Re: [Declude.JunkMail] Are spammers idiots??

[R. Scott Perry]

The odd this is, I made several posts today, as well as sent numerous
e-mails. SOME were delivered right away, others, like this one, just seemed
to vanish. Until 3:41 in this case


Hmmm...

I'd start by checking the IMail SMTP log file, to see if there are any 
clues in there.
   -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Are spammers idiots??

[paul]

> If you show the headers, we can tell you where the delay was.  

I don't NEED the headers to know where the delay was. now, WHY it was
delayed, can you tell me THAT??? 

Received: from declude.com [66.189.58.123] by mail.2khiway.net with ESMTP
  (SMTPD32-7.13) id AD6F37700DE; Fri, 15 Nov 2002 15:47:43 -0500
Received: from mail.2khiway.net [63.160.179.20] by declude.com with ESMTP
  (SMTPD32-7.06) id ABF15176037C; Fri, 15 Nov 2002 15:41:21 -0500
Received: from NS1 [63.160.179.12] by mail.2khiway.net
  (SMTPD32-7.13) id ADEB2400E4; Fri, 15 Nov 2002 09:00:11 -0500

The odd this is, I made several posts today, as well as sent numerous
e-mails. SOME were delivered right away, others, like this one, just seemed
to vanish. Until 3:41 in this case

Paul


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Are spammers idiots??

[R. Scott Perry]

yeowch, I sent this mail at 8:57, and see it in the inbox at 4:07. what a
turnaround.. LOL!


If you show the headers, we can tell you where the delay was.  
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Are spammers idiots??

[Keith Purtell]

Laugh if you want, but this is the same basic scene I have imagined while laboring 
over the mail
server. However, in my version the cops are like "Detective Sipowitz", and the 
spammers make the
mistake of resisting arrest.

Keith Purtell, Web/Network Administrator
VantageMed Operations (Kansas City)
Email:  [EMAIL PROTECTED]

CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole 
use of the
intended recipient(s) and may contain confidential and privileged information. Any 
unauthorized
review, use, disclosure or distribution is prohibited. If you are not the intended 
recipient, please
contact the sender by reply email and destroy all copies of the original message.


> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of Sean Fahey
> Sent: Friday, November 15, 2002 2:59 PM
> To: '[EMAIL PROTECTED]'
> Subject: RE: [Declude.JunkMail] Are spammers idiots??
>
>
> You forgot the arbitrary "Dude - we're so busted"
>
> -Original Message-
> From: paul [mailto:paul@;2khiway.net]
> Sent: Friday, November 15, 2002 7:57 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] Are spammers idiots??
>
>
> LOL! I like that,
>
> Tonight, on COPS! watch the downfall of a SPAM ring.
>
> ding-dong - hello! DELL here with your new PC.
>spammer: dude! we're gettin a DELL!
> COPS - FREEZE DIRTBAG!
>


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Are spammers idiots??

[paul]

yeowch, I sent this mail at 8:57, and see it in the inbox at 4:07. what a
turnaround.. LOL!

Paul
- Original Message -
From: "paul" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, November 15, 2002 8:57 AM
Subject: Re: [Declude.JunkMail] Are spammers idiots??


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Are spammers idiots??

[Sean Fahey]

You forgot the arbitrary "Dude - we're so busted"

-Original Message-
From: paul [mailto:paul@;2khiway.net]
Sent: Friday, November 15, 2002 7:57 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Are spammers idiots??


LOL! I like that,

Tonight, on COPS! watch the downfall of a SPAM ring.

ding-dong - hello! DELL here with your new PC.
   spammer: dude! we're gettin a DELL!
COPS - FREEZE DIRTBAG!

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Are spammers idiots??

[paul]

LOL! I like that,

Tonight, on COPS! watch the downfall of a SPAM ring.

ding-dong - hello! DELL here with your new PC.
   spammer: dude! we're gettin a DELL!
COPS - FREEZE DIRTBAG!

Paul


> Well, if police can bust con artists and prostitutes, why can't they drag
away spammers? Thirty days
> in jail would undoubtedly send a message. Computer crimes get taken less
seriously than their "real
> world" counterparts, despite publicity about financial losses caused by
this kind of thing. It seems
> like law enforcement doesn't want to slap the cuffs on someone unless they
actually see them
> stealing a little old lady's purse.


