[389-12284720-012E] Re: [Declude.JunkMail] Missing Messages
Hello, Please be aware we are receiving copies of the messages below which appear to contain privacy data. You may wish to switch to direct emails. Regards, Mike Scush Inc. scush.com Think green - don't print! From: declude.junkmail@declude.com Sent: Wed, 26 Aug 2009 15:18:56 -0400 To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Missing Messages Scott, I received your message and I will be calling you shortly to have a look at your server. Thanks. - Original Message - From: Scott Fosseen [Prairie Lakes AEA] sfoss...@aea8.k12.ia.us To: decludejunkmail declude.junkmail@declude.com Sent: Wednesday, August 26, 2009 1:39 PM Subject: [Declude.JunkMail] Missing Messages I am running SmarterMail 5 with declude. My mail server has been a little odd for the last few days. I have people complaining about not getting mail, but yet some mail is getting through. One particular problem. I can send an email from outside the problem mail server. I see the message in the SMTP log file, but it never shows in the Virus or Junkmail log. I don't seem to have any folders that are growing in size, I just don't see where the message went, or why it was not processed by Declude. I am running a tail on the log files, and there are messages going through just fine as well. _ This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Your are asked to notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Prairie Lakes Area Education Agency. Prairie Lakes Area Education Agency accepts no liability for any damage caused by any virus transmitted by this email. - _ Scott Fosseen - Systems Engineer - Prairie Lakes AEA - http://www.aea8.k12.ia.us/tech _ Upper Case: The luggage on the top of the pile. Caps Lock: A fastening to keep your hat on your head. Keyboard: The row of hooks where you keep your keys. Space Bar: A sleazy joint where Martians like to hang out. _ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] re: [384-0F3A4F35-96D8] You do not have permission to post to the declude.junkmail@declude.com list
Thank you for submitting a ticket to support. Your ticket number is [384-0F3A4F35-96D8]. Please keep this ticket number for your records and include it in the subject (including brackets) of all future emails regarding this issue. The response time during business hours is usually within 24 hours, if you have had no response in this time please do not hesitate to call our support number 1-866-332-5833Thank You. Declude Technical Support view this ticket online --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] re: [0AC-0F2F1668-54D5] You do not have permission to post to the declude.junkmail@declude.com list
Thank you for submitting a ticket to support. Your ticket number is [0AC-0F2F1668-54D5]. Please keep this ticket number for your records and include it in the subject (including brackets) of all future emails regarding this issue. The response time during business hours is usually within 24 hours, if you have had no response in this time please do not hesitate to call our support number 1-866-332-5833Thank You. Declude Technical Support view this ticket online --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] re: [1A6-0F2F1667-8C86] You do not have permission to post to the declude.junkmail@declude.com list
Thank you for submitting a ticket to support. Your ticket number is [1A6-0F2F1667-8C86]. Please keep this ticket number for your records and include it in the subject (including brackets) of all future emails regarding this issue. The response time during business hours is usually within 24 hours, if you have had no response in this time please do not hesitate to call our support number 1-866-332-5833Thank You. Declude Technical Support view this ticket online --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] re: [32D-0F2E28E3-D4C1] You do not have permission to post to the declude.junkmail@declude.com list
Thank you for submitting a ticket to support. Your ticket number is [32D-0F2E28E3-D4C1]. Please keep this ticket number for your records and include it in the subject (including brackets) of all future emails regarding this issue. The response time during business hours is usually within 24 hours, if you have had no response in this time please do not hesitate to call our support number 1-866-332-5833Thank You. Declude Technical Support view this ticket online --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] re: [244-0F1D628C-258E] You do not have permission to post to the declude.junkmail@declude.com list
Thank you for submitting a ticket to support. Your ticket number is [244-0F1D628C-258E]. Please keep this ticket number for your records and include it in the subject (including brackets) of all future emails regarding this issue. The response time during business hours is usually within 24 hours, if you have had no response in this time please do not hesitate to call our support number 1-866-332-5833Thank You. Declude Technical Support view this ticket online --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] re: [35B-0EDF437D-8B7F] You do not have permission to post to the declude.junkmail@declude.com list
Thank you for submitting a ticket to support. Your ticket number is [35B-0EDF437D-8B7F]. Please keep this ticket number for your records and include it in the subject (including brackets) of all future emails regarding this issue. The response time during business hours is usually within 24 hours, if you have had no response in this time please do not hesitate to call our support number 1-866-332-5833Thank You. Declude Technical Support view this ticket online --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] re: [1CD-0E690ED8-5E5B] You do not have permission to post to the declude.junkmail@declude.com list
Thank you for submitting a ticket to support. Your ticket number is [1CD-0E690ED8-5E5B]. Please keep this ticket number for your records and include it in the subject (including brackets) of all future emails regarding this issue. The response time during business hours is usually within 24 hours, if you have had no response in this time please do not hesitate to call our support number 1-866-332-5833Thank You. Declude Technical Support view this ticket online --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] re: [37A-0DF9A964-4718] You do not have permission to post to the declude.junkmail@declude.com list
Thank you for submitting a ticket to support. Your ticket number is [37A-0DF9A964-4718]. Please keep this ticket number for your records and include it in the subject (including brackets) of all future emails regarding this issue. The response time during business hours is usually within 24 hours, if you have had no response in this time please do not hesitate to call our support number 1-866-332-5833Thank You. Declude Technical Support view this ticket online --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] re: [052-0DA5FA77-DED9] You do not have permission to post to the declude.junkmail@declude.com list
Thank you for submitting a ticket to support. Your ticket number is [052-0DA5FA77-DED9]. Please keep this ticket number for your records and include it in the subject (including brackets) of all future emails regarding this issue. The response time during business hours is usually within 24 hours, if you have had no response in this time please do not hesitate to call our support number 1-866-332-5833Thank You. Declude Technical Support view this ticket online --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] re: [325-0CD4C030-CDA5] You do not have permission to post to the declude.junkmail@declude.com list
Thank you for submitting a ticket to support. Your ticket number is [325-0CD4C030-CDA5]. Please keep this ticket number for your records and include it in the subject (including brackets) of all future emails regarding this issue. The response time during business hours is usually within 24 hours, if you have had no response in this time please do not hesitate to call our support number 1-866-332-5833Thank You.Declude Technical Support ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
[Declude.JunkMail] re: [17B-0CC41FA9-5FDA] You do not have permission to post to the declude.junkmail@declude.com list
Thank you for submitting a ticket to support. Your ticket number is [17B-0CC41FA9-5FDA]. Please keep this ticket number for your records and include it in the subject (including brackets) of all future emails regarding this issue. The response time during business hours is usually within 24 hours, if you have had no response in this time please do not hesitate to call our support number 1-866-332-5833IMPORTANT NOTICEDeclude is migrating to a new CRM business solution which includes a new case management module. We will begin using this feature soon, the result of this action means that Declude will no longer accept and create support cases using the email address [EMAIL PROTECTED]You will need to login into your Declude account to submit a case. If you can not submit a case due to the option being "grayed out" this means that you do not have an active service agreement. Call customer care 866-332-5822 #3 to purchase or renew a service agreement. We understand that this will be awkward and/or unwanted, however our goal is to continue servicing our paying customers.Thank You.Declude Technical Support ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] Decludeproc abend
Try thinking in terms of a programming language and it will come to light. ;) Avolve Support Get High Speed Internet - Go Wireless ! http://www.avolvewireless.net -- Original Message -- From: Dave Beckstrom [EMAIL PROTECTED] Reply-To: Declude.JunkMail@declude.com Date: Thu, 22 Dec 2005 11:22:38 -0600 You guys see the problem here, right? We're all getting so damn old nobody can remember anything for certain LOL!!! -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Harvey Rench Sent: Thursday, December 22, 2005 10:42 AM To: Declude.JunkMail@declude.com; Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Decludeproc abend I remember it being a Novell Netware term. At 11:23 AM 12/22/2005, Don Brown wrote: I think so, too and I don't think it had anything to do with Microsoft, either. It was a common term around a mainframe shop. Wednesday, December 21, 2005, 4:09:03 PM, Darin Cox [EMAIL PROTECTED] wrote: DC DC DC I thought that went further back than that. I remember hearing DC it a lot from mainframe types prior to Windows 1.1early 80's... DC DC Darin. DC DC DC DC DC DC - Original Message - DC From: Nick Hayer DC DC To: Declude.JunkMail@declude.com DC DC Sent: Wednesday, December 21, 2005 4:51 PM DC DC Subject: Re: [Declude.JunkMail] Decludeproc abend DC DC John T (Lists) wrote: DC DC DC Is abend some kindof French word? DC AbnormalEnding. - circa 1985 - coined with the introduction of Microsoft products. DC -Nicko DC DC DC DC DC ;) DC DC DC DC DC JohnT DC DC eServices ForYou DC DC DC DC DC -OriginalMessage- DC From: [EMAIL PROTECTED] DC [mailto:[EMAIL PROTECTED] On Behalf Of GoranJovanovic DC Sent: Wednesday, December 21,2005 1:13PM DC To: Declude.JunkMail@declude.com DC Subject: [Declude.JunkMail] Decludeprocabend DC DC DC DC I have haddecludeproc 3.0.5.22 abend on me twice today. Is DC there anything I should bedoing to capture information about DC this? I have automatic restart enabled soit starts again but I DC am not super happy with it abending. DC DC DC DC Any hints on what (ifanything) I can/should be doing? DC DC DC DC DC GoranJovanovic DC DC OmegaNetwork Solutions DC Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Harvey Rench Senior Network Engineer Clayton Homes, Inc. 865-380-3000 Visit us at www.Clayton.net Confidentiality Notice This message and the accompanying documents may contain information that is privileged, confidential, or exempt from disclosure under applicable law. If the reader of this e-mail is not the intended recipient, you are hereby notified that you are strictly prohibited from reading, disseminating, distributing, or copying this communication. If you have received this e-mail in error, please notify the sender immediately and destroy the original transmission. Thank you. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus By Avolve.net] Sent via the WebMail system at avolve.net --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] does anyone punish email from these folks?
We block them also as of 12-20-05 Avolve Support Get High Speed Internet - Go Wireless ! http://www.avolvewireless.net -- Original Message -- From: Mike K @ NetDotCom [EMAIL PROTECTED] Reply-To: Declude.JunkMail@declude.com Date: Tue, 20 Dec 2005 11:02:46 -0500 We outright reject all their mail. We started by just holding and found lots of 'suspicious' activity like identical emails with different from domains, etc. Normal spam type stuff CC offers, grant money, etc. The we started blocked one /24, then they switched to other subnets so we blocked their entire IP space. No complaints from users. Mike - Original Message - From: Nick Hayer To: Declude.JunkMail@declude.com Sent: Tuesday, December 20, 2005 10:36 Subject: [Declude.JunkMail] does anyone punish email from these folks? I sure do get allot of spam from this ip space - are they legit and are lacking in their monitoring or ? Thanks - -Nick OrgName:WholeSale Internet OrgID: WHOLE-125 Address:1102 Grand Ave Suite 905 City: Kansas City StateProv: MO PostalCode: 64106 Country:US NetRange: 69.30.192.0 - 69.30.239.255 CIDR: 69.30.192.0/19, 69.30.224.0/20 NetName:WHOLESALEINTERNET -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.371 / Virus Database: 267.14.1/206 - Release Date: 12/16/2005 Sent via the WebMail system at avolve.net --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WAY OT: COVAD VOIP
We've been using Nuvio since April of this year and have not looked back. Have not experience the problems that we encountered with Commpartners.us or Vonage, the quality has been much better than expected. Vonage didn't work well over our wireless network for unknown reasons except for the way they play with mac addresses. We have the residential ata's in place and we use the nPBX versions of the service in the office over our wireless and it just flat out works great. Oh, well we can also resell it too, but so do a lot of people. It works great here. ;) Avolve Support Get High Speed Internet - Go Wireless ! http://www.avolvewireless.net -- Original Message -- From: Marc Catuogno [EMAIL PROTECTED] Reply-To: Declude.JunkMail@declude.com Date: Mon, 12 Dec 2005 12:35:21 -0500 I have been considering switching many of our office from POTS lines to COVAD voice over IP. Since this is such a diverse and well informed group, I was wonder if anyone has any experience with them or suggestions as to alternate VOIP providers. Off list replies are welcomed. Thanks - Marc --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus By Avolve.net] Sent via the WebMail system at avolve.net --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WAY OT: COVAD VOIP
You can do that with Nuvio, especially with the nPBX service. Main number somewhere else, extension phone in some other state. Voicemail, caller-id, 3-way calling, call transfer, call fowarding and much more. http://voip.avolve.net I'm practicing, can ya tell. No seriously it works great. Avolve Support Get High Speed Internet - Go Wireless ! http://www.avolvewireless.net -- Original Message -- From: Dave Beckstrom [EMAIL PROTECTED] Reply-To: Declude.JunkMail@declude.com Date: Tue, 13 Dec 2005 11:22:41 -0600 Hi Guys, I have a T-1 in my house and I work from a home office in Minnesota. I have a sales person in New Mexico. Ideally, I'd like a VOIP service where when someone called me they would get a message like press 1 for sales, press 2 for Dave. The idea being that it would route the call either to her or to me. We would need voicemail and caller ID too. Does Vonage provide these kinds of services and if not does anyone have another service they might recommend? I want to give callers the impression that we are a much larger company then we are. Thanks! -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Monday, December 12, 2005 5:57 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] WAY OT: COVAD VOIP I have been using Vonage at home and love it. I had tried Lingo before Vonage and HATED it, although I think most of the problems were due to the D-Link hardware that they supplied. I have had some experience with Linux based PBX systems and have found them to be much more cost effective than hardware PBXs. This along with VoIP really has the possibility of cutting quite a bit of cost around the office. Evans Martin --- EVANS MARTIN [EMAIL PROTECTED] HOSTING: http://www.martek.net PROGRAMMING: http://www.martekware.com iPlus Info Browser - IPB's IMail Migration Tool, password browser, reporting suite make IPlus Info Browser something no IMail administrator should be without. http://www.martek.net/Default.aspx?tabid=96 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Marc Catuogno Sent: Monday, December 12, 2005 11:35 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] WAY OT: COVAD VOIP I have been considering switching many of our office from POTS lines to COVAD voice over IP. Since this is such a diverse and well informed group, I was wonder if anyone has any experience with them or suggestions as to alternate VOIP providers. Off list replies are welcomed. Thanks - Marc --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus By Avolve.net] Sent via the WebMail system at avolve.net --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spoolfiles t's, d's, a's q's
How do you get T, D or even A files to process with Declude if they are in the Imail spool directory. For kicks I rename a T file to a 'q' file and made the corresponding D file a 'd' file and placed them in the proc directory and I think they got delivered. So one would think that all T files have to be a 'q' and all D files have to be a 'd' to get processed from the proc directory ? Sent via the WebMail system at avolve.net --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Keyword
Two options - check the headers of the message it should indicate the line (assuming the test is set to warn). If not you need log level high for it to show the line number in the logs. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Richard Farris To: Declude.JunkMail@declude.com Sent: Monday, November 28, 2005 8:11 PM Subject: [Declude.JunkMail] Keyword If you find your are holding mail because of a keyword, how do you find out which keyword it is? Richard FarrisEthixs Online1.270.247. Office1.800.548.3877 Tech Support"Crossroads to a Cleaner Internet
Re: [Declude.JunkMail] Declude 2.06 with Imail 8.21
Go back to 2.0.5 and change the time between retries and watch the overflow directory. Avolve Support Get High Speed Internet - Go Wireless ! http://www.avolvewireless.net -- Original Message -- From: Darrell \([EMAIL PROTECTED]) [EMAIL PROTECTED] Reply-To: Declude.JunkMail@declude.com Date: Mon, 12 Sep 2005 14:31:44 -0400 This is a known bug with 2.0.6. I wrote up some of my findings on this under 2.0.6 - see this post. http://www.mail-archive.com/declude.junkmail@declude.com/msg24938.html Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Spaminator writes: Greetings all, We're planning on upgrading to iMail 8.21 this week, and wanted to see if anyone know of any significant problems with this latest release and Declude 2.06+AV+FProt+Sniffer+invURIbl2.5. We're still affected by too many Declude processes that somehow get spawned, locking up mail processing (the server needs to be rebooted 2-3 times a week because way more than the max limit of 25 Declude processes run, causing mail processing to more or less stop and routing everything to the overflow folder). Thanks! --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus By Avolve.net] Sent via the WebMail system at avolve.net --- [This E-mail scanned for viruses by Declude Virus By Avolve.net] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude Fix/Update Above 2.0.6 ?
