unsubscribe Declude.JunkMail
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
A large spike hit here Monday. Spool processing lagged about 1.5 hours,
then got worse late in the night to over 9,000 files in spool and a 5-hr
delay. Had to stop SMTP and clear the spool.
I've noticed numerous D/T pairs that appear in \spool and hang there for a
long time (10-15 mins), locked
How tricky is it to configure this? Current price I find is $300.
G.Z.
- Original Message -
From: Dave Beckstrom [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Wednesday, September 20, 2006 1:08 PM
Subject: RE: [Declude.JunkMail] Spam Spike
I run Blackice Server on the
Yes, happened a month or so ago, for several
days. I think during a particularly heavy dictionary attack.
Spammers don't make sense, attacking a server so hard as to effectively crash
it. They're cutting their own throats.
G.Z.
- Original Message -
From: Wolf Tombe
To:
Title: Message
Hahahahaha! E-mail hardlykeeps or
draws customers. Anybody who wants e-mail can go to Hotmail or
Yahoo. When the addy gets horked by spammers, simply abandon it and create
another. Domain hosting, maybe a little. However, I have domain
customers who havenever used their
I think one thing that happened here is that the announcement regarding
ComTouch didn't make it *clear* that it is an *optional* part of Declude.
MY initial impression was that *any* Service Provider who uses the version
of Declude that incomes ComTouch would be required to participate in the
Title: Message
You're saying that email and spam/virus scanning is
a service aspect that specifically draws customers to an ISP.
I'msaying it doesn't, that's all.I've not once heard a
customer state that email service was the deciding factor in choosing us, and
there's no evidence it
To give you guys over at Declude an idea of what is going on out here in the
real world of small ISPs, there may be some small bit of revenue (meaning
funds from paying customers) coming in here, but the operating costs have
outweighed that for the last couple years. The owner has sunk over
I've had a swarm of stock-quote spam in the last
few days. Declude 1.81, Imail 7.15. Appears from the headers there
are no Declude tests running at all on these msgs, but there are Declude headers
added. Majority are null senders. Various IPs. Some have my
addy referenced as an X-RCPT, some
I don't have SMTP-Auth whitelisted. That's
not possible with IMail 7.15.
- Original Message -
From: Markus Gufler
To: declude.junkmail@declude.com
Sent: Monday, June 05, 2006 4:27 PM
Subject: AW: [Declude.JunkMail] No Tests Run
Glenn,
"no tests run" seems the wrong thread title
There may be any number of reasons why a static IP is useful on a dial-up.
I have several customers who have a penchant for sending mass-forwards of
jokes and other debris. If one of them gets caught by HiJack, it may be
several hours until I have an opportunity to check the mail server, and
3.16f doesn't get hung-up on updates any *less* than other versions did.
G.Z.
- Original Message -
From: Colbeck, Andrew [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Tuesday, January 31, 2006 9:53 AM
Subject: RE: [Declude.JunkMail] F-Prot
Richard, are you using the latest
usage of zip files. This is a conundrum for many right now,
but I don't think that the majority of my customers would understand or
appreciate wholesale blocking of zips containing executables since that
is the preferred method of transferring such files.
Matt
Glenn \ WCNet wrote:
I have
Title: Message
Look in Service control panel for"netinfo"
and a target file netinfo.exe. You'll likely have to kill netinfo.exe
somehow. Delete the services keyfrom your Registry then reboot if
necessary. Then you'll be able to delete both netinfo.exe and
orans.sys
G.Z.
-Original
I had the same situation with Overflow and Spool getting overloaded.
Increasing the number of SMTP process in IMail to 90 keeps it clear except
under extreme situations. IMail 7.15.
G.Z.
- Original Message -
From: Will [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Thursday,
I'm still on IMail 7.15 and Declude 1.81. Every time I think about updating
to the latest, there's an issue of some ilk being hashed-out. Stability
with the newer versions seems to be a lost cause.
