RE: [Declude.JunkMail] Whitelist Auth

2003-09-18 Thread John Tolmachoff \(Lists\)
Local to local does not require authentication. If you look at the logs or the Q file, I bet Imail treats it as such and either does not add the authentication line to the Q file. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message-

RE: [Declude.JunkMail] Internal Mail

2003-09-18 Thread John Tolmachoff \(Lists\)
My program MATCH might help. It looks at the To address and the From address, and they are both listed in the respective text files, it returns a "fail" which you could then weight at say -100. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Origina

RE: [Declude.JunkMail] SKIPIFVIRUSNAMEHAS Fizzer

2003-09-15 Thread John Tolmachoff \(Lists\)
Open your sender.eml with notepad, then copy and paste into a new text document. Outlook treats this as an attached e-mail and messes with it. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:De

RE: [Declude.JunkMail] Timing out with latest Microsoft patch

2003-09-15 Thread John Tolmachoff \(Lists\)
> > Keith, you have good stories. > > I'm a novice in a group like this. You must be doing something right to get MS to send an Engineer out to you. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [m

RE: [Declude.JunkMail] Move to a folder instead of ROUTETO

2003-09-13 Thread John Tolmachoff \(Lists\)
> >Is there a way to have a action of moving a D and Q file to a specified > >folder, (not a mailbox.) something like the ROUTETO action? > > Do you mean a directory on the hard drive (that's why we had to rename the > FOLDER action to MAILBOX)? We're planning to change the HOLD action to > speci

RE: [Declude.JunkMail] Whitelisting

2003-09-13 Thread John Tolmachoff \(Lists\)
That is the big gotcha with whitelisting. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Jeff Kratka > Sent: Saturday, September 13, 2003 4:1

RE: [Declude.JunkMail] Gibberish body detector + inline Base64

2003-09-13 Thread John Tolmachoff \(Lists\)
> My feeling is that once you achieve moderate success with Declude, each > successive step is that much harder to make. Remember the old adage: 20% effort for 80% result and 80% effort for the remaining 20% result, if obtainable at all. John Tolmachoff MCSE CSSA Engineer/Consultant eServices F

[Declude.JunkMail] Move to a folder instead of ROUTETO

2003-09-13 Thread John Tolmachoff \(Lists\)
Is there a way to have a action of moving a D and Q file to a specified folder, (not a mailbox.) something like the ROUTETO action? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declu

[Declude.JunkMail] SPAMDOMAINS

2003-09-13 Thread John Tolmachoff \(Lists\)
Any one have an updated list to share? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just

[Declude.JunkMail] Encoded subject lines

2003-09-13 Thread John Tolmachoff \(Lists\)
To continue the discussion on encoded subject lines, the ones I see as spam always have a short body and is always HTML like the following: (Without the extra spaces I through in there. < html > < body > < cen te r> < !--pfuhja2jjk-- > < a href="http : //www . currency4.com /host/d efault.asp?I D=

[Declude.JunkMail] Another Test suggestion

2003-09-13 Thread John Tolmachoff \(Lists\)
How about one similar to SUBJECTSPACES but counts the number of characters other than numbers and letters and spaces? This would include _ - = + ? > < and so forth. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses

RE: [Declude.JunkMail] Timing out with latest Microsoft patch

2003-09-13 Thread John Tolmachoff \(Lists\)
ecution > (824146) Posted September 10, 2003 > > It's working fine on all other servers that we manage. > > > > -Original Message- > > From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED] > > Sent: Saturday, September 13, 2003 11:15 AM > >

RE: [Declude.JunkMail] Timing out with latest Microsoft patch

2003-09-13 Thread John Tolmachoff \(Lists\)
I've enabled and > > disabled Declude a dozen times with the same result. We're > > using 1.75. > > > > Tomorrow morning I'm going to spend a couple of hours with > > the server offline looking deeper into the problem. It's > > difficult to real

RE: [Declude.JunkMail] Baffled???