Any word on the fix to stop the errors that have been cropping up with 2.0.6 and beta .16 with the latest Imail versions ? Sent via the WebMail system at avolve.net --- [This E-mail scanned for viruses by Declude Virus By Avolve.net] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SpamCop blacklist Misdirected bounces
I just found out that our mail server has been blacklisted by spamcop, apparently for "Misdirected bounces" which seems to be nothing more than bouncing a message after first accepting it (I pasted Spamcop's explanation below). I'm running Imail v8.05 with declude v1.82, and I'm not sure how to fix this to Spamcop's satisfaction. Has anyone else had this issue before, and if so, what can be done to fix it? Thanks much, Tom Wright Problem: Misdirected bounces Description: When a mail server accepts a message and later decides that it can't deliver the message, it is required to send back a bounce email to the sender of the original message. These bounce emails are often misdirected. Solution: Upgrade and/or configure your mail server software so that this situation is never encountered. Configure your software to either reject messages during delivery or accept them permanently. Do not let your software make choices about delivery after it has accepted a message. If you must accept delivery before you know the status of a message, then file it internally - do not send, forward or bounce it outside your organization. The errant message can be placed in a special folder or routed to your postmaster
Re: [Declude.JunkMail] URI Blacklist External Program Beta Now Posted For Download
Fred, While invURIBL will catch a lot of SPAM - I still would recommend folks use Sniffer. The thing to keep in mind is that Sniffer triggers on many other aspects of SPAM other than URI data. Darrell Frederick Samarelli writes: It looks like it may be a redundant test to sniffer. Everything INV-URIBL catches so does SNIFFER. Fred - Original Message - From: Darrell ([EMAIL PROTECTED]) To: Declude.JunkMail@declude.com Sent: Monday, December 27, 2004 10:32 PM Subject: [Declude.JunkMail] URI Blacklist External Program Beta Now Posted For Download We have released a public beta of our URI lookup tool at http://www.invariantsystems.com/invuribl/default.htm. In addition, we have posted some stats on how effective the tool is on our system at http://www.invariantsystems.com/invuribl/stats.htm. For a more detailed description on the tool please see the below message or send me a note with any questions. Darrell - Original Message - From: Darrell ([EMAIL PROTECTED]) To: Declude.JunkMail@declude.com Sent: Wednesday, December 22, 2004 11:13 PM Subject: URI Blacklist External Program We have wrote an external application that extracts URI's from a message and checks them against a URI Blacklist. For those not familar with URI blacklists here is how the folks at surbl.org describe it. Surbl blacklists differ from most other RBLs in that they're used to detect spam based on message body URIs (usually web sites). Unlike most other RBLs, SURBLs are not used to block spam senders. Instead they allow you to block messages that have spam domains which occur in message bodies. We have been running this application in production for the last week against multi.surbl.org. We have also tested the application against several of the other SURBL lists with the same level of sucess. If you are interested in testing or running the software please join the following list [EMAIL PROTECTED] During the beta period this is where we will be communicating about the application. For some of the applications basic features and implementation requirements please see http://www.invariantsystems.com/invuribl/default.htm. We expect to release a beta version within the next couple days. If you would like any additional information prior to joining the list please let me know, Darrell --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude and Overflow Directory
Has anyone had any success with bumping that up? If so, what values seemed to work for you? I know the big concern is hitting the mystery heap limit. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Darin Cox writes: In IMail versions 8 and above the setting for Delivery Threads is in the Queue Manager. Default is 30. Darin. - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, December 15, 2004 7:19 AM Subject: Re: [Declude.JunkMail] Declude and Overflow Directory What is the max number of declude processes that will kick off if there are lots of Q*.SMD messages in the overflow directory? Is there an internal limit or is it based on some option? There is no limit, if you want to be technical. Specifically, Declude counts the total number of service-started processes (Declude.exe, SMTP32.exe, and a few others), as it is service-started processes that need to be counted. The number Declude looks for is by default 30, but is based on the IMail SMTP settings (or it may only be accessible via the registry? I cannot recall). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail/Declude queues backing up
I have just spent the last 24 hours slowly feeding messages back into the message queue after queue manager quit delivering. It has happened before, and I have seen posts on the Imail list discussing queue manager hanging. The real problem is, the service is running, it just isn't doing anything. Charles not that this solves your issue, but this happens to us about once a month or so. Usually just a restart fixes the issue. I suspect it could be a bad message that kills it internally. However, I have never been able to hunt that message down or get a break on what is causing the issue. Because of this issue I wrote a Windows service that not only monitors the imail queue it also monitors the declude overflow directory. You can setup different types of alerts (size and growth percentage) to notify you or run an external script when things exceed your thresholds. This has saved me many times. It's always better to get an alert when the queue has 1000 Q*.smd files backed up than 50K... If your interested in this app you can grab a copy of QueueMon from my link below. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] relays.visi.com down?
Does anyone know if relays.visi.com is officially down? I havent had a hit against it since early November. RSL - relays.visi.com Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] ed10.com - E-Dialog
Does anyone have any feedback on E-Dialog.com. It appears their are several reputable companies using them (NFL, Reuters, etc). Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WAY OT: Syslog entries from Cisco ACL question
Rick, My understanding is if the packet is rejected or allowed before the port information is needed for comparison Cisco IOS will log it as port 0. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Rick Davidson writes: Does anyone know what traffic uses a destination and source port of 0? Or what else I should look for? This is a Novell/windows network I have something odd going on at a large branch office so I added an acl to log the inbound and outbound traffic permit ip any any log permitted tcp 10.10.0.72(0) - 10.10.9.18(0), 1 packet permitted udp 10.10.0.98(0) - 10.10.9.10(0), 1 packet I have ALOT of lines with many source and destination addresses, the IPs are valid for the network Thanks for any help Rick Davidson National Systems Manager North American Title Group - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Service Agreements
Hello, I seem to recall that the license code is based on the fqdn of the mail server. Wouldn't that mean that an individual license would be required for each server it is installed on in order to function? I also think that the updates covered by the service agreement are for all products anyway since there is only one codebase for all products but individual config file for each product. That would mean that if you had just JM, the updates also includes the code for AV and HJ as well. FWIW Mike O'Brien Platinum Coast Internet Service --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Log file locking???
Matt, It's possible its a locking issue. What specifically is the error message it is returning? I ran into similar issue with a log rotating script I wrote to move logs around into WebTrends. I was trying to rotate a log file still being downloaded and it would cause an issue. When I would encounter the error I would sleep 30 seconds and try it again. on error resume next If ( Err 0 ) Then oShell.run cmd /c sleep.exe 30, 0 , true Err.Clear End If Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Matt writes: I'm wondering if someone familiar with the logging of IMail, Declude and Sniffer and scripting could enlighten me on an issue that I am having. I have a script that is run every hour on my server that takes the 4 logs generated by these processes, moves them to a temp folder on the same drive, and then appends the data to a log file for each day that is archived on another drive. The problem that I am having is that the script (written in VBScript) is failing part way into the process about once every day or two, or about 1 out of 40 times. It seems to always fail after creating the temp directory, or after moving the IMail log into the temp directory, which happens to be the first two steps (the third is to move the Declude JunkMail log). The only thing that I can think of is that the script is unable to move these files because they are being locked by the system as they are being updated. Both the IMail and JunkMail logs are seeing between 3MB and 15MB of data per hour depending on the time of day and the log. So if someone could confirm whether or not this could be some form of a locking issue that prevents a VBScript move (object.MoveFile), that would be appreciated. Also, if this is a locking issue, what would be the recommended work around for handling this? I'm not familiar with a method of retrying the move until successful within VBScript, though maybe there is a way to detect the error condition and loop until none is found, or a maximum number of tries has occurred. Thanks, Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Skipping test if weight exceeds x
Katie, SKIPIFWEIGHT only works in filter files and you will need the latest version of Declude to use this feature. From my experience DNS based tests and external tests are ran before the filter tests are ran. Most folks use the SKIPIFWEIGHT test to bypass CPU consuming filter files if the message already has reached a certain weight. To the best of my knowledge, Declude will always process all tests before it takes an action. So I don't there is a way to stop all processing if you have a hit on sniffer. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Katie LaSalle-Lowery writes: I have seen recent discussions of SKIPIFWEIGHT. The timing is perfect as I want to change my configuration to do just that--skip all further testing once the weight gets to 10. Do I interpret correctly that that is the purpose of SKIPIFWEIGHT? If I missed any instruction for how to make that change I apologize. I did look over the recent thread but see only discussion on how negative weights are treated. I also examined my manual for Declude Junkmail 1.65. What I want to achieve is for the Message Sniffer test to run first and with an assigned weight of 10. If Message Sniffer gets a match I want the message deleted without further scanning. I want to reduce our overhead due to scanning and logging. If the message passes Message Sniffer but then fails other tests I just want it deleted as soon as it reaches 10. So, how do I use SKIPIFWEIGHT and does Declude run the tests in the order they appear in the default junkmail config for each domain and/or user? Do I need to upgrade to a newer version to achieve my goal? Thanks, Katie LaSalle-Lowery Centric Internet Services 1410 Reserve St. Missoula, MT 59801 Local Phone 549-3337 ext. 21 Toll Free (888)593-2776 ext. 21 Fax (406)721-3438 http://www.centric.net --- [This E-mail scanned for viruses by CENTRIC INTERNET SERVICES] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is this the correct format?
