[Declude.JunkMail] Global.cfg cleanup
For about a week my server (2xP3xeon 2.8GHz) was beiing saturated by an increase of traffic 100% CPU for hours and ten of thousands of messages in \proc the servers was working fine for several years something had to be done, decided to clean global.cfg, and need help optimizing AVafterJM was on Cleaned global.cfg left only Sniffer, Zerohour, some builtin tests, and a couple of filters the server is now stable, but i need some answers to decide what to do next 1- loglevel and logOK have any effects on CPU ? 2- Any DNS tests that are realy important ? (for now, I removed all) 3- Any of the following external tests / Filters are important, or are they outdated ? TIA #HELOISIP external nonzero E:\imail\filters\heloisip\heloisip.exe 3 0 #HELOISIPX external nonzero E:\imail\filters\heloisip\heloisipx.exe 3 0 #SIZE-S external11CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 100000 #SIZE-M external12CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 1000-100 #SIZE-L external13CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 1000-200 #SIZE-XL external14CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 1000-300 #SPAMCHK external weight E:\spamchk\spamchk.exe #INV-URIBL external weight E:\INVURIBL\INVURIBL.exe %WEIGHT% %REMOTEIP% 0 0 ## #GIBBERISH filter E:\IMail\Filters\Gibberish.txt x 0 0 #GIBBERISHSUB filter E:\IMail\Filters\GibberishSub.txtx 0 0 #DYNAMIC filter E:\IMail\Filters\Dynamic.txt x -1 0 #SURBLfilter E:\IMail\Filters\Surbl\surbl.txt x 1 0 #OFFENSIVE filter E:\IMail\Filters\offensive.txt x 0 0 ## # Good attribute Checks, KM00 #FALSE-AOL filter E:\Imail\KM00\False_AOL.txt x 0 0 #FALSE-YAHOO filter E:\Imail\KM00\False_Yahoo.txt x 0 0 #FALSE-HOTMAIL filter E:\Imail\KM00\False_Hotmail.txt x 0 0 #FALSE-TELEFONICA filter E:\Imail\KM00\False_telefonica.txt x 0 0 #GOOD-TELEFONICA filter E:\Imail\KM00\good_telefonica.txt x 0 0 #GOOD_HOTMAIL filter E:\Imail\KM00\Good_Hotmail.txt x 0 0 #GOOD_AOL filter E:\Imail\KM00\Good_Aol.txt x 0 0 #GOOD_Yahoo filter E:\Imail\KM00\Good_Yahoo.txt x 0 0 ## #FILTER-BODYURL filter E:\Imail\KM00\IMail_Filter_URLinBody.txt x 0 0 #FILTER-SPAMMER-COMPANY filter E:\Imail\KM00\IMail_Filter_SpammerCompany.txt x 0 0 #FILTER-PORN filter E:\Imail\KM00\IMail_Filter_PornoSite.txt x -2 0 #FILTER-PORNw filter E:\Imail\KM00\IMail_Filter_PornoSite.txt x -5 0 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Global.cfg cleanup
first thing i did tested the DNS and looked at declude logs no problem there my cpus were not able to handle the traffic, as simple as that - Original Message - From: David Barker To: declude.junkmail@declude.com Sent: Tuesday, April 28, 2009 4:00 PM Subject: RE: [Declude.JunkMail] Global.cfg cleanup Serge, have you checked to make sure you not having DNS issues. DNS causes 80% of the issues with delays. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Serge Sent: Tuesday, April 28, 2009 11:51 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Global.cfg cleanup Importance: High For about a week my server (2xP3xeon 2.8GHz) was beiing saturated by an increase of traffic 100% CPU for hours and ten of thousands of messages in \proc the servers was working fine for several years something had to be done, decided to clean global.cfg, and need help optimizing AVafterJM was on Cleaned global.cfg left only Sniffer, Zerohour, some builtin tests, and a couple of filters the server is now stable, but i need some answers to decide what to do next 1- loglevel and logOK have any effects on CPU ? 