Re: [Declude.JunkMail] New XBL from Spamhaus

2004-01-04 Thread Roger Heath
Reply to: Keith Johnson
  Re: [Declude.JunkMail] New XBL from Spamhaus on Sunday 11:32:26 AM

http://www.spamhaus.org/xbl/index.lasso

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

K>  I read the following on the Register.  Does anyone know if we
K> can include this into Declude?  Thanks for the aid:
 
K>  Clip taken from:
K> http://www.theregister.co.uk/content/55/34690.html
 
K>  However, Spamhaus plans to fight back. Yesterday, it released
K> its Exploits Block List (XBL), a real-time DNS-based database of IP
K> addresses of illegal 3rd party exploits, including open proxies,
K> worms/viruses with built-in spam engines, and other types of
K> trojan-horse exploits utilized by spammers. This list is designed
K> to sit alongside the Spamhaus Block List (SBL), which blocks
K> incoming spam from direct spam sources. The combination of SBL and
K> XBL enables ISPs to safely reject a high volume of incoming spam
K> outright, Spamhaus says. 
 
K>  Keith

 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re[2]: [Declude.JunkMail] X-Declude-Date in Header

2003-12-26 Thread Roger Heath
Reply to: John Tolmachoff (Lists)
  Re: [Declude.JunkMail] X-Declude-Date in Header on Friday 7:18:53 PM

Thanks.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

J> It is a temporary insertion by Declude for troubling shooting. It will be
J> taken out in public release versions. This is per a answer by Scott earlier.

J> John Tolmachoff
J> Engineer/Consultant/Owner
J> eServices For You



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] X-Declude-Date in Header

2003-12-26 Thread Roger Heath
We are seeing an intermittent Declude header added to our messages
without us using a variable for it, e.g. :

X-Declude-Date: 12/26/2003 23:11:23 [106]

Is there a reason causing this to appear? This is the interm version..
and I know it warns of 'unusual logging', but we were surprised that
this is making an appearance with no variable indicated.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re[2]: [Declude.JunkMail] Filter Actions - WHITELIST?

2003-12-23 Thread Roger Heath
Reply to: R. Scott Perry
  Re: [Declude.JunkMail] Filter Actions - WHITELIST? on Tuesday 4:04:36 PM

Thanks! This will relieve the limit on the Global file as well... If
these filters could be processed first, it might give back a lot of
processor if all other actions were performed afterwards, but only if
the whitelist filters did not engage... ;)

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>Filter actions have so many nice basic functions, IGNORE, WARN,
>>DELETE, HOLD etc.
>>
>>Looking at new filters today and observing logs, it just seems
>>one of these actions naturally should be WHITELIST.
>>
>>Does this make sense?

R> We are planning on adding a WHITELIST action.  :)

R> -Scott


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Filter Actions - WHITELIST?

2003-12-23 Thread Roger Heath
Filter actions have so many nice basic functions, IGNORE, WARN,
DELETE, HOLD etc.

Looking at new filters today and observing logs, it just seems
one of these actions naturally should be WHITELIST.

Does this make sense?

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re[2]: [Declude.JunkMail] Null Sender Spam for Valid Accounts

2003-10-16 Thread Roger Heath
Reply to: John Tolmachoff (Lists)
  Re: [Declude.JunkMail] Null Sender Spam for Valid Accounts on Thursday 11:15:50 
AM

This is what I was doing but Spam Review might have 2000-10,000 of
bounced mails... too much to do in deleting them...

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

J> You could put in a temporary rule that holds or routes all message with a
J> blank or <> as sender, that way the end user will not see them, but you will
J> still be complying with the requirements.

J> John Tolmachoff MCSE CSSA
J> Engineer/Consultant
J> eServices For You
J> www.eservicesforyou.com

>> -Original Message-
>> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
>> [EMAIL PROTECTED] On Behalf Of Roger Heath
>> Sent: Thursday, October 16, 2003 1:53 AM
>> To: R. Scott Perry
>> Subject: [Declude.JunkMail] Null Sender Spam for Valid Accounts
>> 
>> Looking  at  Scott's  response below, I'd like to have the Refuse Null
>> Sender  switch off, but we have a situation where spammers are forging
>> valid  e-mail  addresses.  We have thousands of bounces showing up for
>> messages   never   sent   from   valid  accounts  here.  For  example,
>> [EMAIL PROTECTED]  may  be  a  valid  account  but  he  is not a
>> spammer.  But  a  spammer  uses [EMAIL PROTECTED] forges tens of
>> thousands  of messages with this as the 'reply to' account in headers.
>> Since   the  spammer  has  many  unvalid  accounts  in  his  spamming,
>> [EMAIL PROTECTED] is swamped with thousands of bounced mails for
>> mails  that  he did not even send... This is now happening to hundreds
>> of  accounts  here  because  it  looks  like the spammer's software is
>> randomly selecting them from a spam list.
>> 
>> I  have  re-enabled 'Refuse Null Senders' to relieve this problem, but
>> would like to find a more compliant solution. Does any one know how to
>> attack this issue in another way?
>> 
>> --
>> Roger Heath
>> [EMAIL PROTECTED]
>> www.rleeheath.com
>> 
>> R> Well,  the  real question is why do you think that you are safer by
>> R> rejecting  those  E-mails?  I'm not aware of any safety issues. The
>> R> only  issue  I  am  aware of is that a small percentage of spammers
>> R> send their spam that way.
>> R>
>> R> The  NULL  <>  sender  has  been  used for over 20 years for bounce
>> R> messages  and  other automated messages (such as vacation messages,
>> R> and  those  awful  spam  confirmation  E-mails, and Delivery Status
>> R> Notifications).
>> R>
>> R> So the choices are :
>> R>
>> R> [1] Comply (leave "Refuse NULL <> Senders" at the default UNchecked
>> R> setting). Pros: Your mailserver will act as expected. Cons: As very
>> R> small  percentage  of spam is sent this way, but it can be detected
>> R> using standard spam control.
>> R>
>> R> [2]  Refuse NULL <> senders. Pros: You'll have that "safe" feeling.
>> R> Cons:  You  won't  receive all your E-mail, because you're blocking
>> R> someofit,andbecauseyou'llgetlisted   at
>> R> http://www.rfc-ignorant.org .
>> R>
>> R> -Scott
>> 
>> 
>> 
>> 
>> 
>> --
>> ActivatorMail(tm) ver.01010031 Scanned for all viruses by
>> www.activatormail.com intelligent anti-virus anti-spam service
>> 
>> ---
>> [This E-mail was scanned for viruses by Declude Virus
J> (http://www.declude.com)]
>> 
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> type "unsubscribe Declude.JunkMail".  The archives can be found
>> at http://www.mail-archive.com.

J> ---
J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

J> ---
J> This E-mail came from the Declude.JunkMail mailing list.  To
J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
J> type "unsubscribe Declude.JunkMail".  The archives can be found
J> at http://www.mail-archive.com.
J> --
J> ActivatorMail(tm) ver.01010031 Scanned for all viruses by
J> www.activatormail.com intelligent anti-virus anti-spam service


--
ActivatorMail(tm) ver.01010031 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Null Sender Spam for Valid Accounts

2003-10-16 Thread Roger Heath
Looking  at  Scott's  response below, I'd like to have the Refuse Null
Sender  switch off, but we have a situation where spammers are forging
valid  e-mail  addresses.  We have thousands of bounces showing up for
messages   never   sent   from   valid  accounts  here.  For  example,
[EMAIL PROTECTED]  may  be  a  valid  account  but  he  is not a
spammer.  But  a  spammer  uses [EMAIL PROTECTED] forges tens of
thousands  of messages with this as the 'reply to' account in headers.
Since   the  spammer  has  many  unvalid  accounts  in  his  spamming,
[EMAIL PROTECTED] is swamped with thousands of bounced mails for
mails  that  he did not even send... This is now happening to hundreds
of  accounts  here  because  it  looks  like the spammer's software is
randomly selecting them from a spam list.

I  have  re-enabled 'Refuse Null Senders' to relieve this problem, but
would like to find a more compliant solution. Does any one know how to
attack this issue in another way?

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com

R> Well,  the  real question is why do you think that you are safer by
R> rejecting  those  E-mails?  I'm not aware of any safety issues. The
R> only  issue  I  am  aware of is that a small percentage of spammers
R> send their spam that way.
R>
R> The  NULL  <>  sender  has  been  used for over 20 years for bounce
R> messages  and  other automated messages (such as vacation messages,
R> and  those  awful  spam  confirmation  E-mails, and Delivery Status
R> Notifications).
R> 
R> So the choices are :
R> 
R> [1] Comply (leave "Refuse NULL <> Senders" at the default UNchecked
R> setting). Pros: Your mailserver will act as expected. Cons: As very
R> small  percentage  of spam is sent this way, but it can be detected
R> using standard spam control.
R> 
R> [2]  Refuse NULL <> senders. Pros: You'll have that "safe" feeling.
R> Cons:  You  won't  receive all your E-mail, because you're blocking
R> someofit,andbecauseyou'llgetlisted   at
R> http://www.rfc-ignorant.org .
R> 
R> -Scott





--
ActivatorMail(tm) ver.01010031 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re[2]: [Declude.JunkMail] Null Sender

2003-10-10 Thread Roger Heath
Reply to: R. Scott Perry
  Re: [Declude.JunkMail] Null Sender on Friday 8:03:42 AM

Ah, thanks!

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>Would this work if it is '<>' as it most commonly is? Then it is
>>truly not blank... I think Block Null Sender covers this instance.
>>It would be nice to have an alternative that was RFC compliant.

R> It would probably be best to use both:

R> MAILFROM  2  ISBLANK

R> and

R> MAILFROM  2  IS  <>

R> That way, whichever format IMail may choose to use will be caught.



R> -Scott


--
ActivatorMail(tm) ver.00922031 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re[2]: [Declude.JunkMail] Null Sender

2003-10-10 Thread Roger Heath
Reply to: R. Scott Perry
  Re: [Declude.JunkMail] Null Sender on Friday 7:16:33 AM

Would this work if it is '<>' as it most commonly is? Then it is
truly not blank... I think Block Null Sender covers this instance.
It would be nice to have an alternative that was RFC compliant.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>Is there anyway to assign points to a null sender?  Most null sender
>>emails I get are spam and was wondering if I could assign a point value to
>>null sender?

R> I believe you could set up a filter, and add this line to the filter file:

R> MAILFROM  2  ISBLANK


R> -Scott
R> ---
R> Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
R> Declude Virus: Catches known viruses and is the leader in mailserver
R> vulnerability detection.
R> Find out what you've been missing: Ask about our free 30-day evaluation.

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---
R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  The archives can be found
R> at http://www.mail-archive.com.
R> --
R> ActivatorMail(tm) ver.00922031 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service


--
ActivatorMail(tm) ver.00922031 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Spam assassin .exe as external filter

2003-10-09 Thread Roger Heath
Reply to: Adrian Hauri
  Re: [Declude.JunkMail] Spam assassin .exe as external filter on Wednesday 
7:46:06 PM

I would also like to see how this would work. It is free and looks
like it has a big following: http://spamassassin.taint.org/index.html

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

A> I was just wondering if anyone 
A> has implemented spamassassin with declude(as external filter) 
A> ?

A>  

A> There is an easy to use .exe version available
A> fromhttp://www.drbig.co.uk/modules/mydownloads/ .

A> At the moment I use SAproxy which filters a lot 
A> with its Bayesian classifier etc. 

A> But I would like to implement it directly on 
A> the server with declude because some filters are really great.

A>  

A> If someone has done the 
A> implementation already please let me know.

A>  

A> Cheers

A>  

A> Adrian



 

--
ActivatorMail(tm) ver.00922031 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re[2]: [Declude.JunkMail] Foreign Characters and Declude

2003-09-29 Thread Roger Heath
Reply to: Matthew Bramble
  Re: [Declude.JunkMail] Foreign Characters and Declude on Saturday 2:01:01 PM

No, most of these are not encoded, thanks.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

M> And something else that formerly confused me and you pointed out...Roger
M> should make sure that the subject line wasn't base64 encoded by checking
M> out the source of the E-mail since the subject (and the rest of the
M> headers) isn't decoded for filtering..

M> Matt


M> R. Scott Perry wrote:

>>
>>> R> You should be able to filter on those words, if you include the
>>> foreign
>>> R> characters in your filter file (assuming you are running 1.75 or
>>> later --
>>> R> some previous versions wouldn't work with foreign characters in
>>> the filter
>>> R> files).
>>
>>
>>> It doesn't. I have had messages passing right through on very
>>> simple word formats like:
>>>
>>> SUBJECT 13 CONTAINS yöur
>>
>>
>> I just tested a filter with this line in it (with 1.76i4, although 
>> 1.75 and 1.76 should work the same), and it worked.  Are you sure 
>> there are no spaces/tabs at the end of the line?  Are other lines in
>> the filter working (if not, the test may not be set up correctly)?
>>
>>-Scott



M> ---
M> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

M> ---
M> This E-mail came from the Declude.JunkMail mailing list.  To
M> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
M> type "unsubscribe Declude.JunkMail".  The archives can be found
M> at http://www.mail-archive.com.
M> --
M> ActivatorMail(tm) ver.00922031 Scanned for all viruses by 
M> www.activatormail.com intelligent anti-virus anti-spam service


--
ActivatorMail(tm) ver.00922031 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re[3]: [Declude.JunkMail] Foreign Characters and Declude

2003-09-27 Thread Roger Heath
Reply to: R. Scott Perry
  Re: [Declude.JunkMail] Foreign Characters and Declude on Saturday 7:09:47 AM

It doesn't. I have had messages passing right through on very
simple word formats like:

SUBJECT 13 CONTAINS yöur
SUBJECT 600 CONTAINS Löw
SUBJECT 600 CONTAINS äpproved
SUBJECT 600 CONTAINS Räte
SUBJECT 600 CONTAINS Evëry
SUBJECT 600 CONTAINS Herë

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>I want to enable foreign characters but filter on their
>>exact words. It sounds like these character sets are not
>>'viewed' and filtered in Declude?

R> You should be able to filter on those words, if you include the foreign
R> characters in your filter file (assuming you are running 1.75 or later --
R> some previous versions wouldn't work with foreign characters in the filter
R> files).



--
ActivatorMail(tm) ver.00922031 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re[2]: [Declude.JunkMail] Foreign Characters and Declude

2003-09-26 Thread Roger Heath
Reply to: R. Scott Perry
  Re: [Declude.JunkMail] Foreign Characters and Declude on Friday 7:40:45 PM

I want to enable foreign characters but filter on their
exact words. It sounds like these character sets are not
'viewed' and filtered in Declude?

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>Don't know if any one asked this, but we are seeing a flurry of
>>omlauted characters used in Subject fields:
>>
>>RE: üS Döctor appröved RX Prëscríptíon
>>
>>We are ring to filter on these, but Declude doesn't see to
>>recognize them?

R> That should trigger the NONENGLISH test (if you are using it).

R> -Scott
R> ---
R> Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
R> Declude Virus: Catches known viruses and is the leader in mailserver
R> vulnerability detection.
R> Find out what you've been missing: Ask about our free 30-day evaluation.

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---
R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  The archives can be found
R> at http://www.mail-archive.com.
R> --
R> ActivatorMail(tm) ver.00922031 Scanned for all viruses by
R> www.activatormail.com intelligent anti-virus anti-spam service


--
ActivatorMail(tm) ver.00922031 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Foreign Characters and Declude

2003-09-26 Thread Roger Heath
Don't know if any one asked this, but we are seeing a flurry of
omlauted characters used in Subject fields:

RE: üS Döctor appröved RX Prëscríptíon

We are ring to filter on these, but Declude doesn't see to
recognize them?

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com



--
ActivatorMail(tm) ver.00922031 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re[2]: [SPAM-BADHEADERS][Declude.JunkMail] Five Ten List

2003-09-25 Thread Roger Heath
Reply to: Keith Anderson
  Re: [SPAM-BADHEADERS][Declude.JunkMail] Five Ten List on Thursday 9:14:19 AM

We used to be on Qwest and had the same problem. Outgoing was not a
problem, but incoming was. The worst we saw of an RBL blocking whole
providers was BLARS which appears to block whole providers except .NL
Watch out for this one...too.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


K> One of our upstream providers is Qwest, and we have the same problem.
K> However, everyone seems to be aware of the SPAM-SUPPORT flaw because it has
K> never prevented us from getting mail to anyone.

>> My server is blocked by five-ten because the author doesn't
>> like Broadwing? I am immediately going to quit using the
>> five-ten lists because I don't know who else this gentleman
>> doesn't like.
>>
>> The response is:
>>
>> IP address 67.99.44.6 is listed here as broadwing.net
>> spam-support. Please note that the following comments apply


K> ---
K> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

K> ---
K> This E-mail came from the Declude.JunkMail mailing list.  To
K> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
K> type "unsubscribe Declude.JunkMail".  The archives can be found
K> at http://www.mail-archive.com.
K> --
K> ActivatorMail(tm) ver.00922031 Scanned for all viruses by 
K> www.activatormail.com intelligent anti-virus anti-spam service


--
ActivatorMail(tm) ver.00922031 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Filtering 0.0.0.0 ??

2003-09-23 Thread Roger Heath
In Deccon I see relay IP 0.0.0.0 from time to time. What is the
best way to filter, ban, or configure for this IP showing up?

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com

--
ActivatorMail(tm) ver.00922031 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] HiJack CIDR?

2003-09-23 Thread Roger Heath
Searching the archives, I could not find out if Hijack
accepts CIDR format for ALLOW IP? Does any one here know
if it does? The documentation does not indicate this.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


--
ActivatorMail(tm) ver.00922031 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re[2]: [Declude.JunkMail] spamdomains list

2003-05-31 Thread Roger Heath
Reply to: R. Scott Perry
  Re: [Declude.JunkMail] spamdomains list on Friday 10:25:16 AM

Thanks!

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>Wait a second? When I requested this, was this format put in Declude?
>>
>>earthlink.com   earthlink.net
>>earthlink.net   earthlink.com
>>email.itwebmessenger.it
>>excite.com  excitenetwork.com
>>
>>If so, I did not see this indicated in any messages I have read.

R> This was added to v1.70 -- you can either have one entry on a line (where 
R> the reverse DNS must contain that entry, if the return address contains 
R> it), or you can have two (in which case the reverse DNS entry must contain 
R> *either* of the two entries, if the *first* entry appears in the return 
R> address).

R> -Scott
R> ---
R> Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
R> Declude Virus: Catches known viruses and is the leader in mailserver 
R> vulnerability detection.
R> Find out what you have been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] spamdomains list

2003-05-31 Thread Roger Heath
Reply to: Bill B.
  Re: [Declude.JunkMail] spamdomains list on Friday 9:20:04 AM

Wait a second? When I requested this, was this format put in Declude?

earthlink.com   earthlink.net
earthlink.net   earthlink.com
email.itwebmessenger.it
excite.com  excitenetwork.com

If so, I did not see this indicated in any messages I have read.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

B> Attached is a list of spamdomains and their coresponding aliases that I've compiled 
thus far.  Anybody want to comment or expand upon this?