Kris, The syntax would be 66.54.138.0/24 Description Of Why Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Kris McElroy writes: 66.54.138.* Description of why I want to list the whole class C /24, so is the above the correct syntax in an IPFILE? Thanks, Kris McElroy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Moving mail servers
Dean, The best thing to do is lower your TTL well ahead of time of the move. If you lower your TTL down to about 5 minutes on your records your cutover should not take that long for mail to cutover to your new IP. Also, make sure you get your PTR records added ahead of time. Also you have the option of adding the new ip address as a secondary MX so that when the first box goes offline it should start hitting it right away. Than all you have to do is update and remove the old MX. Just make sure you lower the TTL's for any A records as well for how folks access the machine. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Dean Lawrence writes: I am in the process of moving my Imail server to a different machine at a different hosting facility, hence a new IP. Does anyone have any suggestions for making this a smooth transition? I have moved Imail many times before, so I am not worried about the setup. What I am looking for is suggestions as to how to handle the lag time of routers picking up the new IP. I host mail for a number of my clients, so there may be a period of time where they cannot get to their mail. I would like to minimize this. I had thought about just turning off the old server once the DNS changes have been made so that no mail would be lost in translation, but I had also thought about converting it to a store and forward server so that the mail will get delivered to the new server quicker. What do you guys think? Thanks, Dean -- __ Dean Lawrence, CIO/Partner Internet Data Technology 888.GET.IDT1 ext. 701 * fax: 888.438.4381 http://www.idatatech.com/ Corporate Internet Development and Marketing Specialists --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ANN: SPAMC32 (SpamAssassin SPAMC for Declude) 0.5.57 released
Darin, If its an unsigned 4-byte wouldnt it be 4,294,967,295 tests? Darrell Darin Cox writes: This is the same idea I mentioned a year ago when we were all talking about combo tests in Decludeonly problem being if you use more unique tests than the numeric type supported. Assuming the weight/bitmask number is a 4-byte unsigned int, then we have a maximum of 32 tests. Darin. - Original Message - From: Matt To: [EMAIL PROTECTED] Sent: Friday, November 05, 2004 7:35 AM Subject: Re: [Declude.JunkMail] ANN: SPAMC32 (SpamAssassin SPAMC for Declude) 0.5.57 released If you don't mind me expanding on the bitmask ideaSniffer users would benefit from this greatly as many spams fail multiple Sniffer tests. This would allow us to score each result code that it returned, i.e. SNIFFER-GENERAL bitmask1C:\IMail\Declude\Sniffer\execode.exe mycode60 SNIFFER-EXPERIMENTALbitmask2C:\IMail\Declude\Sniffer\execode.exe mycode60 SNIFFER-OBFUSCATION bitmask4C:\IMail\Declude\Sniffer\execode.exe mycode60 SNIFFER-IP bitmask8C:\IMail\Declude\Sniffer\execode.exe mycode40 SNIFFER-CASINO bitmask16C:\IMail\Declude\Snifferexecode.exe mycode80 ... So if a test such as Sniffer returned a result code of 26, that would mean it hit SNIFFER-CASINO, SNIFFER-IP and SNIFFER-EXPERIMENTAL. That would be huge :) Matt Matt wrote: Yes, I would be interested in this very much since it would greatly ease the management, testing and reporting of such tests, and I have been working on something myself that would be capable of returning both positive and negative weights and I didn't want to be running it twice to get the separation in log lines. Something else that is a bit OT regarding external tests...I would be very interested in finding a way to run an external test once and return multiple result codes, that way if you for instance were testing different things that both required substantial code and extra I/O, you could make things much more efficient and also greatly simplify the management of your code. I understand of course that you could create a set of 4 result codes to represent the combination of two hits, but it quickly becomes unwieldy as it grows exponentially. Is there a way that you could return multiple result codes and have Declude fail multiple tests without running the test multiple times? I'm thinking that something like a bitmask returned and then interpreted by Declude to match zero to many tests. http://www.joestump.net/170933118/a-quick-bitmask-howto-for-programmers Note that if this was available, I would probably prefer this over weight+ and weight- for my own needs since I don't perceive being able to do both :) Thanks, Matt Markus Gufler wrote: Yet another update to SPAMC32 that's useful when deployed as a Declude 'weight' test type. See the release notes below and download from the traditional /release folder. As SpamChk is not anymore alone as external 'weight' test maybe also SPAMC32 users are interested in having 'weight+' and 'weight-' So it would be possible to confgure two config lines one for a positive the other for negative results. For example SPAMASSASSIN+ weight+ c:\imail\... SPAMASSASSIN- weight- c:\imail\... The benefits? 1.) It would become possible to use the results of weight tests for combination filters. Up to now it was not possible to assign extra points, for example if an IP4R-test and SPAMCHK has failed. As both tests are tecnicaly completely different the combination would be highly accurate. You can see this for example on http://www2.spamchk.com/public.html on the already existing COMBO-... tests. 2.) Creating reports would be much easier and more clear if weight tests can be separated like showed above. I've suggested this some months ago to Scott. Maybe now with some additional interested parties... Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log
Re: [Declude.JunkMail] LOG Levels
Mark, You will lose some functionality on log level MID. I am not exactly sure which reports you are currently running, but if you check out http://www.invariantsystems.com/dlanalyzer/support.htm it will let you know which log levels are required for each specific report. If you need any help let me know. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Mark E. Smith writes: I've always used LOGLEVEL HIGH on my systems but I'm reconsidering that these days since our logs are running 250mb - 350mb. I use a number of log reports (DLAnalyizer, etc) If I switch to LOGLEVEL MID will I lose anything in my log reporting utils? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] LOG Levels
Those are both great tools. My only complaint with BareTail is I get a lot of flicker under TS. However, their older wintail has no flicker... Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Darin Cox writes: Try BareTail and BareGrep instead, from http://www.baremetalsoft.com/ Great for monitoring logs in real-time as well. Darin. - Original Message - From: Mark E. Smith [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 04, 2004 3:55 PM Subject: RE: [Declude.JunkMail] LOG Levels We have 4 inbound equal MX servers each with 250-350 per day so we're about the same in net-net load. I started writing a log parsing program that will consolidate the logs and insert them into a central SQL database. That way I'll be able to do a query on a message and debug much easier. The problem right now is loading a 350mb (let alone 1.6GB) file with notepad. :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Glenn \ WCNet Sent: Thursday, November 04, 2004 3:24 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] LOG Levels My Declude logs at HIGH range between 1.2 and 1.6 GIGABYTES. The log for 11/3 is 1,701,795 KB. - Original Message - From: Mark E. Smith [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 04, 2004 9:03 AM Subject: [Declude.JunkMail] LOG Levels I've always used LOGLEVEL HIGH on my systems but I'm reconsidering that these days since our logs are running 250mb - 350mb. I use a number of log reports (DLAnalyizer, etc) If I switch to LOGLEVEL MID will I lose anything in my log reporting utils? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Earthlink Porn Spam
Thanks,,, H. - Original Message - From: Matt To: [EMAIL PROTECTED] Sent: Monday, November 01, 2004 3:46 PM Subject: Re: [Declude.JunkMail] Earthlink Porn Spam i360 Support wrote: I am still getting a ton of porn spam from Earthlink. I report it but it does not help much. Any suggestions on how to stop this crap? Attached is the filter that I use to kill this stuff. Last I checked, there were two different spammers that were cracking AUTH to get this stuff through, and their patterns don't seem to have changed, although they probably will and/or more will come.Matt-- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = # HACKEDEARTHLINK v1.1.0REVDNS END NOTCONTAINS .earthlink.netMAILFROM END CONTAINS earthlinkMAILFROM END CONTAINS mindspringREMOTEIP 2 CONTAINS .SUBJECT 10 CONTAINS =?windows-1251?b?HEADERS 15 CONTAINS User-Agent: aolTESTSFAILED 2 CONTAINS SNIFFER-TESTSFAILED 1 CONTAINS FOREIGNTESTSFAILED 1 CONTAINS BADHEADERSTESTSFAILED 2 CONTAINS (ALL)TESTSFAILED -2 CONTAINS (LAST)TESTSFAILED 2 CONTAINS SPAMCOP(ALL)TESTSFAILED 2 CONTAINS XBL(ALL)TESTSFAILED 1 CONTAINS DSBL(ALL)
RE: [Declude.JunkMail] Little confused by these headers
Well this is silly. I guess it's not really a forged header. I was scanning mails that were tagged as spam and passed on, and the original of this was going to a stepindustries.net account. Only this specific user is having that mail all forwarded to an AOL account. Within AOL, she's marking the mail as spam. Maybe it's finally time I start holding or blocking spam as opposed to just tagging it and passing it on. Haven't had a false-positive in over 2 weeks. smime.p7s Description: S/MIME cryptographic signature
Re: [Declude.JunkMail] Client TOS Notifications from AOL
Essentially someone received an email in their AOL acount and marked it as SPAM. Since you setup a feedback loop with AOL they will now send you every instance of an email that was reported as SPAM by one of their members. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Don Schreiner writes: Declude Folks, I need some help figuring out why we are receiving e-mails from [EMAIL PROTECTED] Subject Line: Client TOS Notification, and the Sent To address is [EMAIL PROTECTED] I am not sure if these are coming back to me in our abuse or postmaster account? There is nothing in the body of the e-mail, only an attachment of e-mail apparently getting rejected. Anyone else seeing these? The client we host forwards his e-mail automatically to his AOL account. For example, below is the header of an e-mail that was attached whereas a spam e-amail appears to have been sent to our client (lamphier.com) hosted on our IMail server (sneezy.xerocom.net - vacant.spiderhost.com is router) which was forwarded to his AOL account. Unfortunately it did not weight enough under our Declude config, nor Sniffer to get held as Spam. Any ideas what AOL is doing or what I should do to eliminate these most appreciated. Worried about getting on the wrong side of AOL. Thanks. -Don Return-Path: [EMAIL PROTECTED] Received: from rly-xa05.mx.aol.com (rly-xa05.mail.aol.com [172.20.64.41]) by air-xa03.mail.aol.com (v101_r1.4) with ESMTP id MAILINXA31-7341621d0d322; Tue, 05 Oct 2004 00:03:36 -0400 Received: from SNEEZY.XEROCOM.NET (vacant.spiderhost.com [65.57.241.197]) by rly-xa05.mx.aol.com (v101_r1.5) with ESMTP id MAILRELAYINXA55-7341621d0d322; Tue, 05 Oct 2004 00:03:25 -0400 Received: from SMTP32-FWD by lamphier.com (SMTP32) id A1BF42BA100B8F0C3; Mon, 4 Oct 2004 23:58:48 Received: from pelxavirus3.terra.com.pe [200.48.36.5] by SNEEZY.XEROCOM.NET with ESMTP (SMTPD32-8.12) id ABF42BA100B8; Mon, 04 Oct 2004 23:58:44 -0400 Received: from anamaria (unknown [200.106.79.108]) by pelxavirus3.terra.com.pe (Postfix) with ESMTP id 295EDB7CA4; Mon, 4 Oct 2004 23:07:07 -0500 (PET) Message-ID: [EMAIL PROTECTED] To: Undisclosed Recipients From: Anni [EMAIL PROTECTED] Subject: Proposal Date: Mon, 4 Oct 2004 23:03:21 -0500 MIME-Version: 1.0 Content-type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: HELOBOGUS: Domain pelxavirus3.terra.com.pe has no MX or A records [0301]. X-RBL-Warning: WEIGHT1-9: Total weight between 1 and 9. X-Declude-Sender: [EMAIL PROTECTED] [200.48.36.5] X-Declude-Spoolname: D1bf42ba100b8f0c3.SMD X-Note: CompBiz scanned with Declude JunkMail. X-Spam-Tests-Failed: NOABUSE, HELOBOGUS, WEIGHT1-9 [7]. X-Note: This E-mail was sent from smtp7.terra.com.pe ([200.48.36.5]). X-Sender: Sender of E-mail: [EMAIL PROTECTED] X-Note: RevDNS Remote Server smtp7.terra.com.pe ([200.48.36.5]). X-AOL-IP: 65.57.241.197 X-Mailer: Unknown (No Version) Dear Customer, =20 Be the very first listing in the top search engines immediately. =20 Our company will now place any business with a qualified website permanently= at the top of the major search engines guaranteed never to move. This prom= otion includes unlimited traffic and is not going to last long. If you are=20= interested in being guaranteed first position in the top search engines at a= promotional fee, please contact us promptly to find out if you qualify via=20= email at [EMAIL PROTECTED] AND INCLUDE THE URL(s) YOUR ARE INTERESTED I= N PLACING. This is not pay per click.=20 The following are examples on Yahoo!, MSN and Alta Vista: =20 Company: Oahu Dive Center URL: http://oahudivecenter.com keyword: oahu scuba diving =20 Company: California Moves.com URL: http://steph.cbsocal.com keyword: find a home southern california =20 Sincerely, =20 IGN The Search Engine Promotional Consultants --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Citibank - phishing- still live
PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, October 05, 2004 12:07 PM Subject: RE: [Declude.JunkMail] Citibank - phishing- still live Unfortunately spamdomains is a test that has a lot of false positives and there is not real solid list of spamdomains. Because of that we have to weight spamdomains low, so I could never say that users would not see such an email because of spam domains alone. On the other hand I can give a very high weight to urls contained in the body of an email and will have almost no false positives. Just my thoughts on the matter. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Tuesday, October 05, 2004 9:14 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Citibank - phishing- still live Whether I classify them as spam or not, I don't post every spam that I receive to this list. My point is that if you are blocking phish based on individual URLs I think you are not doing it in the most efficient way. Simply adding... @ameritrade.com.ameritrade.com @citi.com.citibank.com @citibank.com.citibank.com @ebay.com.ebay.com @fleet.com.fleet.com .gs.com @paypal.com .paypal.com @suntrust.com.suntrust.com @visa.com.visa.com @wellsfargo.com.wellsfargo.com to the text file which maps to my Spamdomains test keeps all of the phish away from my users since none of these messages every originate from the proper domains. Dan - Original Message - From: Bill Landry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, October 05, 2004 10:58 AM Subject: Re: [Declude.JunkMail] Citibank - phishing- still live Where else would you suggest they be posted, after all, phishing e-mail are spam in my book. However, with that said, more and more virus vendors are starting to add phishing e-mail recognition to their virus definitions. Both uvscan (NAI/McAfee) and the latest release candidates for ClamAV support phishing e-mail detection. Bill - Original Message - From: Dan Geiser [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, October 05, 2004 4:22 AM Subject: Re: [Declude.JunkMail] Citibank - phishing- still live Can I ask why you guys post these to the Declude JunkMail discussion list? It doesn't seem to have anything to do with the subject matter of this list. - Original Message - From: Kami Razvan mailto:[EMAIL PROTECTED] To: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] Sent: Tuesday, October 05, 2004 6:56 AM Subject: [Declude.JunkMail] Citibank - phishing- still live Hi; the following is another phishing attempt- the site still live. http://211.158.34.250/citifi/ http://211.158.34.250/citifi/ Regards, Kami Email Subject: [37~]Dear customer your details have been compromised MIME-Version: 1.0 (produced by annunciatemarginalia 8.2) Content-Type: multipart/alternative; boundary=--938071008627732911 X-RBL-Warning: IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command. X-RBL-Warning: NJABL-DYNA: Dynamic/Residential IP range listed by NJABL dynablock - http://njabl.org/dynablock.html http://njabl.org/dynablock.html X-RBL-Warning: NJABL-DUL: This E-mail came from 12.107.246.11, a potential spam source listed in NJABL-DUL. X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] X-RBL-Warning: SORBS-DUL: Dynamic IP Address See: http://www.dnsbl.sorbs.net/lookup.shtml?12.107.246.11 http://www.dnsbl.sorbs.net/lookup.shtml?12.107.246.11 X-RBL-Warning: IPLINKED: Message failed IPLINKED test (line 198, weight 13) X-Declude-Sender: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] [12.107.246.11] X-Declude-Spoolname: D26691b0502409fba.SMD X-Note: == X-Note: Spam Score: 37 [BLOCKED ON 20+ DELETED ON 40+] X-Note: Scan Time: 00:43:47 on 05 Oct 2004 X-Note: Spool File: D26691b0502409fba.SMD X-Note: Server Name: dialup-12-107-246-11.dtccom.net X-Note: SMTP Sender: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] X-Note: Reverse DNS IP: dialup-12-107-246-11.dtccom.net [12.107.246.11] X-Note: Country Chain: UNITED STATES-destination 938071008627732911 Content-Type: text/plain; charset=iso-2059-6 Content-Transfer-Encoding: quoted-printable Content-Description: nicholson salmonberry biblical Dear Customer: Recently there have been a large number of cyber attacks pointing our data= base servers. In order to safeguard your account, we require you to sign o= n immediately. This personal check is requested of you as a precautionary measure and to = ensure yourselves that everything is normal with your balance and personal= information. This process is mandatory, and if you did not sign on within the nearest t= ime your account may be subject to temporary