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] BASE64 test

[R. Scott Perry]

I see a test in the more recent Declude config files called BASE64, but
cannot find any documentation of what this test does and why it would be
used. I know what Base64 encoding/decoding is, but maybe someone could
enlighten me as to why it would be a good test to use and what it checks
for. I did check through this list but only found a couple of messages that
did not answer my questions.


The BASE64 test will be triggered when E-mail contains a text or HTML MIME 
segment that is base64 encoded -- there is no reason for such segments to 
be base64 encoded, but spammers commonly use the base64 encoding to try to 
bypass filters.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] BASE64 test

[Richard Edge]

I see a test in the more recent Declude config files called BASE64, but
cannot find any documentation of what this test does and why it would be
used. I know what Base64 encoding/decoding is, but maybe someone could
enlighten me as to why it would be a good test to use and what it checks
for. I did check through this list but only found a couple of messages that
did not answer my questions.

Richard Edge 
System Administrator
TRINITY WESTERN UNIVERSITY 
Voice: 604-513-2089   
E-mail: [EMAIL PROTECTED] 
WWW: http://www.ucs.twu.ca  
FAQ: http://www.ucs.twu.ca/resources/faq.htm
 
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx

[John Tolmachoff]

>I figured I would express the way the spammers our making it difficult to
figure out who is the bad guy and who is the good guy.

Boy Tom, you're not kidding. I have one client that gets a lot of bcc
broadcasts because of the competitive nature of the business they are in. I
have to do a lot of whitelisting for them.

John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx

[Thomas Juliano]

> I don't know what to say 
> I'm sorry? I was just curious. 

There is no reason to be sorry, I wrote the message to clarify
our fromfile and what we are about.  I figured I would express
the way the spammers our making it difficult to figure out who
is the bad guy and who is the good guy.

> I wasn't ridiculing you or your list.

Don't worry about it, I did not take it that way.
I just felt the need to explain it.


Regards,
Tom
Image`fx

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Declude Console Wish List Request

[R. Scott Perry]

Could you activate horizontal scroll capability for the window.  Even at
full screen there's information that's not visible on the right hand
side and no scroll capability exists.


That's something that we will look into, and see if we can fix.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx

[Patrick Childers]

I would just like to say that I use Tom's list (Delog too!).
His time and effort keeping his list/tools updated is truly appreciated. I
thank you Tom! :-)

Like others on this mail list, there are a few domains on Imagefx's
"fromfile" that I need to receive.

So, I created another "fromfile" with the exact NEGATIVE weight that I
assigned to Imagefx's "fromfile".
I enter those "needed" domains/addresses in that list so the weights are
cancelled out. Works well for me.

I think Craig may have saw this post on the 13th and was "taking you up" on
the offer.

>>On 11-13-02 Tom said,
>"Although I am blocking it, does not mean you have to.
>I don't remember every reason for each site added to
>the list, however, more than likely they were sending
>us junk mail without permission.  If you feel that for
>some reason I am wrong for placing them into the list
>then I would like to here it.  I am only human and
>un-like a computer I do make mistakes and unlike a
>computer I try to rectify them."
>(from:
http://www.mail-archive.com/declude.junkmail@;declude.com/msg05218.html )

I am not trying to "start" anything - maybe just clarifying something.