2- Any DNS tests that are realy important ? (for now, I removed all) 3- Any of the following external tests / Filters are important, or are they outdated ? TIA #HELOISIP external nonzero E:\imail\filters\heloisip\heloisip.exe 3 0 #HELOISIPX external nonzero E:\imail\filters\heloisip\heloisipx.exe 3 0 #SIZE-S external11CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 100000 #SIZE-M external12CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 1000-100 #SIZE-L external13CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 1000-200 #SIZE-XL external14CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 1000-300 #SPAMCHK external weight E:\spamchk\spamchk.exe #INV-URIBL external weight E:\INVURIBL\INVURIBL.exe %WEIGHT% %REMOTEIP% 0 0 ## #GIBBERISH filter E:\IMail\Filters\Gibberish.txt x 0 0 #GIBBERISHSUB filter E:\IMail\Filters\GibberishSub.txtx 0 0 #DYNAMIC filter E:\IMail\Filters\Dynamic.txt x -1 0 #SURBLfilter E:\IMail\Filters\Surbl\surbl.txt x 1 0 #OFFENSIVE filter E:\IMail\Filters\offensive.txt x 0 0 ## # Good attribute Checks, KM00 #FALSE-AOL filter E:\Imail\KM00\False_AOL.txt x 0 0 #FALSE-YAHOO filter E:\Imail\KM00\False_Yahoo.txt x 0 0 #FALSE-HOTMAIL filter E:\Imail\KM00\False_Hotmail.txt x 0 0 #FALSE-TELEFONICA filter E:\Imail\KM00\False_telefonica.txt x 0 0 #GOOD-TELEFONICA filter E:\Imail\KM00\good_telefonica.txt x 0 0 #GOOD_HOTMAIL filter E:\Imail\KM00\Good_Hotmail.txt x 0 0 #GOOD_AOL filter E:\Imail\KM00\Good_Aol.txt x 0 0 #GOOD_Yahoo filter E:\Imail\KM00\Good_Yahoo.txt x 0 0 ## #FILTER-BODYURL filter E:\Imail\KM00\IMail_Filter_URLinBody.txt x 0 0 #FILTER-SPAMMER-COMPANY filter E:\Imail\KM00\IMail_Filter_SpammerCompany.txt x 0 0 #FILTER-PORN filter E:\Imail\KM00\IMail_Filter_PornoSite.txt x -2 0 #FILTER-PORNw filter E:\Imail\KM00\IMail_Filter_PornoSite.txt x -5 0 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Global.cfg cleanup
not sure what you mean by invalid i did specify that we have avafterjm on - Original Message - From: nick To: declude.junkmail@declude.com Sent: Tuesday, April 28, 2009 5:31 PM Subject: Re: [Declude.JunkMail] Global.cfg cleanup Serge, Are you getting a lot of invalids? In other words maybe too much traffic for some reason. Also are you scanning for virii after junkmail runs? -Nick -- From: Serge se...@cefib.com Sent: Tuesday, April 28, 2009 1:04 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Global.cfg cleanup first thing i did tested the DNS and looked at declude logs no problem there my cpus were not able to handle the traffic, as simple as that - Original Message - From: David Barker To: declude.junkmail@declude.com Sent: Tuesday, April 28, 2009 4:00 PM Subject: RE: [Declude.JunkMail] Global.cfg cleanup Serge, have you checked to make sure you not having DNS issues. DNS causes 80% of the issues with delays. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Serge Sent: Tuesday, April 28, 2009 11:51 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Global.cfg cleanup Importance: High For about a week my server (2xP3xeon 2.8GHz) was beiing saturated by an increase of traffic 100% CPU for hours and ten of thousands of messages in \proc the servers was working fine for several years something had to be done, decided to clean global.cfg, and need help optimizing AVafterJM was on Cleaned global.cfg left only Sniffer, Zerohour, some builtin tests, and a couple of filters the server is now stable, but i need some answers to decide what to do next 1- loglevel and logOK have any effects on CPU ? 2- Any DNS tests that are realy important ? (for now, I removed all) 3- Any of the following external tests / Filters are important, or are they outdated ? TIA #HELOISIP external nonzero E:\imail\filters\heloisip\heloisip.exe 3 0 #HELOISIPX external nonzero E:\imail\filters\heloisip\heloisipx.exe 3 0 #SIZE-S external11CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 100000 #SIZE-M external12CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 1000-100 #SIZE-L external13CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 1000-200 #SIZE-XL external14CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 1000-300 #SPAMCHK external weight E:\spamchk\spamchk.exe #INV-URIBL external weight E:\INVURIBL\INVURIBL.exe %WEIGHT% %REMOTEIP% 0 0 ## #GIBBERISH