[Declude.JunkMail] JunkMail Newbie

2004-07-16 Thread Evans Martin
Is there a clearing house of JunkMail rules, configs, etc. somewhere so I don’t have to start completely from scratch?   Thanks, Evans Martin   --- Evans L. Martin - Owner, Martek.Net (615) 324-6074 Office    (615) 523-1679 FAX ISP & Website Development:  http://www.martek.net Prog

Re: [Declude.JunkMail] MTLDB observations

2004-07-16 Thread Matt
Scott, If you need a hand with this, I have become quite familiar with the methods used by similar tests, such as CBL, to cleanse their listings and I would gladly contribute my knowledge to help you avoid listing legitimate servers. I shared some of this when it was first released, but I coul

[Declude.JunkMail] OT: find command

2004-07-16 Thread John Tolmachoff \(Lists\)
Is it possible to use the * in the find command? Example: Find "@aol.com" \*\forward.ima >found.txt The idea is to search all subdirectories of the current director for forward.ima and look to see if @aol.com is in there. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E

Re: [Declude.JunkMail] MTLDB observations

2004-07-16 Thread Bill Landry
- Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> > >Unless the database gets cleaned up, I don't see this as a useable test. > > We're working on that. There will be a major change to the listings within > the next week. Please announce to the list when these changes have

RE: [Declude.JunkMail] MTLDB observations

2004-07-16 Thread R. Scott Perry
Unless the database gets cleaned up, I don't see this as a useable test. We're working on that. There will be a major change to the listings within the next week. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailserver

Re: [Declude.JunkMail] E-mail message ID and declude

2004-07-16 Thread R. Scott Perry
Is there a way to get the actions for a message from the Declude log files when all I have is the Message-ID. The To/From fields are suspect. Unfortunately, I do not believe that is possible, since neither Declude nor IMail record the Message-ID:.

Re: [Declude.JunkMail] MTLDB observations

2004-07-16 Thread Bill Landry
- Original Message - From: "Brad Morgan" <[EMAIL PROTECTED]> > Here's what I've seen to date using a Perl script I've written to monitor > the results. I'll leave the test active for a while longer but I've reduced > the weight of the MTLDB test to 0. > > Unless the database gets cleane

RE: [Declude.JunkMail] MTLDB observations

2004-07-16 Thread Brad Morgan
Here's what I've seen to date using a Perl script I've written to monitor the results. I'll leave the test active for a while longer but I've reduced the weight of the MTLDB test to 0. Unless the database gets cleaned up, I don't see this as a useable test. At the moment, hp.com, sun.com, sourcef

RE: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities

2004-07-16 Thread Jose Gosende
Thank God I'm not, and like I said, after turning off syslog things are back to normal. Jose -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of marc catuogno Sent: Friday, July 16, 2004 3:26 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] OT: iMail 6.0

RE: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities

2004-07-16 Thread marc catuogno
If you are using LDAP that is completely and horribly hackable and I don't think there is a patch below 7. Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jose Gosende Sent: Friday, July 16, 2004 9:57 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMa

RE: [Declude.JunkMail] SOT somewhat offtopic

2004-07-16 Thread John Tolmachoff \(Lists\)
Exchange can not do it natively, or not dependably. There are 3rd party add-ons available for that function. Check out MSExchange.org. John Tolmachoff Engineer/Consultant/Owner eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED]

RE: [Declude.JunkMail] SOT somewhat offtopic

2004-07-16 Thread Grant Griffith - Declude JM
I know it can be done as we have a client that POP's into it all the time. I am not familiar with Exchange, but it might be an add-on tool or something. I see the POP lines in the log every day. Sincerely, Grant Griffith EI8HT LEGS Enhanced Web Management A Division of ETC http://www.getafreewebs

RE: [Declude.JunkMail] OT: Grep out letters

2004-07-16 Thread Scott Fisher
That works perfectly. Better than I anticipated. Scott Fisher Director of IT Farm Progress Companies >>> [EMAIL PROTECTED] 07/16/04 12:05PM >>> Hey, Scott. If you'd like, send me a sample off-list. I could use a short brain teaser this morning. The general idea I think would be to do a grep an

Re: [Declude.JunkMail] SOT somewhat offtopic

2004-07-16 Thread Serge
< Just setup aliases to point to a < global box and have Exchange POP into it. It is simple. The client said Exchange cannot pop in an imail mailbox Are you sure it can be done ? To you have a link about how to configure the feature in exchange ? - Original Message - From: "Grant Griff

Re: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities

2004-07-16 Thread Darin Cox
A quick google for "kiwi syslog" reveals...www.kiwisyslog.com... Darin. - Original Message - From: "Jeff Maze" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, July 16, 2004 2:26 PM Subject: RE: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities Hmmm.. Have a link for Kiwi? -