B> Bill

--
ActivatorMail(tm) ver.0518031 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re[2]: [Declude.JunkMail] IMail v8.0 and Declude Jinkmail??

2003-03-29 Thread Roger Heath
You are right $6500 is absolutely rediculous. Nothing like paying
thousands more for many less features...

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

D> Scott,

D> A couple of notes...

D> 1.) We started with IMail Antivirus and next week it looks like we will
D> be adding another imail server purchasing Declude AntiVirus for it and
D> another license for our existing server.  My main problem is that to
D> continue to run Imail AV it costs about $6,500 for a 1 year
D> subscription(unlimited users).  To me that price is ridiculous.  Also,
D> it lacks many features like suppress virus notifications for certain
D> viruses and the ability to block certain file attachments.

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Whitlist Compiler

2003-02-08 Thread Roger Heath
http://www.internetwk.com/breakingNews/showArticle.jhtml?articleID=6512003

"IronMail  compiles whitelists by looking at the recipient addresses of
outgoing  mail,  on  the assumption that frequently used addresses are
those  of  people  that  an enterprise has a partnership with, and who
should be allowed to send e-mail into the enterprise."

Would be a nice feature in Declude...

This appliance costs $27,000 each.. geesh..

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>  Does Declude realize it is a store and forward scenario, thus it 
>> processes the mail and then places it back in the spool directory for 
>> delievery?

R> Yes, it does.  We have quite a few customers who are set up like this.
R> -Scott

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---
R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  The archives can be found
R> at http://www.mail-archive.com.
R> --
R> ActivatorMail(tm) ver.122102 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[2]: [Declude.JunkMail] Reject Msg based on Size

2003-02-03 Thread Roger Heath
Reply to: Andy Schmidt
  Re: [Declude.JunkMail] Reject Msg based on Size on Monday 8:07:22 AM

This is not in my earlier version of Imail... Does this do this
on an account basis or domain basis? It must be in later versions
unless I am missing something.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

A> Why not control the message size in Imail - you can set it per domain and, I
A> believe, per user.

A> If the message exceeds the max message size, Imail will reject it - and it
A> will result in a bounce from the SENDING server.

A> In fact, Imail's ESMTP will announce the max message size to the sending
A> server so that it can be rejected BEFORE it is transmitted (at EHLO time!)

A> Best Regards
A> Andy

A> ---
A> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

A> ---
A> This E-mail came from the Declude.JunkMail mailing list.  To
A> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
A> type "unsubscribe Declude.JunkMail".  The archives can be found
A> at http://www.mail-archive.com.
A> --
A> ActivatorMail(tm) ver.122102 Scanned for all viruses by 
A> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[2]: [Declude.JunkMail] Reject Msg based on Size

2003-02-03 Thread Roger Heath
Reply to: R. Scott Perry
  Re: [Declude.JunkMail] Reject Msg based on Size on Monday 7:12:40 AM

He  has  a dialup modem and wants to limit per message size.. It would
save  processor,  if a partial message was returned to each the sender
and the original message if not delivered might save 1/2 bandwidth..

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>Scott, I just had an MIT engineer/user suggest a feature to reject
>>messages based on their size. I found this fascinating personally.
>>
>>You could look at the size and bounce, e.g.
>>
>>SIZE  10MB  BOUNCE
>>
>>Might be a server saver also... especially if it bounced a
>>partial response smaller message.

R> It is an interesting idea.

R> One problem, though, is that it wouldn't save any bandwidth (as the E-mail 
R> would have to be received before bouncing it).  Is this something that 
R> others might find useful?
R> -Scott

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---
R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  The archives can be found
R> at http://www.mail-archive.com.
R> --
R> ActivatorMail(tm) ver.122102 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



[Declude.JunkMail] Reject Msg based on Size

2003-02-02 Thread Roger Heath
Scott, I just had an MIT engineer/user suggest a feature to reject
messages based on their size. I found this fascinating personally.

You could look at the size and bounce, e.g.

SIZE  10MB  BOUNCE

Might be a server saver also... especially if it bounced a
partial response smaller message.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



[Declude.JunkMail] Declude in PCMag

2003-01-24 Thread Roger Heath
Congratulations, Scott. Declude is mentioned in PCMag,
latest February 25th Issue, page 95. Sniffer is also in
the same listing. Suppose we'll see price increases now.



--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[2]: [Declude.JunkMail] OT: Dictionary Attacks

2003-01-23 Thread Roger Heath
Reply to: Don Schreiner
  Re: [Declude.JunkMail] OT: Dictionary Attacks on Thursday 11:51:25 AM

>From an earlier msg:

Our  servers  are  very  stable  with  this firewall. It does not
autoblock  these  but you can manually block them. I noticed that
they  do  not  show up in the log any more, so it appears to work
fine.  I  know  you can set to autoblock select events by editing
the blackice.ini can be edited for example:

http.urllimit.count=60
http.urllimit.interval=50

will  temporarily  block  too  many  URL  requests, like web site
copying... These are the settings to block dictionary attacks. It
detects too many errors brought on by many failed logins...

[Settings]
smtp.error.count=10   ;total errors within
smtp.error.interval=120   ;this amount of time(sec)then blocked

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

D> Bill,

D> Also running BI as of few weeks ago and tinkering with firewal.ini.
D> Would you mind sharing the .ini changes you made. You can e-mail me off
D> list. Thanks.

D> Sincerely,

D> Don Schreiner
D> CompBiz, Inc.
D> www.compbiz.net
D> 407-322-8654
D> 800-408-3688

D> -Original Message-
D> From: [EMAIL PROTECTED]
D> [mailto:[EMAIL PROTECTED]] On Behalf Of Bill B.
D> Sent: Thursday, January 23, 2003 12:16 PM
D> To: [EMAIL PROTECTED]
D> Subject: Re: [Declude.JunkMail] OT: Dictionary Attacks


D> We started running BlackICE last month and it has been working nice for
D> us.  It requires a few config changes to get it to auto-block IPs that
D> send you dictionary attacks, but it is definitely a good solution.

D> Bill


D> -Original Message-
D> From: "R. Scott Perry"
D> Sent: Thu, 23 Jan 2003 10:58:09 -0500
D> Subject: Re: [Declude.JunkMail] OT: Dictionary Attacks



>>It seems this morning that we have several dictionary attacks happening

>>on one of Imail servers. Is there an easy to stop the person doing 
>>this? I have looked through the log files and cannot easily spot the 
>>person(s) doing this.
>>
>>Is there software that will prevent people from performing Dictionary 
>>Attacks in the future?
>>
>>The POP3 and Delcude processes are using like 50-09% of the CPU.
>>
>>Let me know if there is anything I can do...

D> Are you sure that it is a dictionary attack?  If the POP3 process has 
D> higher usage than normal, then E-mails are being sent to your users
D> (which 
D> would mean that it either isn't a dictionary attack, or a hybrid attack 
D> where they send spam as part of the dictionary attack).

D> You might want to check the archives of the IMail Forum for ideas on how
D> to 
D> stop a dictionary attack.  Some tricks are using a "nobody" alias (which
D> I 
D> believe you are), or using a product like BlackIce Server to stop it.

D> Unfortunately, Declude can't stop these, because it doesn't have access
D> to 
D> the TCP/IP connection (which is where it would need to be stopped).
D>   -Scott

D> ---
D> [This E-mail was scanned for viruses by Declude Virus
D> (http://www.declude.com)]

D> ---
D> This E-mail came from the Declude.JunkMail mailing list.  To
D> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
D> "unsubscribe Declude.JunkMail".  The archives can be found at
D> http://www.mail-archive.com.



D> ---
D> [This E-mail was scanned for viruses by Declude Virus
D> (http://www.declude.com)]

D> ---
D> This E-mail came from the Declude.JunkMail mailing list.  To
D> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
D> "unsubscribe Declude.JunkMail".  The archives can be found at
D> http://www.mail-archive.com.
D> --
D> Scanned by CompBiz for Viruses http://www.CompBiz.Net.
D> Save 15 Percent on Virus Software by visiting
D> http://www.compbiz.net/software_mcafee.cfm for details!


D> ---
D> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

D> ---
D> This E-mail came from the Declude.JunkMail mailing list.  To
D> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
D> type "unsubscribe Declude.JunkMail".  The archives can be found
D> at http://www.mail-archive.com.
D> --
D> ActivatorMail(tm) ver.122102 Scanned for all viruses by 
D> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[6]: [Declude.JunkMail] WhiteList Per User or Domain?

2003-01-21 Thread Roger Heath
Reply to: John Tolmachoff
  Re: [Declude.JunkMail] WhiteList Per User or Domain? on Tuesday 3:40:53 PM

Is there a URL for this. Sorry if I don't have it, but I
am on many lists and sometimes I delete something that maybe
I should not have. 

Thanks again,

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

>> I  have many domains and users on my system. Not all want this feature
>> so  I  need  it  as  a  Pro  (per domain per user) feature... and as I
>> mentioned  earlier,  there  should  be  notification  to  the  user of
>> attempted  delivery  mailfroms...  so he or she can add these to their
>> addressbook  if desired. This is what I was looking to accomplish so I
>> can  tell  the  CNET  editor  this  feature  is  working  in  a viable
>> marketable way...

J> Rodger, the NoXMail add on to Declude would provide the functions I think
J> you are looking for.

J> John Tolmachoff MCSE, CSSA
J> IT Manager, Network Engineer
J> RelianceSoft, Inc.
J> Fullerton, CA  92835
J> www.reliancesoft.com



J> ---
J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

J> ---
J> This E-mail came from the Declude.JunkMail mailing list.  To
J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
J> type "unsubscribe Declude.JunkMail".  The archives can be found
J> at http://www.mail-archive.com.
J> --
J> ActivatorMail(tm) ver.122102 Scanned for all viruses by 
J> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[4]: [Declude.JunkMail] WhiteList Per User or Domain?

2003-01-21 Thread Roger Heath
Reply to: R. Scott Perry
  Re: [Declude.JunkMail] WhiteList Per User or Domain? on Tuesday 2:58:10 PM

I  have many domains and users on my system. Not all want this feature
so  I  need  it  as  a  Pro  (per domain per user) feature... and as I
mentioned  earlier,  there  should  be  notification  to  the  user of
attempted  delivery  mailfroms...  so he or she can add these to their
addressbook  if desired. This is what I was looking to accomplish so I
can  tell  the  CNET  editor  this  feature  is  working  in  a viable
marketable way...

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>Scott, do you know when these features might be in beta, including the
>>notification? We cannot use a global setup or most of our users would
>>not get mail. We are anxious to see this work. 

R> I'm not sure specifically which feature(s) you are referring to?

R> The AUTOWHITELIST option is available as an interim release now, and should 
R> be available as a beta within a week or so.
R>  -Scott

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---
R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  The archives can be found
R> at http://www.mail-archive.com.
R> --
R> ActivatorMail(tm) ver.122102 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[3]: [Declude.JunkMail] WhiteList Per User or Domain?

2003-01-21 Thread Roger Heath
Reply to: R. Scott Perry
  Re: [Declude.JunkMail] WhiteList Per User or Domain? on Monday 8:57:29 PM

Scott, do you know when these features might be in beta, including the
notification? We cannot use a global setup or most of our users would
not get mail. We are anxious to see this work. 

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>How  would  this  be  implemented  on  a user or domain basis?

R> The AUTOWHITELIST option is a global option, and can not be done on a 
R> per-user or per-domain basis.

>>I'm  assuming this auto detects the right path
>>regardless  of  the  drive  the  account  resides  on?

R> That is correct.

>>This is a very interesting feature.

R> I think so too.  :)
R>   -Scott

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[2]: [Declude.JunkMail] WhiteList Per User or Domain?

2003-01-20 Thread Roger Heath
Reply to: R. Scott Perry
  Re: [Declude.JunkMail] WhiteList Per User or Domain? on Monday 6:46:34 PM

Also, I presume there is no notification system for the users
account yet with a bounce message? Forgot to ask that one.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>This is something that we are also giving some serious thought to (perhaps 
>>an "AUTOWHITELIST ON" option that if enabled would let Declude JunkMail 
>>know to check for address books, and if present, would whitelist any 
>>address in them).

R> This will be in the next beta, and is now available as an interim release ( 
R> http://www.declude.com/release/166i/declude.exe ), for those that want to 
R> test it out immediately.

R> To use it, you simply add a line "AUTOWHITELIST ON" in the 
R> \IMail\Declude\global.cfg file.  Then, for incoming E-mail, Declude 
R> JunkMail will check to see if the user has an address book set up in web 
R> messaging, and if so, will whitelist any E-mail addresses listed in it.
R>-Scott

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---
R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  The archives can be found
R> at http://www.mail-archive.com.
R> --
R> ActivatorMail(tm) ver.122102 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[2]: [Declude.JunkMail] WhiteList Per User or Domain?

2003-01-20 Thread Roger Heath
Reply to: R. Scott Perry
  Re: [Declude.JunkMail] WhiteList Per User or Domain? on Monday 6:46:34 PM

Wow,  that was fast! Thanks Scott. as usual you are very responsive to
these kind of requests...

How  would  this  be  implemented  on  a user or domain basis? This is
likely  in  your  'Pro' version documentation, but could you summarize
this  simply  for  me.  I'm  assuming this auto detects the right path
regardless  of  the  drive  the  account  resides  on?  This is a very
interesting feature.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>This is something that we are also giving some serious thought to (perhaps 
>>an "AUTOWHITELIST ON" option that if enabled would let Declude JunkMail 
>>know to check for address books, and if present, would whitelist any 
>>address in them).

R> This will be in the next beta, and is now available as an interim release ( 
R> http://www.declude.com/release/166i/declude.exe ), for those that want to 
R> test it out immediately.

R> To use it, you simply add a line "AUTOWHITELIST ON" in the 
R> \IMail\Declude\global.cfg file.  Then, for incoming E-mail, Declude 
R> JunkMail will check to see if the user has an address book set up in web 
R> messaging, and if so, will whitelist any E-mail addresses listed in it.
R>-Scott

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---
R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  The archives can be found
R> at http://www.mail-archive.com.
R> --
R> ActivatorMail(tm) ver.122102 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[6]: [Declude.JunkMail] WhiteList Per User or Domain?

2003-01-17 Thread Roger Heath
Reply to: Charles Frolick
  Re: [Declude.JunkMail] WhiteList Per User or Domain? on Friday 11:05:37 AM

That's  why  I was making the inquiry earlier about using weights. The
whole  weights  model  is  easier  to abide by and set upper and lower
parameters  or  limits  for  almost everything... This would be a very
nice 'Declude Pro' feature when scaled on unique domains and users.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

C> That makes sense, a mixture of the two. In that case you would not want
C> to use CATCHALLMAILS, but use the "border line" weights to notify, and
C> let the customer decide to allow.

C> Thanks,
C> Chuck Frolick
C> ArgoNet, Inc.
C> -Original Message-
C> From: [EMAIL PROTECTED]
C> [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath
C> Sent: Friday, January 17, 2003 10:51 AM
C> To: Charles Frolick
C> Subject: Re[4]: [Declude.JunkMail] WhiteList Per User or Domain?


C> Reply to: Charles Frolick
C>   Re: [Declude.JunkMail] WhiteList Per User or Domain? on Friday
C> 9:35:39 AM

C> We already capture most spam and virus using weights in Declude,
C> so the user would only be hit with border line emails. I see this
C> as an ideal scenario for those that would want such a feature.

C> --
C> Roger Heath
C> [EMAIL PROTECTED]
C> www.rleeheath.com



C> ---
C> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

C> ---
C> This E-mail came from the Declude.JunkMail mailing list.  To
C> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
C> type "unsubscribe Declude.JunkMail".  The archives can be found
C> at http://www.mail-archive.com.
C> --
C> ActivatorMail(tm) ver.122102 Scanned for all viruses by 
C> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[4]: [Declude.JunkMail] WhiteList Per User or Domain?

2003-01-17 Thread Roger Heath
Reply to: Charles Frolick
  Re: [Declude.JunkMail] WhiteList Per User or Domain? on Friday 9:35:39 AM

We already capture most spam and virus using weights in Declude,
so the user would only be hit with border line emails. I see this
as an ideal scenario for those that would want such a feature.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

C> One problem with held or bounced mail that notifies the intended
C> recipient that it was blocked, is, you did not elimiate the spam, only
C> change it's contents to hundreds of notifications of unwanted mail.
C> This will get very old, very fast, and lead to the blacklists you are
C> trying to avoid.  Intelligent spam filters, combined with reasonably
C> reliable black lists and weighting are much more customizable, and can
C> be set up to allow customers to choose what to hold, what to delete, and
C> what to deliver.  Several members of this list have created such apps
C> using various methods. Before I set mine up I would receive between 50
C> and 100 spams a day, all where caught by Declude, but had low weights
C> (as an ISP I have to be somewhat cosevative in my weighting).  After
C> setting up a system that lets the individuals decide, I used very
C> aggressive setting and now only get 5-10 a day tops, many days I get
C> none.  I never miss any wanted email, I have an allowed senders list and
C> a blocked senders list, and since it uses Imail rules, I can override
C> the hold and delete settings for the rare occasion, such as the poorly
C> built mailer on my statistics program, that always fails BADHEADERS and
C> SPAMHEADERS, and I cant't allow the sender because that's one of the
C> broken headers.

C> Sorry to ramble, just felt I needed to put my two cents in.

C> Thanks,
C> Chuck Frolick
C> ArgoNet, Inc.

C> -Original Message-
C> From: [EMAIL PROTECTED]
C> [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath
C> Sent: Thursday, January 16, 2003 3:24 PM
C> To: R. Scott Perry
C> Subject: Re[2]: [Declude.JunkMail] WhiteList Per User or Domain?


C> Reply to: R. Scott Perry
C>   Re: [Declude.JunkMail] WhiteList Per User or Domain? on Thursday
C> 3:13:03 PM

C> Thanks.  But a catchall is exactly what I don't want. What I want is a
C> bounce  so  the  sender  knows  his  mail  was not accepted... maybe a
C> catchall  if  cannot  deliver  to  sender... There are whitelist email
C> providers  showing  up and usually the sender gets sent a message that
C> his  mail  was not delivered. Usually there is a process to inform the
C> destination  user  if  he  wants  to  add  the  sender  to  his or her
C> whitelist.  Maybe  this  is not feasible with Declude, but it would be
C> most certainly nice to have. The lead ZDNet editor David Berlind and I
C> have  a  dialog  going and he is really down on blacklists and more or
C> less  endorsing  the  whitelist concept. So I am shooting for a way to
C> manage this in Declude. I was thinking I could put high weights on all
C> other  emails  with a bounce by default but give a white list negative
C> counter-weights to let those through. Not sure his would work?