filter E:\IMail\Filters\Gibberish.txt x 0 0 #GIBBERISHSUB filter E:\IMail\Filters\GibberishSub.txtx 0 0 #DYNAMIC filter E:\IMail\Filters\Dynamic.txt x -1 0 #SURBLfilter E:\IMail\Filters\Surbl\surbl.txt x 1 0 #OFFENSIVE filter E:\IMail\Filters\offensive.txt x 0 0 ## # Good attribute Checks, KM00 #FALSE-AOL filter E:\Imail\KM00\False_AOL.txt x 0 0 #FALSE-YAHOO filter E:\Imail\KM00\False_Yahoo.txt x 0 0 #FALSE-HOTMAIL filter E:\Imail\KM00\False_Hotmail.txt x 0 0 #FALSE-TELEFONICA filter E:\Imail\KM00\False_telefonica.txt x 0 0 #GOOD-TELEFONICA filter E:\Imail\KM00\good_telefonica.txt x 0 0 #GOOD_HOTMAIL filter E:\Imail\KM00\Good_Hotmail.txt x 0 0 #GOOD_AOL filter E:\Imail\KM00\Good_Aol.txt x 0 0 #GOOD_Yahoo filter E:\Imail\KM00\Good_Yahoo.txt x 0 0 ## #FILTER-BODYURL filter E:\Imail\KM00\IMail_Filter_URLinBody.txt x 0 0 #FILTER-SPAMMER-COMPANY filter E:\Imail\KM00\IMail_Filter_SpammerCompany.txt x 0 0 #FILTER-PORN filter E:\Imail\KM00\IMail_Filter_PornoSite.txt x -2 0 #FILTER-PORNw filter E:\Imail\KM00\IMail_Filter_PornoSite.txt x -5 0 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com
Re: [Declude.JunkMail] Global.cfg cleanup
we have hijack installed however, for years we have been asking that hijack be improved to differently handle authenticated users we also need to be able to override the limits by IP something like Default limit by ip x,y IP1x1,y1 IP2 (or subnet) x2,y2 authenticated users default: a,b user1 a1,b1 user2 a2, b2 . . . We have large clents with dozens of users behiind a single ip we cannot use the same limits as for a home user David, Please provide feedback on the above - Original Message - From: David Barker To: declude.junkmail@declude.com Sent: Tuesday, April 28, 2009 7:19 PM Subject: RE: [Declude.JunkMail] Global.cfg cleanup This is exactly why delude Hijack is designed to prevent and resolve. If you have a file hijack.cfg.off in your \declude directory just rename it to hijack.cfg to turn it on. Further information about hijack can be found here. http://www.declude.com/searchresults.asp?Cat=125 David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of decl...@mail.net1media.com Sent: Tuesday, April 28, 2009 3:18 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Global.cfg cleanup Serge, We had a similar situation happen about a week ago. For us, it turned out that one of our clients was infected with a virus/spyware/malware and was sending hundreds of thousands of spam messages. We had WHITELIST AUTH in the global.cfg. Once he authenticated, he was whitelisted. The system just could not keep up with the load. Once we figured out what was happening it took us a while to identify which account it was. I found that with LOGLEVEL MID, there is a line in the DECmmdd.LOG file that has the text [Authenticated:email address]. By searching the file and finding an unusually large volume of them from one user showed me which account to disable. Hope this helps, Don - Original Message - From: nick To: declude.junkmail@declude.com Sent: Tuesday, April 28, 2009 12:31 PM Subject: Re: [Declude.JunkMail] Global.cfg cleanup Serge, Are you getting a lot of invalids? In other words maybe too much traffic for some reason. Also are you scanning for virii after junkmail runs? -Nick From: Serge se...@cefib.com Sent: Tuesday, April 28, 2009 1:04 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Global.cfg cleanup first thing i did tested the DNS and looked at declude logs no problem there my cpus were not able to handle the traffic, as simple as that - Original Message - From: David Barker To: declude.junkmail@declude.com Sent: Tuesday, April 28, 2009 4:00 PM Subject: RE: [Declude.JunkMail] Global.cfg cleanup Serge, have you checked to make sure you not having DNS issues. DNS causes 80% of the issues with delays. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Serge Sent: Tuesday, April 28, 2009 11:51 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Global.cfg cleanup Importance: High For about a week my server (2xP3xeon 2.8GHz) was beiing saturated by an increase of traffic 100% CPU for hours and ten of thousands of messages in \proc the servers was working fine for several years something had to be done, decided to clean global.cfg, and need help optimizing AVafterJM was on Cleaned global.cfg left only Sniffer, Zerohour, some builtin tests, and a couple of filters the server is now stable, but i need some answers to decide what to do next 1- loglevel and logOK have any effects on CPU ? 2- Any DNS tests that are realy important ? (for now, I removed all) 3- Any of the following external tests / Filters are important, or are they outdated ? TIA #HELOISIP external nonzero E:\imail\filters\heloisip\heloisip.exe 3 0 #HELOISIPX external nonzero E:\imail\filters\heloisip\heloisipx.exe 3 0 #SIZE-S external11CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 100000 #SIZE-M external12CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 1000-100 #SIZE-L external13CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 1000
Re: [Declude.JunkMail] Global.cfg cleanup
hi we have a script that runs daily to find the number of messages sent per user (the authenticated account, not the from user), and emails me the top 10 senders so that is not the issue here we also have a script that find the number of messages sent per IP, and though we found some wireless CPEs sending mail continuously, (which was agravating the pb), the problem continued even after we fixed these cpes So i am quite sure the mails are inbound (not sent by authenticated user), and not more then a few are sent from the same ip adress - Original Message - From: decl...@mail.net1media.com To: declude.junkmail@declude.com Sent: Tuesday, April 28, 2009 7:18 PM Subject: Re: [Declude.JunkMail] Global.cfg cleanup Serge, We had a similar situation happen about a week ago. For us, it turned out that one of our clients was infected with a virus/spyware/malware and was sending hundreds of thousands of spam messages. We had WHITELIST AUTH in the global.cfg. Once he authenticated, he was whitelisted. The system just could not keep up with the load. Once we figured out what was happening it took us a while to identify which account it was. I found that with LOGLEVEL MID, there is a line in the DECmmdd.LOG file that has the text [Authenticated:email address]. By searching the file and finding an unusually large volume of them from one user showed me which account to disable. Hope this helps, Don - Original Message - From: nick To: declude.junkmail@declude.com Sent: Tuesday, April 28, 2009 12:31 PM Subject: Re: [Declude.JunkMail] Global.cfg cleanup Serge, Are you getting a lot of invalids? In other words maybe too much traffic for some reason. Also are you scanning for virii after junkmail runs? -Nick From: Serge se...@cefib.com Sent: Tuesday, April 28, 2009 1:04 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Global.cfg cleanup first thing i did tested the DNS and looked at declude logs no problem there my cpus were not able to handle the traffic, as simple as that - Original Message - From: David Barker To: declude.junkmail@declude.com Sent: Tuesday, April 28, 2009 4:00 PM Subject: RE: [Declude.JunkMail] Global.cfg cleanup Serge, have you checked to make sure you not having DNS issues. DNS causes 80% of the issues with delays. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Serge Sent: Tuesday, April 28, 2009 11:51 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Global.cfg cleanup Importance: High For about a week my server (2xP3xeon 2.8GHz) was beiing saturated by an increase of traffic 100% CPU for hours and ten of thousands of messages in \proc the servers was working fine for several years something had to be done, decided to clean global.cfg, and need help optimizing AVafterJM was on Cleaned global.cfg left only Sniffer, Zerohour, some builtin tests, and a couple of filters the server is now stable, but i need some answers to decide what to do next 1- loglevel and logOK have any effects on CPU ? 