[Declude.JunkMail] annoying spammer
We have been swamped with spam from United Email Marketing.Below is a list of IP addresses and domains used to send the crap.Sniffer does not catch them and I can't stop them.Does anyone have a solution on how to get rid of them?207.43.11.191207.43.11.192207.43.12.187205.241.69.176205.241.69.175205.241.71.182205.241.72.177205.241.73.187205.241.73.168205.241.68.178205.241.75.170205.241.75.176207.43.11.191207.43.11.192207.43.9.183207.43.8.192207.43.6.175207.43.4.186205.241.76.183205.241.77.182205.241.77.172205.241.81.186205.241.82.184204.95.128.193204.95.129.174uniecommerce.com=20unpitch.comunpromotion.comunplugging.netunmtransactor.comunmpr.comunmplugger.comunnotice.com=20unmmarketer.comunitrucking.comunipurchaser.comuniebuying.comuntrucking.comuntrucker.comuntrafficker.com=20unseller.comuemrbuying.com=20uemrcommerce.comuemrenterprise.comumrmailclient.comumrexchanger.com- Original Message -=20From: Mortgage Connectors=20To: [EMAIL PROTECTED]Sent: Monday, October 04, 2004 3:12 AMSubject: SPAM: Make the Lenders Compete Over You=20Your energies are just mismatched these days. You will gain confidence =in your abilities if you say no to those wanting you to do for them =instead of for yourself. Your energies are just mismatched these days. =Who knew that romance could be so fun? Buy flowers. Write poetry. Order =dessert.You will attract a potential partner. Play your cards right. The big =picture is as crucial as the small one. Consult an expert for help. =Nothing will be as it appears. Be careful.=20Your creative talent must be implemented in your work if you want to =reach a higher level. What you get now is what you wanted all along. =Your energies are just mismatched these days. You will attract a =potential partner. Play your cards right.You find pleasure wherever you look -- and maybe in a few surprising =places as well. You are in a very industrious and creative cycle that =will bring you profits and satisfaction. Avoid opposition for a little =while. As the song says Later on you can decide whether this is the =beginning of a permanent change.aGVpbWlyQHRyb2xsd2ViLmNvbQ=3D=3D=20=2010.1.1.241826112252 --=_NextPart_000_06EA_01C4A99D.138B9190Content-Type: text/html;charset="iso-8859-1"Content-Transfer-Encoding: quoted-printable!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"HTMLHEADMETA http-equiv=3DContent-Type content=3D"text/html; =charset=3Diso-8859-1"META content=3D"MSHTML 6.00.2900.2180" name=3DGENERATORSTYLE/STYLE/HEADBODY bgColor=3D#ffDIVFONT face=3DArial size=3D2We have been swamped with spam from =United Email=20Marketing./FONT/DIVDIVFONT face=3DArial size=3D2Below is a list of IP addresses and =domains used to=20send the crap./FONT/DIVDIVFONT face=3DArial size=3D2/FONTnbsp;/DIVDIVFONT face=3DArial size=3D2Sniffer does not catch them and I can't =stop=20them./FONT/DIVDIVFONT face=3DArial size=3D2/FONTnbsp;/DIVDIVFONT face=3DArial size=3D2Does anyone have a solution on how to =get rid of=20them?/FONT/DIVDIVFONT face=3DArial size=3D2/FONTnbsp;/DIVDIVFONT face=3DArial size=3D2/FONTnbsp;/DIVDIVFONT face=3DArial size=3D2/FONTnbsp;/DIVDIVFONT face=3DArial=20size=3D2207.43.11.191BR207.43.11.192BR207.43.12.187BR205.241.69.17=6BR205.241.69.175BR205.241.71.182BR205.241.72.177BR205.241.73.187=BR205.241.73.168BR205.241.68.178BR205.241.75.170BR205.241.75.176=BR207.43.11.191BR207.43.11.192BR207.43.9.183BR207.43.8.192BR207.=43.6.175BR207.43.4.186BR205.241.76.183BR205.241.77.182BR205.241.7=7.172BR205.241.81.186BR205.241.82.184BR204.95.128.193BR204.95.129=.174/FONT/DIVDIVnbsp;/DIVDIVFONT face=3DArial size=3D2/FONTnbsp;/DIVDIVnbsp;/DIVDIVFONT face=3DArial size=3D2uniecommerce.com=20BRunpitch.comBRunpromotion.comBRunplugging.netBRunmtransactor.com=BRunmpr.comBRunmplugger.comBRunnotice.com=20BRunmmarketer.comBRunitrucking.comBRunipurchaser.comBRuniebuying.=comBRuntrucking.comBRuntrucker.comBRuntrafficker.com=20BRunseller.comBRuemrbuying.com=20BRuemrcommerce.comBRuemrenterprise.comBRumrmailclient.comBRumrexc=hanger.com/FONT/DIVDIVFONT face=3DArial size=3D2/FONTnbsp;/DIVDIVnbsp;/DIVDIV style=3D"FONT: 10pt arial"- Original Message -=20DIV style=3D"BACKGROUND: #e4e4e4; font-color: black"BFrom:/B A=20[EMAIL PROTECTED]href="">mailto:[EMAIL PROTECTED]"Mortgage Connectors/A =/DIVDIVBTo:/B A [EMAIL PROTECTED]href="">mailto:[EMAIL PROTECTED]"[EMAIL PROTECTED]/A /DIVDIVBSent:/B Monday, October 04, 2004 3:12 AM/DIVDIVBSubject:/B SPAM: Make the Lenders Compete Over You/DIV/DIVDIVBR/DIVA=20href="">http://844.umrexchanger.com/106519/[EMAIL PROTECTED].=com"IMG=20src="">http://6485.umrexchanger.com/[EMAIL PROTECTED]" =border=3D0/A=20BRBRBRBRBRBRYour energies are just mismatched these days. =You will=20gain confidence in your abilities if you say no to those wanting you to =do for="">them instead of for yourself. Your energies are just mismatched these =days. Who=20knew that romance could be so fun? Buy flowers. Write poetry.
Re: [Declude.JunkMail] Declude 1.80
Scott, Also from the doc's it appears as if the bounce action has changed back to bounce from bounceonlyifyoumust. Is this correct or an error in the doc's? Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. R. Scott Perry writes: Looks to me like they have finally locked up the executables and you will need an account to access such things in the future (i.e. service agreement). There is a link on the home page to get the new download. Correct. The new owners wisely felt that this would be a good idea, as it will help ensure that we have contact information for our current customers (which is useful for cases such as when we receive abuse complaints regarding our customers, or if there is a serious problem they need to be aware of), and will help ensure that people are licensed properly (quite a few people truly *thought* that they had a valid Service Agreement, and would have gladly purchased one if they had realized they did not, and were unaware that they were violating our licensing agreement by running a version they were not entitled to). Looks to me like it's pretty much the same app, just packaged differently and limited in access. Correct. It's pretty much the same 1.80 release that people would have expected in the past (lots of changes since the last release, but few changes since the last interim), except with an install program and .pdf/.doc documentation files. I'm very thankful that they have maintained a wizzard-less install and configs. :) There should also be a .ZIP file that people can download (if it is not yet available) with just the files that are needed, for people who don't want to run the install program. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Fw: Help, I have been blacklisted
- Original Message - From: Bud Durland [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, September 13, 2004 12:22 PM Subject: Re: [Declude.JunkMail] Fw: Help, I have been blacklisted Richard Farris wrote: I have been delisted from SPAMCOP...whew...but I still am in the red with these guys: PSBL JAMMDNSBL BLARSBL I remember right, once you are on BLARS, you don't ever get off... something about paying him exorbitant amount of money to see if it's worth his time to remove you. I suspect many responsible mail admins don't use BLARSBL because of that. BLARSBL sounds more like a blackmail list then a blacklist. I read about him before and it was not in his favor. We do not use it. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPF tests not working right?
in my GLOBAL file, the tests are defines as follows: SPFPASSspfpassx-50 SPFFAILspffailx8 0 In $default$ SPFPASS warn SPFFAIL warn My problem is, while I do get several successful pass results, I have yet to get a fail result. How exactly is this test carried out? Is it checking for the validity of the SPF record, and if one does not exist, the test is skipped? Or should a mail fail if either the record is inaccurate OR if the record does not exist? Or do I have something configured wrong? From scanning the archives I believe that I do have the tests configured properly. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPF tests not working right?
Yes, I have noticed this already. I've only been using Declude (or any spam filter for that matter) for a week or so now. Still working on getting my weights set properly so-as to block more spam yet prevent false-positives. Thanks for then tip on unknown. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Sunday, September 12, 2004 8:03 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] SPF tests not working right? Syntax looks correct. Fail looks at the SPF record for the domain being checked and if it says mail should not be sent from that domains from the mail server in question, then the test will fail. For the case where the domain does not have an SPF record, the test would return Unknown. If you want to show that result you can add SPFUNKNOWNspfunknownx0 0 SPFUNKNOWNWARN Also note that giving much, or perhaps any, weight to SPF PASS may not be a good idea as some spammers have added SPF records. Darin. - Original Message - From: Matthew Hiltner: oliveJar Support [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, September 12, 2004 2:42 AM Subject: [Declude.JunkMail] SPF tests not working right? in my GLOBAL file, the tests are defines as follows: SPFPASSspfpassx-50 SPFFAILspffailx8 0 In $default$ SPFPASS warn SPFFAIL warn My problem is, while I do get several successful pass results, I have yet to get a fail result. How exactly is this test carried out? Is it checking for the validity of the SPF record, and if one does not exist, the test is skipped? Or should a mail fail if either the record is inaccurate OR if the record does not exist? Or do I have something configured wrong? From scanning the archives I believe that I do have the tests configured properly. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Test needed along with sniffer
Harry, We have a utility to let you know how well a specific test does in our log parser (DLAnalyzer). The test is called the Test Breakdown Summary Report. Essentially you can pick a certain test(s) and see which other tests fail along with them. This report has helped us eliminate tests that performed the same as other tests. For example you can configure the report to summarize messages that failed Sniffer. It will than show you what other tests failed on messages that also failed Sniffer. You can get more granular by even excluding tests. For example: Show me which tests were triggered in conjunction with Sniffer, but did not fail XBL. Below is the link for a sample output from this report. http://www.invariantsystems.com/dlanalyzer/testsamples/TestSummaryBreakdownR eport.html In the above report you can see that out of all messages that failed the weight30 test 85% of them also failed SPAMCOP and 63% failed XBL.. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Harry Vanderzand writes: I am testing sniffer right now and wonder if I need to run all the other tests along side it. I am trying to reduce my daily workload of analyzing the spamtrap and hope that sniffer and surbl will do this. Do I even need surbl? Any advice in this matter would be greatly appreciated. Thanks in advance Harry Vanderzand inTown Internet Computer Services --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Hitting the CPU Wall
Do any of these servers provide pop/imap/webmail services. We have a couple identical servers, but the ones that provide ancillary services tend to consume more CPU. For your type of volume it should be rare to see 25+ declude processes running at one time. From my experience when I have seen this it always pointed to a flaky or malfunctioning DNS server. The other caveat is depending on how many and the type of body filters you have could cause this. Something does seem wrong if your driving the cpu at 100% with a message volume of 2000 messages per hour with that type of box. Again, depending on your configuration of Declude this type of performance could be normal.. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Darrell Goran Jovanovic writes: Hi, I know that the answer to this question is a big it depends but I am trying to get a feel if I have the server mostly configured correctly or am I missing things. I have a 1.4 GHz Celeron CPU with 512MB RAM and a RAID 1 hard drive system. We are pushing the CPU to 100% and close to 100% a lot of the time during core business hours. Declude log files report that we are processing 12 to 15 thousand messages a day. Based on a quick script I created I am seeing some hours where we are dealing with 2000 messages in that hour. I have also looked at Task Manager and at times I see 20 to 25 Declude processes running concurrently. I have a number of BODY search filters that I am skipping if a bypass filter was triggered (for things like PDF attachments etc). I also have two AV scanners F-Prot and McAfee. So the question is: With this setup should I be able to a lot more messages per hour/day or am I lucky that I am doing as many as I am. I would appreciate any thoughts/speculation etc Thanx Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Log Information
If your looking for more of a histogram of the number of messgaes processed we have MRTG scripts that interface with Imail/Declude to provide you this information. This may or may not be what your looking for... Darrell Goran Jovanovic writes: Darrell I was hoping for more of a histogram of the number of messages processed by hour or half hour. My first thought would be to just get info on simply messages by hour and then maybe if I see a spike I could rerun it to see who was sending/receiving during that time. Thanx Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, August 25, 2004 10:22 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Log Information Goran, You can grep your logs out and use DLAnalyzer for this. For example: grep -i 8/13/2004 14: dec0813.log newlogfile.txt Than rename the log file to dec0813.log and than process.. Darrell -- -- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. - Original Message - From: Goran Jovanovic [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, August 25, 2004 6:52 PM Subject: [Declude.JunkMail] Log Information Hi, Is there a log file analyzer that will report on messages received by hour. I am interested in knowing how many e-mails came in between 3 and 4 and then between 4 and 5 etc. Thanx Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] External Test for Subject is Upper Case
I would be curious to hear on this as well. It's my understanding that the non-english test in declude should catch this (chinese in the subject)? Why the need for an external test? Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Keith Johnson writes: Scott Fisher, I heard you mention once that you made a filter to catch Chinese characters in the subject, we have a few customers that get nailed by these often. Was wondering if you could share your thoughts. Thanks, Keith -Original Message- From: [EMAIL PROTECTED] on behalf of Scott Fisher Sent: Tue 8/24/2004 12:12 AM To: [EMAIL PROTECTED] Cc: Subject: [Declude.JunkMail] External Test for Subject is Upper Case I've made an external test to test if the Subject is all upper case (or punctuation). If anyone is interested, let me know and I'll e-mail you a copy. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Attachment sizes
David, We limit around 10MB. It has worked well. That not to say several folks havent tried to email 50+MB files.. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. David Fletcher writes: We have never set message size limits on our servers. Now it is becoming an issue. Is there any sort of standard for maximum message sizes? This is for hosted customers and I'd like to be reasonable, but I don't think allowing them to receive 18meg + messages is necessary. (I just shook my head when I saw this one after hearing the question: Why is my Outlook locking up?) What limits do you all use? Thanks for the input. David Fletcher InfoTech International, LLC. (904)338-9234 -- Awk! Pieces of eight. Pieces of eight. Pieces of seven... ERROR: General Protection Fault. [Paroty Error.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] There's no doom like MyDoom