C> --
C> Roger Heath
C> [EMAIL PROTECTED]
C> www.rleeheath.com


C> - Copy of Original Message(s): -


>>>Is it possible to make a Declude domain or user setting that enables a
>>>whitelist  of  email  sender  addresses in the Pro version whereby all
>>>emails are rejected or bounced accept a whitelist of senders? In other
>>>words  reject  or bounce all senders accept those that the user wishes
>>>to  communicate with. Could this be done with weights...sending an eml
>>>to  bounced  mails? This way the Global.Cfg would not be used with its
>>>limitations.

R>> This isn't currently possible as a designed feature, but you should
C> be able 
R>> to accomplish it with the next release.  To do so, you would set up a

R>> per-domain or per-user configuration of "CATCHALLMAILS HOLD" or
C> something 
R>> similar, and then have a whitelist file for that user with all the 
R>> addresses that should be accepted.
R>>-Scott

R>> ---
R>> [This E-mail was scanned for viruses by Declude Virus
C> (http://www.declude.com)]

R>> ---
R>> This E-mail came from the Declude.JunkMail mailing list.  To
R>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R>> type "unsubscribe Declude.JunkMail".  The archives can be found
R>> at http://www.mail-archive.com.
R>> --
R>> ActivatorMail(tm) ver.122102 Scanned for all viruses by 
R>> www.activatormail.com intelligent anti-virus anti-spam service

C> --
C> ActivatorMail(tm) v

Re[4]: [Declude.JunkMail] WhiteList Per User or Domain?

2003-01-16 Thread Roger Heath
Reply to: R. Scott Perry
  Re: [Declude.JunkMail] WhiteList Per User or Domain? on Thursday 5:57:27 PM

Scott, the only thing that would concern me is that I use multiple
disk drives for my users accounts, for example:

activatormail.com  d:\actmail
techknow.com   c:\Imail\techknow
wyndows.comc:\Imail\wyndows

If you do such a feature I would need to be able to point to an exact
path for each domain...

I think this would be a great feature for Declude and I hope you do
it.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>I think I mentioned this to you
>>earlier,  Scott;  If you could have the user edit their addressbook in
>>Imail  web  mail  as a whitelist, and Declude used this, then the user
>>could  manage  their own whitelist.

R> This is something that we are also giving some serious thought to (perhaps 
R> an "AUTOWHITELIST ON" option that if enabled would let Declude JunkMail 
R> know to check for address books, and if present, would whitelist any 
R> address in them).
R>   -Scott

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---
R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  The archives can be found
R> at http://www.mail-archive.com.
R> --
R> ActivatorMail(tm) ver.122102 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[3]: [Declude.JunkMail] WhiteList Per User or Domain?

2003-01-16 Thread Roger Heath
Reply to: R. Scott Perry
  Re: [Declude.JunkMail] WhiteList Per User or Domain? on Thursday 3:33:30 PM

Thanks,  all.  This  is something that would be a wonderful feature in
Declude.  If the %MAILFROM% was sent to the destination user and he or
she  could  add this address to their whitelist of senders, this might
be  an  extremely  big  feature  indeed.  Not  sure  how all this fits
together,  but  I might experiment with the catchall and/or weights to
see  how  far  I  can  go  with  this. I think I mentioned this to you
earlier,  Scott;  If you could have the user edit their addressbook in
Imail  web  mail  as a whitelist, and Declude used this, then the user
could  manage  their own whitelist. Then if a mail is turned away they
could  just add this email address to their addressbook in web mail to
turn on the receiving of mails from that user in the future.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>Thanks.  But a catchall is exactly what I don't want. What I want is a
>>bounce  so  the  sender  knows  his  mail  was not accepted...

R> Actually, I believe the CATCHALLMAILS test will do what you want.  However, 
R> in this case, you would use "CATCHALLMAILS BOUNCE" instead of 
R> "CATCHALLMAILS HOLD".

R> With "CATCHALLMAILS BOUNCE", all E-mails will be bounced -- except if you 
R> whitelist the sender.

>>Usually there is a process to inform the
>>destination  user  if  he  wants  to  add  the  sender  to  his or her
>>whitelist.

R> That's an interesting idea.  I'll have to see if it is possible to combine 
R> the ALERT action (which would behave in this case just about the same as 
R> the BOUNCE action) with the ATTACH action, which would allow you to send a 
R> bounce message and have an E-mail go to the recipient explaining that an 
R> E-mail from %MAILFROM% was blocked.

>>The lead ZDNet editor David Berlind and I
>>have  a  dialog  going and he is really down on blacklists and more or
>>less  endorsing  the  whitelist concept. So I am shooting for a way to
>>manage this in Declude. I was thinking I could put high weights on all
>>other  emails  with a bounce by default but give a white list negative
>>counter-weights to let those through. Not sure his would work?

R> I'm guessing the "CATCHALLMAILS BOUNCE" combined with a whitelist would 
R> work best.  However, you could likely accomplish the same thing with the 
R> weighting system.
R>  -Scott

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---
R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  The archives can be found
R> at http://www.mail-archive.com.
R> --
R> ActivatorMail(tm) ver.122102 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[2]: [Declude.JunkMail] WhiteList Per User or Domain?

2003-01-16 Thread Roger Heath
Reply to: R. Scott Perry
  Re: [Declude.JunkMail] WhiteList Per User or Domain? on Thursday 3:13:03 PM

Thanks.  But a catchall is exactly what I don't want. What I want is a
bounce  so  the  sender  knows  his  mail  was not accepted... maybe a
catchall  if  cannot  deliver  to  sender... There are whitelist email
providers  showing  up and usually the sender gets sent a message that
his  mail  was not delivered. Usually there is a process to inform the
destination  user  if  he  wants  to  add  the  sender  to  his or her
whitelist.  Maybe  this  is not feasible with Declude, but it would be
most certainly nice to have. The lead ZDNet editor David Berlind and I
have  a  dialog  going and he is really down on blacklists and more or
less  endorsing  the  whitelist concept. So I am shooting for a way to
manage this in Declude. I was thinking I could put high weights on all
other  emails  with a bounce by default but give a white list negative
counter-weights to let those through. Not sure his would work?

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>Is it possible to make a Declude domain or user setting that enables a
>>whitelist  of  email  sender  addresses in the Pro version whereby all
>>emails are rejected or bounced accept a whitelist of senders? In other
>>words  reject  or bounce all senders accept those that the user wishes
>>to  communicate with. Could this be done with weights...sending an eml
>>to  bounced  mails? This way the Global.Cfg would not be used with its
>>limitations.

R> This isn't currently possible as a designed feature, but you should be able 
R> to accomplish it with the next release.  To do so, you would set up a 
R> per-domain or per-user configuration of "CATCHALLMAILS HOLD" or something 
R> similar, and then have a whitelist file for that user with all the 
R> addresses that should be accepted.
R>-Scott

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---
R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  The archives can be found
R> at http://www.mail-archive.com.
R> --
R> ActivatorMail(tm) ver.122102 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



[Declude.JunkMail] WhiteList Per User or Domain?

2003-01-16 Thread Roger Heath
I  know  this question must have been asked about Declude, but thought
I'd ask again anyway as I do not recall if there is a method possible.

Is it possible to make a Declude domain or user setting that enables a
whitelist  of  email  sender  addresses in the Pro version whereby all
emails are rejected or bounced accept a whitelist of senders? In other
words  reject  or bounce all senders accept those that the user wishes
to  communicate with. Could this be done with weights...sending an eml
to  bounced  mails? This way the Global.Cfg would not be used with its
limitations.

Thanks,

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



[Declude.JunkMail] SpamReview Black-listing White-listing Possible Feature

2002-12-27 Thread Roger Heath
Ok,  I  am  now  both  black-listing  and white-listing using a single
filter  file  in  Declude. For example if a source is blacklisted this
can take the form of the following methods or commands examples:

MAILFROM 60 ENDSWITH greatdeal.net
HEADERS 60 CONTAINS somebaby.com
BODY 60 CONTAINS basherman

The weights are so high each mail gets deleted. Now I white-list using
'counter-weights':

REVDNS -100 ENDSWITH sportico.com
MAILFROM -100 ENDSWITH [EMAIL PROTECTED]
HEADERS -100 CONTAINS Yahoo! Alerts
SUBJECT -100 CONTAINS ActivatorMail Sign-up

To manage the above I have a WEIGHT 35 that DELETES 'black-listed'
weights...

Now  that  I  know  I  can  edit  just  one  simple file, I am wishing
SpamReview could do this for me. I am not sure just how to pursue this
but  for mailfrom info could be used initially. This means there would
be four buttons, for example:

Que and White-list Domain  = adds  MAILFROM -100 ENDSWITH @domain.com
Que and White-list Sender  = adds  MAILFROM -100 ENDSWITH [EMAIL PROTECTED]
Delete and Black-List Domain  = adds  MAILFROM 100 ENDSWITH @domain.com
Delete and Black-List Sender  = adds  MAILFROM 100 ENDSWITH [EMAIL PROTECTED]

Maybe  Scott  can  recommend  how to do this to be most efficient with
Declude testing of emails. Maybe a pull down menu would be good rather
than  buttons,  then  many  more parameters could exist in addition to
above four examples above?  For example another method would be:

Delete Black-list REVDNS Domain = adds REVDNS 100 ENDSWITH domain.com
Delete White-list REBDNS Domain = adds REVDNS -100 ENDSWITH domain.com

I  would  find  all  this  quite useful and I am wondering what others
might  think.  SpamReview could be pointed at a single filter.txt file
to edit then edit it...

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[2]: [Declude.JunkMail] An optional web interface for Declude JunkMail?

2002-12-23 Thread Roger Heath
Reply to: [EMAIL PROTECTED]
  Re: [Declude.JunkMail] An optional web interface for Declude JunkMail? on Monday 
8:34:08 PM

Yes  this  would  be  valuable.  It could be launched into IIS from an
actual  link in the Imail web templates going to an alternate port, so
it  would  not  seem  so seemless. The second password system would be
good  because  access  to  spam  filter  management  would  exist as a
privilege  independently. Sounds very interesting to me, especially if
it  enabled  me  to managed captured or HOLD mails remotely. I saw the
utility  uploaded  to this list for this purpose, but I have not tried
it and would be curious if any one has?

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

H> Count me in!

H> Mike

H> - Original Message -
H> From: "R. Scott Perry" <[EMAIL PROTECTED]>
H> To: <[EMAIL PROTECTED]>
H> Sent: Monday, December 16, 2002 7:49 PM
H> Subject: [Declude.JunkMail] An optional web interface for Declude JunkMail?


>> A lot of our customers seem to want a web interface to Declude JunkMail,
>> mostly so that customers can turn their spam settings on or off.
>>
>> We haven't come up with something in the past, because it is very
>> complicated without a hook into web messaging, and it doesn't look like
>> Ipswitch is planning to add an interface to web messaging any time soon.
>>
>> However, we are at the point where we are considering a web interface.  If
>> we do it, it would probably need to be done as an addon to Declude
>> JunkMail, mainly because the development and support costs would be fairly
>> high.  It would also have some drawbacks, being separate from web
>> messaging.  For example, it would require installing a separate service,
>> using a different port than 80 or 8383 for web access (which may cause
>> firewall problems), and having users enter their username/password a
H> second
>> time (if they are already using web messaging).
>>
>> Is this something that is important enough that it would be worthwhile?
>>   -Scott
>>
>> ---
>> [This E-mail was scanned for viruses by Declude Virus
H> (http://www.declude.com)]
>>
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> type "unsubscribe Declude.JunkMail".  The archives can be found
>> at http://www.mail-archive.com.
>>
>>

H> ---
H> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

H> ---
H> This E-mail came from the Declude.JunkMail mailing list.  To
H> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
H> type "unsubscribe Declude.JunkMail".  The archives can be found
H> at http://www.mail-archive.com.
H> --
H> ActivatorMail(tm) ver.122102 Scanned for all viruses by 
H> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.122102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



[Declude.JunkMail] 'Counter-weighing' With One File

2002-12-17 Thread Roger Heath
We  recently  took  the  que  in  earlier  discussions  here  to begin
utilizing   negative  weights  in  the  filter  file  we  had  already
constructed  to  make  counter-weighing work. We are very pleased with
the  results. First we have just one file to edit that weighs possible
spam by rating MAILFROM, BODY, etc. but then we added to the same file
-100  or  -60  counter-weights  for  versions of these that are really
legitimate  sources.  The  whole  operation  is  simple as it is based
strictly  on weight and editing Declude rules to balance against black
lists  that  are  trapping legitimate emails.. works super and is very
easy  to  manage.  You  also  do  not  have  the  limitations of total
whitelisting entries associated with the global.cfg.

Spam weights, for example, look like:

MAILFROM 13 CONTAINS opt-in
MAILFROM 13 CONTAINS optitarget
MAILFROM 13 CONTAINS promo

Spam 'counterweights' look like:

MAILFROM -100 CONTAINS .classmates.com
MAILFROM -100 CONTAINS .rnc.org
MAILFROM -100 CONTAINS pcclub.com

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

>> One problem I see (Sandy and others, please jump in) is that whitelisting
J> is
J> easy to mess up, and a crack that the "law of unintended consequences" will
J> exploit.  Two examples: the example in Scott's manual that says whitelisting
J> mail.com is probably a bad idea, and whitelisting
J> postmaster@[yourdomainhere.tld] gives a free ride to any spam that sends to
J> postmaster while cc'ing everybody else at your domain.

J> I agree. The battle goes on.

J> John Tolmachoff MCSE, CSSA
J> IT Manager, Network Engineer
J> RelianceSoft, Inc.
J> Fullerton, CA  92835
J> www.reliancesoft.com

--
ActivatorMail(tm) ver.082302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



[Declude.JunkMail] Wired: Archive: Fresh Spam for Everyone

2002-11-28 Thread Roger Heath
http://www.wired.com/news/technology/0,1282,56624,00.html
http://www.spamarchive.org/

Good place to soon begin building super Declude filters?

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com

--
ActivatorMail(tm) ver.082302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



[Declude.JunkMail] SEC and Spammer margaret_thomas

2002-11-26 Thread Roger Heath
Just  a quick note that we just received a call and a supoena from the
SEC  Enforcement  Division  in  Washington and they are actively going
after a spammer we had sign up here but Declude Hijack quickly halted.
The   spammer  is  well  known  and  commonly  uses  an  account  name
margaret_thomas. If any here have traceable information they'd like to
volunteer please forward it privately to my personal address below and
I will forward it to the investigator at the SEC.

We  have  actually  abandoned  Human  Kind signup because we could not
establish  a  confirmation  style signup system. Has any one developed
such  a  system?  Since  we manage this manually now we have not had a
spammer  as  we  carefully  screen each who signs up... but I would be
curious  if  such  a  system  has  been  developed and is commercially
available?

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com

--
ActivatorMail(tm) ver.082302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[2]: [Declude.JunkMail] whitelisting

2002-11-21 Thread Roger Heath
Reply to: John Tolmachoff
  Re: [Declude.JunkMail] whitelisting on Thursday 5:02:56 PM

I'd like to do this. Will negative weights work for this list?

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

J> One thing I am considering is using a greylist, where known solid domains
J> that need it will go on a weighted whitelist of say -100 and the weighted
J> greylist will get say -15, and I would put those domains they needed the
J> help but not wanting to actually whitelist.

J> John Tolmachoff MCSE, CSSA
J> IT Manager, Network Engineer
J> RelianceSoft, Inc.
J> Fullerton, CA  92835
J> www.reliancesoft.com


J> ---
J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

J> ---
J> This E-mail came from the Declude.JunkMail mailing list.  To
J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
J> type "unsubscribe Declude.JunkMail".  The archives can be found
J> at http://www.mail-archive.com.
J> --
J> ActivatorMail(tm) ver.082302 Scanned for all viruses by 
J> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.082302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[2]: [Declude.JunkMail] More on: %COUNTRYCHAIN%

2002-11-05 Thread Roger Heath
Reply to: R. Scott Perry
  Re: [Declude.JunkMail] More on: %COUNTRYCHAIN% on Tuesday 10:17:21 AM

This updated dat file fixed it, thanks.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>I have yet to see any countries shown... it is always:
>>
>>  [Unknown]->[APNIC Unlisted]->[ARIN Unlisted]->destination

R> Do you have the \IMail\Declude\all_list.dat file?
R> -Scott

--
ActivatorMail(tm) ver.082302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re: [Declude.JunkMail] More on: %COUNTRYCHAIN%

2002-11-05 Thread Roger Heath
Reply to: Kami Razvan
  Re: [Declude.JunkMail] More on: %COUNTRYCHAIN% on Tuesday 9:57:48 AM

I have yet to see any countries shown... it is always:

 [Unknown]->[APNIC Unlisted]->[ARIN Unlisted]->destination

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

K> Hi;
K> I have:

K> COUNTRYCHAINX-Country-Chain: %COUNTRYCHAIN%

K> In the Global.cfg.

K> Am I to expect the country chain in all eMail headers?  If yes.. Then I
K> am not getting it.

K> I have downloaded the
K> file:http://www.declude.com/release/162/all_list.dat and put it in the
K> declude folder.

K> Missing something?

K> Regards,
K> Kami

K> ---
K> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

K> ---
K> This E-mail came from the Declude.JunkMail mailing list.  To
K> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
K> type "unsubscribe Declude.JunkMail".  The archives can be found
K> at http://www.mail-archive.com.
K> --
K> ActivatorMail(tm) ver.082302 Scanned for all viruses by 
K> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.082302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re: [Declude.JunkMail] Declude JunkMail v1.62 (beta) released

2002-11-04 Thread Roger Heath
Reply to: R. Scott Perry
  Re: [Declude.JunkMail] Declude JunkMail v1.62 (beta) released on Monday 1:16:28 
PM

Not seeing %COUNTRYCHAIN% working in inheader here. Should I be using
%COUNTRIES% instead or does a line have to be added to the Global
file?

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

R> We have just released Declude v1.62 (beta).  See 
R> http://www.declude.com/junkmail/manual.htm .  Changes include:

R>o Will now handle multiple return codes in ip4r tests.
R>o Will now record the action for each test that fails.
R>o Changes handling of invalid "[?.?.?.?]".
R>o External tests can now have variables in their definitions.
R>o Adds a failsafe for invalid CIDR ranges in IP blacklists.
R>o Adds COUNTRY (of remote mailserver) and COUNTRIES (of any mailservers 
R> in chain) to filter.
R>o Adds %COUNTRYCHAIN% variable.
R>o Adds "ipnotinmx" test, which catches E-mail sent from an IP not in the 
R> MX records of sending domain.
R>o HABEAS whitelist type, for whitelisting E-mails with Habeas headers 
R> ("WHITELIST HABEAS").
R>o New "habeas" test type, to allow for negative weighting of E-mails 
R> with Habeas headers.