2- Any DNS tests that are realy important ? (for now, I removed all) 3- Any of the following external tests / Filters are important, or are they outdated ? TIA #HELOISIP external nonzero E:\imail\filters\heloisip\heloisip.exe 3 0 #HELOISIPX external nonzero E:\imail\filters\heloisip\heloisipx.exe 3 0 #SIZE-S external11CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 100000 #SIZE-M external12CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 1000-100 #SIZE-L external13CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 1000-200 #SIZE-XL external14CScript E:\IMail\Filters\Size.vbs //B //NoLogo //T:2 50,75,100 %WEIGHT% 1000-300 #SPAMCHK external weight E:\spamchk\spamchk.exe #INV-URIBL external weight E:\INVURIBL\INVURIBL.exe %WEIGHT% %REMOTEIP% 0 0 ## #GIBBERISH filter E:\IMail\Filters\Gibberish.txt x 0 0 #GIBBERISHSUB filter E:\IMail\Filters\GibberishSub.txtx 0 0 #DYNAMIC filter E:\IMail\Filters\Dynamic.txt x -1 0 #SURBLfilter E:\IMail\Filters\Surbl\surbl.txt x 1 0 #OFFENSIVE
Re: [Declude.JunkMail] Global.cfg cleanup
thanks David also for global.cfg, please consider include directives that will facilitate testing/optimization for example, to put the dns tests, or the sorbs or the ahbl tests in seperate files, and just an include instruction in the main global.cfg will make it more readable and easier to modify/optimize what you think ? - Original Message - From: David Barker To: declude.junkmail@declude.com Sent: Tuesday, April 28, 2009 8:31 PM Subject: RE: [Declude.JunkMail] Global.cfg cleanup I will look at revisiting this issue of additional functionality for hijack. From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Serge Sent: Tuesday, April 28, 2009 4:14 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Global.cfg cleanup we have hijack installed however, for years we have been asking that hijack be improved to differently handle authenticated users we also need to be able to override the limits by IP something like Default limit by ip x,y IP1x1,y1 IP2 (or subnet) x2,y2 authenticated users default: a,b user1 a1,b1 user2 a2, b2 . . . We have large clents with dozens of users behiind a single ip we cannot use the same limits as for a home user David, Please provide feedback on the above - Original Message - From: David Barker To: declude.junkmail@declude.com Sent: Tuesday, April 28, 2009 7:19 PM Subject: RE: [Declude.JunkMail] Global.cfg cleanup This is exactly why delude Hijack is designed to prevent and resolve. If you have a file hijack.cfg.off in your \declude directory just rename it to hijack.cfg to turn it on. Further information about hijack can be found here. http://www.declude.com/searchresults.asp?Cat=125 David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of decl...@mail.net1media.com Sent: Tuesday, April 28, 2009 3:18 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Global.cfg cleanup Serge, We had a similar situation happen about a week ago. For us, it turned out that one of our clients was infected with a virus/spyware/malware and was sending hundreds of thousands of spam messages. We had WHITELIST AUTH in the global.cfg. Once he authenticated, he was whitelisted. The system just could not keep up with the load. Once we figured out what was happening it took us a while to identify which account it was. I found that with LOGLEVEL MID, there is a line in the DECmmdd.LOG file that has the text [Authenticated:email address]. By searching the file and finding an unusually large volume of them from one user showed me which account to disable. Hope this helps, Don - Original Message - From: nick To: declude.junkmail@declude.com Sent: Tuesday, April 28, 2009 12:31 PM Subject: Re: [Declude.JunkMail] Global.cfg cleanup Serge, Are you getting a lot of invalids? In other words maybe too much traffic for some reason. Also are you scanning for virii after junkmail runs? -Nick -- From: Serge se...