Re: [Declude.JunkMail] 1.79i16 - changes?

2004-07-24 Thread Glenn Brooks
holy cow batmannow that is what I call a support...
At 10:28 AM 7/24/2004 -0400, you wrote:
Since not much has been discussed could you possibly provide a list of
changes since i8?
No -- if you'd like to know the details of why, you can search the 
archives.  :)

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-682-7111
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Increase in porn?

2004-07-21 Thread Glenn Brooks
yes a large amount...thought it might just be my config...
gb
At 11:27 AM 7/21/2004 -0400, you wrote:

Are any of you seeing an increase in explicit porn getting past Declude and
Sniffer in the past few days.
We are seeing a disturbing increase that will only fail some minor weighted
test such as bad routing and often fail no test. They are almost dynamically
changing the spelling of the obvious words we are adding to subject and
content filtering.
Any suggestions on how to get ahead of these guys and reduce such emails?
Woody Fussell
Wilbur Smith Associates
Columbia SC
[EMAIL PROTECTED]
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-682-7111
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] What seems to work better for others?

2004-07-19 Thread Glenn Brooks
Also along this line of questions, my main filters are mailfrom and helo 
AND I also
am starting to collect a large number of files. Each filter file as approx. 
1500 lines.

So my question is the same as asked previous (listed below) but  also, 
would it be better to simply use headers filter versus mailfrom and 
helo.or does it not matter?

thanks in advance
gb
At 08:37 PM 7/19/2004 -0400, you wrote:
I am wondering what works better for other operators? To use 10 or 12
smaller txt filter files, or 2 or 3 larger ones?
It seems that more smaller ones are easier to manage using categories. But
what uses less CPU/Memory usage?
Which way is faster?
Thanks
Robert




---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-682-7111
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Now this is funny

2004-07-07 Thread Glenn Brooks
now I have heard it all.
Can you name One, just One thing the UN has done well?
And now they think they can do thisI almost fell out of my chair 
laughing so hard.

At 08:21 AM 7/7/2004 -0400, you wrote:
Just an FYI
http://software.silicon.com/security/0,39024655,39121979,00.htm
http://www.cbsnews.com/stories/2004/07/06/tech/main627736.shtml
Fritz
Frederick P. Squib, Jr.
Network Operations/Mail Administrator
Citizens Telephone Company of Kecksburg
http://www.wpa.net
()  ascii ribbon campaign - against html mail
/\- against microsoft attachments
---
[This E-mail scanned by Citizens Internet Services with Declude Virus.]
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-682-7111
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Span Domains file

2004-04-22 Thread Glenn Brooks


Somehow one of my guys have deleted our spamdomains file.
I was wondering if someone could provide us with one that is working well 
for them.
Anyone can send it directly to [EMAIL PROTECTED]

Thanks in advance.

gb 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] New test

2004-04-19 Thread Glenn Brooks
Will Heloisp run on NT ...I do not see any activity in task manager or in 
the declude logslog level MID



At 01:57 PM 4/19/2004 -0400, you wrote:
You should be fine as long as you don't do matches on numbers below 20, or 
at least that is my experience.  I'm thinking that you created this 
exception in order to head off that problem.  Minimally it's worth a try.

Matt

Bud Durland wrote:

Jason wrote:

These headers didn't trigger the HELOISIP test.  It looks to me like
they should have.  Any Ideas?
Received: from adsl-63-202-107-44.dsl.lsan03.pacbell.net [63.202.107.44]
by areatech.com  (SMTPD32-7.14) id A37557AB0118; Mon, 19 Apr 2004 
10:42:45 -0500

Because of the 'lsan03', the numeric characters in the host name boil 
down to 63.202.107.44.03.  I'm thinking about how best to make this type 
of entry fail, without jacking up the risk of a false positive.

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] New test

2004-04-18 Thread Glenn Brooks
I get an unknow filter type in the log files...

HELOISP filter C:\imail\declude\heloisipx.exe 10 0

this apth would point to the exe file

is this not correct?

At 02:00 AM 4/19/2004 +, you wrote:
any chance to get the source code ?
Thanks
- Original Message -
From: Bud Durland [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, April 19, 2004 12:21 AM
Subject: Re: [Declude.JunkMail] New test
 Andy Schmidt wrote:

 Hm - isn't that already covered in the HELOBOGUS test?
 