It is using yahoo to query for more email addresses. Here is Mcafee's write up. http://vil.nai.com/vil/content/v_127175.htm Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Colbeck, Andrew writes: Another week, another variant. http://isc.sans.org/ Judging from possible strings in the message body and subject, this virus uses a password protected zip (or pretends to), and pretends to be about security, possibly faking your own domain name, just like last week. I don't know what it's trying to do to at Yahoo!... Andrew 8) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Repost of 7/30
Hello all, I need some other (better) minds with this question. I host a domain (with email) that I have whitelisted both to from in the global.cfg file. The entries are: WHITELIST TODOMAIN @domain.com WHITELIST FROM @domain.com I also have an IPBlacklist test as follows: IPBlackList ipfile D:\IMail\Declude\IPBlackList.txt x 5 0 The entry in the $default$.junkmail file is: IPBlackList WARN So here is the question. If the sender is using the MS Outlook mail client to send email via a DSL line whose IP happens to be listed in the IPBlackList file, will his email be stopped by the IPBlacklist test even though it is Whitelisted in the Global.cfg? I ran a test again to see if the IPBlacklist test was really working by reducing the weighting to 0 and indeed, it works. By using the weight of 5 in addition to other tests we use, I can also see where email will exceed our threshold for deletion. I seem to think that the WHITELIST commands will allow the mail to go thru without further tests (regardless of type) being performed - hence, the reason for WHITELISTING. TIA for your comments. Mike O'Brien --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Repost of 7/30
Thanks Scott, I was second-guessing my understanding of the Whitelist entry and my IPBlacklist test. Mike - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, August 02, 2004 10:56 AM Subject: Re: [Declude.JunkMail] Repost of 7/30 I host a domain (with email) that I have whitelisted both to from in the global.cfg file. ... If the sender is using the MS Outlook mail client to send email via a DSL line whose IP happens to be listed in the IPBlackList file, will his email be stopped by the IPBlacklist test even though it is Whitelisted in the Global.cfg? No. A whitelist forces E-mail to pass all anti-spam tests (despite what Ipswitch tried convincing people with the original v8 releases). Since the E-mail has an @example.com return address, and you have WHITELIST FROM @example.com, the E-mail will pass all the spam tests, and be delivered as if Declude JunkMail was not running. There *are* some rare exceptions, but they are ones that you would know about (such as the bypasswhitelist option). I seem to think that the WHITELIST commands will allow the mail to go thru without further tests (regardless of type) being performed - hence, the reason for WHITELISTING. Correct. However, you need to make sure that the E-mail address in the X-Declude-Sender: header matches the domain in the WHITELIST FROM line in the global.cfg file. If the user tries sending E-mail as [EMAIL PROTECTED], for example, their E-mail won't get whitelisted. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelisting IPBlacklist Question
Hello all, I need some other (better) minds with this question. I host a domain (with email) that I have whitelisted both to from in the global.cfg file. The entries are: WHITELIST TODOMAIN @domain.com WHITELIST FROM @domain.com I also have an IPBlacklist test as follows: IPBlackList ipfile D:\IMail\Declude\IPBlackList.txt x 5 0 The entry in the $default$.junkmail file is: IPBlackList WARN So here is the question. If the sender is using the MS Outlook mail client to send email via a DSL line whose IP happens to be listed in the IPBlackList file, will his email be stopped by the IPBlacklist test even though it is Whitelisted in the Global.cfg? I ran a test again to see if the IPBlacklist test was really working by reducing the weighting to 0 and indeed, it works. By using the weight of 5 in addition to other tests we use, I can also see where email will exceed our threshold for deletion. I seem to think that the WHITELIST commands will allow the mail to go thru without further tests (regardless of type) being performed - hence, the reason for WHITELISTING. TIA for your comments. Mike O'Brien --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Message header review
Can someone help me with the header of this message. I think this came from earthlink.net mail server. According to earthlink abuse they can't do anything about this type of spam since it did not originate from their network. We get porn spam from this segement all the time. Received: from asmtp-a063f33.pas.sa.earthlink.net [207.217.120.149] by deepspace.i360.net with ESMTP (SMTPD32-7.15) id A94339680150; Thu, 22 Jul 2004 10:12:03 -0500Received: from 68-235-252-102.atlsfl.adelphia.net ([68.235.252.102])by asmtp-a063f33.pas.sa.earthlink.net with asmtp (Exim 4.34)id 1BnfBN-00062N-F4; Thu, 22 Jul 2004 08:08:32 -0700Message-ID: [EMAIL PROTECTED]Reply-To: "=?windows-1251?B?Y2FtZWxsaWE=?=" [EMAIL PROTECTED]From: "=?windows-1251?B?Y2FtZWxsaWE=?=" [EMAIL PROTECTED]Subject: SPAM: =?windows-1251?B?QnJpZGdldCBtb25yb2Ugc3Vja2luZyBhIGhhcmQgY29jayB2ZXJ5IGRlZXA=?=Date: Thu, 22 Jul 2004 00:56:07 -0400MIME-Version: 1.0Content-Type: text/html;charset="windows-1251"Content-Transfer-Encoding: 7bitX-Priority: 3X-MSMail-Priority: NormalX-Mailer: Microsoft Outlook Express 6.00.2600.X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.X-ELNK-Trace: 006cdaaeaf6f69a98241270f52c7d65b7e972de0d01da9401ceba94723fb6a47959954e32e1a9354350badd9bab72f9c350badd9bab72f9c350badd9bab72f9cX-Originating-IP: 68.235.252.102X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]"X-RBL-Warning: NOPOSTMASTER: "Not supporting [EMAIL PROTECTED]"X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [840a].X-Declude-Sender: [EMAIL PROTECTED] [207.217.120.149]X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam.X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, BADHEADERS, WEIGHT10 [11]X-Note: This E-mail was sent from asmtp-a063f33.pas.sa.earthlink.net ([207.217.120.149]).X-RCPT-TO: [EMAIL PROTECTED]Status: UX-UIDL: 384479918
Re: [Declude.JunkMail] Message header review
I have forwarded several spam emails to [EMAIL PROTECTED] but the only response I get back is that the email did not originate from their network. Its really annoying that they don't give a shit. I would have blocked them if it had not been for one of my clients needing email from that server (they have a client that hosts with earthlink). Thanks to all for the responses. Heimir - Original Message - From: Matt To: [EMAIL PROTECTED] Sent: Thursday, July 22, 2004 4:07 PM Subject: Re: [Declude.JunkMail] Message header review Earthlink has for some reason been forwarding spam through this server for some time. I'm not sure what the setup is, but it's a legitimate Earthlink server and the E-mail originates from a spam zombie.I have thought about IPBYPASS'ing this server in order to capture the real source, but I have yet to confirm if this server is just used for forwarding or what the case may be. It could be that this is an open relay, a forwarding server, or a full fledged mail server. I am guessing the first.Matti360 Support wrote: Can someone help me with the header of this message. I think this came from earthlink.net mail server. According to earthlink abuse they can't do anything about this type of spam since it did not originate from their network. We get porn spam from this segement all the time. Received: from asmtp-a063f33.pas.sa.earthlink.net [207.217.120.149] by deepspace.i360.net with ESMTP (SMTPD32-7.15) id A94339680150; Thu, 22 Jul 2004 10:12:03 -0500Received: from 68-235-252-102.atlsfl.adelphia.net ([68.235.252.102])by asmtp-a063f33.pas.sa.earthlink.net with asmtp (Exim 4.34)id 1BnfBN-00062N-F4; Thu, 22 Jul 2004 08:08:32 -0700Message-ID: [EMAIL PROTECTED]Reply-To: "=?windows-1251?B?Y2FtZWxsaWE=?=" [EMAIL PROTECTED]From: "=?windows-1251?B?Y2FtZWxsaWE=?=" [EMAIL PROTECTED]Subject: SPAM: =?windows-1251?B?QnJpZGdldCBtb25yb2Ugc3Vja2luZyBhIGhhcmQgY29jayB2ZXJ5IGRlZXA=?=Date: Thu, 22 Jul 2004 00:56:07 -0400MIME-Version: 1.0Content-Type: text/html;charset="windows-1251"Content-Transfer-Encoding: 7bitX-Priority: 3X-MSMail-Priority: NormalX-Mailer: Microsoft Outlook Express 6.00.2600.X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.X-ELNK-Trace: 006cdaaeaf6f69a98241270f52c7d65b7e972de0d01da9401ceba94723fb6a47959954e32e1a9354350badd9bab72f9c350badd9bab72f9c350badd9bab72f9cX-Originating-IP: 68.235.252.102X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]"X-RBL-Warning: NOPOSTMASTER: "Not supporting [EMAIL PROTECTED]"X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [840a].X-Declude-Sender: [EMAIL PROTECTED] [207.217.120.149]X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam.X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, BADHEADERS, WEIGHT10 [11]X-Note: This E-mail was sent from asmtp-a063f33.pas.sa.earthlink.net ([207.217.120.149]).X-RCPT-TO: [EMAIL PROTECTED]Status: UX-UIDL: 384479918-- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
[Declude.JunkMail] MTLDB Uninstall
Hello all, The test seems to be stable on our system. However, I looked around and there are a couple of DLLs installed on C:\ProgramFiles\ComputerHorizons\MTLDB. One seems to indicate that it is cyphering or creating/using a secure token of some purpose. In scanning the regisrty, I also notice that the connection for the registration utilizes the typical https:// . I also looked in the Control Panel Add/Remove Programs and there is no entry for the MTLDB program that was installed. I looked for an uninstall method and couldn't find anything. Did I miss something or is it my imagination that the MTLDB test code or registry entries must be manually removed? I know it's easy to comment out the test (or delete it) in the Global.cfg file. What about the rest of it and the unregistration of the dlls.? TIA Mike O'Brien --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] DLAnalyzer 3.0 Released (New Free Version Available)
We are pleased to announce that DLAnalyzer 3.0 is now available. With version 3.0 we are introducing a Lite version that is FREE. To download DLAnalyzer 3.0, please visit: http://www.invariantsystems.com/ New Features In DLAnalyzer 3.0 * Last Action Summary Report * Test Breakdown Summary Report * Weight Range Summary Report * IP Summary Report * Easily Work With Multiple Configurations with the -c Command Line Parameter * Ability To Exclude Tests In The Overall Server Test Summary * Domain Summary - Last Action Filter * Domain Summary - Weight Range Filter * Domain Summary - Zero Message Domain Suppression * Customized Advanced Report Output (HTML TEXT) * Advanced Report - Last Action Filter * Advanced Report - Weight Range Filter * SMTP Auth Support * SMTP Multiple To: Addresses * SMTP BCC: Addresses * SMTP CC: Addresses * GUI Configuration Utility Supports Multiple Configuration Files * Plus Many More... If you have any questions let us know. Darrell - Check out http://www.invariantsystems.com for utilities for Declude and Imail. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spam sent to list
Title: Message I was wondering if someone was posting this item to the list or if my e-mail address was harvest from somewhere. Isaias HernandezTC Online InternetSupport979-775-6239[EMAIL PROTECTED] Received: from declude.com [68.162.218.198] by mail.tconline.net with ESMTP (SMTPD32-7.15) id A3476F6F00C6; Mon, 28 Jun 2004 22:34:31 -0500Received: from pa198.miejsce-piastowe.sdi.tpnet.pl [217.99.175.198] by mail.declude.com (SMTPD32-8.05) id A2713530256; Mon, 28 Jun 2004 23:30:57 -0400X-Message-Info: 315jiTpiaLUO037Vdjitu5nmAEwdWCW857XHZ9feDvejY0Received: from dns014yahoo.com ([24.117.232.112]) by lp52-nks49.yahoo.com with Microsoft SMTPSVC(5.0.2195.6824); Mon, 28 Jun 2004 17:24:57 +0100Received: from yahoo.com [127.0.0.1] by dnsyahoo.com (SMTPD32-7.12 ) id AWW909SH6; Mon, 28 Jun 2004 17:27:57 +0100Subject: [Declude.Virus] SPAMWT40:Attn:Urgent Sales Verification!Act now!From: AdminTo: [EMAIL PROTECTED]Message-Id: [EMAIL PROTECTED]Content-Type: multipart/alternative;boundary="--105305717518494121"X-RBL-Warning: BLITZEDALL: "open proxy - see http://opm.blitzed.org/?ip=217.99.175.198"X-RBL-Warning: DSBL: "http://dsbl.org/listing?ip=217.99.175.198"X-RBL-Warning: DSBLALL: "http://dsbl.org/listing?ip=217.99.175.198"X-RBL-Warning: FIVETENSRC: 112.232.117.24.blackholes.five-ten-sg.com.X-RBL-Warning: MAILDEFLECTOR: "Mail from 217.99.175.198 refused by the postmaster at this domain. Please contact the postmaster for help. You may also link to http://www.maildeflector.net/whywasirefused.php for help"X-RBL-Warning: SORBS-HTTP: "HTTP Proxy See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=217.99.175.198"X-RBL-Warning: SORBS-SOCKS: "HTTP Proxy See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=217.99.175.198"X-RBL-Warning: SPAMCOP: "Blocked - see http://www.spamcop.net/bl.shtml?217.99.175.198"X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [a020010d].X-RBL-Warning: SNIFFER: Message failed SNIFFER: 50.X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15.X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam [a020010d].X-RBL-Warning: WEIGHT10: Weight of 58 reaches or exceeds the limit of 10.X-RBL-Warning: WEIGHT20: Weight of 58 reaches or exceeds the limit of 20.X-Note: This E-mail was scanned for viruses by Declude Virus (www.declude.com)X-NRecips: 4X-Reverse-IP: pa198.miejsce-piastowe.sdi.tpnet.plX-Weight: 58 (BLITZEDALL, DSBL, DSBLALL, FIVETENSRC, MAILDEFLECTOR, NJABLPROXIES, SORBS-HTTP, SORBS-SOCKS, SPAMCOP, SPFUNKNOWN, BADHEADERS, HEUR4, SNIFFER, SPAMCHK, ROUTING, IPNOTINMX, NOLEGITCONTENT, EXPER, CMDSPACE, WEIGHT10, WEIGHT20, WEIGHT40)X-Country-Chain: UNITED STATES-POLAND-destination.X-Declude-Sender: [EMAIL PROTECTED] [217.99.175.198]X-Declude-Spoolname: De27103530256df24.SMDPrecedence: bulkSender: [EMAIL PROTECTED]Reply-To: [EMAIL PROTECTED]Date: Mon, 28 Jun 2004 23:34:33 -0400X-Declude-Sender: [EMAIL PROTECTED] [68.162.218.198]X-Declude-Spoolname: De3476f6f00c6aec9.SMDX-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam.X-Spam-Tests-Failed: Whitelisted [0]X-Country-Chain: UNITED STATES-POLAND-UNITED STATES-destinationX-Note: This E-mail was sent from dpvc-68-162-218-198.bos.east.verizon.net ([68.162.218.198]).X-Note: Total Spam weight of this E-mail is 0.X-RCPT-TO: [EMAIL PROTECTED]Status: UX-UIDL: 385403722 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of AdminSent: Monday, June 28, 2004 10:35 PMTo: [EMAIL PROTECTED]Subject: [Declude.Virus] SPAMWT40:Attn:Urgent Sales Verification!Act now! BUY CHEAP DRUGS,OVERNIGHT DELIVERY
Re: [Declude.JunkMail] Way OT: HTML code for tab
John, It suppose to be #09; i.e. character code 09. Darrell - Check out http://www.invariantsystems.com for utilities for Declude and Imail. Now released QueueMon an Imail/Declude Queue Monitoring Application. John Tolmachoff (Lists) writes: Does any one know what the HTML code for a single tab is? John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude and Spam Review
I was wondering is there a way to change what the Spam Hold button is pointing to in Spam Review. I am currently running Declude Hijack v1.75 and the held e-mails are being sent to the Hold2 folder and not Hold. I have not been using Spam Review much and wanted to start using it to check if the held e-mails in hold2 are Spam or not. Also I wanted to get some opinions on how Spam Review is working for other people. Isaias Hernandez Internet Tech Support 979-775-6239 [EMAIL PROTECTED] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude and Spam Review
Yes I understand what Hijack is doing but I wanted to use Spam Review to easily view the e-mails and send back to the spool folder if they are valid instead of manually having to check each file individually. Isaias Hernandez Internet Tech Support 979-775-6239 [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Thursday, June 17, 2004 9:26 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Declude and Spam Review SpamReview is not intended to be used with Hijack, rather it is intended to be used with Declude JunkMail. Do you understand what Hijack is doing if there are messages in Hold2? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of TCOnline Internet Support Sent: Thursday, June 17, 2004 7:11 AM To: Declude.JunkMail Subject: [Declude.JunkMail] Declude and Spam Review I was wondering is there a way to change what the Spam Hold button is pointing to in Spam Review. I am currently running Declude Hijack v1.75 and the held e-mails are being sent to the Hold2 folder and not Hold. I have not been using Spam Review much and wanted to start using it to check if the held e-mails in hold2 are Spam or not. Also I wanted to get some opinions on how Spam Review is working for other people. Isaias Hernandez Internet Tech Support 979-775-6239 [EMAIL PROTECTED] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Content Rules plus/vs. Sniffer?