- Original Message -
From: Andy Ognenoff [EMAIL PROTECTED]
To:
I did that a few weeks ago, and still have had a few slip through. F-Prot
detects it as a suspicious file if I save the .zip attachment and try to
extract the .exe from it.
G.Z.
- Original Message -
From: John Tolmachoff (Lists) [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent:
I've seen several kinds of spam increase in the
last day.
- Original Message -
From: Kyle Fisher
To: Declude.JunkMail@declude.com
Sent: Friday, February 25, 2005 4:40 PM
Subject: [Declude.JunkMail] casino spam
Has anyone noticed in the past week
an increase in casino, or party
Assuming it's the same thing about which you are asking, new dot net often
rides in on shareware and freeware like KaZaA. It ties in to TCP/IP, adds
to the LSP stack. I've seen numerous cases in which it goes wrong and
networking breaks. Or it gets left behind when KaZaA is uninstalled and
then
I'm still running 1.81 and don't plan on changing that until all this ruckus
gets settled down. :-)
- Original Message -
From: Ralph Krausse [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Friday, February 04, 2005 4:11 PM
Subject: [Declude.JunkMail] Subject: Declude 2.0
test. It's broken in 1.81.
It's the only change between 1.81 and 1.82.
- Original Message -
From: Glenn \ WCNet [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Friday, February 04, 2005 4:28 PM
Subject: Re: [Declude.JunkMail] Subject: Declude 2.0 Update
I'm still running 1.81
My Declude logs at HIGH range between 1.2 and 1.6 GIGABYTES. The log for
11/3 is 1,701,795 KB.
- Original Message -
From: Mark E. Smith [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, November 04, 2004 9:03 AM
Subject: [Declude.JunkMail] LOG Levels
I've always used LOGLEVEL
I think when the Deccon window reopens depends on when all the SMTP
processes have ended and started afresh. On my heavy-traffic server, Deccon
won't reopen until all the SMTP processes have ended. What I do is close
the Console, open Task Manager, pause SMTP, watch for all the declude.exe
I've been putting it off, but need to go ahead with the deed. Can anyone
provide some quick-and-easy tip/instructions on making sure it goes
smoothly? I know IMail's integrated spam detection needs to be disables,
and I recall mention in the past that it can be a little tricky to do that.
TIA
The current version of HiJack supports 'whitelisting' by sending address in
hijack.cfg.
ALLOWADDR [EMAIL PROTECTED]
- Original Message -
From: Mike Wiegers [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, September 28, 2004 11:57 AM
Subject: RE: [Declude.JunkMail] HiJack
In
I have received messages from friends with blank subject lines. I guess
they're lazy.
G.Z.
- Original Message -
From: John Tolmachoff (Lists) [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, July 06, 2004 2:46 PM
Subject: RE: [Declude.JunkMail] SPACE character
I would be
I've gotten three notices from AOL that complaints
by AOL users about our network/mail have increased to an unacceptable
level. 322 complaints, then 489. The notice makes reference to a
"Report Card" but there isno link to view it, and nothing attached or
quoted. There is a link to
I would
call them if I were you. Be prepared to be on hold a long time unless
you call after hours. I recommend after 8pm ET / 5pm PT.
Darin.
- Original Message -
From: Glenn \\ WCNet
To: [EMAIL PROTECTED]
Sent: Monday, June 07, 2004 12:58 PM
Subject
My Declude logs regularly get up to 1.5 GB (log level high). I run
DLAnalyzer daily at 12:05 AM. It takes between 45 and 65 minutes depending
on the size of the log.
- Original Message -
From: Robert [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, June 01, 2004 11:16 PM
SBC T3, can't get ARIN.
- Original Message -
From: Rick Davidson [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, June 02, 2004 11:54 AM
Subject: Re: [Declude.JunkMail] Where is ARIN?