 

 Not really:

   Received: from morden-res-206-45-166-10.mts.net [206.45.166.10]

 morden-res-206-45-166-10.mts.net is a valid host name that will not
 trip HELOBOGUS, but will trip HELOISIP.


 --
 
 Bud Durland, CNE [EMAIL PROTECTED] fax: 518-561-0017
 
 For sale: Parachute.  Like new, used once.  Small stain.
 

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] New test

2004-04-14 Thread Glenn Brooks


interested
At 09:17 AM 4/14/2004 -0400, you wrote:
interested

thanks, andy


- Original Message - 

From: Bud Durland


To: Declude List 

Sent: Wednesday, April 14, 2004 8:58 AM

Subject: [Declude.JunkMail] New test

I am testing a small external test program. A message fails the test if there is an discernable IP address in the HELO entry of the message. These fail the test:

 Received: from host-68-212-107-146.msy.bellsouth.net [68.212.107.146] by mrpcap.com

 Received: from ip-62-129-160-91.evhr.net [62.129.160.91] by mrpcap.com

 Received: from acs-24-154-41-142.zoominternet.net [24.154.41.142] by mrpcap.com

Only the bolded part of the line (HELO name) is tested. Basically, dashes become 'dots', and anything other than numbers and dots are stripped out. If what remains looks like a valid 4-octet IP address, the test fails.

These entries would NOT fail -- stray number make the location of the IP ambiguous

 Received: from wbar3.lax1-4-8-227-083.dsl-verizon.net [4.8.227.83] by mrpcap.com 

 Received: from c-24-125-42-12.va.client2.attbi.com [24.125.42.12] by mrpcap.com 

For testing, I set it up with 0 weight and a HOLD action. So far, it has not flagged anything that was not spam.

If anyone is interested in trying it out, let me know. I'll probably be putting it up for download from my web site later this week.


-- 

---

illigitimi non carborundum

---

Bud Durland, CNE Mold-Rite Plastics

Network Administrator http://www.mrpcap.com

---


Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com



Re: [Declude.JunkMail] Google Gmail.com

2004-04-01 Thread Glenn Brooks
MSNBC reported that it IS NOT a hoax.
But considering MSNBC record for inaccuracy, it probably is a hoax.


At 12:07 PM 4/1/2004 -0800, you wrote:
Anyone think this is a hoax?

They are offering 1 gig of free email space. That is a lot!

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] weird random .htm attachments

2004-03-30 Thread Glenn Brooks
so you do a body filter?

At 09:00 AM 3/30/2004 -0500, you wrote:
I filter on this + String.fromCharCode(

This is common in all of them. Combined with other tests it catches most.

Mike



- Original Message -
From: Glenn Brooks [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, March 29, 2004 20:02
Subject: RE: [Declude.JunkMail] weird random .htm attachments
 Has anyone set up a filter to catch thesewe get a lot of them...

 gb


 At 04:41 PM 3/29/2004 -0800, you wrote:
 Yes, I have been seeing them too. They are java scripts that run.
Definitly
 spam.
 
 John Tolmachoff
 Engineer/Consultant/Owner
 eServices For You
 
   -Original Message-
   From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
   [EMAIL PROTECTED] On Behalf Of Kevin
   Sent: Monday, March 29, 2004 4:37 PM
   To: [EMAIL PROTECTED]
   Subject: [Declude.JunkMail] weird random .htm attachments
  
   Hi,
  
   Tried searching mail-archive.com for these but didn't turn up
anything.
  
   Subject: pass on the fun [random subjects]
   Body: This message has attach [random too]
   [random attachments but always ends in .htm]
  
   I didn't open it with IE but with a text editor.
  
   Starts with script language=JavaScriptcontractions = new
Array(162,
   [whole bunch of numbers]
  
   ends with
  
   charters = 907;
   beetle = 243;
   var equal = ;
   for(bowl = 0; bowl  charters; bowl++)
  equal = equal + String.fromCharCode(contractions[bowl] ^
   preferential[bowl % beetle]);
   document.write(equal);
   /script
  
   Sniffer catches these under rule 62 (Experimental) but it's not enough
to
   hold these.
  
   Any ideas? What does one see when they view this under IE?
  
  
   ---
   [This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]
  
   ---
   This E-mail came from the Declude.JunkMail mailing list.  To
   unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
   type unsubscribe Declude.JunkMail.  The archives can be found
   at http://www.mail-archive.com.
 
