issues have been reported on the Imail list
[Declude.JunkMail] Autowhitelist AND gateways
How does (or doesn't it) AUTOWHITELIST work with a Gateway situation? We use iMail/Junkmail simply as a spam solution to MSFT Exchange 2003. My hunch is that it doesn't work because the users won't have a local login. Then again, I could write an application to extract contacts from a given users mailbox and insert them into the iMail contacts. That would probably cause the gateway to stop functioning because the mailbox would be on the iMail server. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] A little CMA documentation for Outlook 2003 RFC non-compliance 2003 RFC non-compliance
BTW, I forwarded this issue to a colleague, Sue Moser of Slipstick Systems http://www.slipstick.com and Windows magazine contributor. Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, December 04, 2003 2:19 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] A little CMA documentation for Outlook 2003 RFC non-compliance 2003 RFC non-compliance I have a customer who was having trouble with his messages sent to users on servers that use spam filters not being delivered. I had him send a message to me so I could see what tests it fails. As some of you may have already guessed, he's got a new pc with Outlook 2003 and the messages fail the spam headers test. I informed him that among mail server and/or spamfilter administrators this is a known issue. So, he calls MS. MS says it's OEM software, call the vendor. Dell says I'm full of it. So... Would someone with more thorough and better understanding than mine please send me something (with permission to quote or I'd just lift from archives) that I can send to this customer? I'm looking for what it is that Outlook 2003 does wrong and what RFC it is not conforming to. He wants to then show it to Dell and request an exchange for Office 2002. It's really a Microsoft issue (it's a bug -- er, new feature -- in Outlook 2003), but they may have a special arrangement with Dell. Microsoft had a few complaints from people using Outlook that their machine name was leaked in the Message-ID header. Instead of ignoring the complaint, or making the host name used in the Message-ID: header configurable, they chose to remove the Message-ID: header. Microsoft is technically RFC-compliant, *if* they understand the consequences of what they did. In order words, it is only RFC-compliant if accept the fact that the E-mail sent from Outlook 2003 may be marked as spam. Microsoft's position, from what we understand, is that they expect all mailservers to whitelist outgoing E-mail from Outlook 2003 users, and add the Message-ID: header. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] A little CMA documentation for Outlook 2003 RFC non-compliance 2003 RFC non-compliance
I'm assuming that this only happens with Outlook 2003 used with a non-Exchange (POP3/IMAP/SMTP mode)? Here are two headers from Outlook 2003 installed by Office 2003 Pro Microsoft Volume Licensing (not OEM) From Outlook/MAPI via Exchange 2003 -0- Received: from us-inboundmx.blank.com [61.220.41.95] by popmail.domain2.com with ESMTP (SMTPD32-8.03) id AFB28130208; Fri, 05 Dec 2003 05:36:34 -0500 X-MimeOLE: Produced By Microsoft Exchange V6.5.6944.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Subject: testing Date: Fri, 5 Dec 2003 05:36:34 -0500 Message-ID: [EMAIL PROTECTED] X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: testing Thread-Index: AcO7G6c5ASWwh2hOTRWz0b/pUSbfKw== From: Mark E. Smith [EMAIL PROTECTED] To: [EMAIL PROTECTED] X-Note: Weight: 0 - This E-mail was scanned by NETrends Systems (www.netrends.com) for spam. X-Spam-Tests-Failed: Whitelisted X-Spam-Prob: 0.169437 X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 341408898 -0- From Outlook/POP3/SMTP via iMail SMTP -0- Microsoft Mail Internet Headers Version 2.0 Received: from ussmtpin2.blank.com ([10.7.4.111]) by us-inboundmx.blank.com with Microsoft SMTPSVC(6.0.3790.0); Fri, 5 Dec 2003 05:40:53 -0500 Received: from popmail.domain2.com [16.196.89.161] by ussmtpin2.blank.com with ESMTP (SMTPD32-8.03) id A0B38CD0118; Fri, 05 Dec 2003 05:40:51 -0500 Received: from msmithd800xp [162.83.21.69] by popmail.domain2.com with ESMTP (SMTPD32-8.03) id A0AF8330208; Fri, 05 Dec 2003 05:40:47 -0500 From: Mark Smith [EMAIL PROTECTED] To: Mark E. Smith [EMAIL PROTECTED] Subject: Testing from domain2 Date: Fri, 5 Dec 2003 05:40:47 -0500 X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Thread-Index: AcO7HD5aazFkluigRS2DXlE/jJeQ9w== Message-Id: [EMAIL PROTECTED] X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [420e]. X-RBL-Warning: MS-WHITE: Message failed MS-WHITE: 0. X-RBL-Warning: TLD-TRUSTED-MAILFROM: Message failed TLD-TRUSTED-MAILFROM test (27) X-RBL-Warning: TLD-TRUSTED-REVDNS: Message failed TLD-TRUSTED-REVDNS test (46) X-Note: Weight: 3 - This E-mail was scanned by NETrends Systems (www.netrends.com) for spam. X-RBL-Warning: WHITELISTFILE: Message failed WHITELISTFILE test (100) X-RBL-Warning: MS-WHITE: Message failed MS-WHITE: 0. X-RBL-Warning: TLD-TRUSTED-HELO: Message failed TLD-TRUSTED-HELO test (27) X-RBL-Warning: TLD-TRUSTED-MAILFROM: Message failed TLD-TRUSTED-MAILFROM test (27) X-RBL-Warning: TLD-TRUSTED-REVDNS: Message failed TLD-TRUSTED-REVDNS test (37) X-Note: Weight: -110 - This E-mail was scanned by NETrends Systems (www.netrends.com) for viruses and spam. Return-Path: [EMAIL PROTECTED] X-OriginalArrivalTime: 05 Dec 2003 10:40:53.0729 (UTC) FILETIME=[42002510:01C3BB1C] -0- -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, December 04, 2003 2:19 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] A little CMA documentation for Outlook 2003 RFC non-compliance 2003 RFC non-compliance I have a customer who was having trouble with his messages sent to users on servers that use spam filters not being delivered. I had him send a message to me so I could see what tests it fails. As some of you may have already guessed, he's got a new pc with Outlook 2003 and the messages fail the spam headers test. I informed him that among mail server and/or spamfilter administrators this is a known issue. So, he calls MS. MS says it's OEM software, call the vendor. Dell says I'm full of it. So... Would someone with more thorough and better understanding than mine please send me something (with permission to quote or I'd just lift from archives) that I can send to this customer? I'm looking for what it is that Outlook 2003 does wrong and what RFC it is not conforming to. He wants to then show it to Dell and request an exchange for Office 2002. It's really a Microsoft issue (it's a bug -- er, new feature -- in Outlook 2003), but they may have a special arrangement with Dell. Microsoft had a few complaints from people using Outlook that their machine name was leaked in the Message-ID header. Instead of ignoring the complaint, or making the host name used in the Message-ID: header configurable, they chose to remove the Message-ID: header. Microsoft is technically RFC-compliant, *if* they understand the consequences of what they did. In order words, it is only RFC-compliant if accept the fact that the E-mail sent from Outlook 2003 may be marked as spam. Microsoft's position, from what we understand, is that they expect all mailservers to whitelist outgoing E-mail from Outlook 2003 users, and add the Message-ID: header. -Scott --- Declude JunkMail
RE: [Declude.JunkMail] sniffer
Sniffer's well worth the $300.00 per year. That breaks down to less than $1.00 per day. It catches content that some RBLs don't catch. Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Anderson Sent: Tuesday, December 02, 2003 10:28 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] sniffer It's not worth paying the subscription fee, in my opinion. I have a client that's paying for it, and it doesn't catch very much that isn't already caught somewhere else. I am considering Maps too. But it's $1500/yr. Anyone using them? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] EASYNET tests going away December 1
FWIW, I run many more tests than this -- about 30 total plus the internal Declude tests, External Sniffer, and Declude Virus. Message load is about 150,000 messages per day on a dual 2.8 Ghz. No performance hits noticed. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of paul Sent: Monday, December 01, 2003 11:52 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] EASYNET tests going away December 1 Andy, You have all of these tests running? What's the impact on the server for all of these? What's your mail load? I just love having to replace all these tests every month or so, don't we all? LOL! But I want to lessen the impact on our server as much as possible. What of these tests do you recommend the most? Paul Hi, Yesterday's results of my EasyNet replacement candidates: TEST # FAILED Percentage AHBLDOMAINS710.95% AHBLPROXIES...7359.82% AHBLSOURCES...3514.69% (reliable, so far) NJABLDUL..2743.66% (many duplicates with SORBS-DUL) NJABLPROXIES1,085...14.49% NJABLRELAYS...1181.58% NJABLSOURCES..2653.54% (reliable, so far) SORBS-DUL...2,664...35.58% SORBS-HTTP7379.84% (proxies) SORBS-MISC.801.07% (proxies) SORBS-SOCKS...873...11.66% (proxies) SORBS-SMTP..50.07% SORBS-ZOMBIE...300.40% A) Do NOT use SORBS-SPAM. As they point out on their web site, it has been infested with the mail servers of most major providers by the simple fact that virus-infected customer systems have been sending arbitrary emails, implicating the mail sever of the provider. I tested it for two days and kept lowering the weight until I realized that it was not at all helpful in trying to distinguish spam from legitimate mail. B) I have been holding and/or deleting ANYTHING proxy for many weeks now and so far never had any customer complaints about lost emails. Best Regards Andy Schmidt --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: FireWall VPN Opinion
Go for Checkpoint's 25 user/IP option. You can buy two Nokia IP350's on Ebay for $400.00 each. Blows Sonicwall, Watchguard and anything else outtta' the water. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Sunday, November 16, 2003 3:49 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: FireWall VPN Opinion I need to setup a VPN between two offices with under 25 computers one location and 5 at the other end. Both offices also need client remote VPN from windows XP What are your opinions on the SONICWALL and WATCHGUARD products Sonicwall SOHO 3 or Warchguard SOHO 6tc Kevin Bilbee --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Character set/unicode testing?