RE: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities

2004-07-16 Thread Jeff Kratka
Here you go... http://www.kiwisyslog.com/ Jeff Kratka TymeWyse Internet P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] -Original Message- F

RE: [Declude.JunkMail] SOT somewhat offtopic

2004-07-16 Thread Grant Griffith - Declude JM
We do this for a client and had the nobody alias setup to goto a certain email address. Then Exchange POP's that account and delivers the email to the users on the exchange box. This solution does scan emails with Declude. We dropped the nobody alias and setup individual aliases though as we were

Re: [Declude.JunkMail] SOT somewhat offtopic

2004-07-16 Thread Serge
thanks for all that helped - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, July 16, 2004 6:00 PM Subject: RE: [Declude.JunkMail] SOT somewhat offtopic > Yes, change to a Store and Forward for them. I did that exact same thi

RE: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities

2004-07-16 Thread Jeff Maze
Hmmm.. Have a link for Kiwi? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Kratka Sent: Friday, July 16, 2004 2:16 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities I'm still running v6.06 (mostly due to cost

RE: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities

2004-07-16 Thread Jeff Kratka
I'm still running v6.06 (mostly due to cost). One thing I found was moving the spool directory to a completely different location and using Kiwi for my syslog it helped alot. Jeff Kratka TymeWyse Internet P.O.Box 84 - 110 Ecklund St., Canyonville,

[Declude.JunkMail] Spammers using virus infected computers

2004-07-16 Thread John Tolmachoff \(Lists\)
Wasn't some one just last week trying to claim that a test based on virus infected machines was worthless in JunkMail, as what does that have to do with spam? http://techrepublic.com.com/5100-22_11-5272333.html?tag=e019 John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-ma

RE: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities

2004-07-16 Thread John Tolmachoff \(Lists\)
Or leave it off and use Kiwi. John Tolmachoff Engineer/Consultant/Owner eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Jose Gosende > Sent: Friday, July 16, 2004 10:35 AM > To: [EMAIL PROTECTED] > Subject: RE: [

RE: [Declude.JunkMail] SOT somewhat offtopic

2004-07-16 Thread John Tolmachoff \(Lists\)
Yes, change to a Store and Forward for them. I did that exact same thing last year when a client moved from MDaemon to Exchange. 1. Yes. 2. Yes, but not needed. Use Declude Junkmail actions and per domain configuration. 3. It is in the archives. John Tolmachoff Engineer/Consultant/Owner eService

RE: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities

2004-07-16 Thread Jose Gosende
FWIW - After turning off the IMail Sys Logger Service the server is much more stable. Time to find if there's an exploit for this service... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Maze Sent: Friday, July 16, 2004 12:44 PM To: [EMAIL PROTECTED] S

Re: [Declude.JunkMail] SOT somewhat offtopic

2004-07-16 Thread Serge
> Serge, POP and IMAP are certainly available in Exchange, Do you mean that exchange server can use POP to retrieve the messages from the nobody alias mailbox on our imail server ? If we use ETRN to store and forward on our imail, are the messages scanned by declude ? - Original Message -

[Declude.JunkMail] E-mail message ID and declude

2004-07-16 Thread Roderick A. Anderson
Is there a way to get the actions for a message from the Declude log files when all I have is the Message-ID. The To/From fields are suspect. A message made it through all our filtering and the user had already sucked it down to Outlook (LookOut?) before forwarding it to me. Now all I really hav

Re: [Declude.JunkMail] Campaign for spamheaders filter variable (continues)- question for Scott

2004-07-16 Thread Scott Fisher
I'll send you my codes off-list. I've got the codes and what spam category they fell into. Scott Fisher Director of IT Farm Progress Companies >>> [EMAIL PROTECTED] 07/16/04 11:31AM >>> I've thought that this might be possible as an external test in this way, but I have yet to get around to test

RE: [Declude.JunkMail] SOT somewhat offtopic

2004-07-16 Thread Colbeck, Andrew
Serge, POP and IMAP are certainly available in Exchange, but if I read this architecture correctly, what you client probably wants is the ETRN extension to SMTP. I used this once under Exchange 5.5 to fetch mail over dial up. Here's an ancient article on the subject to get you started on some bas

RE: [Declude.JunkMail] OT: Grep out letters

2004-07-16 Thread Colbeck, Andrew
Hey, Scott. If you'd like, send me a sample off-list. I could use a short brain teaser this morning. The general idea I think would be to do a grep and only look for lines with well-formed IP addresses. e.g. egrep "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" sample.txt >result.txt [0-9] me