 ---
 [This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]
 
 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.

 Glenn Brooks
 WebWize, Inc.
 713-688-4382
 http://www.webwize.com


 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] weird random .htm attachments

2004-03-29 Thread Glenn Brooks
Has anyone set up a filter to catch thesewe get a lot of them...

gb

At 04:41 PM 3/29/2004 -0800, you wrote:
Yes, I have been seeing them too. They are java scripts that run. Definitly
spam.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
 -Original Message-
 From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
 [EMAIL PROTECTED] On Behalf Of Kevin
 Sent: Monday, March 29, 2004 4:37 PM
 To: [EMAIL PROTECTED]
 Subject: [Declude.JunkMail] weird random .htm attachments

 Hi,

 Tried searching mail-archive.com for these but didn't turn up anything.

 Subject: pass on the fun [random subjects]
 Body: This message has attach [random too]
 [random attachments but always ends in .htm]

 I didn't open it with IE but with a text editor.

 Starts with script language=JavaScriptcontractions = new Array(162,
 [whole bunch of numbers]

 ends with

 charters = 907;
 beetle = 243;
 var equal = ;
 for(bowl = 0; bowl  charters; bowl++)
equal = equal + String.fromCharCode(contractions[bowl] ^
 preferential[bowl % beetle]);
 document.write(equal);
 /script

 Sniffer catches these under rule 62 (Experimental) but it's not enough to
 hold these.

 Any ideas? What does one see when they view this under IE?


 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Per domain problem

2004-01-21 Thread Glenn Brooks


I am not able to get the per domain feature of pro to work.

Imail running about 60 domains
About 5 of them need to have custom settings.
domain1.com is the top level primary domain and all config files are in the 
declude directory
E:\imail\declude\

inside the declude directory are directories for the 4-5 domains that need 
custom settings.
domain2.com
domain3.com
domain4.com
domain5.com

these domain are the primary domains for each virtual domain in Imail and 
not an alias. They match the case that is also in Imail, not sure if 
case-sensitive is an issue, but they do match.

When I send an email to [EMAIL PROTECTED]
Declude uses the global.cfg and $default.junkmail$ file that is in the 
E:\Imail\declude directory instead of the files in the 
E:\Imail\declude\domain2.com

I would also like to have each domain run their own log files so I have 
change the log file name in each directories global.cfg to be different. 
These log files are never created in the spool directory like the top-level 
domain log file is. I am I doing something wrong here also?

Am I missing something here? Is this the way per-domain is supposed to 
work. This is how I read it in the manual online.

Any assistance will be greatly appreciated.

gb

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Per domain problem

2004-01-21 Thread Glenn Brooks
I have $default.junkmail$ files in each of the directories for each domain 
as well as global.cfg files.
Any other suggestions, one client especially is running out of patience on 
this problem.

Anyone at Declude have any ideas why the per-domain feature would not be 
working?

gb

At 11:54 PM 1/20/2004 -0800, you wrote:
You meed to put a default.junkmail file in the directories. The
golbal.config is just that global and can not be modified to work for just
one domain.
Kevin Bilbee

 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] Behalf Of Glenn Brooks
 Sent: Tuesday, January 20, 2004 11:04 PM
 To: [EMAIL PROTECTED]
 Subject: [Declude.JunkMail] Per domain problem




 I am not able to get the per domain feature of pro to work.

 Imail running about 60 domains
 About 5 of them need to have custom settings.
 domain1.com is the top level primary domain and all config files
 are in the
 declude directory
 E:\imail\declude\

 inside the declude directory are directories for the 4-5 domains
 that need
 custom settings.
 domain2.com
 domain3.com
 domain4.com
 domain5.com

 these domain are the primary domains for each virtual domain in Imail and
 not an alias. They match the case that is also in Imail, not sure if
 case-sensitive is an issue, but they do match.

 When I send an email to [EMAIL PROTECTED]
 Declude uses the global.cfg and $default.junkmail$ file that is in the
 E:\Imail\declude directory instead of the files in the
 E:\Imail\declude\domain2.com

 I would also like to have each domain run their own log files so I have
 change the log file name in each directories global.cfg to be different.
 These log files are never created in the spool directory like the
 top-level
 domain log file is. I am I doing something wrong here also?

 Am I missing something here? Is this the way per-domain is supposed to
 work. This is how I read it in the manual online.