Andy, I know I am not Matt, but I wanted to chime in here. We have a lot of body filters and we use sniffer as well. Mostly because we can quickly code rules to block spam that is coming in at that momemnt instead of waiting for a rule base update. Also, not all of the spam we get ends up in the sniffer database. We use our filters to compliment sniffer. Darrell - Check out http://www.invariantsystems.com for utilities for Declude and Imail. Andy Schmidt writes: Hey Matt: One question - I know that you have been spending a lot of time programming content filters. I'm curious whether you are using Sniffer and whether you found that you needed all those filters to improve detection over Sniffer rules (which then makes me wonder why they are not made part of Sniffer) - or whether you are trying to substitute Sniffer? Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] IP4R DNS lookup
I was wondering how reliable the ip4r lookups are. There seems to be a lot of SPAM that is only failing one of the ip4r test (SORBS, SBL, AHBL, etc) and no more of the test, hence delivering the SPAM. Is it safe to increase the weight of all these test to my deletion weight in order to stop them from being delivered or are there some false positives that may be caught?  Isaias Hernandez TC Online Internet Support 979-775-6239 [EMAIL PROTECTED] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] TESTSFAILED END Question
I seen this post below and wanted to implement the TESTSFAILED to exit out of one of my body filters based on if another test was already triggered. Is the below line correct (assuming REVERSEDNSFILTER is one of my filters that occurs before the filter I put the below line in)? TESTSFAILED END CONTAINS REVERSEDNSFILTER [2] When that line is matched does it show in the logs? Darrell - Check out http://www.invariantsystems.com for utilities for Declude and Imail. Scott Fisher writes: I haven't found any easy way to tell. The information is in the logs at high level. But I can chime in that SKIPIFWEIGHT bypasses about 80% of my e-mail that is obviously spam. TESTSFAILED ENDS for friendly domains/revdns drop off about 8% of e-mail that is most likely not spam, leaving about 12% of the e-mail that I run body filters on. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 06/17/04 12:03PM Matt- My body filters only catch about 4% of messages, but I don't know how often they are run. Is htere a convenient way to tell? -d - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, June 17, 2004 12:40 PM Subject: Re: [Declude.JunkMail] Declude and attachments Scott, I've got a lot more BODY filters than Dave has, though I don't feel that they are excessive. I probably have about 1,500 BODY searches, but with SKIPIFWEIGHT they only run about 25% of the time. If Dave is using Declude Virus, I would also look there for the issue. Anything besides F-Prot and ClamAV in daemon mode will chug a server on a large attachment and it will use up far more processing than Declude JunkMail, but it will keep the Declude instance alive for longer. On about 65,000 messages a day currently, we generally see from 2 to 10 Declude processes running at one time with both F-Prot and AVG enabled (much less with just F-Prot). Disabling AVG results in our average processor utilization dropping by 1/3 to 1/2 on heavy load hours. Matt R. Scott Perry wrote: One instance of Declude, then two, then three, all in the 25%+ range. As soon as it dropped to two Decludes, Queue Manager came right in at 30-40%, then the cycles dropped as QueueManager dropped down. It does sound like it is the large files that are causing the problem. One option would be to temporarily disable the BODY filter with the 200 lines in it, to see if that prevents the problem with the high CPU usage in Declude JunkMail. That could indeed be causing the problem. The other would be to use the debug mode (LOGLEVEL DEBUG in the \IMail\Declude\global.cfg file) and waiting for one of these files to be sent. We can look at the debug log file entries to get a better idea of where the high CPU usage is occurring. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] RFC That Covers HELO BOGUS
Scott/Anyone, What is the RFC that covers HELO BOGUS? I had wrote down RFC 821 4.3. However, when looking at that sub heading it covers Sequencing of Commands and Replies. So I am thinking I must be wrong, because the only thing that I see relevant is the following lines Note: all the greeting type replies have the official name of the server host as the first word following the reply code Thanks Darrell - Check out http://www.invariantsystems.com for utilities for Declude and Imail. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Mail From Help
I am sure this may just be a typo but you put CONTRAINS opposed to CONTAINS? Darrell - Check out http://www.invariantsystems.com for utilities for Declude and Imail. Kris McElroy writes: I am wanting to block anything in the From line that says Sapphirex, so I created a filter called mail_from and it contains the following: MAILFROM 10 CONTRAINS Sapphirex But for some reason this was allowed through? I have a customer whom gets about 100 of these a day from Sapphirex with random email addresses? From: Sapphirex Expeditors [EMAIL PROTECTED] To: Mike Houck [EMAIL PROTECTED] Subject: Houck Residence: 9 N. 11th Mortgagor Statement Date: Thu, 10 Jun 2004 14:37:28 -0600 Message-ID: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_000_0874_BE1151DD.45791A93 X-RBL-Warning: WEIGHT10: Weight of 13 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [64.136.98.37] X-Declude-Spoolname: Db87e40730100217b.SMD X-Note: This E-mail was scanned by Duracom.Net for spam X-Country-Chain: UNITED STATES-destination X-Server: [65.66.8.6]Mailgateway2.duracom.net v.1.78 X-Note: This E-mail was sent from mx37.dacehadr.us ([64.136.98.37]) X-Spam-Tests-Failed: GREY_FILTER_BODY, GIBBERISH, ANTI-GIBBERISH, MAILPOLICE-BULK, IPNOTINMX, NOLEGITCONTENT, WEIGHT10 [13] X-Note: Header code: e Return-Path: [EMAIL PROTECTED] X-Note: Total Weight 13 X-Note: Please send abuse reports to [EMAIL PROTECTED] Status: U X-UIDL: 385411184 Thanks, Kris McElroy [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] MRTG For Declude and IMAIL
If anyone is interested in using MRTG with Declude or Imail we have made available the program(s)that we are using to graph statistics. For Declude Junkmail * Graph A Test / Total Incoming Messages To Declude Junkmail For Imail * Total Incoming Connections * Incoming Connections For a domain / total connections for the server * Incoming And Outgoing Bytes * Incoming And Outgoing Bytes For A Specific Domain * Locally Delivered Messages / Remote Delivered messages These utilities are available for free. To check them out you can visit http://www.invariantsystems.com Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: ASCII code
Correct... Darrell John Tolmachoff (Lists) writes: A space is %20, correct? John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.invariantsystems.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Gibberish and Anti-Gibberish Testing
I have been using the SPAM filters from MailPure and I have notices that the Anti-Gibberish Test has been triggered a lot more than the Gibberish test (5:1 ratio) The Anti-Gibberish Test has been causing a lot of SPAM to go through by applying negative weight to the message. I was wondering if there was a way to skip the Anti-Gibberish Test if the Gibberish is not triggered. (This goes to all the test that contain an Anti- test) Isaias Hernandez Internet Tech Support [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ARGOLINKs SPAM Graph
Terry, I orginally looked at the argolink spam graph, but as the doc's mentioned it goes through the full log file from beginning to end. Our log files are big, but it would tie up the cpu for a bit ~10-15 minutes. We just finished a seperate program that can be used with MRTG to graph junkmail stats. The program is done and I am using it. I just have to package it up and write some small doc's on it. I am in the process of finishing up the program that can be used to link Imail to MRTG as well. Both will be made available for free shortly. I will send a note out when everything is posted on our site.. Darrell Terry Parks writes: OT, A little, any body got it going? I got it to display just the page with the word GRAPH on it. Using Windows 2003. Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.invariantsystems.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] e-commerce counter weights
Most of my false positives are coming from e-commerce sites, where automatic email are generated after an order has been placed. What sort of counter weighting do you guys use to balance out these types of messages? I can't decide on anything to identify these types of messages with that spammers don't already try to fake. Any help would be much appreciated. Thank you for making YourNET Connection your connection to the world Jim O'Keefe Technical Support @YourNET Connection, Inc. [EMAIL PROTECTED]
Re: [Declude.JunkMail] OT: Windows 2000 Performance Monitor
Matt, I monitor a bunch of counters (memory, cpu, process, disk, network, etc) on our servers. I roll the perf logs on a daily basis. The hard thing in tracking this stuff is that when you add process counters there is no way to track all of the individual processes for declude/imail/sniffer. What you will see is each Declude process will show like Declude#1, Declude#2, etc, etc. What I ended up doing is setting the process counters up at a busy time on my server to capture as many of the ...#1 processes. Darrell Matt writes: I've never bothered to run monitoring before, but I need to do so now so that I can make more informed decisions. Does anyone have a good config/setup that they want to share which is most effective at tracking usage primarily related to an IMail/Declude/Sniffer setup? Should I be storing this data in SQL Server? Etc. Thanks, Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.dlanalyzer.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Cheap router to limit by IP
Matt, I used to put routers in these types of situations, but now I don't. I would suggest you/your customer look at some of the low end Netscreen firewalls like a 5GT. You can get these under $500 and they have way more value than a router.. One of the best things about the netscreen devices is they can be installed in transparent mode. Which means no ip configuration required. You just basically put it inline of the server and configure the rules on it. http://www.netscreen.com/products/at_a_glance/ds_5xt.jsp Darrell Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.dlanalyzer.com Matt writes: I have yet another customer that is running GroupWise 5x that is getting attacked by some asian spammer trying to dictionary attack Yahoo.co.jp and other regional sites. Until they can get onto GroupWise 6 (which will reject at the SMTP envelope), my recommendation was for them to install a new router capable of limiting port 25 to just my server's IP, the only problem is that he needs something fast and cheap. Does anyone know of any cheap, chain store stocked routers that are capable of limiting a particular port to a particular IP on inbound only (it still has to deliver by SMTP, just only receive from my IP)? I figure that the following are the best candidates based on the fact that they are readily available. http://www.compusa.com/products/products.asp?N=200158CusaNe=200139 Note that he only needs to firewall one port. BTW, if you are running GroupWise 5.x (including 5.5.5), this asian spammer will stick a group of zombies on your machine for weeks on end even if in fact your server is not actually relaying the messages. This is the same spammer that is responsible for the majority of the Job-Jobs that my locally hosted domains see right now. Thanks, Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Server Recommendation
We are currently looking to upgrade our mail server. Lately the processing of the CPU has causing the SMTP to be working real slow, causing a lot of timeouts. We currently we are running a P3 1.133GHz with 512MB RAM. We are looking to upgrade to a dual processor. I was wondering if anybody was willing to share what type of server hardware they are using and if anybody had any recommendations on the CPU power and RAM to have optimal performance. Also I was wondering what amount of SPAM is being received by other ISPs. Currently over 90% of all incoming mail to our server is SPAM. I just wanted to see if this is normal for an ISP. Isaias Hernandez Internet Tech Support [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Server Recommendation
We currently send and receive about 40,000 to 50,000 e-mails daily. The processes that are taking up the most CPU are multiple instances of declude.exe and NTVDM.exe. We tried to comment out some of our SPAM test to see if it would help and it has freed up some CPU. The SPAM test that were commented out were the ones provided by mailpure.com (Gibberish, Y!directed, etc). Are these tests really worth having to test for SPAM or can they be removed? Isaias Hernandez Internet Tech Support [EMAIL PROTECTED] We are currently looking to upgrade our mail server. Lately the processing of the CPU has causing the SMTP to be working real slow, causing a lot of timeouts. We currently we are running a P3 1.133GHz with 512MB RAM. We are looking to upgrade to a dual processor. How many E-mails do you send/receive per day? When you use Task Manager and sort the processes by CPU usage, which one(s) are using the most CPU? -Scott --- [This E-mail was scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Server Recommendation
NTVDM.exe is used for 16-bit processes, and can indeed cause some servers to slow down to a crawl. Are you using F-Prot.exe with Declude Virus? If so, you should switch to the 32-bit fpcmd.exe version. We are using f-prot.exe with Declude Virus. How do we check to make sure it is running in the 32-bit mode. I was under the impression it was already running in this mode. Can someone post the command line used to run f-prot in the 32-bit mode or send me an e-mail directly? Thanks. Isaias Hernandez Internet Tech Support [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] test gfdsghb
nfdhgfgf Isaias Hernandez Internet Tech Support 979-775-6239 [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] wrong hop?
Does this mean that I am running lookups on the wrong hop? My mail server is ync.net the sender's mail server is mail.webagency.net from the headers: Received: from SMTP32-FWD by ync.net (SMTP32) id A060810EB; Wed, 3 Mar 2004 08:04:18 -0600Received: from mail.webagency.net [216.118.193.135] by ync.net with ESMTP (SMTPD32-8.05) id A5D712BB00EE; Wed, 03 Mar 2004 08:04:07 -0600Received: from pal01 [24.15.209.24] by mail.webagency.net with ESMTP (SMTPD32-7.13) id A3743032C; Wed, 03 Mar 2004 07:53:56 -0600 This message was also in the headers and is the cause of my concern: X-RBL-Warning: HELOBOGUS: Domain pal01 returns a server failure for MX or A records. Why did it run on pal01? Shouldn't it run on mail.webagency.net? Thank you for making YourNET Connection your connection to the world Jim O'Keefe Technical Support @YourNET Connection, Inc. [EMAIL PROTECTED]
RE: [Declude.JunkMail] wrong hop?