Regards,
Patrick


> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of Craig Gittens
> Sent: Friday, November 15, 2002 9:17 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx
>
>
> I don't know what to say I'm sorry? I was just curious. I wasn't
> ridiculing you or your list.
>
> Craig.
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of Tom
> Sent: Thursday, November 14, 2002 9:08 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx
> Importance: High
>
>
> > Well I just wanted to see what the reason was. I assumed since
> > all the entries have a catalogue number that the reason was
> > recorded. In addition I do believe outpost does have removal
> > instructions at the bottom of the emails.
>
> Our List:
>
> Our list is a private list, however, we do share it with the
> Declude community.  Image`fx is not in the business to stop
> spam, we are a local ISP/Developer not SpamCop.  We don't have
> the time and/or resources to become one.  The idea behind the
> list was suppose to be for all of us to share or contribute to.
> Not many people have contributed to our list, but that's ok,
> we don't need the extra work.  We have also indicated to those
> who use the list to use it at their own risk and to consider
> using it with a weight value.
>
>
> IDs:
>
> The ID's were added to work with our program ReadID to help
> identify the address inside Declude's log file without using
> a separate database.  The ID's contain a date and unique
> number as a description.  This description only works with
> Declude's fromfile not Imail's kill list.  This unique ID
> will indicate to ReadID the last time of usage so it can
> clean out addresses that spammers no longer use after X
> number of days.
>
> Removal:
>
> While this may be true for most services I don't feel that
> we should have to do this, we did not sign up for it, so
> why the heck should we sign out from it.  Why would I or
> you want to tell them that we actually exist?  Why should
> I have to tell them I don't want their stupid little news
> letters or pornographic garbage?  I did not ask for it in
> the first place, not only that, it's MY server that they
> are using to advertise from.  Well, guess what, they can
> kiss my royal spam a$$.  They did not pay for my system.
> I did, my blood, my sweat, my hard earned money.  What
> right do they have?  A loop whole the law?  Either way
> I don't care.
>
> 
>
> The problem with those so called removal options is that
> you never know what their intentions actually are.  I
> did try this method and guess what, I got even MORE SPAM.
> So a word to the wise, don't believe everything you see.
>
> It's just as bad a an ANTI SPAM company sending us spam
> to stop their spam, what the heck do they think they
> sent us in the first place?
>
> Best Regard,
> Tom
> Image`fx Productions, Inc.
> Provider of ExecNet Internet Services

---
[This E-mail scanned for viruses by Declude/McAfee]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Are spammers idiots??

[John Tolmachoff]

>i'm sold where do I signup to be a spammer LOL!  kidding of  course...
>does everyone remember that line in the movie gone in 60 seconds where the
>girls says " i discovered you have to work twice as hard when it's honest,"
>who's she kidding it's more like 3 times LOL!

I think your 3 times is a little off. Seems like it is more like 10 times.
:))

John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Possible small wild card?

[R. Scott Perry]

Any chance of considering, of course if it makes sense, a wild card for 
fromfile?

It's in the suggestion database.


of course if we are to blacklist we need 2 entries, namely:

@domain.com
.domain.com

Why can't we have a special character that can substitute for both "@" & 
".", for example:

The problem is that it would be a major change in how the blacklist 
works.  Right now, it pretty much just looks for exactly what you 
enter.  Once we add "&", it has to be documented and will cause extra 
support ("What's that character again?"), we have to first check to see if 
it is a valid E-mail character (if so, we need a way to allow the "&" in 
there such as "&&", and need to document that), and so on.  It's something 
we would like to see, but since it doesn't add any extra real 
functionality, it isn't a high priority right now.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Article

[Dan Olsen ( DANO)]

http://techupdate.zdnet.com/techupdate/stories/main/0,14179,2897473,00.html
 
  I think this guy is a little behind in the 
game. 

RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx

[Craig Gittens]

I don't know what to say I'm sorry? I was just curious. I wasn't
ridiculing you or your list.

Craig.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of Tom
Sent: Thursday, November 14, 2002 9:08 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx
Importance: High


> Well I just wanted to see what the reason was. I assumed since
> all the entries have a catalogue number that the reason was
> recorded. In addition I do believe outpost does have removal
> instructions at the bottom of the emails.

Our List:

Our list is a private list, however, we do share it with the
Declude community.  Image`fx is not in the business to stop
spam, we are a local ISP/Developer not SpamCop.  We don't have
the time and/or resources to become one.  The idea behind the
list was suppose to be for all of us to share or contribute to.
Not many people have contributed to our list, but that's ok,
we don't need the extra work.  We have also indicated to those
who use the list to use it at their own risk and to consider
using it with a weight value.


IDs:

The ID's were added to work with our program ReadID to help
identify the address inside Declude's log file without using
a separate database.  The ID's contain a date and unique
number as a description.  This description only works with
Declude's fromfile not Imail's kill list.  This unique ID
will indicate to ReadID the last time of usage so it can
clean out addresses that spammers no longer use after X
number of days.