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---
R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  The archives can be found
R> at http://www.mail-archive.com.
R> --
R> ActivatorMail(tm) ver.082302 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.082302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[4]: [Declude.JunkMail] question for all...

2002-11-02 Thread Roger Heath
Reply to: Sanford Whiteman
  Re: [Declude.JunkMail] question for all... on Saturday 3:54:30 PM

Thanks, Sandy.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

>> How  do  you  setup  a  domain to spool only then forward to another
>> Exchange server?

S> Search IMail KB for "store and forward."

S> -Sandy

--
ActivatorMail(tm) ver.082302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[2]: [Declude.JunkMail] question for all...

2002-11-02 Thread Roger Heath
Reply to: Bill Beach
  Re: [Declude.JunkMail] question for all... on Friday 8:44:17 AM

How do you setup a domain to spool only then forward to another
Exchange server?

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

>>Has anybody done this?

B> I just set this up this week for another organization on-site here. I used
B> to host their e-mail on my IMail server but they are moving to a new
B> location (none too soon I might add) and want to use Exchange. So currently
B> their mail comes to my IMail server running Declude AV and JunkMail which
B> then forwards it to their Exchange box. No problems to report. As far as the
B> licenses go, my thinking is that if you're only spooling mail and not
B> hosting any user boxes, you should be able to get by with the mininum user
B> license.

B> -B

--
ActivatorMail(tm) ver.082302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[2]: [Declude.JunkMail] SpamReview Request - Delete All

2002-09-25 Thread Roger Heath

Reply to: Darrell L.
  Re: [Declude.JunkMail] SpamReview Request - Delete All on Wednesday 7:42:30 AM

I  know...  This is what I do now. One click would still be nicer
and faster... been using Windows since version 1. 

Thanks,

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

>>>Delete All - Deletes all entries.

D>  

>>>Delete  All  and  Exit - Deletes all entries then exits (deleting
>>>deleted if switch is 'on')

D>   

D> Darrell

--
ActivatorMail(tm) ver.082302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[2]: [Declude.JunkMail] SpamReview Request - Delete All

2002-09-25 Thread Roger Heath

Reply to: Tom Schwarz
  Re: [Declude.JunkMail] SpamReview Request - Delete All on Wednesday 5:57:17 AM

I  would  like  the  buttons  actually... I am using the keyboard
commands but I'd like to make these one clicks.. Particularly the
delete all and exit..then this would delete all displayed entries
and all deleted entries in one click. Perahps the other should be
delete all then reload any new entries.. No highlighting would be
required at all.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

T> Roger,

T> Using standard windows select capibilities you may select multiple entries
T> with the Shift and Ctrl keys or select all entries using Ctrl-A.

T> After selecting multiple entries you can use all the normal functions such
T> as Delete or Move just like you would use them on one selected entry.

T> Will this take care of your request or would the buttons be better?

T> Tom

T> -Original Message-
T> From: [EMAIL PROTECTED]
T> [mailto:[EMAIL PROTECTED]]On Behalf Of Roger Heath
T> Sent: Tuesday, September 24, 2002 9:19 PM
T> To: Tom
T> Subject: [Declude.JunkMail] SpamReview Request - Delete All
T> Importance: Low


T> Ok,  SpamReview  mailFrom is working great for me with the proper
T> string detect...!!!

T> Now for another request. two more buttons:

T> Delete All - Deletes all entries.

T> Delete  All  and  Exit - Deletes all entries then exits (deleting
T> deleted if switch is 'on')

T> This  is  really  want is needed. This way one may inspect select
T> messages  and  manage them then delete the rest in one blow. This
T> will  save  me  even  more time from an already great time saving
T> program.

T> --
T> Roger Heath
T> [EMAIL PROTECTED]
T> www.rleeheath.com

T> --
T> ActivatorMail(tm) ver.082302 Scanned for all viruses by
T> www.activatormail.com intelligent anti-virus anti-spam service

T> ---
T> [This E-mail was scanned for viruses by Declude Virus
T> (http://www.declude.com)]

T> ---
T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  The archives can be found
T> at http://www.mail-archive.com.

T> ---
T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

T> ---
T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  The archives can be found
T> at http://www.mail-archive.com.
T> --
T> ActivatorMail(tm) ver.082302 Scanned for all viruses by 
T> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.082302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



[Declude.JunkMail] SpamReview Request - Delete All

2002-09-24 Thread Roger Heath

Ok,  SpamReview  mailFrom is working great for me with the proper
string detect...!!!

Now for another request. two more buttons:

Delete All - Deletes all entries.

Delete  All  and  Exit - Deletes all entries then exits (deleting
deleted if switch is 'on')

This  is  really  want is needed. This way one may inspect select
messages  and  manage them then delete the rest in one blow. This
will  save  me  even  more time from an already great time saving
program.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com

--
ActivatorMail(tm) ver.082302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re: [Declude.JunkMail] SpamReview Update and "From" EMail Discussion

2002-09-18 Thread Roger Heath

Reply to: Tom Schwarz
  Re: [Declude.JunkMail] SpamReview Update and "From" EMail Discussion on 
Wednesday 3:00:02 PM

This feature to add to kill still fails here. In place of

X-Declude-Sender:

I put

X-Note-Real-Mail-From:

Wondering what I might be doing wrong?

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

T> To SpamReview Users,

T> v1.0.47 is now available.  If you are already using v1.0.45 just click on
T> File/Check for Program Updates to download the new version.

T> Changes in this version.

T> SpamReview now extracts the "From" email address for the list from the "Q"
T> file if you have the"Show Subject in List" option selected in the Settings.

T> Added a new field in the Settings so you can configure a string to use when
T> trying to locate the "From" email address in the settings file.  By default
T> "X-Declude-Sender:" is used since Declude already includes this in the
T> message if you have "XSENDER ON" set in the global.cfg file.

T> No changes were made to the "Add to Kill" except to use the new string to
T> locate the "From" email address.

T> --

T> I hope this helps resolve some of the problems, questions, and confusion.

T> --
T> A few weeks ago I started to update the web page.  You can find help here.
T> http://www.slsoft.com/spamreviewhelp.htm

T> You can also find some of the following discussion regarding the "From"
T> EMail address in the Q&A section.  Here it is in text form.

T> Q. Where does SpamReview get the "From" EMail address from?

T> A. The "From" EMail Address can come from a couple of different places
T> depending on how SpamReview is configured in the Settings.  If you have
T> selected the "Show Subject in List" option then the "From" EMail Address
T> comes from the "Q" file using the Locate "From" EMail Address String:  value
T> in the Settings.  If the "Show Subject in List" option is not selected the
T> "From" EMail Address comes from the "D" file.  In this case it may not be
T> right but it's the best we have since we have not read the "Q" file yet.

T> The Default Value for Locate "From" EMail Address String:  is
T> "X-Declude-Sender:".  You must have "XSENDER ON" in the global.cfg file for
T> this to work.  If you have setup your own custom method for doing this just
T> make sure the resulting string has one and only one space between your text
T> and the start of the email address.  ex.  MyFromEMailAddress:
T> [EMAIL PROTECTED]

T> Important Note: Regardless of the Settings, the "From" EMail address located
T> by using the Locate "From" EMail Address String: is used when adding to the
T> kill.lst file.  There are no exceptions to this.  If you have not properly
T> matched the SpamReview Settings with the Declude JunkMail settings you will
T> get a blank entry in the kill.lst file.




T> ---
T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

T> ---
T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  The archives can be found
T> at http://www.mail-archive.com.
T> --
T> ActivatorMail(tm) ver.082302 Scanned for all viruses by 
T> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.082302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[3]: [Declude.JunkMail] Address Book Only in Declude?

2002-08-29 Thread Roger Heath

Reply to: R. Scott Perry
  Re: [Declude.JunkMail] Address Book Only in Declude? on Thursday 10:19:03 AM

The  only  problem  I see with this is whitelisting... perhaps it
should  even  disregard  the  whitelist  too? Looks like a bounce
would  be  preferable on a feature like this. It would be a great
feature.  If a user wants to receive e-mails from a select source
he  or she could just log into web mail and enter the address. It
would  be  nice  if  they  could  make  a  'CONTAINS' rule by say
entering   an   address   like   [EMAIL PROTECTED],   Then   if
internet.com was in the HEADERS, it would pass the mail..

Others  have  suggested  making whitelists into separate lists so
you  can  per user or per domain them. Perhaps if you do this all
these things can be 'matched up'?

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>Personally we'd like to have this as an add-on and not a standard
>>feature.  So  we'd  like only administrator control over this. It
>>could  be  easily  misunderstood by users as well. The ability to
>>set  a  whole domain or individual users, like the Pro version of
>>Declude is what we really need.

R> If something like this does get added, it would likely best fit into 
R> Declude JunkMail as a test and an action (such as a test "NOTINADDRESSBOOK" 
R> with an action of BOUNCE or HOLD).  That way, it could be applied 
R> per-domain or per-user, and end users wouldn't have any direct control over it.
R>-Scott

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---
R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  The archives can be found
R> at http://www.mail-archive.com.
R> --
R> ActivatorMail(tm) ver.082302 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.082302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[2]: [Declude.JunkMail] Address Book Only in Declude?

2002-08-29 Thread Roger Heath

Reply to: John Tolmachoff
  Re: [Declude.JunkMail] Address Book Only in Declude? on Thursday 9:53:27 AM

Not to be sarcastic, but how? 

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

J> Not to be sarcastic, but wouldn't that be done in a rules.ima file that
J> is configurable by the user?

J> John Tolmachoff
J> IT Manager, Network Engineer
J> RelianceSoft, Inc.
J> Fullerton, CA  92835
J> www.reliancesoft.com


J> -Original Message-
J> From: [EMAIL PROTECTED]
J> [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath
J> Sent: Thursday, August 29, 2002 7:32 AM
J> To: R. Scott Perry
J> Subject: [Declude.JunkMail] Address Book Only in Declude?

J> I just got the following request from one of my users:

R>> How do I arrange to receive only emails from members of my address
J> book?

J> In  my opinion this could be the biggest feature added to Declude
J> at this time. Here's how I'd like it to work:

J> Declude looks at a text cfg file to see if this feature is turned
J> on for a select domain or e-mail account... for example,

J> if   in   ADDR.CFG   email   address  or  domain  wyndows.com  or
J> [EMAIL PROTECTED] then

J> Look  at c:\Imail\Wyndows\users\heath\aliases.txt MAILFROM exists
J> then  pass  the  e-mail  to this account, else delete...or return
J> e-mail as rejected..

J> How soon can I get this, Scott? 

J> --
J> Roger Heath
J> [EMAIL PROTECTED]
J> www.rleeheath.com

J> --
J> ActivatorMail(tm) ver.082302 Scanned for all viruses by 
J> www.activatormail.com intelligent anti-virus anti-spam service

J> ---
J> [This E-mail was scanned for viruses by Declude Virus
J> (http://www.declude.com)]

J> ---
J> This E-mail came from the Declude.JunkMail mailing list.  To
J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
J> type "unsubscribe Declude.JunkMail".  The archives can be found
J> at http://www.mail-archive.com.

J> ---
J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

J> ---
J> This E-mail came from the Declude.JunkMail mailing list.  To
J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
J> type "unsubscribe Declude.JunkMail".  The archives can be found
J> at http://www.mail-archive.com.
J> --
J> ActivatorMail(tm) ver.082302 Scanned for all viruses by 
J> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.082302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[2]: [Declude.JunkMail] Address Book Only in Declude?

2002-08-29 Thread Roger Heath

Reply to: Kami Razvan
  Re: [Declude.JunkMail] Address Book Only in Declude? on Thursday 9:48:16 AM

Personally we'd like to have this as an add-on and not a standard
feature.  So  we'd  like only administrator control over this. It
could  be  easily  misunderstood by users as well. The ability to
set  a  whole domain or individual users, like the Pro version of
Declude is what we really need.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

K> Hi;
K> The idea is a good one but I think it truly belongs at the IMail level.
K> This way, using the web manager, every user can decide what level of
K> mail they want to accept.

K> It is sort of like what the JunkMail setting is with Hotmail.  Strict,
K> allowing only those in the address book to send, or Loose so anyone can
K> send.

K> If Declude adds this then it is up to the Admin to add this for every
K> user upon request.  This is a lot of work!

K> Just a thought.

K> Kami

K> -Original Message-
K> From: [EMAIL PROTECTED]
K> [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath
K> Sent: Thursday, August 29, 2002 10:32 AM
K> To: R. Scott Perry
K> Subject: [Declude.JunkMail] Address Book Only in Declude?


K> I just got the following request from one of my users:

R>> How do I arrange to receive only emails from members of my address 
R>> book?

K> In  my opinion this could be the biggest feature added to Declude at
K> this time. Here's how I'd like it to work:

K> Declude looks at a text cfg file to see if this feature is turned on for
K> a select domain or e-mail account... for example,

K> if   in   ADDR.CFG   email   address  or  domain  wyndows.com  or
K> [EMAIL PROTECTED] then

K> Look  at c:\Imail\Wyndows\users\heath\aliases.txt MAILFROM exists then
K> pass  the  e-mail  to this account, else delete...or return e-mail as
K> rejected..

K> How soon can I get this, Scott? 

K> --
K> Roger Heath
K> [EMAIL PROTECTED]
K> www.rleeheath.com


K> ---
K> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

K> ---
K> This E-mail came from the Declude.JunkMail mailing list.  To
K> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
K> type "unsubscribe Declude.JunkMail".  The archives can be found
K> at http://www.mail-archive.com.
K> --
K> ActivatorMail(tm) ver.082302 Scanned for all viruses by 
K> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.082302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



[Declude.JunkMail] Address Book Only in Declude?

2002-08-29 Thread Roger Heath

I just got the following request from one of my users:

R> How do I arrange to receive only emails from members of my address book?

In  my opinion this could be the biggest feature added to Declude
at this time. Here's how I'd like it to work:

Declude looks at a text cfg file to see if this feature is turned
on for a select domain or e-mail account... for example,

if   in   ADDR.CFG   email   address  or  domain  wyndows.com  or
[EMAIL PROTECTED] then

Look  at c:\Imail\Wyndows\users\heath\aliases.txt MAILFROM exists
then  pass  the  e-mail  to this account, else delete...or return
e-mail as rejected..

How soon can I get this, Scott? 

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com

--
ActivatorMail(tm) ver.082302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



[Declude.JunkMail] Optimizing Declude Filters

2002-08-21 Thread Roger Heath

I  am wondering if there is a particular order to Declude filters
that  will cause them to be more efficient? In this light do they
add  up  weights till the violate a threshold then process? I was
just  thinking  if  the  program  could  DELETE at WEIGHT 35, for
example,  as  opposed  to  doing all these tests.. would this not
speed  up the whole process substantially if I put my worst tests
first.

Scott,  maybe you can see where I'm headed. I am always afraid of
my  rules getting so long that they delay mail, especially in the
BODY filters.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com

--
ActivatorMail(tm) ver.061902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re[2]: BLARSBL:Re[2]: [Declude.JunkMail] Kill File list update for 07/31/02

2002-07-31 Thread Roger Heath

Reply to: Tom
  Re: BLARSBL:Re[2]: [Declude.JunkMail] Kill File list update for 07/31/02 on 
Wednesday 5:39:02 PM

Ah. Thanks.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>> I  asked  earlier  about  using the '.' as a leading character in
>> kill.lst for example:
>> 
>> .bluehornet.com ID-07312002-000
>> .e-dialog.com   ID-07312002-001
>> .moveon.org ID-07312002-002

T> This kill list was meant for Declude not Imail.
T> I'm not sure if the "." would be a problem or
T> not with Imail.  However, with Declude's kill
T> list it seems to work fine for me and if you
T> were to check out our previous messages you 
T> would find that this subject has come up many 
T> times on this list.  If you go to the following
T> site http://www.mail-archive.com you will be able
T> to read all about it.

T> Below is a link to the reply message you inquired about:
T> http://www.mail-archive.com/declude.junkmail%40declude.com/msg03399.html

T> Regards,
T> Tom
T> Image`fx


T> ---
T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

T> ---

T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  You can E-mail
T> [EMAIL PROTECTED] for assistance.  You can visit our web
T> site at http://www.declude.com .
T> --
T> ActivatorMail(tm) ver.061902 Scanned for all viruses by 
T> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.061902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



BLARSBL:Re[2]: [Declude.JunkMail] Kill File list update for 07/31/02

2002-07-31 Thread Roger Heath

Reply to: Tom
  Re: [Declude.JunkMail] Kill File list update for 07/31/02 on Wednesday 4:25:41 PM

I  asked  earlier  about  using the '.' as a leading character in
kill.lst for example:

.bluehornet.com ID-07312002-000
.e-dialog.com   ID-07312002-001
.moveon.org ID-07312002-002

No one has shown me this works and it caused domains not to be
killed here earlier... Is there any documentation on this? Does
this actually work for you? If so, what version of Imail are you
using?

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


T> Here is the latest update for the Declude
T> Kill file.  We made some changes to the
T> ID as you may have noticed.  This change
T> was done for a program we are developing
T> to help us keep track of this kill list
T> and make a comparison to the Declude log
T> file.  In any-case the entire list can
T> be downloaded from the following URL:
T> http://www.imagefxonline.net/apps/delog/fromfile.txt

T> As usual I have to stress the following:
T> Each item on the list was checked, however,
T> we will not guarantee anything.  So, with
that said->> Use it at your own risk!