 Any assistance will be greatly appreciated.

 gb


 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Per domain problem

2004-01-21 Thread Glenn Brooks
Ok thanks Scott, that makes sense.to confirm, but the only global.cfg 
file that will be used under any condition is the top level global.cfg file 
within the Imail/declude directory

thanks again for all your support

gb

At 03:04 PM 1/21/2004 -0500, you wrote:

My understanding, that once you have a directory for a domain, you must have
a $default$.junkmail file in there, otherwise no action will be taken at
all.
The per-domain config file (\IMail\Declude\example.com\$default$.JunkMail 
file) is actually not required.

If a per-user config file exists, Declude JunkMail will use 
it.  Otherwise, it will check for a per-domain config file, and use that 
if it exists.  If neither of those exists, the 
\IMail\Declude\$default$.JunkMail file will be used.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] turn off one client

2004-01-14 Thread Glenn Brooks


I know this has been answered before, but I can not find it in the archives.
I have one client that wants to turn off the spam filter.
I have individual directories for each domain that is running special 
weights and they are one.

How can I disable declude for their specific domain without doing a global 
whitelist of their domain.

thanks in advance gents

gb

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] A single domain not able to whitelist

2004-01-14 Thread Glenn Brooks
Initially I was trying to whitelist an entire hosted domain but was not 
able to do so. Declude still caught spam being sent to them. So upon 
further checking I found that that individual domain was actually using my 
top level config files when email was sent to that particular doamin, 
instead of the config files in their domain directory.

So to please the client I simply tried to whitelist their entire domain, 
but no matter if I use the whitelist todomain or create a whitelistfilter, 
I can not seem to whitelist everything sent to their individual domain. I 
still see where spam is being caught in the log files.

Where should I start to track down the problem...other domains with custom 
directories for weighting and filters work fine. I simply need to whitelist 
all email sent to them.

Thanks in advance

Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] New CMDSPACE test in latest interim release

2004-01-06 Thread Glenn Brooks
It has been a while since I upgrade my versionare there any special 
step to upgrading or can I simply replace the .exe file and restart Imail 
SMTP and POP services?

thanks in advance

gb

At 07:42 PM 1/6/2004 -0500, you wrote:

Woops on the Delude thing
Sorry, it should be:

http://www.declude.com/interim



   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] HOTMAIL ?

2003-12-18 Thread Glenn Brooks
I would like to try the file listed below for the spamdomains...but I am 
nto sure if wrapping has taken place in the mail client. Could someone send 
me a attachement of the text file that has been working for them...thanks 
in advance...At 04:31 PM 12/18/2003 -0500, you wrote:

altavista.  .av.com
amazon.com  .forevermail.com
ameritech.net  .sbc.com
.aol.com
@aol.com  .aol.com
.apple.com
@apple.com  .apple.com
.att.   .cdpd.airdata.com
@att.   .att.
attbi.com  .comcast.
bellatlantic.net .verizon.net
.bellsouth.net
@bellsouth.net  .bellsouth.net
.btinternet.
@btinternet.  .btinternet.
.buy.com  .dartmail.com
@buy.com  .buy.com
.charter.net
@charter.net  .charter.net
.cisco.com
@cisco.com  .cisco.com
.comcast.
@comcast.  .comcast.
.compaq.com
@compaq.com  .compaq.com
compuserve.com  .aol.com
concentric.com  .cnchost.com
concentric.net  .cnc.net
.cox.
@cox.   .cox.
@cs.com   .aol.com
.dell.com
@dell.com  .dell.com
earthlink.  .mindspring.
.ebay.com  .emailebay.com
@ebay.com  .ebay.com
excite.com  .excitenetwork.com
.gateway.com  .dartmail.net
@gateway.com  .gateway.com
geocities.com  .yahoo.com
gte.   .verizon.
.hotmail.com
@hotmail.com  .hotmail.com
hp.com   .compaq.com
juno.com  .untd.com
.lycos.com
@lycos.com  .lycos.com
.microsoft.com
@microsoft.com  .microsoft.com
mindspring.  .earthlink.
msn.com   .hotmail.com
netscape.  .aol.com
netzero.  .untd.com
.paypal.com
@paypal.com  .paypal.com
prodigy.net  .yahoo.
psi.   .cogentco.com
qwest.   .uswest.
.rr.com
@rr.com   .rr.com
.sbc.com
@sbc.com  .sbc.com
sprint.   .sprintlink.net
swbell.net  .prodigy.net
uswest.   .qwest.
verio.   .veriomail.com
verizon.com  .gte.com
verizon.net  .bellatlantic.
.yahoo.
@yahoo.   .yahoo.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Server Gone Wild