Is there any way to filter based on character set, code page, etc?
I'm getting swamped with tons of Cirilic spam lately and it's passing my
RBL's recently.
I can't filter by code word or phrase and the MAILFROM field is random.
Any thoughts?
Here's a sample
-0-
ETOpJa8Lj9twl9fIQ
(, . ...)
. . , .59, (7-10 . ). 352,8
. . 1- / ( ), 2 ., ,
, , , ,
. 2 .
1100$ . , : 200$ . . / ( ).
: rcl506TD940837
TIGQEcqiUgIFpRrJ
j)pj jyu+*7^V*m^r[yNfy^
%y j)fj)b b{.n+lzwZI[hfu%fvz
%y j)Srzjm j)Zb(
RE: [Declude.JunkMail] Placing Weight in Header
Title: Message Duuuh.. Why didn't I think of that. FWIW, if you just put Weight: %WEIGHT% in the header then you might be breaking RFC's. There should be an X- before your "Weight"linewhich will denote a comment line. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of GlobalWeb.net WebmasterSent: Thursday, September 04, 2003 8:25 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Placing Weight in Header we use , in our global.cfg file, XINHEADERWeight: %WEIGHT% so you could out in yours: XINHEADERX-DECLDUE-WEIGHT:%WEIGHT% Sincerely,Randy ArmbrechtGlobal Web Solutions, Inc.804-346-5300 ext. 1877-800-GLOBAL (4562) ext. 1http://globalweb.net -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark SmithSent: Thursday, September 04, 2003 7:39 AMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Placing Weight in Header Is there any way to place the total weight in the SMTP header? Something like: X-DECLUDE-WEIGHT: yyy
RE: [Declude.JunkMail] Declude failing openrelay test
Title: Message I just have "Relay for Addresses" I include my local Internal DMZ's subnet so I can relay off of various ASP scripts, etc. All of my users must authenticate in order to relay. -Original Message-From: Keith Johnson [mailto:[EMAIL PROTECTED] On Behalf Of Keith JohnsonSent: Thursday, September 04, 2003 8:34 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Declude failing openrelay test Mishi, I am running 8.02 and 7.15HF2with "Relay for Addresses" and Declude JM Pro 1.75i and I just ran the test and produced perfect results on both machines. It only reported 'Unknown User' and 'Not a local gateway', which is great. What relay setting are you running and version of Imail? Keith -Original Message- From: Mishi Saravi [mailto:[EMAIL PROTECTED] Sent: Thu 9/4/2003 7:20 AM To: [EMAIL PROTECTED] Cc: Subject: Re: [Declude.JunkMail] Declude failing openrelay test I am using the test for open relay at http://www.abuse.net/cgi-bin/relaytest on a machine running imail with declude and it is reporting the machine as openrelay. However the same test will report as no relay on a machine running imail without declude. Has any one run into this situation? Is it because declude that the machine is reporting as open relay? Many Thanks, Mishi attachment: winmail.dat
RE: [Declude.JunkMail] SORBS-SPAM
Cox cable I'll bet. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Glen Harvy Sent: Monday, September 01, 2003 6:12 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] SORBS-SPAM Who's Cox? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Smart Business Lists Sent: Tuesday, 2 September 2003 07:57 To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SORBS-SPAM Careful on SORBS-SPAM - blocking some large providers - Cox for one. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OSRELAY
No. They're not coming back. Read the mail archives. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of James R. Skivers Sent: Tuesday, September 02, 2003 12:25 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OSRELAY Does anybody know if *.osirusoft.com is back up yet? Anybody have a solid alternative configuration to be used in the mean time? James R. Skivers Network Administrator Web One Inc. [EMAIL PROTECTED] http://astra1.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Alligate
Is anyone using Alligate http://www.alligate.com ? I'm using message sniffer and was looking at adding alligate also. I'd appreciate any feedback.. Mark --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OSRELAY question.