2003-09-12 Thread John Tolmachoff \(Lists\)
> Note the conspicuously missing Declude headers. Any idea what would be > causing Declude to not add it's headers to this persons messages? Scott, if > you would like me to run debug logging, I can, but who know how long before > this person posts to the list again. Do you have Imgate striping

RE: [Declude.JunkMail] Question about whitelisting

2003-09-12 Thread John Tolmachoff \(Lists\)
I believe all tests are still run, just no action taken. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Matthew Bramble > Sent: Friday, Septem

RE: [Declude.JunkMail] Timing out with latest Microsoft patch

2003-09-12 Thread John Tolmachoff \(Lists\)
Since Declude has nothing to do with messages being received or sent from the server, or POP3 service and such, how could disabling Declude affect this? What version of Declude.exe are you using? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Orig

[Declude.JunkMail] Header question: X-Accutrak:

2003-09-12 Thread John Tolmachoff \(Lists\)
When ever I see this in the header, it is associated with a legit newsletter. Any one see the same, or see spam with this header? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declud

RE: [Declude.JunkMail] Cautionary note on BASE64

2003-09-12 Thread John Tolmachoff \(Lists\)
L PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) > Sent: Thursday, September 11, 2003 7:59 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Cautionary note on BASE64 > > Thanks Andrew for the update. > > I wonder i

RE: [Declude.JunkMail] Cautionary note on BASE64

2003-09-11 Thread John Tolmachoff \(Lists\)
Thanks Andrew for the update. I wonder if this behavior has been changed in Exchange 2003? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Co

RE: [Declude.JunkMail] New test request

2003-09-10 Thread John Tolmachoff \(Lists\)
In your examples, I only see 4 that would be FP under this, the ones from microsoft.com, unitiedmedia.com, yahoo groups, and Travelocity.com. newsletters.microsoft.com is already in a whitefilter. Yahoo groups are already in a whitefilter for known problems. Travelocity is a legit company, and the

RE: [Declude.JunkMail] New test request

2003-09-10 Thread John Tolmachoff \(Lists\)
OK, my suggested weights are too high. Remember, the point of this test is to be used in the weighting system only. Pagers have 10 numbers, so I would actually start at either 11 or 15. An old CompuServe address will most likely not be failing other tests to where this one would put it over. Ho

RE: [Declude.JunkMail] New test request

2003-09-10 Thread John Tolmachoff \(Lists\)
Any thoughts, good or bad? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) > Sent: Tuesday, September 09

[Declude.JunkMail] SUBJECTSPACES test

2003-09-09 Thread John Tolmachoff \(Lists\)
I am sure I can do this but thought I would ask: SUBJECTSPACES1 subjectspaces 15 x x 10 0 SUBJECTSPACES2 subjectspaces 30 x x 10 0 Any message with 30 or more spaces would get a weight of 20 added, correct? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com

[Declude.JunkMail] New test request

2003-09-09 Thread John Tolmachoff \(Lists\)
How about a test like this: NUMBERSINMAILFROM It would be similar to SUBJECTSPACES but would count the amount of numbers in the mail from address. You could then configure it for say if 10 or more, add 5 to the weight and so forth. John Tolmachoff MCSE CSSA Engineer/Consultant eServices F

RE: [Declude.JunkMail] default.junkmail file

2003-09-09 Thread John Tolmachoff \(Lists\)
I asked this question a few days ago. If test is not going to have a action configured for it, you can omit it. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTE

RE: [Declude.JunkMail] Error in JM log

2003-09-09 Thread John Tolmachoff \(Lists\)
Sharyn, if your DNS server is on the same box as Imail, set it up to use 127.0.0.1, not the public IP address. Also, flush the cache on both Imail DNS cache and the W2K DNS. Have you checked to see if the W2K DNS is passing both tests? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For

RE: [Declude.JunkMail] Error in JM log

2003-09-09 Thread John Tolmachoff \(Lists\)
It appears that the DNS server is not responding. Whos is it? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sharyn Schmidt Sent: Tuesday, September 09, 2003 7:18 AM

RE: [Declude.JunkMail] Multiple recipients seeing action

2003-09-08 Thread John Tolmachoff \(Lists\)
I would actually think that this should be an configuration option in Imail, where if you wanted to, each incoming message, if to more than one recipient on the local server, would be separated. In other words, if Imail received a message destined to 3 people on the server, instead of creating one

RE: [Declude.JunkMail] Message Delay. Was: Feature request: no displayable text in body

2003-09-06 Thread John Tolmachoff \(Lists\)
> A feature that delays incoming mail from unfamiliar (new) source IPs would > allow heuristic tests (like Message Sniffer) and rbls time to add coding > for the messages before processing them. That is, if the connecting IP is > unknown then Declude could park the message in a folder for some amou