2003-12-02 Thread Glenn Brooks
possible dns not resolvingtry changing DNS in Imail and restart 
smtpworks for mine sometimes...

gb

At 12:06 AM 12/3/2003 -0600, you wrote:
A friend of mine at Safe-t.net in Mt. Vernon Ohio just called me and said
his spool in Imail is loading up and holding all messages..He thinks the
Declude has stopped working...Imail tech support not available..
He has rebooted the server several times with no luck..

Declude log is not showing anything...

If anyone on this list has an idea what is going on could you please give
Brian Thompson a call at 1.888.895.8648
He can't use email as it just goes to the spool and sits

Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Report System

2003-08-01 Thread Glenn Brooks
)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Log entry question

2003-07-31 Thread Glenn Brooks


Has anyone seen this line of code in the declude log file...if so, what 
does it mean?

07/31/2003 00:00:21 Qa24dc2d300f29dd8 WARNING: Unknown filter type 
vwaitingyou.info. 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] ORDB problem, slightly off topic

2003-07-21 Thread Glenn Brooks


I got it fixedwe are not in their database any longer
At 12:14 PM 7/21/2003 -0400, you wrote:
Glenn,
When I click on that link it
says...

-
This host is not listed in ORDB as an open mail relay
-

So what's the problem?

Dan


- Original Message - 

From: Glenn Brooks 


To: [EMAIL PROTECTED] 

Sent: Friday, July 18, 2003 9:00 PM

Subject: [Declude.JunkMail] ORDB problem, slightly off topic

We got listed on the ORDB database as a mail relay...everywhere I test mail relay, it says we are not running a relay. When looking at the logs...it appears ORDB can get my mail server to mail to their email address of 

[EMAIL PROTECTED]

from my [EMAIL PROTECTED]

you can see the report at: http://ordb.org/lookup/?host=216.165.193.28

I can not for the life of me block this action for retesting by ORDBI have had ORDB retest 5 times...and it still goes through..

...anyone have any suggestions

Glenn Brooks

WebWize, Inc.

713-688-4382

http://www.webwize.com 



Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com



[Declude.JunkMail] ORDB problem, slightly off topic

2003-07-18 Thread Glenn Brooks


We got listed on the ORDB database as a mail relay...everywhere I test
mail relay, it says we are not running a relay. When looking at the
logs...it appears ORDB can get my mail server to mail to their email
address of 
[EMAIL PROTECTED]
from my [EMAIL PROTECTED]
you can see the report at:
http://ordb.org/lookup/?host=216.165.193.28
I can not for the life of me block this action for retesting by ORDBI
have had ORDB retest 5 times...and it still goes through..
...anyone have any suggestions

Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com



RE: [Declude.JunkMail] ORDB problem, slightly off topic

2003-07-18 Thread Glenn Brooks


Thankssounds like I am going to have to contact 1500 clients about
setting Authorize on thei email client..
Gb
At 10:09 PM 7/18/2003 -0400, you wrote:
What
are your Imail settings with respect to relaying?

Looks as if you may have
defined permit for local hosts - which is misleading, because
all it requires is that the sender use one of your domain names to be
able to relay through your system.

You need to either do NOT allow
relaying (and have your dial-up users use SMTP AUTH) and/or only allow
relaying based on specific IP addresses (your own and any trusted IP
blocks).
Best Regards
Andy
Schmidt

Phone: +1 201 934-3414 x20
(Business)
Fax: +1 201 934-9206 


-Original Message-

From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]
On Behalf Of Glenn Brooks

Sent: Friday, July 18, 2003 09:01 PM

To: [EMAIL PROTECTED]

Subject: [Declude.JunkMail] ORDB problem, slightly off
topic

We got listed on the ORDB database as a mail relay...everywhere I
test mail relay, it says we are not running a relay. When looking at the
logs...it appears ORDB can get my mail server to mail to their email
address of 

[EMAIL PROTECTED]

from my [EMAIL PROTECTED]

you can see the report at:
http://ordb.org/lookup/?host=216.165.193.28

I can not for the life of me block this action for retesting by
ORDBI have had ORDB retest 5 times...and it still goes
through..

