Strange question here. We have a footer line in our virus config file. it
is not printing at the bottom of the emails.
One possibility is that they are there, but you just can't see them. Many
mail clients will only display footers when viewing the plain text version
of an E-mail.
Another
I have received a couple of emails that were like this over the past couple
of months. I didn't give them much consideration.
Dan Horne, CCNA
Web Services Administrator
TAIS Web
Wilcox World Travel Tours
[EMAIL PROTECTED]
CONFIDENTIALITY
I received a message from a customer that was receiving SPAM. For some
reason, this message was whitelisted but we do not have any of theses
domains or IP addresses whitelisted. Am I missing something from this
message header or can someone add the whitelist line to the message
header.
The
Hello,
are there any known problems with Imail Declude with IDN Domains?
(Like blöd.de or something like that)
Alex
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an
Sorry for my ignorance on this but it's driving me nuts. It appears I have a
spammer on my system. It is coming from one of my dialup customers. I have
started to look into IP addresses for the mail and radius but would like to
be alittle more sure. Does anyone have any good ideas to track someone
Are you using Declude Hijack?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Jeff Kratka
Sent: Wednesday, February 18, 2004 9:38 AM
To: [EMAIL PROTECTED]
Subject:
I received a message from a customer that was receiving SPAM. For some
reason, this message was whitelisted but we do not have any of theses
domains or IP addresses whitelisted. Am I missing something from this
message header or can someone add the whitelist line to the message
header.
Have you
I am using Imail/Declude VirusJunkmail as a gateway for my mail server.
Works wonderfully on mail coming in.
I'd like to route all outbound mail through the Imail/Declude gateway but only to
virus check. I guess I'd like to exclude Junkmail testing on the IP Address of my mail
server.
Can
I am using Imail/Declude VirusJunkmail as a gateway for my mail server.
Works wonderfully on mail coming in.
I'd like to route all outbound mail through the Imail/Declude gateway but
only to virus check. I guess I'd like to exclude Junkmail testing on the
IP Address of my mail server.
Can
check in global for
WHITELIST HABEAS
Spammers are putting Habeas headers in to their mail...we've reported 3 of
them today to www.habeas.com.
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, February 18, 2004 11:40 AM
Subject: Re:
I have checked the log and found out the reason the message was
whitelisted. Here is the scenario...
A Spammer sends e-mail to multiple customers of ours. One of these
customers does not want anything to be filtered from his e-mail so we
added WHITELISTTO [EMAIL PROTECTED]
My question is if
No I have Imail 6.06 (Yeah I know..) Declude Junk Mail and Virus. I have
been thinking about Hijack but right now funds are thin. I'm mostly trying
to track them down.
Jeff Kratka
*
TymeWyse Internet
P.O.Box 84 - 110 Ecklund St., Canyonville,
My question is if one of our customers is whitelisted, is everyone
receiving this message going to be receiving the whitelisted message?
Yes. The way that SMTP works, it is expected that an E-mail with multiple
recipients be delivered to everyone in the same way.
If so, is there a way to
I have a question about Declude Hijack. I was wondering if Hijack will help
me track this person down with IP addresses and logs. It looks like they are
either spoofing an address since I can't see the IP addresses in the radius
or I'm completely brain dead.
This is the first spammer I have had
Hijack tracks outgoing by IP address.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Jeff Kratka
Sent: Wednesday, February 18, 2004 10:27 AM
To: [EMAIL PROTECTED]
For those that are currently using the ANTI-AV filter, it's important
that you take note of this.
In one of the last two releases, I added a bunch of strings to the
filter that detected some non-standard characters that were very common
in these AV bounces, probably due to some broken decoder
We have just released Declude Virus v1.78 (beta). See
http://www.declude.com/junkmail/manual.htm . Notable changes since the
last beta include:
o AV FIX Had an internal limit of 20 forging viruses; changed to 200.
o AV FIX Prevents false positives where begin followed by .
Jeff,
If you ran a log analyzer on your IMail logs and checked for high
utilization senders, that might to it, or maybe grep if you have a
knack for that.
I would think that chances are that this person merely has a virus
infected computer that is being hijacked, though you need to provide
Scott,
This is obviously a very big advance to Declude because it now allows us
to do combination tests. I have a few brief questions though.
First, does IPNOTINMX and NOLEGITCONTENT still get processed (weight
adjustments, and triggers for TESTSFAILED) after custom filters? I've
been
Thank you,
I just installed Declude Hijack and it is helping already. Being that it is
showing the IP address of the outgoing mail and the amount I can check into
this more. I think it will help me with this issue.
Jeff Kratka
*
TymeWyse
First, does IPNOTINMX and NOLEGITCONTENT still get processed (weight
adjustments, and triggers for TESTSFAILED) after custom filters? I've
been setting SKIPIFWEIGHT to a value equal to those tests because the
points would be deducted afterwards. This is also important if we
possibly write a
Hi Scott.
Can I take the Global.cfg from the Declude websiteput my code
in...make any changes to log file locations .copy it to the
\\..\imail\declude directory?
-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED]
Sent: Tuesday, February 17, 2004 12:18 PM
To:
R. Scott Perry wrote:
Actually, both IPNOTINMX and NOLEGITCONTENT should be run before the
filters.