Removal:

While this may be true for most services I don't feel that
we should have to do this, we did not sign up for it, so
why the heck should we sign out from it.  Why would I or
you want to tell them that we actually exist?  Why should
I have to tell them I don't want their stupid little news
letters or pornographic garbage?  I did not ask for it in
the first place, not only that, it's MY server that they
are using to advertise from.  Well, guess what, they can
kiss my royal spam a$$.  They did not pay for my system.
I did, my blood, my sweat, my hard earned money.  What
right do they have?  A loop whole the law?  Either way
I don't care.



The problem with those so called removal options is that
you never know what their intentions actually are.  I
did try this method and guess what, I got even MORE SPAM.
So a word to the wise, don't believe everything you see.

It's just as bad a an ANTI SPAM company sending us spam
to stop their spam, what the heck do they think they
sent us in the first place?

Best Regard,
Tom
Image`fx Productions, Inc.
Provider of ExecNet Internet Services






---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Possible small wild card?

[Kami Razvan]

Title: Message



Hi 
Scott:
Any chance of 
considering, of course if it makes sense, a wild card for 
fromfile?
 
We see companies 
that send SPAM from different variations of emails.
 
[EMAIL PROTECTED]
[EMAIL PROTECTED]
 
of course if we 
are to blacklist we need 2 entries, namely:
 
@domain.com
.domain.com
 
Why can't we have 
a special character that can substitute for both "@" & ".", for 
example:
 
?domain.com
 
& it includes 
both listings.
 
This can reduce 
the size of blacklist tremendously (if not by 1/2).  Would this be 
beneficial at all?
 
Regards,
Kami

Re: [Declude.JunkMail] Why did this get nabbed by my pornfilter?

[Mike K]

Had a similar occurance on filtering for theose stupid spam penny stock tips
that always contain "O*T*C"

Found out that attachments sometimes morphed to contain that string.

Lesson learned, be more specific.

Mike

- Original Message -
From: "Sharyn Schmidt" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, November 15, 2002 8:15 AM
Subject: RE: [Declude.JunkMail] Why did this get nabbed by my pornfilter?


> Statistically it should not happen often,
> but it can happen occasionally.  The longer the string you search on,
> the
> less likely it will happen.
> -Scott
>
>
>
> Thanks, Scott. This is the very first time something like this has
> happened so I'm not going to worry about it. Just making sure I didn't
> miss something obvious :)
>
> Sharyn
>
>
> We are the worldwide producer and marketer of the award winning Cruzan
> Single Barrel Rum, judged "Best in the World" at the annual
> San Francisco Wine and Spirits Championships. For
> more information, please click (go to) http://www.cruzanrums.com";>www.cruzanrums.com
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>
>


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Declude Console Wish List Request

[George Kulman]

Scott,

Could you activate horizontal scroll capability for the window.  Even at
full screen there's information that's not visible on the right hand
side and no scroll capability exists.

Thanks,

George Kulman
Partner
Ridge Systems, L.L.C.

Cell   - 201-647-3250 or 516-582-0019
Office - 201-291-0600
Fax- 201-291-8887 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Why did this get nabbed by my pornfilter?

[Sharyn Schmidt]

Statistically it should not happen often, 
but it can happen occasionally.  The longer the string you search on,
the 
less likely it will happen.
-Scott



Thanks, Scott. This is the very first time something like this has
happened so I'm not going to worry about it. Just making sure I didn't
miss something obvious :)

Sharyn


We are the worldwide producer and marketer of the award winning Cruzan
Single Barrel Rum, judged "Best in the World" at the annual
San Francisco Wine and Spirits Championships. For
more information, please click (go to) http://www.cruzanrums.com";>www.cruzanrums.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Newbie Whitelist / PERCENT questions

[Patrick Childers]

Are you running v1.62? I believe the HABEAS test requires that version of
Declude.

PERCENT Test: (taken from the Declude manual)
"This test will catch all mail with "To:" addresses that contain a percent
sign. The percent sign indicates an outdated routing method that can be used
by spammers to bypass closed relays. IMail does normally check for this, but
there is a report of it not catching this type of mail under certain
circumstances."


> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of Diarmaid Mac
> Aonghusa
> Sent: Friday, November 15, 2002 5:34 AM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] Newbie Whitelist / PERCENT questions
>
>
> Hi
>
> I've just installed 'JunkMail' and in the log file I get the line...
>
> 11/15/2002 10:16:05  Invalid WHITELIST type: HABEAS
>
> every time it does a check.
>
> I have not made any change to the whitelist settings so why am I getting
> this error?  Should I just reomve the reference to 'HABEAS' from
> the config
> file?
>
> Also, in the $default$.junkmail file, there is a setting for PERCENT
> What test is this referring to?  I can't seem to find a reference to it.
>
> Thanks
>
> Diarmaid

---
[This E-mail scanned for viruses by Declude/McAfee]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Why did this get nabbed by mypornfilter?

[R. Scott Perry]

Here is the body of the email that the filter nabbed:

[[ MAPI 1.0 storage : 4891 in winmail.dat ]]I keep getting these error
messages, in Excel and Word, A Lot! In fact they have frozen my PC on
more than one occasion. Can someone help me please?
-


I'm guessing that the 4-character string that you are searching on appeared 
in the attachment (winmail.dat).  Statistically it should not happen often, 
but it can happen occasionally.  The longer the string you search on, the 
less likely it will happen.
   -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Newbie Whitelist / PERCENT questions

[R. Scott Perry]

I've just installed 'JunkMail' and in the log file I get the line...

11/15/2002 10:16:05  Invalid WHITELIST type: HABEAS

every time it does a check.

I have not made any change to the whitelist settings so why am I getting
this error?  Should I just reomve the reference to 'HABEAS' from the config
file?


Yes, if you remove the "WHITELIST HABEAS" line from the 
\IMail\Declude\global.cfg file (or just put a "#" in front of it), you 
should be all set.  That's a new feature in the latest beta.  Having that 
line in your global.cfg file for earlier versions won't cause a problem, 
except for that warning message.

Also, in the $default$.junkmail file, there is a setting for PERCENT
What test is this referring to?


That test will catch all mail that has a "%" in the recipient's 
address.  That was used in the old days for routing E-mail, and shouldn't 
be used anymore.  However, under certain circumstances, IMail can end up 
being an open relay and allowing that type of mail to be accepted and 
relayed.  We added the test to make sure that it could not happen.
-Scott



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Why did this get nabbed by my pornfilter?

[Sharyn Schmidt]

Good morning and tgif!

I have made a custom filter that I've named pornfilter. In my global
config, it looks like this:

PORNFILTER FILTER D:\IMAIL\Declude\filterlist.txt x 1 0

In the filterlist.txt file, I only have one entry:

BODY 0 CONTAINS F * C K (no spaces, no *, pardon the french)

The action for the pornfilter is to attach. So far this has worked great
but today it nabbed something that, for the life of me, I can't figure
out why. (course, it IS Friday and the old brain doesn't work so well at
the end of the week)

Here is the body of the email that the filter nabbed:


[[ MAPI 1.0 storage : 4891 in winmail.dat ]]I keep getting these error
messages, in Excel and Word, A Lot! In fact they have frozen my PC on
more than one occasion. Can someone help me please?

-

The declude email that comes with the attachment looked like this:

You have spam!

Subject:computer kinks
From:   [EMAIL PROTECTED] 
Tests Failed:   1-PORNFILTER-Dfc77134.SMD

To view the E-mail, just click the attachment.


So, there is no doubt my pornfilter triggered it.

Why

Thanks in advance!
Sharyn


We are the worldwide producer and marketer of the award winning Cruzan
Single Barrel Rum, judged "Best in the World" at the annual
San Francisco Wine and Spirits Championships. For
more information, please click (go to) http://www.cruzanrums.com";>www.cruzanrums.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Newbie Whitelist / PERCENT questions

[Diarmaid Mac Aonghusa]

Hi

I've just installed 'JunkMail' and in the log file I get the line...

11/15/2002 10:16:05  Invalid WHITELIST type: HABEAS

every time it does a check.

I have not made any change to the whitelist settings so why am I getting
this error?  Should I just reomve the reference to 'HABEAS' from the config
file?

Also, in the $default$.junkmail file, there is a setting for PERCENT
What test is this referring to?  I can't seem to find a reference to it.