That is odd, I am getting destination net unreachable from qwest on a
server
in Arizona,
Group
-
- Original Message -
From: Pete McNeil [EMAIL PROTECTED]
To: Glenn \\ WCNet [EMAIL PROTECTED]
Sent: Wednesday, June 02, 2004 1:43 PM
Subject: Re[2]: [Declude.JunkMail] Where is ARIN?
No problem getting there from here.
multi-homed through Savvis and Sprint on a pair
I'm curious what caused this message to fail CMDSPACE?
Received: from PARTSMANAGER [64.72.97.82] by wcnet.net with ESMTP
(SMTPD32-7.15) id AF16D700130; Wed, 14 Apr 2004 12:04:22 -0500
Message-ID: [EMAIL PROTECTED]
From: First Last [EMAIL PROTECTED]
To: First Last [EMAIL PROTECTED]
Subject:
So the problem is with the sending mail server at 64.72.97.82, not the
sending client (OE 6)? Just trying to understand.
Glenn Z.
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, April 14, 2004 12:46 PM
Subject: Re: [Declude.JunkMail]
Nope. Don't whitelist dial-up IPs, that totally quashes the point of
HiJack, to catch YOUR users sending spam.
I've adjusted the threshold parameters, but I still do have instances where
a dial-up IP gets caught for a high volume of mail (multiple recipients on
those IDIOT mass-forwards of jokes
I hold them in the Virus folder just so I can check how much activity is
going on if I want to, and a scheduled batch file clears the folder every
two hours.
Glenn Z.
- Original Message -
From: Kami Razvan [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, March 03, 2004 2:25 PM
I set my Declude Virus several months ago not to send any notifications for
any viruses. Of course that doesn't stop notifications on forged addresses
sent to my users from other ISPs -- I just explain to them that, no, you
don't have a virus, someone else does and your address was forged on it
marc catuogno wrote:
Now, real-estate agents in general are the most technologically challenged
group forced to use technology. I imagine that agents nation wide kept
sending listing information to people even after they requested to stop
getting e-mail. I almost don't want to help them...
Oh
Hmmm. I tag the subject on weight 14 to 19, delete on 20+. I've had
Sniffer weighted at 18 for a while. Reduced it to 16 a couple days ago
after adding some additional SORBS tests that are in the lastest global.cfg.
Anyway, I've had several Nigerian-type scam emails come through without
failing
I also found some today, held by Virus. Dunno if there have been others
that did get through.
Glenn Z.
- Original Message -
From: John Tolmachoff (Lists) [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, January 12, 2004 5:42 PM
Subject: RE: [Declude.JunkMail] WHITELIST HABEAS
I
Title: Message
Anybody know where I can get PowerRen 2000 (or
something similar)? I have 500 emails (1000 files) held by HiJack that I
need to release. All the download sites I checked via a Google search show
it as not available. Manual renaming is a serious pain.
Glenn Z.
Given this subject line:
Subject:
=?iso-8859-1?B?TXkgd2lmZSBzYWlkIEkgbmVlZGVkIFYpaWFncmEgSSB3ZW50IGhlcmUhIFRoY
W54IEd1eXMh?=
which displays as:
My wife said I needed V)iagra I went here! Thanx Guys!
Does Declude decode it for SUBJECT CONTAINS filtering, so I could match on
V)iagra? Is it safe
Yes, that happened to me. I had entered my address in the WebMail addy book
for one of my accounts (don't recall why), and I started getting spam that
showed as WHITELISTED. It wasn't obvious why at first because I wasn't the
primary To recipient on the spam, but I finally figured it out.
G.Z.
I know I'm late in responding to this thread . .
but my comment is, if the interim releases are only to fix specific problems,
and there is no public announcement or release notesas to what those fixes
are, then how is a person toknow whetherhe does or does not need a
particular interim
Running JunkMail since May 2002. I've done a
bit oftuning on test weights, am using Sniffer
andseveralfilters,contra-filter, and blacklistof my own
based on false-positives that I find on my own accounts, but I haven't done near
the amount of tuning that some have done. I delete on
Try increasingthe number of SMTP processes
until you find a value that keeps the spool caught up. I raised mine to
100. My Declude logs show that 250,000+ messages pass through my server each day.The
Declude log from yesterday, at loglevel= high, is 1,017,555 KB.