I've seen it to. Additionally http://relays.osirusoft.com isn't responding and emails are being bounced. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick Sent: Tuesday, August 26, 2003 8:14 PM To: Declude. JunkMail (E-mail) Subject: [Declude.JunkMail] OSRELAY question. In going thru the held mail I am finding some emails with this warning. X-RBL-Warning: OSRELAY: Please stop using relays.osirusoft.com This only shows up on a few emails but it causes the email to fail the OSRELAY test - meaning more false positives. Other emails either do not have the warning or they show a normal OSRELAY warming - X-RBL-Warning: OSRELAY: This E-mail came from XXX.27.65.23, a potential spam source listed in OSRELAY. I searched the archives but did I miss an announcement that we were suppose to quit using OSRELAY. Thanks. Chuck Schick Warp 8, Inc. 303-421-5140 www.warp8.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OSRELAY question.
Anyone have any recommendations on what to replace: #OSDUL ip4rrelays.osirusoft.com127.0.0.3 5 0 #OSFORM ip4rrelays.osirusoft.com127.0.0.8 5 0 #OSLIST ip4rrelays.osirusoft.com127.0.0.7 5 0 #OSRELAYip4rrelays.osirusoft.com 127.0.0.2 5 0 #OSSMARTip4rrelays.osirusoft.com 127.0.0.5 5 0 #OSSOFT ip4rrelays.osirusoft.com127.0.0.6 5 0 #OSSRC ip4rrelays.osirusoft.com127.0.0.4 5 0 With? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OSRELAY Replacement question.
The fact that SPEWS is gone is not a bad thing! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Wednesday, August 27, 2003 1:11 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OSRELAY Replacement question. Let me also correct one thing. I mentioned SPEWS as an alternative to Osirusoft, but that one also comes from their servers :) In otherwords, don't use that either (as noted in Hank's recent message). Matt Andy Schmidt wrote: Here is the replacements that I'm using (marked up red) with the results for the last few hours: Best Regards Andy Schmidt -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark Smith Sent: Wednesday, August 27, 2003 09:44 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] OSRELAY question. Anyone have any recommendations on what to replace: #OSDUL ip4rrelays.osirusoft.com127.0.0.3 5 0 #OSFORM ip4rrelays.osirusoft.com127.0.0.8 5 0 #OSLIST ip4rrelays.osirusoft.com127.0.0.7 5 0 #OSRELAYip4rrelays.osirusoft.com 127.0.0.2 5 0 #OSSMARTip4rrelays.osirusoft.com 127.0.0.5 5 0 #OSSOFT ip4rrelays.osirusoft.com127.0.0.6 5 0 #OSSRC ip4rrelays.osirusoft.com127.0.0.4 5 0 With? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Imail 8 and antispam
Just installed Imail 8 and was wondering what the consensus about the default DNS blackslists are? Are most junkmail/sniffer users leaving these enabled or disabling them? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] iMail 8.0
Are there any issues with Junkmail/Virus and iMail version 8.0? We're planning on the upgrade next week and didn't want to break anything. :) Thanks! --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Amazing!!
If this isn't the easiest way to get valid email addresses for spammers! -0- -Original Message- From: Hacking Emails [mailto:ijnijnijnijnijnijnijnijnijnijnijnijnijnijnijnijnijnijn [EMAIL PROTECTED] Sent: Tuesday, March 25, 2003 5:25 AM To: Subject: Just send the email address u want to hack. We'll send u the password. Want to HACK any ones EMAIL ?. Just send 2 emails to [EMAIL PROTECTED] . In the first email write your-email-address in the subject line. Then immediately send the second email writing the-persons-email-address-u want-to-hack in the subject line. (remember, the second email should contain the persons id whom you want to hack. In the subject line). Thats all. If your request is qualified and passed. The password of the person you want to hack will be send to your email address in 48 hrs. But we do not take any respossibilities of non delivery. --- [This E-mail scanned for viruses by NETrends.com Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] TMDA test...