@cefib.com Sent: Tuesday, April 28, 2009 1:04 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Global.cfg cleanup first thing i did tested the DNS and looked at declude logs no problem there my cpus were not able to handle the traffic, as simple as that - Original Message - From: David Barker To: declude.junkmail@declude.com Sent: Tuesday, April 28, 2009 4:00 PM Subject: RE: [Declude.JunkMail] Global.cfg cleanup Serge, have you checked to make sure you not having DNS issues. DNS causes 80% of the issues with delays. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Serge Sent: Tuesday, April 28, 2009 11:51 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Global.cfg cleanup Importance: High For about a week my server (2xP3xeon 2.8GHz) was beiing saturated by an increase of traffic 100% CPU for hours and ten of thousands of messages in \proc the servers was working fine for several years something had to be done, decided to clean global.cfg
[Declude.JunkMail] server freezing
My imail/declude server has been running fine for years ... until last week now Imail will stop working (smtp, pop, imap, ...)once or twice per day restarting the services doesnt help, i have to reboot last time it happened, i looked at the jouurnals i get error 2019 at 17:18:17 it showed declude stopped at 17:18:29, started at 19:18:30 17:21:30 i get error 8032 and imail stops responding and i need to reboot would appreciate any help/hints TIA PS: i havent made any changes to the server lately --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Errorlevel not working
ok, now i understand thank you both BR Serge - Original Message - From: Andy Schmidt andy_schm...@hm-software.com To: declude.junkmail@declude.com Sent: Monday, February 09, 2009 12:15 PM Subject: RE: [Declude.JunkMail] Errorlevel not working Because it does a = comparison, you need to start with the greatest value and work your way lower. -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Serge Sent: Sunday, February 08, 2009 7:58 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Errorlevel not working found a solution This works on both cases if errorlevel 1 goto gziperr1 if errorlevel 0 goto gziperr0 but this does not work if errorlevel 0 goto gziperr0 if errorlevel 1 goto gziperr1 but WHY ??? - Original Message - From: Serge se...@cefib.com To: declude.junkmail@declude.com Sent: Monday, February 09, 2009 12:49 AM Subject: Re: [Declude.JunkMail] Errorlevel not working Hello sandy Not true even if i comment echo line, i still get gzip OK errorlevel 0, Unzipping even if the file if corrupted gzip -d -f -t zydt3crn.snf.gz if errorlevel 0 goto gziperr0 if errorlevel 1 goto gziperr1 GOTO END :gziperr0 Echo gzip OK errorlevel 0, Unzipping GOTO END :gziperr1 Echo gzip errorlevel 1 Echo gzip .gz file did not test OK GOTO END :END - Original Message - From: Sanford Whiteman sa...@cypressintegrated.com To: Serge declude.junkmail@declude.com; Message Sniffer Community snif...@sortmonster.com Sent: Monday, February 09, 2009 12:39 AM Subject: Re: [Declude.JunkMail] Errorlevel not working I have a problem with the branching in the batch below even when the test fails and echo %errorlevel% shows 1 the branching still goes to gziperr0 Does enyone knows why and how to fix ? When you echo the errorlevel, the errorlevel is reset to the value returned by echo(). --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: sa...@cypressintegrated.com SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release / Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/downloa d/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/re lease/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Errorlevel not working