[Declude.JunkMail] Test definitions and actions

2003-09-06 Thread John Tolmachoff \(Lists\)
Question, if a test is defined for use in weighting only, and no action will be performed based on that test, does it have to be listed in the $default$.junkmail and action portion of Global.cfg? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E

RE: [Declude.JunkMail] Warnings in HJ log

2003-09-05 Thread John Tolmachoff \(Lists\)
Note: To report any issues, please contact [EMAIL PROTECTED] Status: U X-UIDL: 362788298 John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behal

RE: [Declude.JunkMail] Warnings in HJ log

2003-09-05 Thread John Tolmachoff \(Lists\)
September 05, 2003 9:53 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Warnings in HJ log > > Are those the full headers? They do not include any Received: headers. > -Scott > > At 12:46 PM 9/5/2003, John Tolmachoff \(Lists\) wrote: >

RE: [Declude.JunkMail] Warnings in HJ log

2003-09-05 Thread John Tolmachoff \(Lists\)
Here is the header: (Retrieved from the Exchange log of the recipient) Date: Fri, 5 Sep 2003 00:09:47 -0700 Message-Id: <[EMAIL PROTECTED]> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii From: "Postmaster" <[EMAIL PROTECTED]> Reply-To: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sub

[Declude.JunkMail] Warnings in HJ log

2003-09-05 Thread John Tolmachoff \(Lists\)
I am seeing this warning on messages that Declude creates using the postmaster.eml file for virus notifications. Is this do to the message ID problem with IMail's mail1.exe? 09/05/2003 00:09:47 Q2967f2315dc Warning: Could not find IP3 end on first line of datafile (bound)? 09/05/2003 00:09:47 Q29

RE: [Declude.JunkMail] Increased AOL, Hotmail, Yahoo, etc. false positives positives

2003-09-04 Thread John Tolmachoff \(Lists\)
It is known that AOL, Hotmail and Yahoo will often fail NOABUSE, NOPOSTMASTER and REVDNS, as they are not setup nor do they care. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On

RE: [Declude.JunkMail] consultant/help wanted

2003-09-04 Thread John Tolmachoff \(Lists\)
I kind of have mixed feelings about a post like this. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Jeremy Marquardt > Sent: Thursday, Septe

RE: [Declude.JunkMail] Using Declude to block Sobig Virus

2003-09-04 Thread John Tolmachoff \(Lists\)
b One Inc. > [EMAIL PROTECTED] > http://astra1.com > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff > (Lists) > Sent: Thursday, September 04, 2003 10:42 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail]

RE: [Declude.JunkMail] Challenge - Response software

2003-09-04 Thread John Tolmachoff \(Lists\)
> So, just a general question, does it appear to anyone else that the > challenge/response software at the consumer level, contributes to the level > of spam anyone is receiving? It is not really SPAM. (Well, sort of.) It is the software trying to send a message to the from address for validation

RE: [Declude.JunkMail] Using Declude to block Sobig Virus

2003-09-04 Thread John Tolmachoff \(Lists\)
You would need to block it before Imail receives it. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of James R. Skivers Sent: Thursday, September 04, 2003 8:19 AM To: [E

RE: [Declude.JunkMail] Test based on results of other tests

2003-09-03 Thread John Tolmachoff \(Lists\)
> Actually, it could be a minor change to the processing -- at the > $default$.junkmaillevel, rather than Global.cfg -- as this is not a > "test", but a handling of the test results. It would mean order dependence, > usually (or the processing of combining tests done first, then other > handl

RE: [Declude.JunkMail] WEIGHT

2003-09-03 Thread John Tolmachoff \(Lists\)
> No, assuming that the "CATCHALLMAILS catchallmails x x 0 0" line is in > there (it is in the default config file). By default, it is commented out, no? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude V

RE: [Declude.JunkMail] Test based on results of other tests

2003-09-03 Thread John Tolmachoff \(Lists\)
> >Is there a test that can be based on the results of 2 or more other > >specific tests? ex: an email that fails both HELOBOGUS and > >BADHEADERS would fail "HELOHEAD" and have x number of points > >added/deducted to it? > > No, that is not possible. It is something that has been requested, but

RE: [Declude.JunkMail] Best practice for new config file

2003-09-03 Thread John Tolmachoff \(Lists\)
> Copy the new tests that I want to use to the old file? That would probably be best, as replacing the file would undo any tweaks you have done for your situation. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses b

RE: [Declude.JunkMail] Setting MAX Testing Weight

2003-09-03 Thread John Tolmachoff \(Lists\)
> There is a new "PREWHITELIST ON" option that will run some of the > whitelists before the tests are run. Can you explain the "some" part? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://w

RE: [Declude.JunkMail] Log message

2003-09-03 Thread John Tolmachoff \(Lists\)
Sharyn, I am a little surprised. You usually keep up on things. Guess you have not seen any of the posts regarding OSRelay in the last 2 weeks? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAI

RE: [Declude.JunkMail] A way to stop the Undeliverables from sobig?