Has the addition of the TMDA test been discussed with Junkmail/Imail? http://tmda.net --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spews is incompetent (well, overzealous at least)
Right, the only way to talk to them is through the abuse newsgroup. The problem is that you have to deal with the comments from the millions of other As* Hol** on that group. I love the comments like Well just move to another ISP. Yeah right and have to re-configure hundreds of IP addresses in DNS records, ASP, PHP, routing, etc.. :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Phillip B. Holmes Sent: Thursday, February 06, 2003 7:27 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spews is incompetent (well, overzealous at least) Mark, I may be off base here, but I am almost positive that spews.org offers no way of communicating with people. There is no way to contact them. Regards, Phillip B. Holmes Media Resolutions Inc. Macromedia Alliance Partner http://www.mediares.com [EMAIL PROTECTED] 1-888-395-4678 972-889-0201 /* Please send support requests to [EMAIL PROTECTED] */ Failure is not falling down but refusing to get up.--- Chinese Proverb -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Mark Smith Sent: Thursday, February 06, 2003 8:38 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spews is incompetent (well, overzealous at least) Here Here! I'm not defending them at all but they really should use something other then that kiddy farm newsgroup to communicate with. I really think that's half of their perception problem. Of course their guerilla tactics don't help! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Phillip B. Holmes Sent: Wednesday, February 05, 2003 8:03 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spews is incompetent (well, overzealous at least) Well, Nah, they're incompetent, overzealous and irresponsible. Did I say that out loud? I feel like I did my part. Today we helped convinced another mid-sized provider (http://www.OLM.com) to stop using spews completely. They implemented spews on 02/03/03 and by 02/05/03 it was gone. However, I can't take all the credit. There were PLENTY of ticked off users and admins reading them the riot act. Regards, Phillip B. Holmes Media Resolutions Inc. Macromedia Alliance Partner http://www.mediares.com [EMAIL PROTECTED] 1-888-395-4678 972-889-0201 /* Please send support requests to [EMAIL PROTECTED] */ Failure is not falling down but refusing to get up.--- Chinese Proverb -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Colbeck, Andrew Sent: Wednesday, February 05, 2003 6:02 PM To: '[EMAIL PROTECTED]' Subject: [Declude.JunkMail] Spews is incompetent (well, overzealous at least) Check out this article if you haven't already. http://www.theregister.co.uk/content/6/29159.html The link to the Newsgroup message thread for pro vs. con is worth a read, and includes some gems. The short of it is that spews.org often lists a much bigger netblock than they need to, on the philosophy that users of their system prefer to not deal at all with an ISP that is receiving income by hosting a spammer. For similar reasons, even though it's a pretty darn big ISP through acquisitions, my ISP is listed in XBL and BLARS for a very small number of spammer infractions. I use OSSRC but give it a relatively low weight due to the likelihood of throwing the baby out with the bathwater. Andrew. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
RE: [Declude.JunkMail] Spews is incompetent (well, overzealous at least)
Here Here! I'm not defending them at all but they really should use something other then that kiddy farm newsgroup to communicate with. I really think that's half of their perception problem. Of course their guerilla tactics don't help! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Phillip B. Holmes Sent: Wednesday, February 05, 2003 8:03 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spews is incompetent (well, overzealous at least) Well, Nah, they're incompetent, overzealous and irresponsible. Did I say that out loud? I feel like I did my part. Today we helped convinced another mid-sized provider (http://www.OLM.com) to stop using spews completely. They implemented spews on 02/03/03 and by 02/05/03 it was gone. However, I can't take all the credit. There were PLENTY of ticked off users and admins reading them the riot act. Regards, Phillip B. Holmes Media Resolutions Inc. Macromedia Alliance Partner http://www.mediares.com [EMAIL PROTECTED] 1-888-395-4678 972-889-0201 /* Please send support requests to [EMAIL PROTECTED] */ Failure is not falling down but refusing to get up.--- Chinese Proverb -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Colbeck, Andrew Sent: Wednesday, February 05, 2003 6:02 PM To: '[EMAIL PROTECTED]' Subject: [Declude.JunkMail] Spews is incompetent (well, overzealous at least) Check out this article if you haven't already. http://www.theregister.co.uk/content/6/29159.html The link to the Newsgroup message thread for pro vs. con is worth a read, and includes some gems. The short of it is that spews.org often lists a much bigger netblock than they need to, on the philosophy that users of their system prefer to not deal at all with an ISP that is receiving income by hosting a spammer. For similar reasons, even though it's a pretty darn big ISP through acquisitions, my ISP is listed in XBL and BLARS for a very small number of spammer infractions. I use OSSRC but give it a relatively low weight due to the likelihood of throwing the baby out with the bathwater. Andrew. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spews is incompetent.