HOP 1 and I don't have any IPBYPASS, I have it commented out. I also have HOPHIGH commented out. Thank you for making YourNET Connection your connection to the world Jim O'Keefe Technical Support @YourNET Connection, Inc. [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 03, 2004 10:41 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] wrong hop? Does this mean that I am running lookups on the wrong hop? It sounds like it. My mail server is ync.net the sender's mail server is mail.webagency.net from the headers: Received: from SMTP32-FWD by ync.net (SMTP32) id A060810EB; Wed, 3 Mar 2004 08:04:18 -0600 Received: from mail.webagency.net [216.118.193.135] by ync.net with ESMTP (SMTPD32-8.05) id A5D712BB00EE; Wed, 03 Mar 2004 08:04:07 -0600 Received: from pal01 [24.15.209.24] by mail.webagency.net with ESMTP (SMTPD32-7.13) id A3743032C; Wed, 03 Mar 2004 07:53:56 -0600 Here, you should be scanning the IP 216.118.193.135, and mail.webagency.net. This message was also in the headers and is the cause of my concern: X-RBL-Warning: HELOBOGUS: Domain pal01 returns a server failure for MX or A records. So this is wrong. What are you HOP and IPBYPASS settings in the \IMail\Declude\global.cfg file? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail has been scanned for viruses by the YourNet Connection Virus system] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] DNS timeout and DNS configuration - does it get logged?
DNS line in the \IMail\Declude\global.cfg file). Note that it is recommended (with or without Declude) that you only use 1 DNS server in the IMail SMTP settings. What types of problems tend to crop up with multiple DNS servers listed in Imail? Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] HOP HIGH / Spam Tests
We are setup currently using HOPHIGH 1. With using a HOPHIGH setting of 1. What we are seeing is an increase in messages that are gettng caught with XBL, DSBL, SORBS, and other tests along this line on the second HOP even though they were legit messages that were sent through normal ISP servers. How many folks are using HOPHIGH 1? Also, for tests like XBL, DSBL, and others along this line are you changing them to XBL-DUL to only work on the first HOP? Thanks Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HOP HIGH / Spam Tests
Matt, Thats actually a very good idea I am going to incorporate. How did you come up with the scoring balance between first and second hop? Darrell Matt writes: You need to segment your tests between Spamtraps/Zombies/Relays and Static Sources. Static sources such as SBL should have no increase in FP's over multiple hops, however XBL, SpamCop, ORDB and others will. What I do is trick Declude into splitting the test scores giving the last hop a higher score than a hit that sits before the last hop, but only for the Spamtraps/Zombies/Relays types of tests. Here's an example: # Spam Traps (staggered scoring per hop) SPAMCOP(DYNA) ip4rbl.spamcop.net 127.0.0.240 SPAMCOP(ALL) ip4rbl.spamcop.net 127.0.0.220 XBL(DYNA) ip4rsbl-xbl.spamhaus.org127.0.0.460 XBL(ALL) ip4rsbl-xbl.spamhaus.org127.0.0.420 The (DYNA) part of the name makes Declude only use that test on the last hop, while the (ALL) has no special function and it will hit on any hop that is scanned. Last hop hits will score both, but prior hop hits will only score the (ALL) version for a lower score. This definitely helped my spam capture rates, but I have caught some zombies that were sending legitimate E-mail, though they score very low and many of them pass. I've suggested before that extra columns be added to Declude for such tests so that we can control the score they give according to the hop that they hit on. The full description of this suggestion is in the recent archives. Note that negative weight tests need to be kept exclusively to the last hop because they do get spoofed in forged headers, and also, RHSBL tests are not hop aware since they pull a domain from the MAILFROM instead of the hops, so you don't need to do anything special with these tests. Matt DLAnalyzer Support wrote: We are setup currently using HOPHIGH 1. With using a HOPHIGH setting of 1. What we are seeing is an increase in messages that are gettng caught with XBL, DSBL, SORBS, and other tests along this line on the second HOP even though they were legit messages that were sent through normal ISP servers. How many folks are using HOPHIGH 1? Also, for tests like XBL, DSBL, and others along this line are you changing them to XBL-DUL to only work on the first HOP? Thanks Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.dlanalyzer.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HOP HIGH / Spam Tests
Matt, For the dyna/dul tests I though the test name had to end with either DYNA or DUL. I noticed you use (DYNA) - does it (declude) just look for the work dyna or dul to limit it to one hop? Darrell Matt writes: I basically came up with a rule where the (DYNA) test gets 3/4 to 2/3 of the points, and the (ALL) test gets 1/4 to 1/3 of the points. To air on the side of caution, I would step the points up on the (DYNA) test until it reached 3/4 and then I would add another point to the (ALL) test, i.e. 3 = 2 1 4 = 3 1 5 = 4 1 6 = 4 2 7 = 5 2 8 = 6 2 9 = 7 2 10 = 7 3 Here's my current list of split tests, the hardest part is understanding which ones qualify, and that can take some reading: # Relay Lists (staggered scoring per hop) AHBL-PROXIES(DYNA)ip4rdnsbl.ahbl.org127.0.0.33 0 AHBL-PROXIES(ALL)ip4rdnsbl.ahbl.org127.0.0.310 BLITZEDALL(DYNA)ip4ropm.blitzed.org*50 BLITZEDALL(ALL)ip4ropm.blitzed.org*20 DSBL(DYNA)ip4rlist.dsbl.org127.0.0.250 DSBL(ALL)ip4rlist.dsbl.org127.0.0.220 FIVETEN-MISC(DYNA)ip4rblackholes.five-ten-sg.com127.0.0.93 0 FIVETEN-MISC(ALL)ip4rblackholes.five-ten-sg.com127.0.0.91 0 FIVETEN-MULTI(DYNA)ip4rblackholes.five-ten-sg.com127.0.0.5 30 FIVETEN-MULTI(ALL)ip4rblackholes.five-ten-sg.com127.0.0.51 0 NJABL-RELAYS(DYNA)ip4rdnsbl.njabl.org127.0.0.23 0 NJABL-RELAYS(ALL)ip4rdnsbl.njabl.org127.0.0.21 0 ORDB(DYNA)ip4rrelays.ordb.org*50 ORDB(ALL)ip4rrelays.ordb.org*20 SORBS-HTTP(DYNA)ip4rdnsbl.sorbs.net127.0.0.240 SORBS-HTTP(ALL)ip4rdnsbl.sorbs.net127.0.0.22 0 SORBS-MISC(DYNA)ip4rdnsbl.sorbs.net127.0.0.440 SORBS-MISC(ALL)ip4rdnsbl.sorbs.net127.0.0.42 0 SORBS-SMTP(DYNA)ip4rdnsbl.sorbs.net127.0.0.540 SORBS-SMTP(ALL)ip4rdnsbl.sorbs.net127.0.0.52 0 SORBS-SOCKS(DYNA)ip4rdnsbl.sorbs.net127.0.0.34 0 SORBS-SOCKS(ALL)ip4rdnsbl.sorbs.net127.0.0.320 NJABL-PROXIES(DYNA)ip4rdnsbl.njabl.org127.0.0.96 0 NJABL-PROXIES(ALL)ip4rdnsbl.njabl.org127.0.0.92 0 NJABL-MULTI(DYNA)ip4rdnsbl.njabl.org127.0.0.53 0 NJABL-MULTI(ALL)ip4rdnsbl.njabl.org127.0.0.510 # Spam Traps (staggered scoring per hop) SPAMCOP(DYNA)ip4rbl.spamcop.net127.0.0.240 SPAMCOP(ALL)ip4rbl.spamcop.net127.0.0.220 XBL(DYNA)ip4rsbl-xbl.spamhaus.org127.0.0.460 XBL(ALL)ip4rsbl-xbl.spamhaus.org127.0.0.420 It's of course ugly, but I believe it makes the most sense to do it this way. I did this at the same time that I moved over to multiple hop testing (I test the last 4 hops since my server can handle it currently and that helps with forwarding). I've only seen a few FP's as a result of tagged zombies sending legit E-mail, maybe a couple a week and always just barely failing. Note that all of these scored are based on a hold weight of 10 or 13. Matt DLAnalyzer Support wrote: Matt, Thats actually a very good idea I am going to incorporate. How did you come up with the scoring balance between first and second hop? Darrell Matt writes: You need to segment your tests between Spamtraps/Zombies/Relays and Static Sources. Static sources such as SBL should have no increase in FP's over multiple hops, however XBL, SpamCop, ORDB and others will. What I do is trick Declude into splitting the test scores giving the last hop a higher score than a hit that sits before the last hop, but only for the Spamtraps/Zombies/Relays types of tests. Here's an example: # Spam Traps (staggered scoring per hop) SPAMCOP(DYNA) ip4rbl.spamcop.net 127.0.0.24 0 SPAMCOP(ALL) ip4rbl.spamcop.net 127.0.0.22 0 XBL(DYNA) ip4rsbl-xbl.spamhaus.org127.0.0.46 0 XBL(ALL) ip4rsbl-xbl.spamhaus.org127.0.0.42 0 The (DYNA) part of the name makes Declude only use that test on the last hop, while the (ALL) has no special function and it will hit on any hop that is scanned. Last hop hits will score both, but prior hop hits will only score the (ALL) version for a lower score. This definitely helped my spam capture rates, but I have caught some zombies that were sending legitimate E-mail, though they score very low and many of them pass. I've suggested before that extra columns
Re: [Declude.JunkMail] Yahoo, Sendmail to test antispam system
Actually, Bill announced today at the RAS conference that Windows XP SP2 should fix the virus issue. Beyond the Windows service release, Gates also showed off ``active protection technologies'' that will gird Windows computers against attacks by sensing changes in the network that indicate virus activity. If a problem is detected, the computer's firewall will dynamically ratchet up defenses. It's all under control now :) Darrell Matt writes: Web scripts come to mind as an obvious exception that probably won't be covered by this. I'm not concerned about this though...Bill Gates said that he would solve the spam problem by 2005...right after they figure out how to stop viruses of course... Matt Matt Robertson wrote: Anyone have any comments on how effective this will be (or not...)? What good is this if *everyone* doesn't use it? Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.dlanalyzer.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Feature-itis
That was our log parsing tool (DLAnalyzer). Our mail servers are very busy and we often see a lot of the lines intermixed during peak times. We make every attempt to interpet mixed logging lines to extract as much information out of the lines, but sometimes its so intermixed its impossible so the information gets discarded as unusable. It would be nice to have syslogging as a feature. However, it may not be very easy to integrate syslogging support into Declude. I am curious to know if the majoriety of folks would prefer that the focus of the developer(s) be maintained on developing new spam features versus re-tooling Declude to work with a syslog daemon. Depending on the amount of work my preference (if a lot of work was required) would be to spend the time working on new spam detection features. Darrell Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.dlanalyzer.com Charles Frolick writes: I ran across this when I wrote my graphing app, and someone else that wrote a log parser said they had to skip those lines as well, so the end result is lost information. High volume servers are going to be a lot more likely to suffer. I know there is a solution, what it is I don't know. The ability to write to a syslog daemon would help, it could buffer the input data and commit to the log file with full locking. Just a thought, Scott, you already send log info to Declude Console, how about using Declude console or some other helper app as the log writer, keeps the conversation local and should resolve the whole two processes write to the same line issue? Thanks, Chuck Frolick ArgoLink.net -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, February 23, 2004 3:29 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Feature-itis Ick :) LOGLEVEL MID doesn't look nearly as bad, though there will be the occasional series of line breaks with code appearing in it. I haven't tried parsing the logs with anything but DLAnalyzer though. Matt Colbeck, Andrew wrote: Ahem, like I said, the attachment. Andrew ;) -Original Message- From: Colbeck, Andrew Sent: Monday, February 23, 2004 12:58 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Feature-itis Matt, it's not that I particularly want the log files to be neatly ordered instead of interleaved. Although it would be nice, I'm used to identifying the Q... number first and then filtering out the one(s) I want for examination. My bugbear is that individual lines are garbled, the start of new log lines appearing in the middle of other log lines. See the accompanying snippet for a sample. I have not added or removed any CR/LF from that sample. Back in the stone age, I implemented a very similar logging system that was also multi-process, and locking was feared to be too much of a drain. For readability, I wanted the log to not be interleaved, and I also wanted to avoid generating unique names for the logs, so instead of printing the lines instantly, I appended to a string, complete with CR/LF, and at the end of the task, I then implemented a lock, spin, write, unlock routine. Andrew 8( -Original Message- From: Matt [mailto:[EMAIL PROTECTED] Sent: Monday, February 23, 2004 11:49 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Feature-itis Andrew, I just wanted to chime in and say that I of course would love to see non-text base64 stuff thrown out before scanning, and allow us to target only unencoded text strings. The idea of scanning only the decoded text would also be a big processor saver and the primary method, so maybe you would make the decoded choice the BODY filter and have a BODYSOURCE filter for the encoded version. It's important that a filter have the ability to scan MIME attachment descriptors though, so a method to provide for that would be necessary as well. Maybe a BODYSOURCE check would match what a BODY filter does today even with the source of the attachments. Regarding the logging, I'm not sure about the garbling, but streamed log files like Declude's, IMail's and all sorts of HTTP stuff is generally done on demand instead of grouped together. I believe there are definite advantages beyond speed for doing this. It does though lack a unique identifier as a single field which might be nice for log parsing, and maybe that's what's needed here. Something like the spool file name with a -1 appended to it which increments and appears on each line would do the trick, am I right? That would certainly make things easier to parse. Matt Colbeck, Andrew wrote: Far be it for me to halt progress... Scott, I can't wait to put in the new TESTSFAILED logic. I've wanted exactly this to keep certain multi-answer ip4r tests in check, and Matt is off to a great start in combining tests... I
[Declude.JunkMail] Whitelisting and SPAM
I received a message from a customer that was receiving SPAM. For some reason, this message was whitelisted but we do not have any of theses domains or IP addresses whitelisted. Am I missing something from this message header or can someone add the whitelist line to the message header. The header from the message was as follows: Received: from tcmall.com [80.146.192.132] by mail.tconline.net (SMTPD32-7.15) id AD08F1D023A; Tue, 17 Feb 2004 06:46:00 -0600 To: [EMAIL PROTECTED] From: berry [EMAIL PROTECTED] Message-Id: [EMAIL PROTECTED] Date: Tue, 17 Feb 2004 05:47:56 GMT Subject: A D-r-u-g more potent than VIAG-RA?! Content-Type: text/plain; X-Declude-Sender: [EMAIL PROTECTED] [80.146.192.132] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-Note: This E-mail was sent from [No Reverse DNS] ([80.146.192.132]). X-RCPT-TO: [EMAIL PROTECTED] Here is a header for another message: Received: from tcoek12.org [208.17.78.98] by mail.tconline.net (SMTPD32-7.15) id A7411A740262; Wed, 18 Feb 2004 05:06:41 -0600 To: [EMAIL PROTECTED] From: vince [EMAIL PROTECTED] Date: Wed, 18 Feb 2004 11:05:55 GMT Message-Id: [EMAIL PROTECTED] Sender: [EMAIL PROTECTED] Subject: Would you like to get laid TONIGHT?! Content-Type: text/html; X-Declude-Sender: [EMAIL PROTECTED] [208.17.78.98] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-Note: This E-mail was sent from user98.net270.lv.sprint-hsd.net ([208.17.78.98]). X-RCPT-TO: [EMAIL PROTECTED] Thanks, Isaias Hernandez Internet Tech Support 979-775-6239 [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelisting and SPAM
I have checked the log and found out the reason the message was whitelisted. Here is the scenario... A Spammer sends e-mail to multiple customers of ours. One of these customers does not want anything to be filtered from his e-mail so we added WHITELISTTO [EMAIL PROTECTED] My question is if one of our customers is whitelisted, is everyone receiving this message going to be receiving the whitelisted message? If so, is there a way to whitelist only that one customer and not the other messages that are going to other users? Isaias Hernandez Internet Tech Support 979-775-6239 [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, February 18, 2004 11:41 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Whitelisting and SPAM I received a message from a customer that was receiving SPAM. For some reason, this message was whitelisted but we do not have any of theses domains or IP addresses whitelisted. Am I missing something from this message header or can someone add the whitelist line to the message header. Have you checked the Declude JunkMail log file? It should say why the E-mail was whitelisted. Do you have mail.com whitelisted? That would cause the E-mail to be whitelisted. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Gibberish filter not working
Todd, Yes we do have a version that is compatible with the new log file changes. You need to download 2.0.6R. Darrell Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.dlanalyzer.com Todd writes: Thanks Matt, I have the interim release in now and the filter is working. I do use DLAlalyzer so I will check that I have the latest version of that. I see what you mean about the Declude logs. The Low setting is much different. Thanks again, Todd At 03:18 PM 2/14/2004, you wrote: http://www.declude.com/interim/ Note that I'm not using the very latest interim release, and there can be issues or other unexplained behavior from one version to the next, and they change frequently. Certainly monitor things if you are going to install this just in case, though I haven't seen any major issues reported for weeks. Most issues usually relate to new functionality. The log file format changed from the beta version, at least at the LOW level, and that can impact programs that parse them. There is a new version of DLAnalyzer that works with the new formats if you use that. Matt Todd wrote: I dont see a link on the Declude manual to that version of the beta. Is this something that I can dl? Thanks, Todd At 02:02 PM 2/14/2004, you wrote: Todd, You have to use at least the 1.77i7 or higher interim release. In the initial beta release the END functionality would always trigger which effectively disabled the test. Matt Todd wrote: I updated to the Gibberish 2.1.0 filter and now the filter is not working. The previous 1.07 filter worked fine. I have DJ Pro v 1.77 - re-downloaded today to be sure. Todd Hunter --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How do I stop the reply to potentialvirus senders?