T> Regards,
T> Tom
T> Image`fx

T> -
T> .bluehornet.com ID-07312002-000
T> .e-dialog.com   ID-07312002-001
T> .moveon.org ID-07312002-002
T> .VALOFFERS.COM  ID-07312002-003
T> .pch.comID-07312002-004
T> .mx0.netID-07312002-005
T> .omahasteaks.comID-07312002-006
T> .investorreview.com ID-07312002-007
T> .emarketers.com ID-07312002-008
T> .colonize.com   ID-07312002-009
T> .funsleuthmail.com  ID-07312002-010
T> .fye.comID-07312002-011
T> space-offers.comID-07312002-012
T> @BodyEq.com ID-07312002-013
T> @default.comID-07312002-014
T> @gamers.com ID-07312002-015
T> @gocolchester.com   ID-07312002-016
T> @heapbuilders.com   ID-07312002-017
T> @imarketmedia.com   ID-07312002-018
T> @industryemail.com  ID-07312002-019
T> @inmaronlinenetwork.com ID-07312002-020
T> @lotsofhelp.com ID-07312002-021
T> @marca.es   ID-07312002-022
T> @mycoupons.com  ID-07312002-023
T> @netmailservices.comID-07312002-024
T> @prophetfinance.com ID-07312002-025
T> @rt.nl  ID-07312002-026
T> @sdilabs1w.com  ID-07312002-027
T> @stylustech.com ID-07312002-028
T> @161.58.185.26  ID-07312002-029
T> @surg.co.uk ID-07312002-030
T> .CUSTOMOFFERSMAIL.COM   ID-07312002-031
T> .directabout.comID-07312002-032
T> .EDIETS.COM ID-07312002-033
T> .hmdelivery.com ID-07312002-034
T> .keywordgold.comID-07312002-035
T> .quris.net  ID-07312002-036
T> .securesite8.comID-07312002-037
T> .shutterfly.com ID-07312002-038
T> .superstorespecials.com ID-07312002-039
T> .tatarstan.ru   ID-07312002-040 
T> ---
T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

T> ---

T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  You can E-mail
T> [EMAIL PROTECTED] for assistance.  You can visit our web
T> site at http://www.declude.com .
T> --
T> ActivatorMail(tm) ver.061902 Scanned for all viruses by 
T> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.061902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



BLARSBL:Re: [Declude.JunkMail] Spam Review kill.lst problem question

2002-07-31 Thread Roger Heath

Reply to: Tom Schwarz
  Re: [Declude.JunkMail] Spam Review kill.lst problem question on Wednesday 
9:17:17 AM

This  would  explain  our  problem.  I  guess  if you do not want
Declude  name in your header, you are outta luck on this issue...
We  chose to use only the name of our own services only in header
inserts.  We  also do not do reverse lookups for headers any more
because  this  slows  mail delivery time. We would rather you use
the  mailfrom actually, but I do not know how you would integrate
this.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

T> Please reply to [EMAIL PROTECTED]

T> If you are having problems with adding to kill.lst please review the
T> following and let me know if this is or is not your problem.

T> Per Scott Perry's Instructions, I look for "X-Declude-Sender:" to locate the
T> Sender of the email.  The only way this will be included in the files I am
T> looking at is if you have this option set in Declude: "XSENDER ON"

T> If this option is missing or set to OFF in Declude you will have have a
T> "X-Declude-Sender:" entry in your email files and the Add to Kill will not
T> work.

T> My question to you is:  How is your XSENDER option set?


T> Note From Scott:

T> If the "XSENDER ON" option is used.  Without that, there is no way of
T> knowing for sure what the return address is without looking at the IMail log
T> files for the "MAIL FROM:" line.

T> ---
T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

T> ---
T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

T> ---

T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  You can E-mail
T> [EMAIL PROTECTED] for assistance.  You can visit our web
T> site at http://www.declude.com .
T> --
T> ActivatorMail(tm) ver.061902 Scanned for all viruses by 
T> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.061902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



BLARSBL:Re[2]: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released

2002-07-30 Thread Roger Heath

Reply to: R. Scott Perry
  Re: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released on Tuesday 
10:17:30 AM

Yes. I thought it might be adding whitelist entries automatically
if  emails  passed all spam tests. If it is just a log entry.. no
pbm,  but  I  don't  want  to  have  tons of automatic white list
entries. 

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>Scott,  I  am seeing 'whitelisted automatically' ??? How does his work?

R> Do you mean that you are seeing a log file entry "This E-mail was 
R> whitelisted - automatically passing all spam tests"?

R> We added that log file entry because SO many people have complained about 
R> E-mail not getting caught, only to find out that it had been whitelisted.
R>  -Scott

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---

R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  You can E-mail
R> [EMAIL PROTECTED] for assistance.  You can visit our web
R> site at http://www.declude.com .
R> --
R> ActivatorMail(tm) ver.061902 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.061902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



BLARSBL:Re: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released

2002-07-30 Thread Roger Heath

Reply to: R. Scott Perry
  Re: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released on Tuesday 9:44:55 
AM

Scott,  I  am seeing 'whitelisted automatically' ??? How does his
work?

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

R> We have just released Declude JunkMail v1.57 (beta).  Changes include:

R> o HELOBOGUS will now only be tested on non-local senders.
R> o HELO detection wasn't using correct hop; fixed.
R> o An issue STARTSWITH in filter was fixed.
R> o ROUTETO/COPYTO can now use variables (IE "spam@%LOCALHOST%").
R> o Fixes an issue where starting external programs could fail (0xC142 
R> error without a .DLL listed).
R> o Takes care of possible whitelist corruption when certain Received: 
R> headers were processed.
R> o IS filter type added.
R> o ENDSWITH filter type added.
R> o HEADERS filter location added.
R> o Added REDIRECT option in config files to allow configuration "groups".

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---

R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  You can E-mail
R> [EMAIL PROTECTED] for assistance.  You can visit our web
R> site at http://www.declude.com .
R> --
R> ActivatorMail(tm) ver.061902 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.061902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



BLARSBL:Re: [Declude.JunkMail] Declude and Sniffer

2002-07-26 Thread Roger Heath

Reply to: Jeff Kratka
  Re: [Declude.JunkMail] Declude and Sniffer on Friday 3:08:26 PM

You will like Sniffer. Not only is it great at spam detection but
it is substantially faster than text based rules.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

J> Just curious. How many people are using both Declude Junk Mail and the
J> sniffer add-on and has it made a difference if yes. I have been completely
J> pummeled with Spam and am looking for more options.

J> Thanks.

J> Jeff

J> *
J> TymeWyse Internet
J> P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417
J> tel/fax: (541) 839-6027  -  [EMAIL PROTECTED]
J> *


J> ---
J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

J> ---

J> This E-mail came from the Declude.JunkMail mailing list.  To
J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
J> type "unsubscribe Declude.JunkMail".  You can E-mail
J> [EMAIL PROTECTED] for assistance.  You can visit our web
J> site at http://www.declude.com .
J> --
J> ActivatorMail(tm) ver.061902 Scanned for all viruses by 
J> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.061902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re[2]: BLARSBL:Re: [Declude.JunkMail] problem with spamreview software

2002-07-24 Thread Roger Heath

Reply to: Eddie Cornejo
  Re: BLARSBL:Re: [Declude.JunkMail] problem with spamreview software on Wednesday 
6:01:50 PM

I  have furnished some files to him to fix this and got fixes the
same  day.  It  is  an indispensable piece of sofware. Don't know
what  I  would  do  without it. Hope to see fixes on the kill.lst
That is the only problem I am experiencing at this time.

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

E> Roger,

E> I've come to the conclusion that the spamreview software is choking on my
E> spool files.
E> I installed the software on three different machines with the same results
E> (2k server, 2k pro, and win98).
E> I am sending the author a sample of my spool files for testing.

E> If anyone on this list wants to give it a try, please email me directly.

E> mailto:[EMAIL PROTECTED]

E> Eddie Cornejo, Sys Admin
E> Tom Rowe & Associates
E> 956-412-6600 Ext.10
E> Toll Free USA 888-866-7693
E> Toll Free Canada 877-866-7693
E> http://www.tomrowe.com



E> -Original Message-
E> From: [EMAIL PROTECTED]
E> [mailto:[EMAIL PROTECTED]]On Behalf Of Roger Heath
E> Sent: Wednesday, July 24, 2002 5:10 PM
E> To: Eddie Cornejo
E> Subject: BLARSBL:Re: [Declude.JunkMail] problem with spamreview software


E> Reply to: Eddie Cornejo
E>   Re: [Declude.JunkMail] problem with spamreview software on Wednesday
E> 4:05:03 PM

E> We  have  reported  this  for several months now and it has never
E> been  fixed  because  it  is  working for the author. We know the
E> paths  are  correct as we can load the kill.lst from the menu. It
E> keeps  putting  carriage  returns  at  the end of the file but no
E> addresses or domains... NT4SP6A. You are not alone. 

E> --
E> Roger Heath
E> [EMAIL PROTECTED]
E> www.rleeheath.com


E> - Copy of Original Message(s): -

E>> Is anyone having a problem with the latest version (1.0.39) of spamreview
E>> not writing to the kill.lst file?
E>> Tried local and mapped drives, file permissions etc. without success.
E>> I have an older version (1.0.12) that does write to the kill.lst file.

E>> I've also emailed the author of the program.

E>> Thanks,

E>> Eddie Cornejo, Sys Admin
E>> Tom Rowe & Associates
E>> 956-412-6600 Ext.10
E>> Toll Free USA 888-866-7693
E>> Toll Free Canada 877-866-7693
E>> http://www.tomrowe.com

E>> ---
E>> [This E-mail was scanned for viruses by Declude Virus
E> (http://www.declude.com)]

E>> ---

E>> This E-mail came from the Declude.JunkMail mailing list.  To
E>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
E>> type "unsubscribe Declude.JunkMail".  You can E-mail
E>> [EMAIL PROTECTED] for assistance.  You can visit our web
E>> site at http://www.declude.com .
E>> --
E>> ActivatorMail(tm) ver.061902 Scanned for all viruses by
E>> www.activatormail.com intelligent anti-virus anti-spam service

E> --
E> ActivatorMail(tm) ver.061902 Scanned for all viruses by
E> www.activatormail.com intelligent anti-virus anti-spam service

E> ---
E> [This E-mail was scanned for viruses by Declude Virus
E> (http://www.declude.com)]

E> ---

E> This E-mail came from the Declude.JunkMail mailing list.  To
E> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
E> type "unsubscribe Declude.JunkMail".  You can E-mail
E> [EMAIL PROTECTED] for assistance.  You can visit our web
E> site at http://www.declude.com .

E> ---
E> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

E> ---

E> This E-mail came from the Declude.JunkMail mailing list.  To
E> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
E> type "unsubscribe Declude.JunkMail".  You can E-mail
E> [EMAIL PROTECTED] for assistance.  You can visit our web
E> site at http://www.declude.com .
E> --
E> ActivatorMail(tm) ver.061902 Scanned for all viruses by 
E> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.061902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



BLARSBL:Re: [Declude.JunkMail] problem with spamreview software

2002-07-24 Thread Roger Heath

Reply to: Eddie Cornejo
  Re: [Declude.JunkMail] problem with spamreview software on Wednesday 4:05:03 PM

We  have  reported  this  for several months now and it has never
been  fixed  because  it  is  working for the author. We know the
paths  are  correct as we can load the kill.lst from the menu. It
keeps  putting  carriage  returns  at  the end of the file but no
addresses or domains... NT4SP6A. You are not alone. 

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

E> Is anyone having a problem with the latest version (1.0.39) of spamreview
E> not writing to the kill.lst file?
E> Tried local and mapped drives, file permissions etc. without success.
E> I have an older version (1.0.12) that does write to the kill.lst file.

E> I've also emailed the author of the program.

E> Thanks,

E> Eddie Cornejo, Sys Admin
E> Tom Rowe & Associates
E> 956-412-6600 Ext.10
E> Toll Free USA 888-866-7693
E> Toll Free Canada 877-866-7693
E> http://www.tomrowe.com

E> ---
E> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

E> ---

E> This E-mail came from the Declude.JunkMail mailing list.  To
E> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
E> type "unsubscribe Declude.JunkMail".  You can E-mail
E> [EMAIL PROTECTED] for assistance.  You can visit our web
E> site at http://www.declude.com .
E> --
E> ActivatorMail(tm) ver.061902 Scanned for all viruses by 
E> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.061902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



[Declude.JunkMail] BLARSBL:Declude Keyword Filters

2002-07-04 Thread Roger Heath

Are  key  word  filters  case  sensitive? We see some filters not
working on subject fields, for example, unless they match exactly
the case of the filter...


--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com

--
ActivatorMail(tm) ver.061902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



BLARSBL:Re[2]: [Declude.JunkMail] Whitelist stopped working, REVDNS lookup fails

2002-06-30 Thread Roger Heath

Reply to: Andy Schmidt
  Re: [Declude.JunkMail] Whitelist stopped working, REVDNS lookup fails on Sunday 
10:22:57 AM

Scott,  could  you  list the limits of the whitelist again? It is
limited  to  100  entries?  Is this a total of ANYWHERE and FROM,
etc.?  And  I  have another question. Are there limits to the new
filtering  or blacklists. I am transforming my filters from Imail
to  Declude  and  finding  Declude substantially faster, but I am
concerned about limitations...

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

A> Hi Scott:

>>> Am I right you have the HOP value set to 0?  Do you have the HOPHIGH
A> value set? <<

A> Here the first few lines of my Global.CFG (Hop=0, Hophigh=undefined):

A> LOGFILE D:\imail\spool\dec.log
A> LOGLEVELMID
A> LOG_OK  NONE

A> HOP 0
A> CONSOLE OFF
A> XINHEADER   X-Declude: Version %VERSION%; %QUEUENAME% from %REVDNS%
A> [%REMOTEIP%]
A> XINHEADER   Return-Path: <%MAILFROM%>
A> XOUTHEADER  X-Note: Report any abuse to [EMAIL PROTECTED]
A> IPBYPASS63.107.174.32
A> IPBYPASS65.86.89.162
A> XSENDER OFF
A> XSPOOLNAME  OFF
A> SWITCHRECIP ON

A> #
A> # White Lists
A> #
A> WHITELIST   IP  63.107.174.
A> WHITELIST   IP  65.86.89.162

>>> It seems that for some reason 1.55i may not be able to pick up the
A> correct IP from the headers, or it may be getting corrupted. <<

A> Well - it seems to get corrupted - because, remember, my XINHEADER always
A> REPORTS the correct IP Address.  But, when it tries to do the reverse
A> lookup - it "lost" that knowledge.  Because the Declude log file entry for
A> REVDNS just displays a "space" where the IP address should be.

A> I can definitely narrow this down for you, with respect to which application
A> AND which version broke it:

A> The RevDNS problem seems to be consistently happening with emails created by
A> the AOL7 mailer.  Something in their headers tripps up the latest 1.55i
A> versions.  It apparently was fine with 1.55 (since I never heard of
A> complaints with the original beta. I have a few people who regularily email
A> me from AOL several times at night). Emailing worked fine until the Friday
A> night after I installed the latest 1.55i from Friday lunch time. Then they
A> started getting my REVDNS alerts for each message they sent.

A> However the problem is not EXLUSIVE to AOL.  The log shows a high number of
A> other senders with bogus REVDNS errors - where the IP is blank.  But, there
A> are also a large number of emails which correctly identify the IP address in
A> the log (at least apparently so).

A> Best Regards
A> Andy Schmidt

A> H&M Systems Software, Inc.
A> 600 East Crescent Avenue
A> Suite 203
A> Upper Saddle River, NJ 07458-1846

A> Phone:  +1 201 934-3414 x20 (Business)
A> Fax:+1 201 934-9206

A> http://www.hm-software.com/


A> ---
A> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

A> ---

A> This E-mail came from the Declude.JunkMail mailing list.  To
A> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
A> type "unsubscribe Declude.JunkMail".  You can E-mail
A> [EMAIL PROTECTED] for assistance.  You can visit our web
A> site at http://www.declude.com .
A> --
A> ActivatorMail(tm) ver.061902 Scanned for all viruses by 
A> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.061902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



BLARSBL:Re[2]: [Declude.JunkMail] About Addresses

2002-06-22 Thread Roger Heath

I tried it and it does not work here. For example where I had

@bounce.azoogle.com I used in the kill.lst

.azoogle.com

and  it  did  not  work.  What was blocked before was not blocked
afterwards.  Are  you  referring  to  the kill.lst or the Declude
blacklist  feature?  I was looking for use in the kill.lst but it
looks like this is for the blacklist feature...

--
Roger Heath

- Copy of Original Message(s): -


>> Is  there documentation on kill.lst and use of the proceeding '.'
>> dot?  I  could  not  find this... The Infobase says use @ in each
>> example... Is this for use in Declude blacklist or kill.lst?

T> I don't know if there is any documentation on it other than what
T> I got from this list.  To the best of my knowledge you are allowed
T> to use any part of an address.

T> For example:

T> [EMAIL PROTECTED]

T> you can use .someplace.com or someplace.com
T> However, you must very careful using a short name, because
T> you can catch another domain by accident.  That is if you
T> had the address place.com, you would also catch someplace.com
T> That is why it suggested that you use the @ or . character.

T> Keep in mind, with a longer name, you can get away without
T> using these characters.  However, you might want to consider 
T> the following information from Netsol.

T> Quoted from the NETSOL.COM web site
T> ---

T> Letters and numbers are always valid characters. 
T> Hyphens may also be used in but may not begin nor end your domain name. 
T> Spaces and special characters are never permitted. The special characters
T> include, but are not limited to, these special characters: 

T> ! @ # $ % ^ & * ( ) ? " 

T> You can use up to 67 characters in your domain name, including the 
T> extension .COM, .NET, or .ORG. You've got lots of options for 
T> establishing your Internet identity! 

T> "www." and http://www. are not considered part of your domain name and 
T> therefore don't count towards the 67 character total.

T> An example of a valid domain name is: 
T> 67-character-web-addresses-are-available-from-networksolutions.com  
T> ---
T> end of quote

T> Regards,
T> Tom

T> ---
T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

T> ---

T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  You can E-mail
T> [EMAIL PROTECTED] for assistance.  You can visit our web
T> site at http://www.declude.com .
T> --
T> ActivatorMail(tm) ver.061902 Scanned for all viruses by 
T> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.061902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



BLARSBL:Re[2]: [Declude.JunkMail] More Spam Addresses

2002-06-22 Thread Roger Heath

Reply to: Tom
  Re: [Declude.JunkMail] More Spam Addresses on Saturday 9:09:17 PM

Is  there documentation on kill.lst and use of the proceeding '.'
dot?  I  could  not  find this... The Infobase says use @ in each
example... Is this for use in Declude blacklist or kill.lst?

--
Roger Heath

- Copy of Original Message(s): -

T> Here are a few more spam addresses that were checked.
T> "like always, use them at your own risk." -TJ

T> .adult-mailer.com   
T> .almus.com  
T> .asseenontw.com 
T> .clubshop.com   
T> .emailfactory.com   
T> .emazing.com
T> .infogeneratorpro.com   
T> .intimail.com   
T> .masterbatesknows.com   
T> .optinmailing.com   
T> .sandbox.com
T> .temd.net   
T> .tradersunite.com   
T> .wippit.com 
T> @Yokoz.com  
T> @befree.com 
T> @c-h-o.com  
T> @cadvision.com  
T> @df.lth.se  
T> @discounts.com.ar   
T> @doe.com
T> @doge.it
T> @free-inter.net 
T> @gz-5.com   
T> @hanson.com 
T> @informaticien.org  
T> @intenseschool.com  
T> @jyrki.com  
T> @kali.com.cn
T> @motorcycle.com 
T> @msgserv.com
T> @optinstar.com  
T> @pediatrician.com   
T> @rapidimpactonline.net  
T> @salliemaemail.com  
T> @sgleb.com.lb   
T> @spermfun.com   
T> @spray.no   
T> @surfacemail.com
T> @thenetdeals.com
T> @total.net  
T> @two-river.com  
T> @uptilt.com 
T> @w2knews.com
T> @xidserv.com
T> @xynergy.org
T> @yeah.net   
T> @zbzoom.net 
T> armstrongonewire.com
T> businessopp2002.com 
T> theadmanager.com


 
T> ---
T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

T> ---

T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  You can E-mail
T> [EMAIL PROTECTED] for assistance.  You can visit our web
T> site at http://www.declude.com .
T> --
T> ActivatorMail(tm) ver.061902 Scanned for all viruses by 
T> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.061902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



[Declude.JunkMail] BLARSBL:Time Msg Processed : ms ?? (like DEBUG log)

2002-06-20 Thread Roger Heath

I  have  seen  others ask about this here and I am curious if any
such  feature  was  done..???  where %TIMEINOUT% or some variable
that  is  the  milliseconds  of Declude processing time, normally
seen  in  the  DEBUG  logging  mode. This would be a nice quality
control  feature  for  JunkMail if it can be done... so it can be
placed in headers even temporarily to view how well mail is being
processed.