Same thing happened to us... You're preaching to the choir on that one. FWIW, the way we got around it was to work with our ISP and had them grant us a /29 subnet that wasn't listed on SPEWS. We then multinetted that network and placed two SMTP servers on it as gateways/smarthosts. I've lowered OSSRC to a weight of 1. It does have some value but not much IMHO. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Phillip B. Holmes Sent: Tuesday, February 04, 2003 7:34 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spews is incompetent. Spews Topic: Spews.org blacklisted one of our mail servers because of a domain that the client hosts on another host! He has about 20 sites on different networks and only one sent 1 round of spam from one of his OTHER SITES BEFORE he moved a domain to us! In other words, the domain in question has never been nor will be our client or even near our network. We were grouped with about 10 other ISPs as supporting spam. So, we are just guilty by association! Luckily, most ISPs don't take spews seriously. Quite frankly, their webpages sounds like it was written by a 14 year old kid. It is amazing they have not been sued out of existence. Mr. Perry would do well to remove the OSSRC listing from his product completely. Regards, Phillip B. Holmes Media Resolutions Inc. Macromedia Alliance Partner http://www.mediares.com [EMAIL PROTECTED] 1-888-395-4678 972-889-0201 /* Please send support requests to [EMAIL PROTECTED] */ Failure is not falling down but refusing to get up.--- Chinese Proverb -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff Sent: Tuesday, February 04, 2003 12:41 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Comments Spews is a joke and should be taken offline Agreed. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Windows API call to WINSOCK.DLL
I'm not sure I understand what you want to do. The ASP code is just done through the Request.ServerVariables Collection. I'm not sure I understand the requirement for the .exe Have you ever used API's before? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Paul Fuhrmeister Sent: Monday, January 27, 2003 11:21 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Windows API call to WINSOCK.DLL We need to do a Windows API call to WINSOCK.DLL - GetHostByAddr and - GetHostByName Need to do it in an ASP page and in a server side .exe (VB6). It's for a project where we're running a name server with spam-vertised domain names, IP Numbers and phone numbers. We have an .exe to pick them out of emails, now we need to look them up on the name server. Can anyone tell us what is the code to do these winsock api call? Will make all source and system available to everyone. [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Hotmail, Yahoo, MSN, etc...
What is everyone doing about Hotmail, Yahoo, Juno and other web-based mail systems? It's really a catch-22. Hotmail is so frequently listed on RBL's and is a large source of spam but it's also a large source of legitimate email. They all seem to fail postmaster and abuse so they're already at 6-8 points on most peoples Junkmail. You can't whitelist them, and the RBL's usually send them over the edge. I use Sniffer so I've thought about adding a rule for hotmail, yahoo, etc to subtract the sum of postmaster and abuse and let message sniffer do some magic on these sites. Thoughts? --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hotmail, Yahoo, MSN, etc...
That's the problem... Hotmail is on and off of Spamcop every other day. We bounce at 12 and delete at 20. Spamcop is at 8 so I'll put in -8 for hotmail which will adjust for the nopostmaster and noabuse. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff Sent: Thursday, January 09, 2003 11:59 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Hotmail, Yahoo, MSN, etc... The way I have it configured, they will end up with a weight of 8 and we hold at 20, so they would have to fail a test like SPAMCOP or NOXMAIL or one of our major filters to be held. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] No reverse dns
This shouldn't fail REVDNS as there is a REVDNS entry. Maybe HELOBOGUS. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Jim Rooth Sent: Thursday, January 09, 2003 1:24 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] No reverse dns Problem is there are 57 domains using one ip address. Reverse lookup shows the domain the server is and not the other domains. But if you do a reverse lookup for mail.standardhardware.com it will give you 168.75.225.197 mail.klotron.com. Thus it fails the reverse dns test. The IP is correct but the domain name is that of the main mail record. Jim Rooth Klotron, Inc. 214.244.0979 [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff Sent: Thursday, January 09, 2003 12:17 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] No reverse dns Jim, only one PTR record per IP address needed. Should only be for the mail record domain. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.438 / Virus Database: 246 - Release Date: 1/7/2003 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.438 / Virus Database: 246 - Release Date: 1/7/2003 --- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] any ideas?