2003-09-01 Thread John Tolmachoff \(Lists\)
Configure a filter test looking for body words and HOLD on that test. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Marc Catuogno > Sent: Mo

RE: [Declude.JunkMail] User Interface

2003-09-01 Thread John Tolmachoff \(Lists\)
.  Maybe it would be better just to write a Hello World script instead and watch some TV with my spare time... Matt John Tolmachoff (Lists) wrote: I think you hit the nail on the head on the differences on how this is to bedone. Some want to be able to load on the same machine not using IIS, so

RE: [Declude.JunkMail] User Interface

2003-09-01 Thread John Tolmachoff \(Lists\)
I think you hit the nail on the head on the differences on how this is to be done. Some want to be able to load on the same machine not using IIS, some want IIS. Some want to be able to load on a different machine not using IIS, some want IIS. John Tolmachoff MCSE CSSA Engineer/Consultant eServi

RE: [Declude.JunkMail] wired weight

2003-08-30 Thread John Tolmachoff \(Lists\)
Entire log for that message please, not just a snippet. That does not show total weight or final action and such. What is your loglevel at? You might want to send a copy of the message, with full headers, and your Global.cfg file to Scott or someone else like me off list to further review it. Jo

RE: [Declude.JunkMail] weired weight

2003-08-30 Thread John Tolmachoff \(Lists\)
Have you checked the log? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of serge Sent: Friday, August 29, 2003 8:01 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail]

RE: [Declude.JunkMail] AUTO Whitelist question

2003-08-30 Thread John Tolmachoff \(Lists\)
OTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff > (Lists) > Sent: Friday, August 29, 2003 2:37 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] AUTO Whitelist question > > > Unless you send e-mail to your self, your e-mail address will not be liste

RE: [Declude.JunkMail] AUTO Whitelist question

2003-08-29 Thread John Tolmachoff \(Lists\)
Unless you send e-mail to your self, your e-mail address will not be listed in your file. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Keit

RE: [Declude.JunkMail] AUTO Whitelist question

2003-08-29 Thread John Tolmachoff \(Lists\)
> If the AUTOWHITE from John how much is it? I don't see a price on his > website. It is in the information.pdf. Standard, $75 Professional, $175 Enterprise, Pending John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruse

RE: [Declude.JunkMail] AUTO Whitelist question

2003-08-29 Thread John Tolmachoff \(Lists\)
Please note, there are 2 different items: AUTOWHITELIST is a Declude JunkMail option. AutoWhite for Declude is a 3rd party add on. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declu

[Declude.JunkMail] Spammers know OSRelay is down too.

2003-08-29 Thread John Tolmachoff \(Lists\)
Number of spam messages not caught has gone up since the tests went down. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail m

RE: [Declude.JunkMail] AUTO Whitelist question

2003-08-29 Thread John Tolmachoff \(Lists\)
http://www.eservicesforyou.com/products/autowhite.html John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You 626-737-6003 [EMAIL PROTECTED] www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Greg Fou

RE: [Declude.JunkMail] IMAIL directory

2003-08-29 Thread John Tolmachoff \(Lists\)
Have you tried opening one in notepad? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of serge > Sent: Thursday, August 28, 2003 6:36 PM > To: [E

RE: [Declude.JunkMail] Alligate

2003-08-28 Thread John Tolmachoff \(Lists\)
f so, why? > > Thanks, > > Bill > > > > > -- Original Message ------ > > From: "John Tolmachoff \(Lists\)" <[EMAIL PROTECTED]> > > Reply-To: [EMAIL PROTECTED] > > Date: Thu, 28 Aug 2003 09:03

RE: [Declude.JunkMail] Alligate

2003-08-28 Thread John Tolmachoff \(Lists\)
Please see the link to the archives in my earlier post on this. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of bill.maillists > Sent: Thursda

RE: [Declude.JunkMail] Alligate

2003-08-28 Thread John Tolmachoff \(Lists\)
Yes, many of us are using Alligate. Please see the discussion from last week: http://www.mail-archive.com/[EMAIL PROTECTED]/msg10255.html John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declu

RE: [Declude.JunkMail] Setting MAX Testing Weight

2003-08-28 Thread John Tolmachoff \(Lists\)
You do not want Declude to stop at a certain point. What if it stops, right before the next test which is a whitefilter type test?   With the weighting system, it is important to run all tests to get the final weight.   John Tolmachoff MCSE CSSA Engineer/Consultant eServices For

RE: [Declude.JunkMail] OSRELAY question.