--
Roger Heath

--
ActivatorMail(tm) ver.061902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re[5]: [Declude.JunkMail] BLARSBL:DBSL

2002-06-13 Thread Roger Heath

Reply to: Bill Landry
  Re: [Declude.JunkMail] BLARSBL:DBSL on Thursday 11:18:07 AM

Thanks, I will try these. Actually Scott has :

#DSBLALLip4runconfirmed.dsbl.org*   4   0

Maybe this was the source of the pbm?

--
Roger Heath

- Copy of Original Message(s): -

B> I'm not sure if you mean BLARSBL or DSBL, but I have been using both, and
B> DSBL-MULTI as well, for several months without issue.  In fact, they have
B> worked quite well for me, so I've given each of them a weight of 6, with my
B> hold weight being 10.

B> BLARSBL ip4rblock.blars.org *   6   0
B> DSBLip4rlist.dsbl.org   *   6   0
B> DSBL-MULTI  ip4rmultihop.dsbl.org   *   6
B> 0

B> Bill

B> -----Original Message-
B> From: Roger Heath [mailto:[EMAIL PROTECTED]]
B> Sent: Thursday, June 13, 2002 9:03 AM
B> To: R. Scott Perry
B> Subject: Re[3]: [Declude.JunkMail] BLARSBL:DBSL


B> Reply to: R. Scott Perry
B>   Re: [Declude.JunkMail] BLARSBL:DBSL on Thursday 10:18:20 AM

B> Thanks.  I  had  to  drop this almost as soon as I started it. It
B> seemed  to  work but then I began getting almost all mail trapped
B> with  a weight 10 appearing from nowhere. Even the tests list did
B> not list a weight 10 rule violation. I commented out the DBSL and
B> now am back to normal.

B> --
B> Roger Heath



B> - Copy of Original Message(s): -


>>>No,  but  I  will  try it. It seems to be working good. Scott had
>>>this under subscription based services in his sample global file,
>>>so I was a bit confused.

R>> FYI, that section is for services that require a subscription *or* are
B> not 
R>> commonly used.  The only ones that require a subscription are the MAPS 
R>> tests (RBL, RSS, DUL) and the SNIFFER and POSTFIXGATE tests.

>>>Are there others? Does any one here have
>>>a complete list of the free ones available?

R>> You can go to http://www.declude.com/junkmail/support/ip4r.htm for a list

R>> of all the known DNS-based spam tests.  Except for the ones listed above,

R>> they are all free.
R>> -Scott

R>> ---
R>> [This E-mail was scanned for viruses by Declude Virus
B> (http://www.declude.com)]

R>> ---

R>> This E-mail came from the Declude.JunkMail mailing list.  To
R>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R>> type "unsubscribe Declude.JunkMail".  You can E-mail
R>> [EMAIL PROTECTED] for assistance.  You can visit our web
R>> site at http://www.declude.com .
R>> --
R>> ActivatorMail(tm) ver.061102 Scanned for all viruses by 
R>> www.activatormail.com intelligent anti-virus anti-spam service

B> --
B> ActivatorMail(tm) ver.061102 Scanned for all viruses by 
B> www.activatormail.com intelligent anti-virus anti-spam service

B> ---
B> [This E-mail was scanned for viruses by Declude Virus
B> (http://www.declude.com)]

B> ---

B> This E-mail came from the Declude.JunkMail mailing list.  To
B> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
B> type "unsubscribe Declude.JunkMail".  You can E-mail
B> [EMAIL PROTECTED] for assistance.  You can visit our web
B> site at http://www.declude.com .

B> ---
B> [This e-mail was scanned for viruses by Pointshare's Virus Scanning Service]
B> ---
B> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

B> ---

B> This E-mail came from the Declude.JunkMail mailing list.  To
B> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
B> type "unsubscribe Declude.JunkMail".  You can E-mail
B> [EMAIL PROTECTED] for assistance.  You can visit our web
B> site at http://www.declude.com .
B> --
B> ActivatorMail(tm) ver.061102 Scanned for all viruses by 
B> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.061102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re[3]: [Declude.JunkMail] BLARSBL:DBSL

2002-06-13 Thread Roger Heath

Reply to: R. Scott Perry
  Re: [Declude.JunkMail] BLARSBL:DBSL on Thursday 10:18:20 AM

Thanks.  I  had  to  drop this almost as soon as I started it. It
seemed  to  work but then I began getting almost all mail trapped
with  a weight 10 appearing from nowhere. Even the tests list did
not list a weight 10 rule violation. I commented out the DBSL and
now am back to normal.

--
Roger Heath



- Copy of Original Message(s): -


>>No,  but  I  will  try it. It seems to be working good. Scott had
>>this under subscription based services in his sample global file,
>>so I was a bit confused.

R> FYI, that section is for services that require a subscription *or* are not 
R> commonly used.  The only ones that require a subscription are the MAPS 
R> tests (RBL, RSS, DUL) and the SNIFFER and POSTFIXGATE tests.

>>Are there others? Does any one here have
>>a complete list of the free ones available?

R> You can go to http://www.declude.com/junkmail/support/ip4r.htm for a list 
R> of all the known DNS-based spam tests.  Except for the ones listed above, 
R> they are all free.
R> -Scott

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---

R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  You can E-mail
R> [EMAIL PROTECTED] for assistance.  You can visit our web
R> site at http://www.declude.com .
R> --
R> ActivatorMail(tm) ver.061102 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.061102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re[2]: [Declude.JunkMail] BLARSBL:DBSL

2002-06-13 Thread Roger Heath

Reply to: Intelliware Administrator
  Re: [Declude.JunkMail] BLARSBL:DBSL on Thursday 9:38:20 AM

No,  but  I  will  try it. It seems to be working good. Scott had
this under subscription based services in his sample global file,
so I was a bit confused. Are there others? Does any one here have
a complete list of the free ones available?

--
Roger Heath


- Copy of Original Message(s): -

I> Did you also uncomment DSBLALL ?


I> Kevin M. Donovan, MCSE
I> Network Support Specialist
I> IntelliWare Systems, Inc.

I> Phone (817) 277-0800 x228

I> - Original Message -----
I> From: "Roger Heath" <[EMAIL PROTECTED]>
I> To: "Roger Heath" <[EMAIL PROTECTED]>
I> Sent: Thursday, June 13, 2002 9:04 AM
I> Subject: Re: [Declude.JunkMail] BLARSBL:DBSL


>> Reply to: Roger Heath
>>   Re: [Declude.JunkMail] BLARSBL:DBSL on Thursday 8:49:08 AM
>>
>> Should be DSBL... and it appears to be working here after turning
>> it on..
>>
>> --
>> Roger Heath
>>
>> - Copy of Original Message(s): -
>>
>> R>
I> http://www.infoworld.com/cgi-bin/fixup.pl?story=http://www.infoworld.com/art
I> icles/op/xml/02/05/20/020520opestrat.xml&dctag=security
>>
>> R> Is DBSL a free blacklist? It seems so in the above article...
>>
>> R> If  so, do I just uncomment the line in the Global.Cfg to make it
>> R> active?
>>
>> R> --
>> R> Roger Heath
>>
>> R> --
>> R> ActivatorMail(tm) ver.061102 Scanned for all viruses by
>> R> www.activatormail.com intelligent anti-virus anti-spam service
>>
>> R> ---
>> R> [This E-mail was scanned for viruses by Declude Virus
I> (http://www.declude.com)]
>>
>> R> ---
>>
>> R> This E-mail came from the Declude.JunkMail mailing list.  To
>> R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> R> type "unsubscribe Declude.JunkMail".  You can E-mail
>> R> [EMAIL PROTECTED] for assistance.  You can visit our web
>> R> site at http://www.declude.com .
>> R> --
>> R> ActivatorMail(tm) ver.061102 Scanned for all viruses by
>> R> www.activatormail.com intelligent anti-virus anti-spam service
>>
>> --
>> ActivatorMail(tm) ver.061102 Scanned for all viruses by
>> www.activatormail.com intelligent anti-virus anti-spam service
>>
>> ---
>> [This E-mail was scanned for viruses by Declude Virus
I> (http://www.declude.com)]
>>
>> ---
>>
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> type "unsubscribe Declude.JunkMail".  You can E-mail
>> [EMAIL PROTECTED] for assistance.  You can visit our web
>> site at http://www.declude.com .
>>

I> ---
I> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

I> ---

I> This E-mail came from the Declude.JunkMail mailing list.  To
I> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
I> type "unsubscribe Declude.JunkMail".  You can E-mail
I> [EMAIL PROTECTED] for assistance.  You can visit our web
I> site at http://www.declude.com .
I> --
I> ActivatorMail(tm) ver.061102 Scanned for all viruses by 
I> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.061102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.JunkMail] BLARSBL:DBSL

2002-06-13 Thread Roger Heath

Reply to: Roger Heath
  Re: [Declude.JunkMail] BLARSBL:DBSL on Thursday 8:49:08 AM

Should be DSBL... and it appears to be working here after turning
it on..

--
Roger Heath

- Copy of Original Message(s): -

R> 
http://www.infoworld.com/cgi-bin/fixup.pl?story=http://www.infoworld.com/articles/op/xml/02/05/20/020520opestrat.xml&dctag=security

R> Is DBSL a free blacklist? It seems so in the above article...

R> If  so, do I just uncomment the line in the Global.Cfg to make it
R> active?

R> --
R> Roger Heath

R> --
R> ActivatorMail(tm) ver.061102 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---

R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  You can E-mail
R> [EMAIL PROTECTED] for assistance.  You can visit our web
R> site at http://www.declude.com .
R> --
R> ActivatorMail(tm) ver.061102 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.061102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



[Declude.JunkMail] BLARSBL:DBSL

2002-06-13 Thread Roger Heath

http://www.infoworld.com/cgi-bin/fixup.pl?story=http://www.infoworld.com/articles/op/xml/02/05/20/020520opestrat.xml&dctag=security

Is DBSL a free blacklist? It seems so in the above article...

If  so, do I just uncomment the line in the Global.Cfg to make it
active?

--
Roger Heath

--
ActivatorMail(tm) ver.061102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



BLARSBL:Re[2]: [Declude.JunkMail] Blocking Dictionary Attacks and Mail Harvesting -- Does BlackIce help?

2002-04-30 Thread Roger Heath

Reply to: Jim Jones, Jr.
  Re: [Declude.JunkMail] Blocking Dictionary Attacks and Mail Harvesting -- Does 
BlackIce help? on Tuesday 7:46:02 AM

Our  servers  are  very  stable  with  this firewall. It does not
autoblock  these  but you can manually block them. I noticed that
they  do  not  show up in the log any more, so it appears to work
fine.  I  know  you can set to autoblock select events by editing
the blackice.ini can be edited for example:

http.urllimit.count=60
http.urllimit.interval=50

will  temporarily  block  too  many  URL  requests, like web site
copying... I do not know the settings for too many SMTP requests,
but it must exist if you research or call support. Let me know if
you find this out.

I  can't  imagine  running  Imail without this firewall as I have
EZSignup and IIS on the same setup and it autoblocks Code Red and
numerous illegal requests in IIS automatically..

--
Roger Heath



- Copy of Original Message(s): -

J> we put that on after having over 100,000 connections to our server in one
J> day for harvesting purposes.  We noticed that it was seeing these attacks,
J> but couldn't tell if it was blocking them or not.  I wonder if there is a
J> way to configure blackice to automatically block someone that is doing this
J> for one day?

J> also, how has your server been, stability wise, after installing blackice?
J> ours seems to have held up pretty well.

J> thanks,

J> jim
J> - Original Message -
J> From: "Roger Heath" <[EMAIL PROTECTED]>
J> To: "Jesus Alvarez" <[EMAIL PROTECTED]>
J> Sent: Monday, April 29, 2002 5:16 PM
J> Subject: BLARSBL:Re: [Declude.JunkMail] Blocking Dictionary Attacks and Mail
J> Harvesting


>> Reply to: Jesus Alvarez
>>   Re: [Declude.JunkMail] Blocking Dictionary Attacks and Mail
J> Harvesting on Monday 4:26:37 PM
>>
>> The  Server  version  of  NetworkIce  Black  Ice detects these as
>> 'SMTP-  too  many errors'. When we see this, we set that IP to be
>> blocked  for  a  day  or  a  week  if  they  are  persistent.  It
>> essentially  shuts  off their attack for a set time period... You
>> can purchase this Server Firewall at www.networkice.com
>>
>> --
>> Roger Heath
>>
>>
>>
>> - Copy of Original Message(s): -
>>
>> J> Can Declude Hijack help with dictionary attacks and
>> J> other attacks that attempt at mail harvesting ?
>>
>> J> We had a case recently where someone tried over 5
>> J> email addresses on a domain before we were able to stop
>> J> him. Since we have an Imgate front end, the bounce messages
>> J> increased our queues and delivery times quite a bit. His
>> J> ISP was notified and their account cancelled but that does
>> J> not prevent this from happening again. We currently run
>> J> Declude Hijack but it normally catches attempts at
>> J> massive outgoing deliveries, not cases like this.
>>
>> J> Else, how do other Imail & Declude users protect themselves
>> J> in these cases ?
>>
>> J> Thanks.
>>
>> J> ---
>> J> [This E-mail was scanned for viruses by Declude Virus
J> (http://www.declude.com)]
>>
>> J> ---
>>
>> J> This E-mail came from the Declude.JunkMail mailing list.  To
>> J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> J> type "unsubscribe Declude.JunkMail".  You can E-mail
>> J> [EMAIL PROTECTED] for assistance.  You can visit our web
>> J> site at http://www.declude.com .
>> J> --
>> J> ActivatorMail(tm) ver.041902 Scanned for all viruses by
>> J> www.activatormail.com intelligent anti-virus anti-spam service
>>
>> --
>> ActivatorMail(tm) ver.041902 Scanned for all viruses by
>> www.activatormail.com intelligent anti-virus anti-spam service
>>
>> ---
>> [This E-mail was scanned for viruses by Declude Virus
J> (http://www.declude.com)]
>>
>> ---
>>
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> type "unsubscribe Declude.JunkMail".  You can E-mail
>> [EMAIL PROTECTED] for assistance.  You can visit our web
>> site at http://www.declude.com .
>>

J> ---
J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

J> ---

J> This E-mail came from the Declude.JunkMail mailing list.  To
J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
J> type "unsubscribe Declude.JunkMail".  You can E-mail
J> [EMAIL PROTECTED] for assistance.  You can visit our web
J> site at http:/

BLARSBL:Re: [Declude.JunkMail] Blocking Dictionary Attacks and Mail Harvesting

2002-04-29 Thread Roger Heath

Reply to: Jesus Alvarez
  Re: [Declude.JunkMail] Blocking Dictionary Attacks and Mail Harvesting on Monday 
4:26:37 PM

The  Server  version  of  NetworkIce  Black  Ice detects these as
'SMTP-  too  many errors'. When we see this, we set that IP to be
blocked  for  a  day  or  a  week  if  they  are  persistent.  It
essentially  shuts  off their attack for a set time period... You
can purchase this Server Firewall at www.networkice.com

--
Roger Heath



- Copy of Original Message(s): -

J> Can Declude Hijack help with dictionary attacks and
J> other attacks that attempt at mail harvesting ?

J> We had a case recently where someone tried over 5
J> email addresses on a domain before we were able to stop
J> him. Since we have an Imgate front end, the bounce messages
J> increased our queues and delivery times quite a bit. His
J> ISP was notified and their account cancelled but that does
J> not prevent this from happening again. We currently run
J> Declude Hijack but it normally catches attempts at
J> massive outgoing deliveries, not cases like this.

J> Else, how do other Imail & Declude users protect themselves
J> in these cases ?

J> Thanks.

J> ---
J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

J> ---

J> This E-mail came from the Declude.JunkMail mailing list.  To
J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
J> type "unsubscribe Declude.JunkMail".  You can E-mail
J> [EMAIL PROTECTED] for assistance.  You can visit our web
J> site at http://www.declude.com .
J> --
J> ActivatorMail(tm) ver.041902 Scanned for all viruses by 
J> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.041902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



BLARSBL:Re[2]: [Declude.JunkMail] 1.49 list problem

2002-04-27 Thread Roger Heath

Reply to: Jack Taugher
  Re: [Declude.JunkMail] 1.49 list problem on Friday 1:50:18 PM

Using Declude 1.5 and still see this problem. I have a local list
of  1800 I send out and it is now over four hours later and it is
still  delivering  this  in  about  8 LST files. I have exhausted
trying  to  find  out  why 1800 and all local accounts would take
this  amount of time or longer. Am I missing a setting somewhere?
I  have  never  seen  it  take  so  long to deliver local emails.
Otherwise regular emails are passing very fast.

--
Roger Heath

- Copy of Original Message(s): -

J> I wonder if that was our problem yesterday.

J> We had a few messages sent to our a list of 800 and a list of 1200.  I
J> didn't recall seeing any .LST files, however it took more than 2 hours to
J> send out the message -- whereas in the past those two lists seemed to send
J> everything within 5 minutes.



J> - Original Message -
J> From: "R. Scott Perry" <[EMAIL PROTECTED]>
J> To: <[EMAIL PROTECTED]>
J> Sent: Friday, April 26, 2002 10:17 AM
J> Subject: Re: [Declude.JunkMail] 1.49 list problem


>>
>> >Does this mean that if I send something to a list it will not go out
J> right
>> >now?
>>
>> That depends on your queue timer settings.  However, if you need to send
>> something out immediately, you can go to the IMail Administrator, go to
>> View Queue, find the .LST file(s) and click the "Send One" button to send
>> them out immediately.
>> -Scott
>>
>> ---
>> [This E-mail was scanned for viruses by Declude Virus
J> (http://www.declude.com)]
>>
>> ---
>>
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> type "unsubscribe Declude.JunkMail".  You can E-mail
>> [EMAIL PROTECTED] for assistance.  You can visit our web
>> site at http://www.declude.com .
>>

J> ---
J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

J> ---

J> This E-mail came from the Declude.JunkMail mailing list.  To
J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
J> type "unsubscribe Declude.JunkMail".  You can E-mail
J> [EMAIL PROTECTED] for assistance.  You can visit our web
J> site at http://www.declude.com .
J> --
J> ActivatorMail(tm) ver.041902 Scanned for all viruses by 
J> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.041902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



BLARSBL:Re: [Declude.JunkMail] 1.49 list problem

2002-04-26 Thread Roger Heath

Reply to: John Shacklett
  Re: [Declude.JunkMail] 1.49 list problem on Friday 8:38:25 AM

We  have  been  witnessing  this for a while... as well. It seems
like  list  mail  just  sits  there forever unless is is manually
pushed.. This seems to be the only way it gets delivered.