...anyone have any suggestions

Glenn Brooks

WebWize, Inc.

713-688-4382

http://www.webwize.com




Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com



RE: [Declude.JunkMail] Lost One Account - Help Please

2003-07-11 Thread Glenn Brooks

Thanks ... good advice
A couple of questionswhen testing for an IP address, if I want to 
filter a block of address what is the correct way to write this:

HELO 20 CONTAINS 216.111.26.

OR CAN

HELO 15 CONTAINS 216.111.26.0/24

Also is there a size limit with declude for the .txt files used to list IP 
addresses or domains, like there is in IMail?

Thanks in advance everyone...looks like our spam has really tightened up 
with all your suggestions...

gb 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Lost One Account - Help Please

2003-07-11 Thread Glenn Brooks
OK thanks...will just use mine and very specific addresses...

One other question:

When adding a line to the domain list, what/when is the correct method of 
adding a . before a domain, for example:

HELO 20 CONTAINS .gstassoc.com

The from addresses usually do not show additional aliases, but when looking 
at the header information I usually see an aliases before the domain.

thanks in advancethe spam is really down since all of you have provided 
me with answersthanks everyone

gb



At 03:33 PM 7/11/2003 -0400, you wrote:
Aarrgh.  I meant to say, that includes OUR very valid mail server in that
range.
What Glenn should do is block servers pretending to be HIS domain (so, he
should use HIS ip address in the HELO line), not any type of range. Range
blocking would be more appropriate for blocking blocks of numbers used by
spammers (usually cable or dial-up).
Karen

 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] Behalf Of Karen D. Oland
 Sent: Friday, July 11, 2003 3:24 PM
 To: [EMAIL PROTECTED]
 Subject: RE: [Declude.JunkMail] Lost One Account - Help Please


 I just hope you don't include either of the below (since that
 range includes
 are very valid email server and probably a few more).

 Use the single address of your own server (since the problem is people
 pretending to be YOU, not ME (I hope)).

 Karen

  -Original Message-
  From: Glenn Brooks
 
  A couple of questionswhen testing for an IP address, if I want to
  filter a block of address what is the correct way to write this:
 
  HELO 20 CONTAINS 216.111.26.
 
  OR CAN
 
  HELO 15 CONTAINS 216.111.26.0/24

 ---
 [This E-mail scanned for viruses by Declude Virus]

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Lost One Account - Help Please

2003-07-10 Thread Glenn Brooks
I hate to continue to ask for assistance for the same problem, but I just 
can not figure it out.
I lost a 300.00/month hosting account today due to continued spam getting 
through.

Here is what I have: I have multiple domains. Only a couple run with their 
own directory within the Declude directory within the Imail Directory.
The client that left for another hosting company was running off the same 
global.cfg file as my main domain.

In the Global.cfg file I have a line of code like thes:

BLACKLISTDOMAIN filter E:\IMail\Declude\domainblacklist.txt x 20 0:

I do not have any other line of code associated with this test in the 
globla.cfg file.

In the file named domainblacklist.txt I have the following lines of code 
(there are about 100 lines, on sep. lines):

MAILFROM 20 CONTAINS hollywoodspecials.net
MAILFROM 20 CONTAINS .hollywoodspecials.net
Then in my junkmail file I have the following line of code:
BLACKLISTDOMAIN DELETE
I do not know if I am missing some code somewhere else or if I need to add 
something somewhere...I am just lost...
and hate to lose another account, which a couple are threatening if I can 
not stop the spam from the same addresses.

Any help or suggestions is greatly appreciated...I will even pay to have 
the problem solved...it's probably something
I am not doing correctly.



Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Lost One Account - Help Please

2003-07-10 Thread Glenn Brooks



Then in my junkmail file I have the following line of code:
BLACKLISTDOMAIN DELETE
The questions here include:

[1] Is that junkmail file the one being used for E-mail to the domain in 
question (IE do you have any per-user or per-domain configurations)?
Yes this file is used for the domain in question and webwize.com, the main 
domain

[2] Could the E-mail to the domain in question be considered outgoing 
E-mail (if the E-mail is a gateway domain, that is not stored locally)?
All email is stored locally...I do not think the email was outgoing, since 
it was being received by the client, and I received some as well, under the 
webwize.com domain.