2003-08-27 Thread John Tolmachoff \(Lists\)
Yes, this has been reported both on Imail list and this list at 08/24. news.prodigy.com John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Chuck S

RE: [Declude.JunkMail] Multi Server Configs

2003-08-25 Thread John Tolmachoff \(Lists\)
Check what ftp server you are connecting to. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Matthew Bramble > Sent: Monday, August 25, 2003 7

RE: [Declude.JunkMail] Multi Server Configs

2003-08-25 Thread John Tolmachoff \(Lists\)
Yes, Declude Virus does this. Declude Virus is fired before Declude JM. It is checked in this order by default: Imail SMTP security Declude Virus virus scan Declude Virus banned extension Declude Virus vulnerabilities Declude JM Imail Rules Delivery John Tolmachoff MCSE CSSA Engineer/Consultant

RE: [Declude.JunkMail] Multi Server Configs

2003-08-25 Thread John Tolmachoff \(Lists\)
The problem is when it comes to notifications and requeing. If a message gets stopped by banned extension first, and it is infected, you are going to be sending out a notice to the recipient of the blocked message. He is going to tell you hey, I know that send, and such and you are going t

RE: [Declude.JunkMail] emails do not exist- Declude Sender?

2003-08-23 Thread John Tolmachoff \(Lists\)
Lets see here. There is a way to do this. Setup a filter: MAILFROM50 ENDSWITHdomain.com Then use program MATCH. In the from file, list all valid addresses. In the too file, list only @domain.com Give the test a weight of -50. Then, any message listed as a from address wi

RE: [Declude.JunkMail] OT: Declude notification and SoBig assault.

2003-08-22 Thread John Tolmachoff \(Lists\)
That line sounds like part of the generic otherpostmaster.eml file, and therefore is probably a Declude user. Post the full headers, or send off list so we can pursue this and get this person to fix it. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com >

RE: [Declude.JunkMail] Multi Server Configs

2003-08-21 Thread John Tolmachoff \(Lists\)
Actually, F-Prot was catching Sobig.F almost immediately from reports on the list on Tuesday. McAfee was the lager this time.   John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com   -Original Message- From: [EMAIL PROTECTED] [mai

RE: [Declude.JunkMail] Does this exist in junkmail

2003-08-21 Thread John Tolmachoff \(Lists\)
That is not possible at this time with Declude, and has been discussed. Some other tests maybe be looking at the ability to do that. However, while the concept is interesting, your example has the potential to delete legits. The reason is taking action based on blacklisted keywords can be dangero

RE: [Declude.JunkMail] Alligate vs. Message Sniffer...opinions?

2003-08-20 Thread John Tolmachoff \(Lists\)
> I don't want to knock Alligate, it has some nice functionality, > especially when used without Declude (auto whitelisting and digest > notification), and it does what it says, but it has a relatively high > false positive rate in the default configuration and therefore it can't > be scored higher

RE: [Declude.JunkMail] Alligate vs. Message Sniffer...opinions?

2003-08-20 Thread John Tolmachoff \(Lists\)
As one of the earlier testers and helped develop the variable scale of Alligate, I can understand your position. I have a client that gets a lot of e-mail from the Far East and a lot of bcc broadcasts and lists. Many of these show elements of spam, but are legit. That is what makes it hard. There

RE: RE : [Declude.JunkMail] Alligate

2003-08-20 Thread John Tolmachoff \(Lists\)
[Declude.JunkMail] Alligate > > Hi, > > Is Alligate so good ? What about false positive ? > > Thanks > Mehdi Blagui > > -Message d'origine- > De : [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] De la part de John Tolmachoff (Li

RE: [Declude.JunkMail] Alligate

2003-08-19 Thread John Tolmachoff \(Lists\)
Do you mean as a Declude ONLY test? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Keith Johnson > Sent: Tuesday, August 19, 2003 7:18 PM > To

RE: [Declude.JunkMail] Picking up just User Name in email?