Thanks

Diarmaid


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: RE: [Declude.JunkMail] subscribe message

[David Lewis-Waller]

The domain that Declude was registered to has to be the same as the
official host in Imail or Declude won't work.  

David
WiSS Limited

-Original Message-
From: [EMAIL PROTECTED]
[mailto:Declude.JunkMail-owner@;declude.com] On Behalf Of Tom
Sent: 15 November 2002 07:47
To: [EMAIL PROTECTED]
Subject: RE: RE: [Declude.JunkMail] subscribe message



>
> I have just purchased my copy of declude and I am getting this in my 
> log files? Does anyone know why?
>
>
> 11/14/2002 22:54:40 Q7e100b79021ad390 Declude JunkMail NOT Registered 
> for media14.mediaresolutions.com; not scanning E-mail.

I believe that your Declude registration is not for that domain, please
check the domain name that you used to register Declude with.  I could
be wrong, but I'm sure I read something about it someplace when I
purchased Declude.

Regards,
Tom
Image`fx

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx

[Don Schreiner]

Errr I second that response as I spend my daily morning hour
cleaning Spam from the servers. Tom has a great service with his list
and while an occasional address mistakenly listed - it is incredible how
the addresses are near the same as the addresses we add to our list when
running Read ID and it checks for duplicates. 

-Don S.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:Declude.JunkMail-owner@;declude.com] On Behalf Of Tom
Sent: Thursday, November 14, 2002 8:08 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx
Importance: High

> Well I just wanted to see what the reason was. I assumed since 
> all the entries have a catalogue number that the reason was 
> recorded. In addition I do believe outpost does have removal
> instructions at the bottom of the emails.

Our List:

Our list is a private list, however, we do share it with the 
Declude community.  Image`fx is not in the business to stop
spam, we are a local ISP/Developer not SpamCop.  We don't have
the time and/or resources to become one.  The idea behind the
list was suppose to be for all of us to share or contribute to.
Not many people have contributed to our list, but that's ok, 
we don't need the extra work.  We have also indicated to those
who use the list to use it at their own risk and to consider
using it with a weight value.


IDs:

The ID's were added to work with our program ReadID to help
identify the address inside Declude's log file without using
a separate database.  The ID's contain a date and unique
number as a description.  This description only works with
Declude's fromfile not Imail's kill list.  This unique ID
will indicate to ReadID the last time of usage so it can
clean out addresses that spammers no longer use after X
number of days.

Removal:

While this may be true for most services I don't feel that
we should have to do this, we did not sign up for it, so
why the heck should we sign out from it.  Why would I or
you want to tell them that we actually exist?  Why should
I have to tell them I don't want their stupid little news
letters or pornographic garbage?  I did not ask for it in 
the first place, not only that, it's MY server that they
are using to advertise from.  Well, guess what, they can
kiss my royal spam a$$.  They did not pay for my system.
I did, my blood, my sweat, my hard earned money.  What
right do they have?  A loop whole the law?  Either way
I don't care.  



The problem with those so called removal options is that
you never know what their intentions actually are.  I
did try this method and guess what, I got even MORE SPAM.
So a word to the wise, don't believe everything you see.

It's just as bad a an ANTI SPAM company sending us spam
to stop their spam, what the heck do they think they 
sent us in the first place?

Best Regard,
Tom
Image`fx Productions, Inc.
Provider of ExecNet Internet Services






---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
Scanned by CompBiz for Viruses http://www.CompBiz.Net.
Save 15 Percent on Virus Software by visiting
http://www.compbiz.net/software_mcafee.cfm for details!


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: RE: [Declude.JunkMail] Whitelisting To address

[Tom]

>> Having Declude Standard, I can only 
>> WHITELIST TO abuse or postmaster,
>> correct?

> That is correct.

Would it be to much to ask for another possible 
address that could be whitelisted to the list, such
as "refused@"?  This is an address that is used to
delete any mail that is sent to it.  Because of the
restrictions and/or limitations with Imail we had
to create a special account to just accept and 
DELETE mail.  When a spam message comes in to 
Imail it is held and if it was designated for 
oblivion it has to wait for our intervention.
We tried to pick out the best name to use for
mail that will be sent to the can, however,
this can be changed if necessary to work with
what ever you feel would be appropriate.

Regards,
Tom
Image`fx

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.