[3] If per-user or per-domain settings are being used, are there any user 
aliases or host aliases involved?
No

[4] The obvious (to me) question: Do the E-mails that aren't getting 
deleted have hollywoodspecials.net in the return address (the 
X-Declude-Sender: header or the MAIL FROM line in the SMTP log file; 
these are often different than the From:, Reply-To:, Sender: or 
other similar headers)?
The email that was sent to me at this email address, [EMAIL PROTECTED] 
from the hollywoodspecials.net had the email in the from address, it was 
also in the X-Declude-Sender, they were identical for these particular emails.

[5] What do the log files show for this E-mail (which narrows it down to 
being a problem with the test, or the actions that are being used on it)?
I will have to watch for thisthe thing I noticed last night and today 
was the following in the declude log files, but am not sure they were for 
these exact emails, but I have this continually in the declude log files.

07/10/2003 20:11:42 Q0eb9c314012eb215 Msg failed BLACKLISTIP ( This is a 
spam IP address). Action=IGNORE.
07/10/2003 20:11:42 Q0eb9c314012eb215 Msg failed BLACKLISTDOMAIN (Message 
failed BLACKLISTDOMAIN test (120)). Action=IGNORE.

Then a couple of lines down I will have:

07/10/2003 20:12:59 Q0f07c404012ee48a Msg failed BLACKLISTIP ( This is a 
spam IP address). Action=DELETE.
07/10/2003 20:12:59 Q0f07c404012ee48a Msg failed BLACKLISTDOMAIN (Message 
failed BLACKLISTDOMAIN test (132)). Action=DELETE.

This is what has me confused, it seems to catch the tests, sometimes

thanks for the help...

gb





---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Lost One Account - Help Please

2003-07-10 Thread Glenn Brooks

Write in the atlasfilter.txt
helo 20 contains ommo.net
helo 20 contains 212.64.200.32
I will adjust mine to match this and give it a try

Can I use the following for IPs

helo 20 contains 212.64.200.0/24

to cover more IP addresses?

Thanks for the suggestions...

gb 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Lost One Account - Help Please

2003-07-10 Thread Glenn Brooks
that is a great suggestion

..looks like you configuration is working so far...and setting the log to 
mid helps sort out the log files.when at low it showed the test 
ignored, while looking at it at MID set, it shows ignore and then further 
down the log it deletes after finishing all tasks

Thanks for all your help...

gb

At 05:05 AM 7/11/2003 +0300, you wrote:
Glen ,

In fact 212.64.200.32 is my server ip address.
Many spammers try to fool your mail server using as hello your mail server
ip address.
Every mail server start talking as follow HELO(EHLO) myhostname.com
But many spammers use HELO(EHLO) 212.64.200.32
212.64.200.32 is my server ip address.
The remote mail server name can not be my ip address :)
This is a spammer trick which can work with very old mail servers.
Thats why i am deleting every mail which contains HELO(EHLO) 212.64.200.32
I am cacthing more than 20% of spam like this.
And be sure this %100 spam.
I have never seen a mail server using the remote mail server name.
Rifat Levis







- Original Message -
From: Glenn Brooks [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, July 11, 2003 4:50 AM
Subject: Re: [Declude.JunkMail] Lost One Account - Help Please



Write in the atlasfilter.txt
helo 20 contains ommo.net
helo 20 contains 212.64.200.32
I will adjust mine to match this and give it a try

Can I use the following for IPs

helo 20 contains 212.64.200.0/24

to cover more IP addresses?

Thanks for the suggestions...

gb

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Some Help needed on a couple of things

2003-07-09 Thread Glenn Brooks


I finally have had the chance to upgrade to 1.65 and need a little help on 
a couple of things

I have in my global.cfg file a couple of tests:

BLACKLISTIP ipfile E:\IMail\Declude\ipblacklist.txt x 20 0
BLACKLISTDOMAIN filter E:\IMail\Declude\domainblacklist.txt x 20 0
one is an ip address test and the other is a domain test

The domain test file has about 90 lines of:

MAILFROM 20 CONTAINS myfulfillments.com
MAILFROM 20 CONTAINS forumxpress.com
MAILFROM 20 CONTAINS mail.almtal.net
The IP test has the following code on separate lines:

80.0.122.0/24 This is a spam IP address
211.43.197.0/24 This is a spam IP address
218.146.185.0/24 This is a spam IP address
In my default.jumkmail I have:

BLACKLISTIP DELETE
BLACKLISTDOMAIN DELETE
IN the log files I am seeing this:
07/09/2003 20:21:41 Qbf9a3efa012ca2d1 Msg failed BLACKLISTIP ( This is a 
spam IP address). Action=IGNORE.
07/09/2003 20:21:41 Qbf9a3efa012ca2d1 Msg failed BLACKLISTDOMAIN (Message 
failed BLACKLISTDOMAIN test (79)). Action=IGNORE.

