I don't want to knock Alligate, it has some nice functionality,
especially when used without Declude (auto whitelisting and digest
notification), and it does what it says, but it has a relatively high
false positive rate in the default configuration and therefore it can't
be scored higher
Hi,
Message sniffer is not so bad as I tested it but have a big problem with
News letter it has a bif False positive rate with them.
Regards
Mehdi Blagui
-Message d'origine-
De : [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] De la part de Matthew
Bramble
Envoyé : jeudi 21 août 2003 03:32
I'm running twin dual Xeon 2.4s and was nearly wiped out today by all the extra
virus/worm activity. Its midnight and I'm still clearing out the overflow, to the
tune of 2 dozen Declude processes.
Rather than running them in parallel as we had before (setting them up with the same
MX weight),
Hi,
I'm trying actually to trigger some action in case of combination of
failed test not only on Weight.
For example if Weight 15 and the test fail Filter.txt test wich is
done against keyword or a test like sniffer, we want then to delete the
email of hold it! In other case the delete action
Dan,
Declude does not have that kind of power as it is the IMAIL SMTP Daemon
which accepts the mail and places it into the spool.
After it is in the spool declude queue moves it to the overflow for faster
processing if there are more messages in the spool than imail can run
smtp-delivery
That is not possible at this time with Declude, and has been discussed. Some
other tests maybe be looking at the ability to do that.
However, while the concept is interesting, your example has the potential to
delete legits.
The reason is taking action based on blacklisted keywords can be
Check-out this obfuscation technique: ;-)
-E---y---P---G
-n---o---e---u
-l---u---n---a
-a---r---i---r
-r---s---a
-g---n
-e---t
-e
-e
-d
Bill
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This
LOL! that's peanuts.. try 70,000 ...yes 70,000 per hour and then tell
me about being nailed ... and i didn't have a powerhouse like you...only a
400mhz p2 in otherwords 2.5 million in 24 hours.
Sheldon
- Original Message -
From: Tom Baker|Netsmith Inc [EMAIL PROTECTED]
To:
Message sniffer is not so bad as I tested it but have a big problem
with News letter it has a bif False positive rate with them.
On the home page for MessageSniffer you'll find a Help (QA) section which
is worth your time to read if it's worth your time to implement.
Submit false positives to:
Please forward a copy of the newsletter to me
([EMAIL PROTECTED]) as an attachment and I will adjust the rule
base (if appropriate). This is a service we provide by default to each
subscriber, but we also - in general - code the core rule base to avoid
false positives whenever we hear about them
Wow, I thought my increase in messages from 5,800 messages inbound to 10,000
was a lot.
BTW, my old mail server (PII @ 333 MHz, data on a SCSI2 mirror) with the
same volume would regularly run mid-morning (my peak volume) with a 30 to
100 messages in the overflow folder.
The new server (PIII @
Hi,
Many of our users are getting plowed by Sobig, Declude and Fprot do
there job well, but the users mailbox is getting clogged with the
notices of detection. Is there a way to turn off notices for a
particular virus? For now I've removed the mail templates.
Any ideas?
---
[This E-mail was
Many of our users are getting plowed by Sobig, Declude and Fprot do
there job well, but the users mailbox is getting clogged with the
notices of detection. Is there a way to turn off notices for a
particular virus? For now I've removed the mail templates.
Add a line SKIPIFVIRUSNAMEHAS Sobig to
I've removed my notice .eml template to users... I've found that they really
don't want to see them at all. As far as they are concerned if it's been
blocked why should they care.
Greg
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Malcolm Kynoch
Sent:
We have a little less volume than you do, but it's amazing how
concentrated the messages can be. My personal account which has many
domains pointed at it has not received a single copy of the virus, but
one account on our server has been hit over 500 times in the last 48
hours. We run Declude
We have a little less volume than you do, but it's amazing how
concentrated the messages can be. My personal account which has many
domains pointed at it has not received a single copy of the virus, but one
account on our server has been hit over 500 times in the last 48
hours. We run
Hi All,
Can I use Junkmail to delete incoming emails that are bounces from
Postmaster, etc?
THANKS
Peter
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to
Well, you shouldn't... here is a cleaned up version of the JunkMail Pro
filter file I started using last night.
My global.cfg has:
BADNOTIFY filter D:\IMail\Declude\BadNotify.txt x 0 0
and
BADNOTIFY HOLD
If you want BADNOTIFY to show up in your Total weight = lines in your
decMMDD.log file,
Greg wrote
I've found that they really don't want to see them at all.
I get that a lot myself. However the notices also tell them my
value-added service is diligently doing its job. If I don't remind them
why they're paying me, they might forget :D
With that said, enough is enough.
Can I use Junkmail to delete incoming emails that are bounces from
Postmaster, etc?
Actually, to do that, you can use the IMail SMTP Refuse NULL Senders
option (which has the added benefit that it will not use up bandwidth for
the bounce message). But it is not recommended -- doing so will
Here's what I do. I send outside notifications by way of
[EMAIL PROTECTED], and then I use IMail rules to delete any
replies. The text of the message says to reply to our postmaster
address and that replies to bouncer will be automatically deleted. The
rule.ima file takes care of it with
Rusty,
Since they're all trying to get your money, they always have a URL or phone
number, possibly obfuscated, which you can block with a filter if you have
the PRO Version. I think that this is my fastest growing filter file.
George
-Original Message-
From: [EMAIL PROTECTED]
22 matches
Mail list logo