[Declude.JunkMail] SOT somewhat offtopic

2004-07-16 Thread Serge
We have a client curently using MDaemon, all his messages are stored here in the same mailbox (nobody) then his mdaemon server retrieves the messages (using pop) and dispatche to his specific users mailboxes. He want to move to exchange, which apparently cannot use pop so we need to switch to stor

RE: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities

2004-07-16 Thread Jeff Maze
We're running 6.06 and haven't had that problem yet (knocks on wood). But I do know there are certain MS patches that will mess up the display of the admin page (2000 SP4 for example). Is it possible you just ran an MS update and one of those messed the system up? iMail is an old version and the

Re: [Declude.JunkMail] Campaign for spamheaders filter variable (continues) - question for Scott

2004-07-16 Thread Matt
I've thought that this might be possible as an external test in this way, but I have yet to get around to testing it out.  It could be that the %HEADERCODE% variable isn't populated until later like %WEIGHT% was before modification, and if so, enabling it should provide a sufficient mechanism f

Re: [Declude.JunkMail] Campaign for spamheaders filter variable (continues) - question for Scott

2004-07-16 Thread Scott Fisher
-Scott, Would this be possible to check in an external test? Is the %HEADERCODE% variable available? Here's my early thoughts: gloabl.cfg: HEADER-VBS external1 "CScript D:\IMail\Declude\FPFilters\vbs\header.vbs CW=%WEIGHT% MAXW=330 MINW=75 %HEADERCODE%" 10 0

RE: [Declude.JunkMail] Campaign for spamheaders filter variable (continues)

2004-07-16 Thread Scott Fisher
I run HIGH level on my logs. Scott Fisher Director of IT Farm Progress Companies >>> [EMAIL PROTECTED] 07/16/04 10:51AM >>> > I import my logs into an MS Access database. Since I want to > track badheaders/spamheaders, I wrote code to process those > junkmail lines. At loglevel MID I can't se

RE: [Declude.JunkMail] Campaign for spamheaders filter variable (continues)

2004-07-16 Thread Markus Gufler
> I import my logs into an MS Access database. Since I want to > track badheaders/spamheaders, I wrote code to process those > junkmail lines. At loglevel MID I can't see any result code in the logfile. Only in the warning header line of a hold message. Markus --- [This E-mail was scanned f

RE: [Declude.JunkMail] Campaign for spamheaders filter variable (continues)

2004-07-16 Thread Scott Fisher
I import my logs into an MS Access database. Since I want to track badheaders/spamheaders, I wrote code to process those junkmail lines. Scott Fisher Director of IT Farm Progress Companies >>> [EMAIL PROTECTED] 07/16/04 10:34AM >>> > If there was a variable to filter on SPAMHEADERS, this would

RE: [Declude.JunkMail] Campaign for spamheaders filter variable (continues)

2004-07-16 Thread Gufler Markus
> If there was a variable to filter on SPAMHEADERS, this would > make one effective filter. Sound's easy to implement. At the moment I have 27000 spams in our hold folder. 32 of them has failed the spamheaders test with c040120e 27 of this 32 has reached a weight between 400 and 500% of our ho

[Declude.JunkMail] OT: Grep out letters

2004-07-16 Thread Scott Fisher
I have a file IP numbers and some rare entries with letters. I'd like to use grep to remove anything that has letters in it. Can anyone help me out? Scott Fisher Director of IT Farm Progress Companies --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This

[Declude.JunkMail] Campaign for spamheaders filter variable (continues)

2004-07-16 Thread Scott Fisher
I'm continuing my campaign got a variable to check the spamheaders (and badheaders) in filters. Pretty much once a week, a particular spam company unleashes new domains/IP numbers at me and my users. The new IP numbers / domain names aren't on any RBL and are too new for sniffer, hence they usu

[Declude.JunkMail] OT: iMail 6.06 vulnerabilities

2004-07-16 Thread Jose Gosende
Does anyone know of any vulnerabilities in iMail 6.06? Within a minute after turning on iMail's SMTP service my server becomes completely unresponsive and eventually goes down. I've also installed all of the 6.06 related patches from Ipswitch's site. Jose --- Outgoing mail is certified Virus Free.

Re: [Declude.JunkMail] 2 copyto action

2004-07-16 Thread R. Scott Perry
what happens if we have 2 test with copyto actions to different directories ? will this create 2 copies ? Yes, it will. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable v

RE: [Declude.JunkMail] stopping one particular spam

2004-07-16 Thread R. Scott Perry
Your help did not stop them unfortunately. From the declude log Can you suggest a simple way deleting these from rock.com? This is the simple way -- remember, there is no "blacklist" command in Declude JunkMail (some people think that there should be one just like whitelisting, until they realiz