Dear all I have a problem with the branching in the batch below even when the test fails and echo %errorlevel% shows 1 the branching still goes to gziperr0 Does enyone knows why and how to fix ? echo %time% echo testing .gz gzip -d -f -t myfile.snf.gz echo %errorlevel% if errorlevel 0 goto gziperr0 if errorlevel 1 goto gziperr1 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Errorlevel not working
found a solution This works on both cases if errorlevel 1 goto gziperr1 if errorlevel 0 goto gziperr0 but this does not work if errorlevel 0 goto gziperr0 if errorlevel 1 goto gziperr1 but WHY ??? - Original Message - From: Serge se...@cefib.com To: declude.junkmail@declude.com Sent: Monday, February 09, 2009 12:49 AM Subject: Re: [Declude.JunkMail] Errorlevel not working Hello sandy Not true even if i comment echo line, i still get gzip OK errorlevel 0, Unzipping even if the file if corrupted gzip -d -f -t zydt3crn.snf.gz if errorlevel 0 goto gziperr0 if errorlevel 1 goto gziperr1 GOTO END :gziperr0 Echo gzip OK errorlevel 0, Unzipping GOTO END :gziperr1 Echo gzip errorlevel 1 Echo gzip .gz file did not test OK GOTO END :END - Original Message - From: Sanford Whiteman sa...@cypressintegrated.com To: Serge declude.junkmail@declude.com; Message Sniffer Community snif...@sortmonster.com Sent: Monday, February 09, 2009 12:39 AM Subject: Re: [Declude.JunkMail] Errorlevel not working I have a problem with the branching in the batch below even when the test fails and echo %errorlevel% shows 1 the branching still goes to gziperr0 Does enyone knows why and how to fix ? When you echo the errorlevel, the errorlevel is reset to the value returned by echo(). --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: sa...@cypressintegrated.com SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/download/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/release/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Test Statistics
Hi all what tools do you curently use to find which test are taking the most time and/or CPU .. BR Serge --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] DNS Tools
Hi 1-I was using dnsstuff, first it was free, then 25$/year which is OK now it is 75, too expensive for me (i only use it about 6 time per year) anyone knows of a similar free site ? 2-also, my server ip ( 217.170.148.6) is curently filtered by yahoo. how do i find if it is on other balcklists ? TIA Serge --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Grep Scripts
Helo Grep experts I need a script that will show the numbers of message send by a user (from a log file) caculated using Authenticated [EMAIL PROTECTED], session treated as local., not from or return to adress Also, if a message is sent to 10 recepients, it should be calculated as 10 not 1 anyone has such a script or exe utility ? TIA Regards --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Grep Scripts
one clarification the script should give the totalper user for ALL users in the log, not a single user - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Friday, November 07, 2008 5:18 AM Subject: [Declude.JunkMail] Grep Scripts Helo Grep experts I need a script that will show the numbers of message send by a user (from a log file) caculated using Authenticated [EMAIL PROTECTED], session treated as local., not from or return to adress Also, if a message is sent to 10 recepients, it should be calculated as 10 not 1 anyone has such a script or exe utility ? TIA Regards --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPF Issue
Hi all I have som SPF issues It was working fine some times back I use Mixrosoft dns I have (same as parent)Text v=spf1 mx ip4:217.64.107.106 -all mailText v=spf1 mx ip4:217.64.107.106 -all What is wrong with above ? TIA --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: AW: [Declude.JunkMail] Hardware upgrade -Software Crossgrade?