DLAnalyzer reports 279,886
This happened to me several times, possibly caused
by spam storms. I know two lesser instances were when particular user
accounts were targeted. Once by a spammer, and another time by a runaway
auto-responder programmed on a web site. Anyway, I pretty much solved the
problem my increasing
I've gotten two or three like this in the last
couple days, but mine are getting tagged on with weight 21 or thereabouts.
I delete on weight20.
G.Z.
- Original Message -
From:
Kami
Razvan
To: [EMAIL PROTECTED]
Sent: Friday, October 03, 2003 5:11
PM
Subject:
How do I reliably block this kind of thing?
Can my own domain be added to the SpamDomains list? I've replaced the
recipient address with [local-user] in the headers below, but it was the
samevalid local user account on all parameters. 138.89.104.227 is
not one of my IPs.
Glenn Z.
example.org
are equivalent
if the hostname is null?
-Original Message-From: Glenn \ WCNet
[mailto:[EMAIL PROTECTED] Sent: Friday, September 19, 2003 10:23
AMTo: [EMAIL PROTECTED]Subject:
[Declude.JunkMail] blocking spam faked as coming from local
from mine, and his, and hers over
there...
Andrew
8)
-Original Message-From: Glenn \ WCNet
[mailto:[EMAIL PROTECTED] Sent: Friday, September 19, 2003 10:23
AMTo: [EMAIL PROTECTED]Subject:
[Declude.JunkMail] blocking spam faked as coming from local
I haven't made use of the SpamDomains test yet, am
working on that now. I found a sd.txt file from Bill B. dated
5/30/2003. Does anybody have a newer list to share?
Glenn Z.
Hmmm. So WHITELIST AUTH does not work with
IMail 7.x? Why is it enabled by default in the latest global.cfg and
thereare no comments indicating that it works only with IMail 8? I
just upgraded from 1.69 to 1.75 yesterday, and incorporated the changes in the
defaultglobal.cfg and
I don't use the HOLD action, except for one test
(Percent). I Delete on weight20, tag the subject "Possible Spam" on
weight14.
I initially Deleted on Weight30. Then dropped
it to Weight25. Then we did a Hold on Weight20 for just a couple days and
found very few false-positives (and those
Declude Virus and F-Prot is a great
combination. F-Prot is $50 (currently) for a 10-machine license (the
minimum for commercial use). A simple configuration file for Declude Virus
references the command line needed to have F-Prot scan the mail.
Note that Frisk Software Internationalis in
I have the same trouble following the discussion of new tests. Some of them sound
very useful, but since I have many other things to do besides play with the mail
server and Declude, I generally can't take the time to pull all the list messages
together into a semblance of order to figure out
I got the same thing a few mins ago. Blank message, no body text.
From: Sender Unspecified
Date: Friday, June 6, 2003 12:49 PM
To: none
Subject: [No subject]
- Original Message -
From: Dan Geiser
To: Declude JunkMail
Sent: Friday, June 06, 2003 1:15 PM
Subject:
I simply cannot keep up with the constant changes
in JunkMail. News tests, variables, and parameters are listed in the
Release Notes, but the trick is how to integrate those tests into an existing
configuration, where to insert them, how to configure the parameters for new
tests, etc.
For
What is the latestversion of Declude Console
and from where do I get it? Can a link for that beadded tothe
JunkMail manual?
Glenn Z.