2003-08-19 Thread John Tolmachoff \(Lists\)
Title: Message Kami, you have already used up your quota of Mondays for the month of August. One more, and you get 50 lashes with a wet noodle.   John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com   -Original Message- From: [EMA

RE: [Declude.JunkMail] IP address for REVDNS

2003-08-18 Thread John Tolmachoff \(Lists\)
Seems like that would be dependent on the timing of the test order and when that line was added. Scott, can a variable be used in a filter with an equation like this: HEADER 0 CONTAINS %REVDNS%=64.214.161.171 John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com

RE: [Declude.JunkMail] Ebay and Spamdomians

2003-08-14 Thread John Tolmachoff \(Lists\)
y, August 06, 2003 1:40 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Ebay and Spamdomians > > What is the LA? > > - Original Message ----- > From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Wednes

RE: [Declude.JunkMail] Declude Virus Pro and Fprot (DOS)

2003-08-14 Thread John Tolmachoff \(Lists\)
I have Declude send out a vulnerablility.eml message. If the receiver recognizes it, he replies and I put the files back into the spool folder letting them know to have the sender fix the problem. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Orig

RE: [Declude.JunkMail] Declude Virus Pro and Fprot (DOS)

2003-08-14 Thread John Tolmachoff \(Lists\)
You probably mean it is catching the multi-part attachments that the sender has his Outlook configured incorrectly to use. Explain to the sender not to have Outlook break up attachments. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Messa

RE: [Declude.JunkMail] Declude and W2003

2003-08-14 Thread John Tolmachoff \(Lists\)
> What do you mean "AutoWhitelist"? Is this a declude product or custom script? I think he is referring to the add-on product for Declude JunkMail. www.eservicesforyou.com/products/autowhite.html John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [Thi

RE: [Declude.JunkMail] Declude Virus Pro and Fprot (DOS)

2003-08-14 Thread John Tolmachoff \(Lists\)
ility.eml message. > > Thanks > ----- Original Message - > From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Monday, August 11, 2003 2:31 PM > Subject: RE: [Declude.JunkMail] Declude Virus Pro and Fprot (DOS) > > > I h

RE: [Declude.JunkMail] Ebay and Spamdomians

2003-08-14 Thread John Tolmachoff \(Lists\)
Sending messages from a hotmail address but not through a hotmail server may not be allowed under the LA. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On

RE: [Declude.JunkMail] Process Tree

2003-08-10 Thread John Tolmachoff \(Lists\)
Imail SMTP security Imail Kill list Declude Virus Declude JM Imail Rules John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Robert Forsyth > Sent:

RE: [Declude.JunkMail] FW: quick question

2003-08-06 Thread John Tolmachoff \(Lists\)
1. If you want no e-mail going out, configure Imail SMTP to send all via a smart host, then point it at 127.0.0.1. 2. My program match can be used along with catchallmails in JM. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message-

RE: [Declude.JunkMail] Non-existent mail addresses

2003-08-02 Thread John Tolmachoff \(Lists\)
> I realize that a lot of e-mail goes to the spam folder that is addressed to > non-existent (or not-anymore-existent) addresses. Is there any reason, why > Declude does not check the recipient's name before doing other tests? > Wouldn't it be better to return e-mail to non exiistent addresses inst

RE: [Declude.JunkMail] Report System

2003-08-01 Thread John Tolmachoff \(Lists\)
> It's become blatantly apparent that there is a VERY STRONG NEED for an > application such as this. Are the Declude people listening? With all the work that Scott and his "interms" do, I think this is perfectly fine. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesfo

RE: [Declude.JunkMail] Is the list down?

2003-07-31 Thread John Tolmachoff \(Lists\)
> Let me guess...the mode of transportation will be a short wheel base, > Diamond T w/Browning 4X4 tranny and no trailer! Ah, there you are Jim. ;) But is has to have a chain drive. > There is something down though that is affecting a lot opf people. Network > Solutions have 4 DNS servers that ar

RE: [Declude.JunkMail] Is the list down?

2003-07-31 Thread John Tolmachoff \(Lists\)
> I don't want to go home, I want a vacation! Dear Mr. Sheldon Koehler; It is with great pleasure that I can announce that you are hereby granted an official vacation. You MUST take this vacation immediately, or forfeit the right to use it forever. To claim your official vacation, you must call

RE: [Declude.JunkMail] Is the list down?