Was this changed??? Back on 12/20/2003 in a thread started by Bill on
Weight processing, several of us stated that we had seen issues
related to these being deducted only after the custom
Can I take the Global.cfg from the Declude websiteput my code
in...make any changes to log file locations .copy it to the
\\..\imail\declude directory?
Yes, that would work fine.
-Scott
---
Declude JunkMail: The advanced anti-spam
From another list I get:
Quote ON
...we now have seven return codes, up from the previous four, and the
Received-SPF field is now more structured.
The total number of domains covered by SPF is actually much, much higher
than 7000. That number comes from self-reporting. The true number is
Actually, both IPNOTINMX and NOLEGITCONTENT should be run before the filters.
Was this changed???
No.
Back on 12/20/2003 in a thread started by Bill on Weight processing,
several of us stated that we had seen issues related to these being
deducted only after the custom filters were
...we now have seven return codes, up from the previous four, and the
Received-SPF field is now more structured.
The SPF protocol is still being changed. The SPF code in Declude JunkMail
follows one of the specs from December -- we expect to add support for the
final one after the final specs
Another incorrect entry is this one:
@ltgsys.com ID-20040121-000433
This is a company called Lighting Systems and is one of our business
partners.
Please fix.
Thank you.
-Mike
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Tom
Sent:
I blocked it with declude Junkmail using this in a myfilter :
BODY 15 CONTAINS TVqQAAME//8AAL
BODY 15 CONTAINS UEsDBAoAAI2aUjBdbrA
Thanks,
Chris Patterson, CCNA
Network Engineer
Rapid Systems
(813)232-4887 Ext. 112
[EMAIL PROTECTED]
Managed Spam Filtering and Anti-Virus
Hi,
Can someone explain these new tests?
I tried searching the archives but couldn't find any previous discussions
about this.
Kevin
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
Can someone explain these new tests?
From the release notes:
New tests dow and hour, to allow hour and day-of-week detection. IE
HOUR hour 9 16 0 0 for local 9AM-4:59PM. DOW dow 1 5 0 0 for Monday
through Friday.
So if you add the following lines to your \IMail\Declude\global.cfg file:
HOUR
What would be a good use for these tests? Or what is the motivation
behind there creation? I don't understand what kind of Spam would be
caught with them.
Thanks,
Todd Holt
Xidix Technologies, Inc
Las Vegas, NV USA
702.319.4349
www.xidix.com
-Original Message-
From: [EMAIL PROTECTED]
Looks good Scott,
o JM FIX IPBYPASS limit increased from 20 to 100 entries.
-Liking this, I'm up to 18
o JM ADD DOMAINWHITELISTS ON option, to allow for per-domain whitelist
files at \IMail\Declude\example.com\whitelist.txt.
-looks easy enough, can't wait to try it!
o JM ADD New tests
On 03:32 PM 2/18/2004 -0800, it would appear that Todd Holt wrote:
What would be a good use for these tests? Or what is the motivation
behind there creation? I don't understand what kind of Spam would be
caught with them.
The point being that legitimate business messages tend to be received
What would be a good use for these tests? Or what is the motivation
behind there creation? I don't understand what kind of Spam would be
caught with them.
Some people find that E-mail during certain hours or days of the week is
more likely to be spam. For example, a business that is open from
o JM ADD Adds TESTSFAILED searching for filters (for tests that have
already run). For example, TESTSFAILED END CONTAINS SPAMCOP.
-Do I understand this correctly, just build FILTER entries that reference
stand alone tests and put them at the top of every FILTER file?
That would work fine.
As
How would you add weight to these testes.
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, February 18, 2004 6:22 PM
Subject: Re: [Declude.JunkMail] new dow and hour tests
Can someone explain these new tests?
From the release
Your blacklist includes @Optonline.com
@optonline.net ID-20040211-002132
M
M Please be advised:
M
M This was an oversight and was removed.
M A new list was generated, sorted and re-formatted.
M
M Best Regards,
M Tom
M Image`fx
Question, Tom, is
.georgewbush.com
Built a filter:
SUBJECT -30 CONTAINS tunafish
Doesn't trigger.
BODY -30 CONTAINS tunafish
Triggers fine.
It could very well be me, but if so, I'm stumped as to why.
Rob
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus
Sorry for false alarm, but I couldn't recreate this myself. Working now.
Rob
===
Built a filter:
SUBJECT -30 CONTAINS tunafish
Doesn't trigger.
BODY -30 CONTAINS tunafish
Triggers fine.
It could very well be me, but if so, I'm stumped as to why.
Rob
---
How would you add weight to these testes.
Instead of:
HOURhour9 16 0 0
you could use:
HOURhour9 16 3 0
which would add 3 points to any E-mail sent between 9AM and 4:59PM.
-Scott
---
Declude
For some reason this isn't coming up in the archives (though I know I've
seen it)
Can someone shoot me the config line for the new CMDSPACE ?
Thanks
Jason
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail
New ONE
Moving fast!
Virus Warning - [EMAIL PROTECTED]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.
43 matches
Mail list logo