- Original Message -
From:
R. Scott
Perry
To: [EMAIL PROTECTED]
Sent: Thursday, March 20, 2003 7:31
AM
Subject: Re: *
I've been wondering the same thing. I noticed
a couple times that Hijack repeatedly did a level 1 hold on a particular IP
(dial-up user), and the messages in question had a virus. The stream of
outgoing mail never did reach level 2 hold, and I'm wondering if Virus caught
the infection each
MSN has been having mail troubles for about two
weeks. Several of our users have complained. One contacted MSN, and
they told her to have us call them. We did, and MSN said they had done
some sort of maintenance procedure on their mail system, and something
broke. At that point in time they
SpamCop is just as bad. We run a web server
for an associate who lives in another city. One of his customers has some
java scripts ona site for free download. A spammer in Taiwan has
added one of those scripts into the html on his advertisement. The script
includes a reference to the
Every few days I sort the spool directory by date,
and delete logs older than five days, and other stray files older than two or
three days. Sometimes there arematching T and D files, sometimes
only a D file. I alsoregularly clear the \spool\web folder of stray
files, which sometimes
I've lost the recent messageadvising
thatone of these has gone defunct and should no longer be used.
Which one is it?
Thanks.
Glenn Z.
There's a new per-host security feature in IMail 7
that, if enabled, will bounce incoming messages if thesub-mailbox does not
already exist -- it WILL NOT be created. I've found several cases of
sub-mailboxes that had never been accessed, and the user was checking his
account only by
Yes, they can be accessed by POP3 client.
Create a new account in the client, and set the POP3/Incoming Server Account
Name as
user-submailbox -- "billy-spam" for
example, instead of "billy"
If it's a user on a virtual host (other than the
default host), then set the full email address as
I've been clearing some mail accounts that
customers have abandoned, haven't checked their mail for a couple months or
longer. It's not unusual to find 4000messages or more, 20 MB or
more, ALL of it spam. No one on a dial-up connection is going to wait for
all that mail to download, and
As I recall, if a message is addressed to multiple
recipients, JunkMail uses the most restrictive settings it finds. If one
of the recipients is set up for JunkMail and the others aren't, then that user's
filtering applies to ALL of them.
- Original Message -
From:
Tom
I'd also be interested. Porn spam is quite a
problem . . when a little old lady uses her email just to keep in touch with the
grandkids and gets "discovered" by spammers . . she tends to not be a happy
camper.
Glenn Z.
- Original Message -
From:
Brian Milburn
To:
So it wouldn't work for the 6085accounts on
my default host. :-)
Glenn Z.
- Original Message -
From:
R. Scott
Perry
To: [EMAIL PROTECTED]
Sent: Wednesday, October 30, 2002 5:32
PM
Subject: RE: [Declude.JunkMail] Update of
SpamReview web app (not related
I sometimes send messages to multiple recipients as
BCCswith myself as TO. I think that's prefereable to putting all the
recipients as TO. Doesn't OE refuse to send if TO is blank? Or does
it just pop up a warning, but will send anyway after OKing the warning -- I've
never left TO blank, so
Message
OE cannot filter on headers.
- Original Message -
From: Jerry L. Barker
To: [EMAIL PROTECTED]
Sent: Friday, October 18, 2002 12:33 PM
Subject: [Declude.JunkMail] How to filter header in Outlook Express
Today is dumb question day. As I do not use Outlook Express, I'm not real
Is this using the Declude "spam wrapper"
feature? I had that happen quite a bit when I was using that action during
initial configuration testing. Decided not to use it in the
end.
Glenn Z.
- Original Message -
From:
Kevin
(Linkbrokers Support)
To: [EMAIL PROTECTED]
Here are some to add to your Kill file or
BlackList!
--
Hello Administrators for wcnet.net,Please check to verify
that messages being sent to our Opt-in customers that are using your
If a message is addressed to multiple TO recipients
all on the same host, and one or more of those recipients has a custom JunkMail
configuration, how does Declude determine which configuration to use for
processing the message?