--
Roger Heath

- Copy of Original Message(s): -

J> Since downloading the 1.49 beta on Wednesday [was it Wednesday? seems like
J> it was; everything is a blur lately], my mailserver seems to have developed
J> a problem with List delivery. The List submissions are accepted, scanned,
J> and dumped into the spool directory as nice tidy .LST files, and then they
J> just sit there. Very well done indeed. Seems like we had a problem similar
J> to this a couple of dozen versions ago? Anyway, I've been pushing these
J> critters out manually, but I'll let the next one sit and see if it
J> eventually goes out on its own. Maybe on the next queue run?

J> --


J> John Shacklett

J> www.continentaloffice.com

J> [EMAIL PROTECTED]
J> [EMAIL PROTECTED]



J> ---
J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

J> ---

J> This E-mail came from the Declude.JunkMail mailing list.  To
J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
J> type "unsubscribe Declude.JunkMail".  You can E-mail
J> [EMAIL PROTECTED] for assistance.  You can visit our web
J> site at http://www.declude.com .
J> --
J> ActivatorMail(tm) ver.041902 Scanned for all viruses by 
J> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.041902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



BLARS:Re[4]: [Declude.JunkMail] Spam Review and Kill File

2002-03-20 Thread Roger Heath

Reply to: Tom Schwarz
  Re: [Declude.JunkMail] Spam Review and Kill File on Wednesday 6:56:42 PM

This  is  a  followup on this thread because I'd sure like to see
two things added added to Spam Review. First, I'd like to be able
to  set  a  switch to delete Deleted Spam and Virus messages upon
exiting the program. It is really burdensome to have to use those
menus  over  and over and it would really speed things up to have
these deleted automatically at exit.

Second,  and  perhaps more important, I'd love to see Spam Review
made  into  a  full  Spool manager. The fact is that Ipswitch has
very  limited  capabilities  in  its  administrator  program. One
cannot  view  and manipulate spool files, whereas Spam Review has
most  of  this already in place and it even works over my subnet.
So  why  not  apply these capabilities to the Spool, then one can
get  rid  of  Spool  files  that  are  corrupt, or simply are not
deliverable..  This  would  be an invaluable tool for me here. As
far as I know, no such Spool utility exists now.

--
Roger Heath

--
ActivatorMail(tm) ver.030302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Fwd: Re: [Declude.JunkMail] Question

2002-02-04 Thread Roger Heath

This is a forwarded message
From: R. Scott Perry <[EMAIL PROTECTED]>
To: Roger Heath <[EMAIL PROTECTED]>

Thought others here might find this interesting as I did.

--
Roger Heath

=Original message text===

>My mail server and Declude is really being tested today.
>I think I got a concerted attack by several people at once
>to try and crash the server. I have a free email signup
>system (EZSignUp) and they signup then start sending libraries
>of email addresses through the server. Since these are from
>spammers and they violate SpamCop and other blacklists Declude
>was capturing thousands of emails. What is puzzling to me is
>that the spammers were sending to their own email address.

Actually, they aren't amateurs.  They very much want those E-mail that they 
are getting. These are the guys that go hunting for open relays.  They find 
lots of mail servers and try sending an E-mail through to a free mail 
account that they have; if it goes through, they know they found an open relay.

>I figure they must not know what is happening.

True -- they probably don't know that their mail is getting caught.

>It looks like they are amateurs.

These are actually the experts (or at least the most dedicated spammers).

>In SMTP I use 'Relay for Local Users Only'.

Note that this will allow spammers to send mail through your server to 
other servers, if they use a valid return address on one of your 
domains.  Most spammers won't go to that trouble, but they could.

>Here is an actual emails from the Spam directory:
>
>Received: from resystems.com [208.1.108.105] by activatormail.com with ESMTP
>   (SMTPD32-5.05) id AF4421E00DE; Mon, 04 Feb 2002 17:54:44 -0600

This is the open relay that they found.

>Received: from mx3.yahoo.com (host22.tracersinfo.com [216.242.132.22] (may 
>be forged))
> by resystems.com (8.9.3/8.9.3) with SMTP id CAA32528
> for <[EMAIL PROTECTED]>; Tue, 5 Feb 2002 02:25:56 -0500

And the open relay got it from 216.242.132.22, which is on the 
tracersinfo.com domain.  Most likely, the spammer hacked into the server, 
and isn't connect to it.  That's the server they are running their open 
relay tester software on.

>From: [EMAIL PROTECTED]
>Message-ID: <[EMAIL PROTECTED]>

Forged headers.

>To: <[EMAIL PROTECTED]>

This is the free account on your server.

>Subject: testmail

In most cases, they use a subject with a seemingly innocent header, in case 
the E-mail gets caught on the open relay and an admin finds it (subjects 
such as "I'll see you Tuesday" are common).

>0500490540460500520500460490510500460500500581041511605005004611611409709910111411510511010211104609909058055048049058053048058089101115

Here's the proof that it's a spammer.  This is their encoded data.  If you 
decode it, you'll see something that includes the IP address of the open 
relay.  To decode it, if you feel like it, take the numbers into groups of 
three digits (050, 049, 054...), start Notepad, and hold down the ALT key 
and type the three-digit number, and let go of the ALT key.  You'll see 
"216...", which is the real data the spammer sent.

>Received: from riceville.k12.ia.us [207.28.21.3] by activatormail.com with 
>ESMTP
>   (SMTPD32-5.05) id AF4110B0084; Mon, 04 Feb 2002 17:54:41 -0600

Here, the nice spammer found an educational mail server he could abuse.
-Scott

==End of original message text===

--
ActivatorMail(tm) ver.013102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.JunkMail] Spam Review Update v1.0.7

2002-02-03 Thread Roger Heath

Reply to: Tom Schwarz
  Re: [Declude.JunkMail] Spam Review Update  v1.0.7 on Saturday 10:18:30 AM

Seems to me the best way to handle same sender messages is to
detect within the program matching senders than ask with a popup
'Delete all instances of this sender?' Yes No. or even have a
switch in settings to do this automatically. Then you won't
even have to highlight messages to get the same effect faster.

Another way to speed review might be for the program to keep
a list of previously deleted email addresses then have a switch
in settings like 'Delete at boot matched deletes?' Yes No...
Then, as the program loads, it would automatically delete previously
deleted sender messages. One could purge this list to start over
again using this method. You would only be dealing with 'new
senders' at that point.

I don't know how much time Tom has.  I do appreciate very much
the program that exists.

--
Roger Heath

- Copy of Original Message(s): -

T> Power is back and life is getting back to normal so I thought I would post
T> an update.  The last update I posted the first person that downloaded it
T> found a major problem.  I hope that is not the case this time. 

--
ActivatorMail(tm) ver.013102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re[2]: [Declude.JunkMail] Am I blacklisting correctly?

2002-01-31 Thread Roger Heath

Reply to: R. Scott Perry
  Re: [Declude.JunkMail] Am I blacklisting correctly? on Thursday 2:52:03 PM

This would explain my %testsfailed% experiences.
I even tried putting the WARNs 'above' the HOLDs but this
made no difference, just so ya know.

--
Roger Heath

- Copy of Original Message(s): -

R> Yes.  We are currently investigating a problem reported with v1.35a that
R> may cause the WARN action not to be used when the HOLD action is used.  If 
R> you are running 1.35a, that could be why this is happening.
R> -Scott

--
ActivatorMail(tm) ver.013102 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.JunkMail] header confusion

2002-01-31 Thread Roger Heath

Reply to: John Shacklett
  Re: [Declude.JunkMail] header confusion on Thursday 7:20:44 AM

I tried several times yesterday to get %testsfailed%
working but it seemed to shut off weighing all together.
When we dropped this variable everything returned to
normal. We never saw tests listed here but had a blank line
as well. We are not using this variable now. I was waiting
for someone else to say something here. If you remove the
%testsfailed% perhaps you will see the blank lines disappear
too?

--
Roger Heath

- Copy of Original Message(s): -

J> Good morning, all.

J> I have a sequence of XINHEADER lines defined in my global.cfg, many based on
J> suggestions from Roger Heath and others. They look something like:

J> XINHEADER   X-Note: Total spam weight of this E-mail is %WEIGHT%.
J> XINHEADER   X-Note: QueInControl: %QUEUENAME% (%NRECIPS%)
J> XINHEADER   X-Note: Tests failed: %testsfailed%
J> XINHEADER   X-Note: RDNS Real Origin: %REVDNS%[%REMOTEIP%]
J> XINHEADER   X-Note: SMTP Real From: %MAILFROM%
J> XINHEADER   X-Note: SMTP Real To: %ALLRECIPS%

J> In addition, I have several tests defined that use the WARN action and they
J> have $default$.junkmail lines such as:

J> SPAMCOP header  X-RBL-Warning: SPAMCOP
J> ADULT   header  X-RBL-Warning: Possible ADULT Content

J> What I'm seeing in actual message Dxxx.SMD files is a blank line between
J> the X-Notes and the X-RBL-Warnings, so that the X-RBL-Warnings are showing
J> up as visible in the delivered messages. Is this a glitch, or have I done
J> something incorrect in my setups?

J> --

J> John Shacklett

J> www.continentaloffice.com

J> [EMAIL PROTECTED]
J> [EMAIL PROTECTED]

J> ---
J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

J> ---

J> This E-mail came from the Declude.JunkMail mailing list.  To
J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
J> type "unsubscribe Declude.JunkMail".  You can E-mail
J> [EMAIL PROTECTED] for assistance.  You can visit our web
J> site at http://www.declude.com .
J> --
J> ActivatorMail(tm) ver.013002 Scanned for all viruses by 
J> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.013002 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re[4]: [Declude.JunkMail] Spam Review and Kill File

2002-01-30 Thread Roger Heath


Reply to: Tom Schwarz
  Re: [Declude.JunkMail] Spam Review and Kill File on Wednesday 6:56:42 PM


I always thought you must recycle the SMTP for any change
in Imail, rules.ima, kill.lst, etc. I think this may be
because some of these settings are held in memory for speed.
http://support.ipswitch.com/kb/IM-19990624-DM02.htm
shows the requirement for kill.lst


--
Roger Heath


- Copy of Original Message(s): -


T> I don't find in the IMail documentation that you have to recycle the SMTP
T> service.  Can you confirm this please?


--
ActivatorMail(tm) ver.012602 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re[2]: [Declude.JunkMail] Spam Review and Kill File

2002-01-30 Thread Roger Heath

Reply to: Chuck Schick
  Re: [Declude.JunkMail] Spam Review and Kill File on Wednesday 6:30:12 PM

Suppose you could have a setting that would allow you
to use a Declude blacklist rather than the kill.lst, seeing
how this might be more effective and this is dynamic, not
requiring a SMTP service recycle to be effective... Here
is how it would work.

1. click on 'Blacklist' Button
2. Up pops a dialog with the MAILFROM string
3. Edit the string to be used then click OK

In the settings you have a path and name to the
Blacklist file to be used. This could default to
c:\Imail\kill.lst  but could be edited to say,
c:\Imail\Declude\Blacklist.txt

Looking at how Scott commented today on the more effective
blacklist functions by Declude it might work better where
kill.lst may save processor use. The only other thing about
the Declude Blackilist is that it may require a 'description'?
I do not know if this is required. Like in manual:

[EMAIL PROTECTED] This guy was mailbombing us

--
Roger Heath

advanced internet desktop: www.activatordesk.com   
antivirus antispam email : www.activatormail.com
master internet index: www.infogrid.com

- Copy of Original Message(s): -

C> Tom:

C> I think a button option would be fine.  Here is my reasoning - many of the
C> from addresses are bogus anyway so I do not bother with putting many of them
C> on the kill.lst very often.  I have put from addresses on the kill list only
C> to see the spammer change  his from address within the hour.  I go through
C> 1000 messages on some days in the spam folder and if I had to hit another
C> confirmation button it would just slow me down.

C> Thanks for all the hard work.

C> Chuck Schick
C> Warp 8, Inc.
C> www.warp8.com
C> 303-421-5140


C> - Original Message -
C> From: "Tom Schwarz" <[EMAIL PROTECTED]>
C> To: <[EMAIL PROTECTED]>
C> Sent: Wednesday, January 30, 2002 5:15 PM
C> Subject: [Declude.JunkMail] Spam Review and Kill File


C> : Let's talk about the IMail "kill.lst" file for just a minute.
C> :
C> : Some of you suggested that you wanted to add "from" email addresses to the
C> : "kill.lst" file from SpamReview.  I like this idea and am working on it.
C> :
C> : My question is...
C> :
C> : How do you want it to work?
C> :
C> : Do you want a button to do it?
C> :
C> : Do you want an option in Settings for adding it whenever you click on
C> "Move
C> : To Deleted"?
C> :
C> : Other?
C> :
C> : Tom
C> :
C> : ---
C> : [This E-mail was scanned for viruses by Declude Virus
C> (http://www.declude.com)]
C> :
C> : ---
C> :
C> : This E-mail came from the Declude.JunkMail mailing list.  To
C> : unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
C> : type "unsubscribe Declude.JunkMail".  You can E-mail
C> : [EMAIL PROTECTED] for assistance.  You can visit our web
C> : site at http://www.declude.com .
C> :

C> ---
C> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

C> ---

C> This E-mail came from the Declude.JunkMail mailing list.  To
C> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
C> type "unsubscribe Declude.JunkMail".  You can E-mail
C> [EMAIL PROTECTED] for assistance.  You can visit our web
C> site at http://www.declude.com .
C> --
C> ActivatorMail(tm) ver.012602 Scanned for all viruses by 
C> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.012602 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.JunkMail] Spam Review and Kill File

2002-01-30 Thread Roger Heath

Reply to: Tom Schwarz
  Re: [Declude.JunkMail] Spam Review and Kill File on Wednesday 6:15:27 PM

A button would be great. The problem as I see it is
making sure it was the real SMTP %MailFrom% variable.
I use:

XINHEADER   X-Note: SMTP Real-From: %MAILFROM%

But maybe the best way for you to do this is take into
consideration the 'D' file that is being viewed than take
the value rom the 'Q' file of the same name, e.g. line
with : S<[EMAIL PROTECTED]> Sometimes you could,
I suppose, make it for the whole address or a whole domain..
or simply popup a dialog so the string could be edited
before saving to kill.lst.

--
Roger Heath

- Copy of Original Message(s): -

T> Let's talk about the IMail "kill.lst" file for just a minute.

T> Some of you suggested that you wanted to add "from" email addresses to the
T> "kill.lst" file from SpamReview.  I like this idea and am working on it.

T> My question is...

T> How do you want it to work?

T> Do you want a button to do it?

T> Do you want an option in Settings for adding it whenever you click on "Move
T> To Deleted"?

T> Other?

T> Tom

T> ---
T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

T> ---

T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  You can E-mail
T> [EMAIL PROTECTED] for assistance.  You can visit our web
T> site at http://www.declude.com .
T> --
T> ActivatorMail(tm) ver.012602 Scanned for all viruses by 
T> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.012602 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re[5]: [Declude.JunkMail] Declude v1.35 released

2002-01-30 Thread Roger Heath

Reply to: R. Scott Perry
  Re: [Declude.JunkMail] Declude v1.35 released on Wednesday 12:35:49 PM

Thanks, I keep forgetting this.

--
Roger Heath

- Copy of Original Message(s): -
R> If this is in the $default$.JunkMail file, are you seeing any warning
R> headers, and if so, what shows up in them?
R> -Scott

--
ActivatorMail(tm) ver.012602 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re[4]: [Declude.JunkMail] Declude v1.35 released

2002-01-30 Thread Roger Heath

Reply to: R. Scott Perry
  Re: [Declude.JunkMail] Declude v1.35 released on Wednesday 12:25:37 PM

Hmmm. I updated my Global.Cfg and I think there is a bug.
I still don't have weight notices in my headers. I have:

WEIGHT10HOLD
WEIGHT20HOLD
WEIGHT25HOLD
WEIGHT30HOLD

WEIGHT10WARNX-RBL-Warning: %TESTSFAILED%.
WEIGHT20WARNX-RBL-Warning: %TESTSFAILED%.
WEIGHT25WARNX-RBL-Warning: %TESTSFAILED%.
WEIGHT30WARNX-RBL-Warning: %TESTSFAILED%.

I know I have 1.35a verified via -diag.

--
Roger Heath

- Copy of Original Message(s): -


>>I am running Declude JunkMail 1.35.. Installed it yesterday... need to get
>>the 1.35a :)

R> You can type "Declude -diag" from a command prompt; the first line will 
R> display the version number, to make sure that you actually have 1.35.

>>and here is what i have typed
>>
>>WEIGHT10WARNX-RBL-Warning: This E-mail failed the following
>>tests: %TESTSFAILED%.

R> That does look correct; my guess is that you actually have 1.34.
R> -Scott

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---

R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  You can E-mail
R> [EMAIL PROTECTED] for assistance.  You can visit our web
R> site at http://www.declude.com .
R> --
R> ActivatorMail(tm) ver.012602 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.012602 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re[2]: [Declude.JunkMail] Declude v1.35 released

2002-01-30 Thread Roger Heath

Reply to: R. Scott Perry
  Re: [Declude.JunkMail] Declude v1.35 released on Wednesday 10:41:02 AM

WEIGHT10HOLDX-RBL-Warning: %TESTSFAILED%.

We've never seen the WEIGHT10 appear in the header, only
WEIGHT20, etc. I just realized these are all HOLD, so I
guess I need duplicate tests with WARN? It looks like my
error in retrospect...

--
Roger Heath

- Copy of Original Message(s): -


>>I have already observed that this does not appear when
>>used in XINHEADER. I keep getting weights but no testsfailed..
>>It is blank every time.

R> I've just tested it here, and it is working.

R> Could you show me the exact line from your \IMail\Declude\global.cfg file?
R> -Scott

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---

R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  You can E-mail
R> [EMAIL PROTECTED] for assistance.  You can visit our web
R> site at http://www.declude.com .
R> --
R> ActivatorMail(tm) ver.012602 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.012602 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re[2]: [Declude.JunkMail] Spam Review Question

2002-01-30 Thread Roger Heath

Reply to: Bennie
  Re: [Declude.JunkMail] Spam Review Question on Wednesday 10:03:36 AM

Global.Cfg

I add:

XINHEADER   X-Note: RDNS Real-Origin: %REVDNS% [%REMOTEIP%]
XINHEADER   X-Note: SMTP Real-From: %MAILFROM%
XINHEADER   X-Note: SMTP Real-To: (%NRECIPS%) %ALLRECIPS%


--
Roger Heath

- Copy of Original Message(s): -

B> Roger.