Put in Nifty-fun-pages.com It will kill anything with that string in the fromlist. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of paul Sent: Tuesday, December 24, 2002 10:01 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] any ideas? Hey gang, First, Merry Christmas, or Happy Holidays, take your pick. First: One thing that really ticks me off is entries like this: @mail46.nifty-fun-pages.com @mail212.nifty-fun-pages.com @mail125.nifty-fun-pages.com Now I could list each of these in my kill file, but if they use mail1 - mail1999 that list would get pretty long. I have .nifty-fun-pages.com in my FROMLIST file, but I don't weight any ONE test to delete, and each of these uses a different IP address. So the question: What's the best approach to kill this crap? My idea was to create a Declude filter that IS set to delete if it fails, and put .nifty-fun-pages.com in it. That would work, but does anyone else do anything differently? Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Incorrect Action
DOLP Thanks for the extra set of eyes! :) Merry Christmas! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, December 24, 2002 10:11 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Incorrect Action I hit the send button too fast on this one. There should have been another test with the log and config files. Do you see it? I've found it. The problem seems to be due to a typo: WEIGHT1229 weightrange x x 12 19 WEIGHT1219 BOUNCE If you change the WEIGHT1229 weightrange x x 12 19 line from the global.cfg file to WEIGHT1219 weightrange x x 12 19, it should take care of the problem. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Incorrect Action
Title: Message Scott,Why is Junkmail assigning the action 'ignore' to these emails?SMTP Header:Received: from mail.aloansolution.com [208.179.55.3] by popmail.netrends.com with ESMTP (SMTPD32-7.13) id AEE938801CA; Mon, 23 Dec 2002 22:05:13 -0500Received: from info.cisoffice.com ([65.194.90.21]) by mail.aloansolution.com (VisNetic.MailServer.v5.3.5.0) with ESMTP id KHAVHT for [EMAIL PROTECTED]; Sun, 22 Dec 2002 16:01:19 -0800Received: from info.cisoffice.com ([65.194.90.21]) by info.cisoffice.com with Microsoft SMTPSVC(5.0.2195.5329); Sun, 22 Dec 2002 18:00:41 -0500Received: by info.cisoffice.com (Microsoft Connector for POP3 Mailboxes 5.00.2195) with SMTP (Global POP3 Download) id [EMAIL PROTECTED]; Sun, 22 Dec 2002 18:00:36 -0500Received: from mail.aloansolution.com (unverified [208.179.55.3]) by mailserver.carolinainternet.com(Vircom SMTPRS 5.3.232) with ESMTP id [EMAIL PROTECTED] for [EMAIL PROTECTED];Sun, 22 Dec 2002 17:50:22 -0500Message-ID: [EMAIL PROTECTED]Received: from localhost ([127.0.0.1]) by mail.aloansolution.com (VisNetic.MailServer.v5.3.5.0) with SMTP id KHAVHT for [EMAIL PROTECTED]; Sun, 22 Dec 2002 14:20:19 -0800Date: Sun, 22 Dec 2002 14:20:19 -0800From: Jim [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: Ready to Refinance? We make it EASY! ADVX-Mailer: VisNetic WebMail 3.3.3X-Originating-IP: 208.54.20.242MIME-Version: 1.0Content-Type: text/html; charset="us-ascii"Content-Transfer-Encoding: 7bitReturn-Path: [EMAIL PROTECTED]X-OriginalArrivalTime: 22 Dec 2002 23:00:41.0747 (UTC) FILETIME=[F3912E30:01C2AA0D]X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?208.179.55.3X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 208.179.55.3 with no reverse DNS entry.X-RBL-Warning: SPAMFILTER: Message failed SPAMFILTER test (19)X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam.X-Spam-Tests-Failed: SPAMCOP, REVDNS, SPAMFILTER, WEIGHT1229X-RCPT-TO: [EMAIL PROTECTED]Status: UX-UIDL: 330496548 Logfile:KFILE DELETEDSBL WARNORDB WARNOSDUL WARNOSFORM WARNOSLIST WARNOSRELAY WARNOSSMART WARNOSSOFT WARNOSSRC WARNSPAMCOP WARNBASE64 WARNSPAMFILTER WARNMONKEYPROXIES WARNMONKEYFORMMAIL WARNDSN WARNNOABUSE WARNNOPOSTMASTER WARNBADHEADERS WARNHELOBOGUS WARNMAILFROM WARNPERCENT WARNREVDNS WARNROUTING WARNSPAMHEADERS WARNSNIFFER WARNWEIGHT1219 BOUNCEWEIGHT20 DELETE
RE: [Declude.JunkMail] Hex Code URL's...
This is a trick to make the user think that they're going to a link on yahoo. Actually this is redirecting them to IP address: 0xD5.0xEF.0x8F.0x9A or 213.239.143.154 and then encode the path. I can't see any reason to do this. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kami Razvan Sent: Thursday, December 19, 2002 12:29 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Hex Code URL's... Hi; I am seeing more and more URL's that are encoded, like: http:[EMAIL PROTECTED]/%72%65%64%6C%69%67%68%74%65%6D% 61%69%6C%2F%69%6D%61%67%65%73%2F%30% I am yet to see anyone with a legitimate eMail use such an approach for sending their links. Is there a legitimate reason to do this? It seems like this could be an easy test to have in JM for the body. It is almost like a 100% guarantee that if used this is a spam.. Regards, Kami --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hex Code URL's...