Declude automatically does not send out email notifications to people that the email was intended for or who sent them ? Without any configuration ? What version is that if it is so ? -- Original Message -- From: R. Scott Perry [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Thu, 29 Jan 2004 12:28:37 -0500 What with all the ^%$#%@ viruses and junk mail and forged and spoofed email addresses ... how do I stop the response sent by Declude? Or can I or should I? Declude should *not* be sending a response (either to a forging virus, or to spam). If you look at the thread DUMBAVFILTER ip4r ?, it covers some ideas on how to stop the bogus notifications that are being sent out. Note that if you get any Mydoom notifications from Declude Virus running on other servers, I would like to know about it -- we are contacting our customers that are sending out the bogus notifications. Also ... I tried to find the setup instructions on the web but couldn't find them ... Scott could you point me in the right direction please ... You can find the instructions at http://www.declude.com/junkmail/manual.htm . -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus By Avolve.net] -- Avolve Support Get High Speed Internet - Go Wireless ! http://www.avolvewireless.net -- --- [This E-mail scanned for viruses by Declude Virus By Avolve.net] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Keyword filtering AND Aliases
This is a two part question: First, I had a question about filtering using keywords. I have the following command in the global.cfg: KEYWORDFILTER filter d:\Imail\.\keywordfilter.txtx 10 0 To help stop some of the SPAM that is going through the server, keywords are added to the keywordfilter.txt file. I was wondering if this test is checking attachments and if so, how can I set it to skip over the scanning of attachments for keywords. Second, we also host a number of websites. One of our customers has a personal account on Domain A and has a business account on Domain B. They have it set to forward the e-mails from Domain B to Domain A, literally having Domain B's e-mail address set as an alias. For some reason, Declude is blocking this message. I'm not sure which test it is failing as I was told by someone else of this problem. The problem was fixed by whitelisting the domains but I was just wondering if there was a better way to do this instead of whitelisting. Sorry for the vagueness of the second question. Isaias Hernandez Internet Tech Support 979-775-6239 [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] **OT** Intrusion Detection Software
Snort... darrell Sharyn Schmidt writes: I have been asked to research Intrusion Detection Software. I have done a Google search, but most of what I see is an actual appliance. All I am looking for is software that will notify me when something suspicious attempts to hit our network. Anyone have any suggestions? Sharyn Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.dlanalyzer.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Domain Registrar recommendation
Todd, Dotster.com has always been good to us. Darrell Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.dlanalyzer.com Todd writes: Anyone using a registrar that they like? I want to get some of my clients accounts off of NetSol. I have some registered at www.dotearth.com but I would like a registrar that I can maintain multiple domains from a central interface like at NetSol. Thanks, Todd Hunter --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Best Test for SPAM from AOL, Yahoo
What are the best test weights to use for scanning e-mails from AOL and Yahoo. We are catching many valid e-mails and many SPAM e-mails are going through. We have been getting many complaints from customers about blocking valid e-mails that we have been temporarily whitelisted the domains. Also are there any other tests that can be done to stop the amount of SPAM sent to our uses. 80%-90% of our network traffic is incoming SPAM and much is going through. Thanks, Isaias Hernandez TC Online Internet Tech Support [EMAIL PROTECTED]
RE: [Declude.JunkMail] Best Test for SPAM from AOL, Yahoo
This is our global.cfg file. Isaias Hernandez -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Wednesday, January 28, 2004 3:41 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Best Test for SPAM from AOL, Yahoo Would you mind posting your global.cfg? Redact whatever you want private. With that maybe some good suggestions can be made -Nick Hayer From: TC Online Support [EMAIL PROTECTED] To: Declude.JunkMail [EMAIL PROTECTED] Subject:[Declude.JunkMail] Best Test for SPAM from AOL, Yahoo Date sent: Wed, 28 Jan 2004 15:20:42 -0600 Send reply to: [EMAIL PROTECTED] What are the best test weights to use for scanning e-mails from AOL and Yahoo. We are catching many valid e-mails and many SPAM e-mails are going through. We have been getting many complaints from customers about blocking valid e-mails that we have been temporarily whitelisted the domains. Also are there any other tests that can be done to stop the amount of SPAM sent to our uses. 80%-90% of our network traffic is incoming SPAM and much is going through. Thanks, Isaias Hernandez TC Online Internet Tech Support [EMAIL PROTECTED] # # Declude JunkMail configuration file. # # This file has the global Declude JunkMail settings, defines the tests, and lists the # actions to take on outgoing E-mail (for the Pro version; not normally used). # CODE3C3EF29C # in the LOGFILE option, if present, automatically gets replaced with the month/date. LOGFILE spool\dec.log LOGLEVELLOW HOP 0 #HOPHIGH1 # # Below are some advanced options # XINHEADER X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. XINHEADER X-Spam-Tests-Failed: %TESTSFAILED% [%WEIGHT%] #XINHEADER X-Country-Chain: %COUNTRYCHAIN% XOUTHEADER X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. XSENDER ON XSPOOLNAME OFF #XINHEADER X-Note: This E-mail was sent from %REVDNS% ([%REMOTEIP%]). #XOUTHEADER Organization: Your Name Here #IPBYPASS 127.0.0.1 WHITELIST HABEAS # # Definitions of the tests to use (do not edit unless you know what you are doing). # These must come before the actions. # # First is the name of the check, then the type of check (ip4r is a DNS lookup using # the reverse of the IP address). # # For type ip4r, 'matchstring' is the string to look for, or * for anything. # DSBLip4rlist.dsbl.org * 10 0 MONKEYFORMMAIL ip4rformmail.relays.monkeys.com * 10 0 MONKEYPROXIES ip4rproxies.relays.monkeys.com * 10 0 ORDBip4rrelays.ordb.org * 5 0 OSDIPS ip4rrelays.osirusoft.com127.0.0.3 5 0 OSFORM ip4rrelays.osirusoft.com127.0.0.8 6 0 OSLIST ip4rrelays.osirusoft.com127.0.0.7 5 0 OSPROXY ip4rrelays.osirusoft.com127.0.0.9 7 0 OSRELAY ip4rrelays.osirusoft.com127.0.0.2 4 0 OSSMART ip4rrelays.osirusoft.com127.0.0.5 5 0 OSSOFT ip4rrelays.osirusoft.com127.0.0.6 5 0 OSSRC ip4rrelays.osirusoft.com127.0.0.4 1 0 SPAMCOP ip4rbl.spamcop.net 127.0.0.2 10 0 WIREHUB-DNSBL ip4rblackholes.wirehub.net 127.0.0.2 10 0 DSN rhsbl dsn.rfc-ignorant.org127.0.0.2 5 0 NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 2 0 NOPOSTMASTERrhsbl postmaster.rfc-ignorant.org 127.0.0.3 2 0 BADHEADERS badheaders x x 8 0 BASE64 base64 x x 4 0 HELOBOGUS helovalid x x 7 0 MAILFROMenvfrom x x 12 0 IPNOTINMX ipnotinmx x x 1 0 PERCENT percent x x 10 0 REVDNS revdnsexistsx x 3 0 ROUTING spamrouting x x 5 0 SPAMHEADERS spamheaders x x 5 0 #SNIFFERexternalnonzero C:\IMail\Declude\Sniffer\sniffer.exe authentication 7 0 #WEIGHT5weight x x5 0 #WEIGHT7weight x x7 0 WEIGHT10weight x x 10 0 WEIGHT15weight x x 15 0 WEIGHT20weight x x 20 0 CATCHALLMAILS catchallmails
Re: [Declude.JunkMail] OT zip from command prompt
Winzip has a command line utility add in. Darrell ISPhuset Nordic AS writes: Hi a little off topic Anyone knowing off a free or nearly free zip utility which can pack some files to a zip archive. unpacking isn't a problem It is a must that it can run for a command prompt Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.dlanalyzer.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT zip from command prompt
winzip is only $29...and the command line add-on is free to registered users. Darin. - Original Message - From: ISPhuset Nordic AS [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, January 15, 2004 8:13 AM Subject: [Declude.JunkMail] OT zip from command prompt Hi a little off topic Anyone knowing off a free or nearly free zip utility which can pack some files to a zip archive. unpacking isn't a problem It is a must that it can run for a command prompt Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. _ [This E-mail virus scanned by 4C Web] _ [This E-mail virus scanned by 4C Web] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT zip from command prompt
Well..for 150 it's only $7.00/PC, which is pretty low. One thing I like about winzip is that you buy it once and get every upgrade in the future. I purchased it about 7 years ago and have upgraded two major versions so far, and a third is about to come out. For free, you might check around sourceforge to see if there are any projects that meets your needs. Darin. - Original Message - From: ISPhuset Nordic AS [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, January 15, 2004 8:47 AM Subject: RE: [Declude.JunkMail] OT zip from command prompt Yes i know but i hvae to distribute this on 150 boxes and that is a lot of licenses :-) so free or nearly free are the keyword here -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of DLAnalyzer Support Sent: 15. januar 2004 14:37 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT zip from command prompt Winzip has a command line utility add in. Darrell ISPhuset Nordic AS writes: Hi a little off topic Anyone knowing off a free or nearly free zip utility which can pack some files to a zip archive. unpacking isn't a problem It is a must that it can run for a command prompt Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.dlanalyzer.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. _ [This E-mail virus scanned by 4C Web] _ [This E-mail virus scanned by 4C Web] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] DLAnalyzer - Update Available For The New Log File Changes
For those who have downloaded/currently using DLAnalyzer to process thier Declude Junkmail Logs an update is available that supports the new log file format found in 1.77i15+. It is also backward compatible and will still continue to work with the older log files as well. Please see the read me notes that addresses some new features added as well as some bug fixes for the GUI configuration utility. You can download the update from our site http://www.dlanalyzer.com. Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] *OT* Web dns management console
Hi Nick, I put together a simple one in .NET for MS DNS that uses SQL2K and the dnscmd utility to manage the most common functions in DNS (adding, deleting Host and MX records). Note that it does currently require IIS, the .NET framework, and SQL2K on the MS DNS server. If you're interested, we can talk offline to see if it is a fit for your needs. Darin. - Original Message - From: Nick Hayer [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, January 13, 2004 2:09 PM Subject: Re: [Declude.JunkMail] *OT* Web dns management console Can anyone recommend a web interfaced dns management console for end users? Want end users to be able to manage their own domains eg: adding, deleting, edits. Thanks much! -Nick Hayer --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. _ [This E-mail virus scanned by 4C Web] _ [This E-mail virus scanned by 4C Web] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] *OT* Web dns management console
Totally agree, John. That's why the simple interface I put together has multiple security levels: one for users that could get into trouble by accidentally deleting their MX records and www, etc. hostsand another for more educated users who can be trusted to manage those. Generally shared hosting users can get access to the simple things like adding and deleting , and collocated customers can perform somewhat more advanced tasks like MX and common host (www, ftp, mail, etc.) record management. Overall, it saves us a small amount of support time and makes some of our customers happy when they have the power to make changes themselves without having to contact someone else to do it. Darin. - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, January 13, 2004 2:30 PM Subject: RE: [Declude.JunkMail] *OT* Web dns management console GENERAL WARNING. More control available to the end user means more problems can be created by the end user. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Tuesday, January 13, 2004 11:09 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] *OT* Web dns management console Can anyone recommend a web interfaced dns management console for end users? Want end users to be able to manage their own domains eg: adding, deleting, edits. Thanks much! -Nick Hayer --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. _ [This E-mail virus scanned by 4C Web] _ [This E-mail virus scanned by 4C Web] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