B> Where do you ad this line?

B> Bennie

>> 
>> This line gives me the 'real' sender and I'd love to kill.lst
>> some of these if they are clearly doing only spamming...:
>> 
>> XINHEADER   X-Note: SMTP Real-From: %MAILFROM%
>> 
>> I do not see an immediate need to notify senders of bad mail.
>> 
>> --
>> Roger Heath
>> 



B> ---
B> [This E-mail scanned for viruses by Declude Virus]

B> ---
B> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

B> ---

B> This E-mail came from the Declude.JunkMail mailing list.  To
B> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
B> type "unsubscribe Declude.JunkMail".  You can E-mail
B> [EMAIL PROTECTED] for assistance.  You can visit our web
B> site at http://www.declude.com .
B> --
B> ActivatorMail(tm) ver.012602 Scanned for all viruses by 
B> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.012602 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.JunkMail] Spam Review Question

2002-01-30 Thread Roger Heath

Reply to: Tom Schwarz
  Re: [Declude.JunkMail] Spam Review Question on Wednesday 9:38:23 AM

Actually, the next most useful feature for me would
be to take the real sender and add-to-kill.lst function.
Then if you consistently see an abuser, you just add his
address to Imails kill file... This also ultimately reduces
server load as well, as mail is simply rejected rather than
processed...

This line gives me the 'real' sender and I'd love to kill.lst
some of these if they are clearly doing only spamming...:

XINHEADER   X-Note: SMTP Real-From: %MAILFROM%

I do not see an immediate need to notify senders of bad mail.

--
Roger Heath

- Copy of Original Message(s): -

T> On some of the email I review I would like to click a button and send an
T> email back to the sender, based on a template, letting them know that they
T> have a problem.  It could include all the warnings.  Is this a feature that
T> others would use if it was available?

T> Tom

T> ---
T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

T> ---

T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  You can E-mail
T> [EMAIL PROTECTED] for assistance.  You can visit our web
T> site at http://www.declude.com .
T> --
T> ActivatorMail(tm) ver.012602 Scanned for all viruses by 
T> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.012602 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re[2]: [Declude.JunkMail] Spamreview Update v1.0.4

2002-01-30 Thread Roger Heath

Reply to: Tom Schwarz
  Re: [Declude.JunkMail] Spamreview Update  v1.0.4 on Wednesday 9:19:03 AM

I quite agree with Andy. Let no good deed go unrewarded. 
This utility is very very good for QC on spam filtering
and saves tons of time.

--
Roger Heath

- Copy of Original Message(s): -

T> Thanks Andy.  It's always good to hear a good word.

T> I make a living writing software but this project is different.  May I
T> suggest, if you feel guilty, you make your payment in the form of a donation
T> to a good cause in either time or money.

T> Have a great day, Tom



T> -Original Message-
T> From: [EMAIL PROTECTED]
T> [mailto:[EMAIL PROTECTED]]On Behalf Of andyb@thumpernet
T> Sent: Wednesday, January 30, 2002 9:14 AM
T> To: Tom Schwarz
T> Subject: Re: [Declude.JunkMail] Spamreview Update v1.0.4


T> Hi,

T> This little program has saved me so much time over the past few
T> days...what used to take an hours now takes minutes...reviewed all the
T> spam being held in about 3 minutes this morning...

T> This worth paying for.

T> Thanks,
T> Andy Baldwin

T> [EMAIL PROTECTED]
T> http://www.thumpernet.com
T> 315-282-0020

T> Wednesday, January 30, 2002, 8:58:24 AM, you wrote:

TS>> Several New features and fixes.

TS>> If you have previously installed all you need is the exe.

TS>> http://www.slsoft.com/spamreview.htm

TS>> (We are getting rain and ice so if you cannot get to the site the power
TS>> lines may be down.)

TS>> ---
TS>> [This E-mail was scanned for viruses by Declude Virus
T> (http://www.declude.com)]

TS>> ---

TS>> This E-mail came from the Declude.JunkMail mailing list.  To
TS>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
TS>> type "unsubscribe Declude.JunkMail".  You can E-mail
TS>> [EMAIL PROTECTED] for assistance.  You can visit our web
TS>> site at http://www.declude.com .

T> ---
T> [This E-mail was scanned for viruses by Declude Virus
T> (http://www.declude.com)]

T> ---

T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  You can E-mail
T> [EMAIL PROTECTED] for assistance.  You can visit our web
T> site at http://www.declude.com .

T> ---
T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

T> ---

T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  You can E-mail
T> [EMAIL PROTECTED] for assistance.  You can visit our web
T> site at http://www.declude.com .
T> --
T> ActivatorMail(tm) ver.012602 Scanned for all viruses by 
T> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.012602 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re[2]: [Declude.JunkMail] Spam Review Program

2002-01-27 Thread Roger Heath

Reply to: Tom Schwarz
  Re: [Declude.JunkMail] Spam Review Program on Sunday 4:00:21 PM

This is super Tom. You are really saving me one heck
of a lot of time. It looks nicer all the time. I like
the switch from text to html display. Since you are
adding features, figured I'd list a few:

Keyboard hooks:
1. Delete key for Move to Delete in addition to button.
2. Insert key to Return to Que in addition to button.
3. F5 to Refresh key in addition to button.

Still not displaying Weight here. If you tell me what it
is looking for, maybe I can change my header to be
recognized?

--
Roger Heath

- Copy of Original Message(s): -

T> Dan,

T> v1.0.1 is now available on the web.

T> v1.0.1 allows you to shut off the delete confirmation (look in settings).

T> v1.0.1 shows the subject.

T> Great idea on the Hold button.  Will look into this.

T> I know I need to work on the sort.  I would like to let you sort it multiple
T> ways.

T> If you resize the form, the message body will resize but resizing all the
T> windows is more difficult so that will have to wait for a future version.
T> Great idea though.  I will add it to the list.

T> Keep the great ideas coming.

T> Thanks, Tom


T> -Original Message-
T> From: [EMAIL PROTECTED]
T> [mailto:[EMAIL PROTECTED]]On Behalf Of Dan Spangenberg
T> Sent: Sunday, January 27, 2002 11:35 AM
T> To: [EMAIL PROTECTED]
T> Subject: RE: [Declude.JunkMail] Spam Review Program


T> Great program?
T> Are you ready for some feedback and a few ideas/suggestions?

T> I would like a way to shut off the delete confirmation.
T> It would be nice to be able to resize the windows. I like to see the subject
T> line and it is always down a ways so you have to scroll to see it.

T> A button to move to a "hold" directory in addition to the "move to que" and
T> "delete" buttons could be useful.

T> Also what is the sort order meant to be?  Mine doesn't appear to have much
T> of a sort order.  By date might be good.

T> This is a really a great utility and works very well.

T> Thanks
T> Dan

T> ---
T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

T> ---

T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  You can E-mail
T> [EMAIL PROTECTED] for assistance.  You can visit our web
T> site at http://www.declude.com .
T> --
T> ActivatorMail(tm) ver.012602 Scanned for all viruses by 
T> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.012602 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re[2]: [Declude.JunkMail] Spam Review Program

2002-01-26 Thread Roger Heath

Reply to: Tom Schwarz
  Re: [Declude.JunkMail] Spam Review Program on Saturday 6:43:32 PM

We have never seen the default message when a weight of 10
occurs. We have seen it when greater than 20 occurs. I thought
perhaps you are using a specific format with perhaps a undocumented
variable like %TOTALWEIGHT% or something like that.

I do not see anything in the latest manuals or cfg files.

--
Roger Heath

- Copy of Original Message(s): -

T> Roger,

T> If you have upgraded Declude Junkmail recently you can find out how to use
T> this new feature in their online manual.

T> If you download their new config files I think, by default, this message
T> will appear.

T> Tom


T> -Original Message-
T> From: [EMAIL PROTECTED]
T> [mailto:[EMAIL PROTECTED]]On Behalf Of Roger Heath
T> Sent: Saturday, January 26, 2002 6:17 PM
T> To: Tom Schwarz
T> Subject: Re: [Declude.JunkMail] Spam Review Program


T> Reply to: Tom Schwarz
T>   Re: [Declude.JunkMail] Spam Review Program on Saturday 10:28:46 AM

T> Tom, I am really enjoying the speed of your app.

T> You web page mentions that you place a weight message
T> in your headers using Declude but does not show how this
T> is done. Can you show this here? I'd like to get this working...

T> Thanks again,

T> --
T> Roger Heath

T> - Copy of Original Message(s): -

T>> I have received several replies.  If it's ok with Declude, I will post
T> the
T>> download address on this list.  If someone from Declude would reply to me
T> I
T>> would appreciate it.

T>> This program will be Freeware (I hate spam) and will only be supported to
T>> the extent that I have time to support it (I have a real job).  I will be
T>> using it on a daily basis so I will be adding features and fixing bugs
T> when
T>> needed.  I will provide the source code to those that want it.  Test it
T>> carefully yourself.  I will not be responsible for problems that may
T> occur.


T>> Program Notes:

T>> This program is written in VB6.0.  You give it the path to your IMail
T> spool
T>> folder and it locates the spam email that is in hold by looking in the
T> spam
T>> folder under the spool folder.  ex.  "c:\imail\spool\spam".

T>> A list of all the files in the spam hold folder come up in a list box.
T> It
T>> includes the name of the file, date, from address, to address.

T>> Selecting an email in the list displays information in three boxes.  The
T>> header, the declude warnings, and the body of the message.  You can click
T> on
T>> View HTML and view the body in a browser format.

T>> You can click on "Move To Deleted" and the selected email is moved to a
T>> deleted folder under the spam folder.  The selected email is removed from
T>> the spam hold folder.

T>> You can click on "Return To Que" and the email will be moved back to the
T>> spool folder.  The selected email is removed from the spam hold folder.

T>> A Refresh button let's you refresh the list.

T>> Tom

T>> ---
T>> [This E-mail was scanned for viruses by Declude Virus
T> (http://www.declude.com)]

T>> ---

T>> This E-mail came from the Declude.JunkMail mailing list.  To
T>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T>> type "unsubscribe Declude.JunkMail".  You can E-mail
T>> [EMAIL PROTECTED] for assistance.  You can visit our web
T>> site at http://www.declude.com .
T>> --
T>> ActivatorMail(tm) ver.012302 Scanned for all viruses by
T>> www.activatormail.com intelligent anti-virus anti-spam service

T> --
T> ActivatorMail(tm) ver.012302 Scanned for all viruses by
T> www.activatormail.com intelligent anti-virus anti-spam service

T> ---
T> [This E-mail was scanned for viruses by Declude Virus
T> (http://www.declude.com)]

T> ---

T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  You can E-mail
T> [EMAIL PROTECTED] for assistance.  You can visit our web
T> site at http://www.declude.com .

T> ---
T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

T> ---

T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  You can E-mail
T> [EMAIL PROTECTED] for assistance.  You can visit our web
T> site at http://www.declude.com .
T> --
T> ActivatorMail(tm) ver.012302 Scanned for all viruses by 
T> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.012302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.JunkMail] Spam Review Program

2002-01-26 Thread Roger Heath

Reply to: Tom Schwarz
  Re: [Declude.JunkMail] Spam Review Program on Saturday 10:28:46 AM

Tom, I am really enjoying the speed of your app.

You web page mentions that you place a weight message
in your headers using Declude but does not show how this
is done. Can you show this here? I'd like to get this working...

Thanks again,

--
Roger Heath

- Copy of Original Message(s): -

T> I have received several replies.  If it's ok with Declude, I will post the
T> download address on this list.  If someone from Declude would reply to me I
T> would appreciate it.

T> This program will be Freeware (I hate spam) and will only be supported to
T> the extent that I have time to support it (I have a real job).  I will be
T> using it on a daily basis so I will be adding features and fixing bugs when
T> needed.  I will provide the source code to those that want it.  Test it
T> carefully yourself.  I will not be responsible for problems that may occur.


T> Program Notes:

T> This program is written in VB6.0.  You give it the path to your IMail spool
T> folder and it locates the spam email that is in hold by looking in the spam
T> folder under the spool folder.  ex.  "c:\imail\spool\spam".

T> A list of all the files in the spam hold folder come up in a list box.  It
T> includes the name of the file, date, from address, to address.

T> Selecting an email in the list displays information in three boxes.  The
T> header, the declude warnings, and the body of the message.  You can click on
T> View HTML and view the body in a browser format.

T> You can click on "Move To Deleted" and the selected email is moved to a
T> deleted folder under the spam folder.  The selected email is removed from
T> the spam hold folder.

T> You can click on "Return To Que" and the email will be moved back to the
T> spool folder.  The selected email is removed from the spam hold folder.

T> A Refresh button let's you refresh the list.

T> Tom

T> ---
T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

T> ---

T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  You can E-mail
T> [EMAIL PROTECTED] for assistance.  You can visit our web
T> site at http://www.declude.com .
T> --
T> ActivatorMail(tm) ver.012302 Scanned for all viruses by 
T> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.012302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re[2]: [Declude.JunkMail] Spam Review Software

2002-01-26 Thread Roger Heath

Reply to: Tom Schwarz
  Re: [Declude.JunkMail] Spam Review Software on Saturday 1:28:47 PM

Thanks, Tom. It is working nicely here. It is much faster
as once you delete and confirm the focus is on the appropriate
button, so once it starts you can just keep hitting Enter
until you get to something you want to not delete. I hope
I get a lot of spam today. 

This is very useful.

--
Roger Heath

- Copy of Original Message(s): -

T> Either will work.

T> \\myserver\imail\spool

T> or

T> c:\imail\spool




T> -Original Message-
T> From: [EMAIL PROTECTED]
T> [mailto:[EMAIL PROTECTED]]On Behalf Of Jim Jones, Jr.
T> Sent: Saturday, January 26, 2002 1:25 PM
T> To: [EMAIL PROTECTED]
T> Subject: Re: [Declude.JunkMail] Spam Review Software


T> can i use a unc to get to the spooled files or does it have to be mapped?

T> thanks!!

T> Jim
T> - Original Message -
T> From: "Tom Schwarz" <[EMAIL PROTECTED]>
T> To: <[EMAIL PROTECTED]>
T> Sent: Saturday, January 26, 2002 12:48 PM
T> Subject: [Declude.JunkMail] Spam Review Software


>> Exactly 15 hours after I sat down at a computer to write a program to
T> review
>> spam email I have a first release.  I tell you this so you won't yell at
T> me
>> if you find a bug.  Feel free however to report bugs and suggest
>> enhancements.
>>
>> You can locate this software at http://www.slsoft.com/spamreview.htm.
>> Please read the page carefully before downloading.
>>
>> Tom
>>
>>
>>
>> ---
>> [This E-mail was scanned for viruses by Declude Virus
T> (http://www.declude.com)]
>>
>> ---
>>
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> type "unsubscribe Declude.JunkMail".  You can E-mail
>> [EMAIL PROTECTED] for assistance.  You can visit our web
>> site at http://www.declude.com .
>>

T> ---
T> [This E-mail was scanned for viruses by Declude Virus
T> (http://www.declude.com)]

T> ---

T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  You can E-mail
T> [EMAIL PROTECTED] for assistance.  You can visit our web
T> site at http://www.declude.com .

T> ---
T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

T> ---

T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  You can E-mail
T> [EMAIL PROTECTED] for assistance.  You can visit our web
T> site at http://www.declude.com .
T> --
T> ActivatorMail(tm) ver.012302 Scanned for all viruses by 
T> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.012302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.JunkMail] Spam Review Program

2002-01-26 Thread Roger Heath

Reply to: Tom Schwarz
  Re: [Declude.JunkMail] Spam Review Program on Saturday 10:28:46 AM

I appreciate this. It would prove useful if it works well.
I manage my files over a network, all but the drive is ok
in that path. I'd like a copy, but I am already wondering
if I can change the path. I do not have VB.

--
Roger Heath

- Copy of Original Message(s): -


T> This program is written in VB6.0.  You give it the path to your IMail spool
T> folder and it locates the spam email that is in hold by looking in the spam
T> folder under the spool folder.  ex.  "c:\imail\spool\spam".

--
ActivatorMail(tm) ver.012302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.JunkMail] Scanning for false positives

2002-01-24 Thread Roger Heath

Reply to: Chuck Schick
  Re: [Declude.JunkMail] Scanning for false positives on Thursday 9:42:24 AM

I just view the main 'D' messages with a text editor, To stop
having to load the smaller 'Q' you can add these settings to
your Global.Cfg to view what contents are in the 'Q' as these
reveal the real sender, receiver, etc.

XINHEADER   X-Note: QueInControl: %QUEUENAME% (%NRECIPS%)
XINHEADER   X-Note: RDNS Real Origin: %REVDNS%[%REMOTEIP%]
XINHEADER   X-Note: SMTP Real From: %MAILFROM%
XINHEADER   X-Note: SMTP Real To: %ALLRECIPS%

This at least speeds up determining the overall message
setting and requests.

--
Roger Heath

- Copy of Original Message(s): -

C> Has anyone come up with a good procedure on scanning the spam folder for
C> legitimate email.  We have just started holding the email that fails the
C> spamcop test and I want to check to be sure I am not catching legitimate
C> email.

C> Chuck Schick
C> Warp 8, Inc.
C> www.warp8.com
C> 303-421-5140

--
ActivatorMail(tm) ver.012302 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.JunkMail] Problems with SPAMCOP test in JunkMail standard

2002-01-14 Thread Roger Heath

Reply to: Michael Ernst
  Re: [Declude.JunkMail] Problems with SPAMCOP test in JunkMail standard on Monday 
2:33:57 PM

We make the WEIGHT10 and make SpamCop 9... then give
other test weights the ability to 'substantiate' SpamCop
or push the value to 10. We have all tests WARN except
WEIGHT10 which is HOLD. This enables us to view all
failed tests in captured email and see what combinations
of tests are working best and tweak them accordingly

We had similar results with SpamCop alone, but decided
to make that process 'verified' by other tests.

I am a little concerned, because if you read SpamCop's
web site, they are soon going to be charging for this
service on a per setup or per user basis. I hope this
is not expensive.

--
Roger Heath

- Copy of Original Message(s): -

M> Hi, I'm using the 1.31 Beta of JunkMail standard and having fairly good luck 
identifying spam with the WEIGHT tests.  I've been expecting to see some results from 
SPAMCOP as well, but have not
M> seen a single positive from SPAMCOP in the logs over a period of three weeks or 
more,

--
ActivatorMail(tm) ver.011402 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



  1   2   >