Theoretically, there should never be a @ symbol in the URL unless it contains authentication. I can't think of that happening too often. The problem is searching for http://%@% where % is the wildcard. I don't think this is possible with the current filters. Scott? Maybe just placing a weight test to search for @ or %40 would help, but as _M just pointed out there are some that will be trapped. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Madscientist Sent: Thursday, December 19, 2002 1:18 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Hex Code URL's... We've done some research on this and experimented with some rules. More rule templates are coming, but as it turns out - filtering this is harder than you might expect - depending upon your system's requirements. Many supposedly legitimate mail/news systems encode large segments of URLs or even entire urls after some processing root in order to track user activity. Many of our first attempts to filter based on this kind of encoding have since been rejected due to false positive requests. One such rule even blocked messages from the IMail list due to an encoded %40 in the tag line. One trick that seems to reduce the false positive rate is to define the root of the URL carefully and to ensure that the pattern match is at the root of the URL... so, for example, look for the href= or href= at the top of the url to avoid the kind of legitimate encoding that might come later. Hope this helps, _M PS: We do have a number of rules coding for patters like this and they are very successful - not as successful as we thought they would be, but still pretty good! Pete McNeil (Madscientist) President, MicroNeil Research Corporation Chief SortMonster (www.sortmonster.com) --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] An optional web interface for Declude JunkMail?
I'll be willing to publish mine (with source) but I'm not going to offer an installer. :) Here's how mine works.. All filter files and blacklists are kept in SQL tables. Actions (bounce, alert, etc) and Locations (mailfrom, subject, body) are also kept in SQL tables. The logic is pretty simple on this part. There's just an ASP front end but the catch is that it's dependant on ASPGrid by Persits Software so you'll need to purchase that COM Object to get this to work out of the box: http://www.aspgrid.com There's just more code involved to do the same thing in regular ASP but it's not that hard. The second part is a VB6 Application that simply extracts the tables, reformats, and writes them into the \declude directory. I chose to make this an actual application that has hooks back into IIS (using STDOUT) rather than an ASP or COM .dll because I wanted to be able to run it from a command line as well as the web interface. All you do is click on the publish link and IIS runs the .exe and the tables are written. Since there is currently no external whitelist, I've used a filter file that sets the weight to -100. If you know VB and ASP then it will be pretty easy to customize. You'll need: ADO 2.7 (MDAC 2.7) http://www.microsoft.com/data/ VB6 Runtime files ASPGrid http://www.aspgrid.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Avolve Support Sent: Tuesday, December 17, 2002 8:30 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] An optional web interface for Declude JunkMail? Double yes and Christmas wish ! -- Original Message -- From: David Lewis-Waller [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Tue, 17 Dec 2002 09:54:58 - A definite yes. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: 17 December 2002 00:50 To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] An optional web interface for Declude JunkMail? A lot of our customers seem to want a web interface to Declude JunkMail, mostly so that customers can turn their spam settings on or off. We haven't come up with something in the past, because it is very complicated without a hook into web messaging, and it doesn't look like Ipswitch is planning to add an interface to web messaging any time soon. However, we are at the point where we are considering a web interface. If we do it, it would probably need to be done as an addon to Declude JunkMail, mainly because the development and support costs would be fairly high. It would also have some drawbacks, being separate from web messaging. For example, it would require installing a separate service, using a different port than 80 or 8383 for web access (which may cause firewall problems), and having users enter their username/password a second time (if they are already using web messaging). Is this something that is important enough that it would be worthwhile? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] An optional web interface for Declude JunkMail?
That's why we try stay away from the bleeding edge technology -- there's a reason they use the word bleeding. It will actually be easier for us to use a flat file than to use a database. ODBC for text files? :) Sorry, I should have included PHP in that list (which is amazingly flexible, BTW). We're not talking about something the typical pre-bubble We need to show them something to collect our $10 million funding company would produce. We actually wrote a web scripting language well before ASP was available, and wrote our first web server back when people thought that dynamic content on a web page was a web page that was updated by hand every few hours. If we require ASP or PHP, we're going to require something that a number of our customers either don't have or won't have. Many of our customers would not even think of installing IIS or Apache on a mailserver. -Scott Interesting. Another thought... Is there any hook into the iMail web interface/server? If so, could it run your scripting engine? --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