2003-07-31 Thread John Tolmachoff \(Lists\)
I am not here. Your message was not delivered. Everyone went home. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Sheldon Koehler > Sent: Thur

RE: [Declude.JunkMail] Massive flood of uncaught spam

2003-07-28 Thread John Tolmachoff \(Lists\)
Here is what I am now doing to fight problems with DNS servers going down.   I have installed DNS on the Imail server. It has no zones and answers queries only from Imail and Declude. I have set Imail DNS server to 127.0.0.1. I have then configured 4 forwarders in the DNS server propertie

RE: [Declude.JunkMail] Declude using 50% cpu

2003-07-25 Thread John Tolmachoff \(Lists\)
Title: Message Morning Kami.   Hate to differ, but I disagree, as I am sure others will, on using RAID 5 for mail boxes. The mail boxes are heavy Read AND Write. RAID 5 will slow performance in heavy write usage. RAID 5 is best and shines the greatest in mainly Read situations, like dat

RE: [Declude.JunkMail] Declude using 50% cpu

2003-07-24 Thread John Tolmachoff \(Lists\)
Title: RE: [Declude.JunkMail] Declude using 50% cpu BTW, with an average CPU usage of 44% before Declude, you may be reaching the saturation point of the server. Not critical, but from my understanding if average CPU usage is at 50%, you need to start looking at things.   John Tolmac

RE: [Declude.JunkMail] Declude using 50% cpu

2003-07-24 Thread John Tolmachoff \(Lists\)
Title: RE: [Declude.JunkMail] Declude using 50% cpu Where is your DNS server you are using in Imail?   John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com   -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On

[Declude.JunkMail] ROUTETO

2003-07-23 Thread John Tolmachoff \(Lists\)
Will ROUTETO work to an external domain that is one not held on Imail? Example: Message addressed to [EMAIL PROTECTED] Sfdomain.com is not hosted on Imail, but Imail is doing S&F for it. That message triggers a test called SFDOMAINREROUTE with a ROUTETO action to [EMAIL PROTECTED] Again, sfdomain

RE: [Declude.JunkMail] A good SD.TXT File?

2003-07-23 Thread John Tolmachoff \(Lists\)
> >Does the path to the text file need to be in quotes? > > No. > > The only time quotes are required (or can be used properly) is in external > tests. What if there is a space in either the directory name or the file name? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.ese

RE: [Declude.JunkMail] OT: Email with attachments kills the connection

2003-07-22 Thread John Tolmachoff \(Lists\)
What do the log files say? Do they indicate a connection? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of i360 Sent: Tuesday, July 22, 2003 1:59 PM To: [EMAIL PROTECTE

RE: [Declude.JunkMail] Declude JunkMail FAQ or Knowledge Base?

2003-07-22 Thread John Tolmachoff \(Lists\)
At this time, all updates would be routed through one person to update manually. If there is a better way... BTW, if someone has a better way and wants to maintain it, but has no server available, it can be done on mine. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservic

RE: [Declude.JunkMail] Yahoo Groups.

2003-07-21 Thread John Tolmachoff \(Lists\)
> RL> Do you think that we can move the Declude list to yahoo for the following I veto (if I had that authority) any such idea or move. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.d

RE: [Declude.JunkMail] Declude JunkMail FAQ or Knowledge Base?

2003-07-21 Thread John Tolmachoff \(Lists\)
I have had the intent but not the time. I am willing to host it. In fact, I already have it set up just need the documents to include. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.Ju

RE: [Declude.JunkMail] ORDB problem, slightly off topic

2003-07-18 Thread John Tolmachoff \(Lists\)
Are you using the PERCENT test?   They are using something like [EMAIL PROTECTED]@domain.com.   From the JunkMail manual:   PERCENT This test will catch all mail with "To:" addresses that contain a percent sign. The percent sign indicates an outdated routing method

RE: [Declude.JunkMail] OT: Imail v6 and Windows Update

2003-07-17 Thread John Tolmachoff \(Lists\)
> Yea, and expose my server's security to fix some GUI issue? > Sounds like Ipswitch should provide a maintenance release for v6.0 users > to eradicate this problem. Uh, trying reading through the many posts in the archives on the Imail forum. This is the Declude JunkMail list. The pros and cons h

<    5   6   7   8   9   10   11   12   >