I have a user who does not want her account scanned
by
Rick, would you mind providing the details of your
tests and weights? Itried HOLDING on weight30 for a couple days,
reviewing with SpamReview to see what comes through. It wasaround
8000 per day. None were legit, so I'm deleting those now. On
Weight20 I get between 20,000 and 26,000 per
Oooo, sorry, I really don't know anything about how
the new word filters work. Haven't tried them. But I would guess the
weight would be 5, that it doesn't multiply based on how many times the word
occurs.
Glenn Z.
- Original Message -
From:
Eje
Gustafsson
To: Glenn
Howdy to all.
I know this isn't an IMail support list, but
perhaps someone can shed some light on this situation . . .
I upgraded from IMail 6.06 to IMail 7.1 HF1 a few
days ago. Since then, my spool directory has grown by leaps and
bounds. It normally runs between 300 and 500 files (I
Before changing WEIGHT30 to HOLD, it was
WARN.
WEIGHT10, 14, and 20 are still WARN. All
other tests are LOG.
G.Z.
- Original Message -
From:
R. Scott
Perry
To: [EMAIL PROTECTED]
Sent: Wednesday, June 12, 2002 6:10
PM
Subject: Re: [Declude.JunkMail] HUGE
I'm trying the trial version of MessageSniffer, but
it won't last for long before hitting the limit. Does anybody have a
suggestion for what weight to assign to it? I'm using action SUBJECT on
Weight10, and ATTACH for Weight14 or higher. How accurate is
MessageSniffer taken by itself?
I got an on-line order confirmation from
QuillCorp.com that failed both BADHEADERS and SPAMHEADERS.
Glenn Z.
- Original Message -
From:
R. Scott
Perry
To: [EMAIL PROTECTED]
Sent: Wednesday, May 29, 2002 9:27
AM
Subject: Re: [Declude.JunkMail] any
way
Hi
Yes, I've gotten several spams that didn't fail any
tests. I've added some to my blacklist test, but I doubt that will do much
good in the end.
Glenn Z.
- Original Message -
From:
Mark
Smith
To: [EMAIL PROTECTED]
Sent: Wednesday, May 29, 2002 5:50
PM
I don't like the idea of bouncing or deleting any
messages. I don't want to take that responsibility, and potentially zap a
message that a user wants. I've set up a local blacklist (based on the
spams I've received that didn't fail any tests), a local whitelist, and I've
adjusted the
Yes, I don't see any filter selection in OE (6) or
Netscape (4.79) for checking headers, but WebMail does. I think that's
where the ATTACH action becomesuseful -- the failed Junk-Mail tests are
listed in the body of the advisory, so OE users can do body= filters if they
want to "delete from
I'm using the ATTACH action for Weight10, 14, 20,
and 30. Subject = Probable Spam!
Glenn Z.
- Original Message -
From:
J Porter
To: [EMAIL PROTECTED]
Sent: Monday, May 20, 2002 11:18 AM
Subject: Re: [Declude.JunkMail] Advice
for SUBJECT text
I had the same
What version of OE provides checking headers?
Mine is 6.00.2600.. The choices I have are:
from
subject
body
to
CC
to or CC
priority
account
size
attachment
secure
for all messages
Glenn Z.
- Original Message -
From:
David
Lewis-Waller
To: '[EMAIL
Is there a limit on local blacklist entries?
I'm getting several spams per day that don't fail any tests. We haven't
gone "live" with Junk-Mail to our users yet, but when we do, there may be
requests to block specific addresses or domains. Don't know yet if we'll
offer that to the users,
How risky is it to out-right delete messages that
fail the SPAMCOP or OSSRC tests? Those soundpretty accurate for
catching known spammers.
Are any of the many tests on the "DNS-based Spam
Databases" worth putting into effect to get more accuracy out of
Junk-Mail?
Glenn Z.
LOL, I can't possibly hold and review mail for 220
hosted domains and 6300 of my own users! We're planning at this point to
go with the ATTACH action. Then it's THEIR choice to set up a filter to
delete all of it, or let it come in for review.
Glenn Z.
- Original Message -
88 matches
Mail list logo