So it looks like I have both these test set up wrong

Can anyone point me in the right direction?

Thanks in advance

gb

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Some Help needed on a couple of things 2

2003-07-09 Thread Glenn Brooks
I just checked the log files again and I am seeing this:

07/09/2003 20:26:04 Qc0a12c1600c8a399 Msg failed BLACKLISTIP ( This is a 
spam IP address). Action=DELETE.
07/09/2003 20:26:04 Qc0a12c1600c8a399 Msg failed BLACKLISTDOMAIN (Message 
failed BLACKLISTDOMAIN test (79)). Action=DELETE.

So it looks like the test delete sometimes and then sometimes they do 
ignore



Glenn Brooks
WebWize, Inc.
713-688-4382
http://www.webwize.com 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Sorry if Off Topic Need Declued Anti Spam info

2003-06-12 Thread Glenn Brooks


We currently use your anti-spam product and would like to get away from the 
4K anti-virus solution from IMail.

Not sure if you have a Anti-Virus usergroup like this anti-spam usergroup. 
May have missed it on the web site.

If not...I am a little confused on how to implement your anti-virus 
solution. If I understand it correctly from reading on the web site. I need 
you anti-virus solution to scan the mail, but use a third party engine to 
know the viruses...

Do I buy something like F-prot and load it on the server and then somehow 
tie the Declude Anti-virus to it?

Any help is greatly appreciated. My anti-virus expires this weekend so I 
need to get something going by tomorrow

gb

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] f-prot

2003-02-18 Thread Glenn Brooks
Hate to sounds like the idiot butcould someone answer a couple 
questions on F-prot

It anti-virus?
Does in run at the server level?
Does it run at the client level also, or only at client level?

Sorry if I came in on the back side of this conversation...

Thanks
gb


At 08:37 AM 2/18/2003 -0500, you wrote:
Hello,

Same Here. I love the ease of use with F-prot. And the license is great so
we have it running on all our in-house systems. I have also started using it
on all our corporate customers where we provide IT Support. I just get the
customer an F-prot license for $40 (20 users) and can install the product on
all his PC. This is truly the best value on the market and the scheduler for
downloads and scans is easy to set-up.

Ken
- Original Message -
From: Keith Purtell [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, February 17, 2003 3:11 PM
Subject: RE: [Declude.JunkMail] f-prot


 Same here; no problems with F-Prot. Plus it fit our budget very nicely.

 Keith Purtell, Web/Network Administrator
 VantageMed Operations (Kansas City)
 Email:  [EMAIL PROTECTED]

 CONFIDENTIALITY NOTICE: This email message, including any attachments, is
for the sole use of the
 intended recipient(s) and may contain confidential and privileged
information. Any unauthorized
 review, use, disclosure or distribution is prohibited. If you are not the
intended recipient, please
 contact the sender by reply email and destroy all copies of the original
message.


  -Original Message-
  From: [EMAIL PROTECTED]
  [mailto:[EMAIL PROTECTED]]On Behalf Of
  Michael Graveen
  Sent: Monday, February 17, 2003 2:02 PM
  To: [EMAIL PROTECTED]
  Subject: Re: [Declude.JunkMail] f-prot
 
 
  I use F-Prot with Declude and I am very satisfied with it.
 
  Mike
 
  At 11:52 AM 2/17/2003 -0800, you wrote:
  Is anyone using f-prot with Imail and Declude ?? I'm presently using
  Mcafee net shield but I am always looking for alternatives ...
  
  TIA
  Doris
 
 

 ---
 [This E-mail scanned for viruses by Declude Virus]

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.
 ---
 [This E-mail scanned for viruses at mail.fiam.net]



---
[This E-mail scanned for viruses at mail.fiam.net]

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Glenn Brooks
WebWize, Inc.
713-682-7111
http://www.webwize.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.