Hello David Do we have to pay any fees to switch from declude Imail to declude SM ? TIA - Original Message - From: David Barker [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Monday, March 10, 2008 9:23 PM Subject: RE: AW: [Declude.JunkMail] Hardware upgrade -Software Crossgrade? SmarterTools standard version protection policy covers all purchases made within 45 days of that product's major release. If you are going to be buying SM - best to do so before the release. I have heard the target date is 15 March. David B PS. Just in case you thought of going anywhere else. You want to buy your SM from Declude ;) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Hirthe, Alexander Sent: Monday, March 10, 2008 5:06 PM To: declude.junkmail@declude.com Subject: AW: AW: [Declude.JunkMail] Hardware upgrade -Software Crossgrade? or maybe not? :-) http://www.smartertools.com/forums/t/17365.aspx Thanks for the info, I'll give it a try. Von: [EMAIL PROTECTED] [EMAIL PROTECTED] im Auftrag von Gary Steiner [EMAIL PROTECTED] Gesendet: Montag, 10. März 2008 21:00 An: declude.junkmail@declude.com Betreff: re: AW: [Declude.JunkMail] Hardware upgrade -Software Crossgrade? If you are going to purchase SmarterMail, you may want to wait a little as they are about to release a new version. 5.x is currently in beta. http://www.smartertools.com/forums/38.aspx Original Message From: Hirthe, Alexander [EMAIL PROTECTED] Sent: Monday, March 10, 2008 10:59 AM To: declude.junkmail@declude.com declude.junkmail@declude.com Subject: AW: [Declude.JunkMail] Hardware upgrade -Software Crossgrade? Hi, Ø Alexander, you are really citing two problems with your scale and performance. That's true, and I'm sure I will install IMail 8 on the new server to get an easier migration. (and to be sure, to work on just one case) That's the thing I must do, exchange the hardware. To small disks, to slow CPU. RAM would be ok. The second part (Update the Software) would be nice, even if there will be more support calls after upgrading. Ø My suggestion is that both problems would be relieved by introducing a mail gateway in front of your mailboxes. In the Windows world, Alligate and XWall are popular with Declude/Sniffer users on this list and the Sniffer support list. With either one, I think you will find that the gateway will take the brunt of the antispam effort, leaving the back-end server to service mailbox connections and requests. We use NoSpamToday as a front end server, and this lowers the incoming spam very well. The problem is, we are getting more and more customers :-) and they all want a good working email system. Ø If your existing hardware is old, you could replace the fans and disks and have it become your new gateway, while you purchase some new hardware for your back-end, which will scale much higher than before once the back-end has to do less antispam processing. We bought a new piece of hardware for the frontend Antispamserver. Ø p.s. Did you have a third problem? Were you implying that the feature-set of IMail is no longer to your liking? Is there anyone really using IMail 9? Especially if you had Imail 8 before? I'm paying about 1000$ every year, and I haven't seen a really good working version of IMail since 8.22. I tried it on my testserver, put some domains on it, and it didn't worked like it should. I called support, mailed support and it was not getting better. So I put it away and tried it some month later again. IMail 9 was (is) getting better and better, but still it's not as stable as I want it. Today I installed Smartermail and it's nice, easy to handle, has a nice webinterface, and it's *cheap*. I thought about dumping the IMail SA and buy Smartermail for that price :) That's the reason for the Mail. IMail 8 is working, but it's old. And I think, there could be a better software than IMail 8 :-) Alex From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Hirthe, Alexander Sent: Monday, March 10, 2008 1:44 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Hardware upgrade -Software Crossgrade? Hello, we are going to move to an new hardware. At the moment we are running Imail 8, Declude, Sniffer. It works, but Spam detection is not perfect and overall system performance is getting worse. Should we - wait for IMail 10? - use IMail 9? - stay with Imail 8? - move to Smartermail? We host about 200 domains, with about 2000 Mailboxes. Alex Siller AG, Wannenaeckerstrasse 43, 74078 Heilbronn Vorstand: Prof. H.-F. Siller (Vorsitzender), Joern Buelow, Ralf Michi Aufsichtsratsvorsitzender: Armin Sohler Reg. Gericht Stuttgart, HRB 107707, Ust-Id Nr. DE145782955 --- This E-mail came from the Declude.JunkMail
Re: [Declude.JunkMail] OT: Virus pb
found a utility called Dtaskmanager shows all processes assosiated with ports (very nice utility) using it, found the culprit it was a lexmark application looking for printers, starting with IP 0.x.x.x and scanning up it was using a fixed 32k outbound bandwidth stopped the services problem resolved Thanks to all - Original Message - From: SJ.Stanaitis [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Monday, January 28, 2008 8:52 PM Subject: RE: [Declude.JunkMail] OT: Virus pb Sounds like a rootkit maybe, try rootkitreveal. Also try scanning the drives externally from a clean system. --SJ SJ.Stanaitis - Network Administrator Decorative Product Source, Inc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Monday, January 28, 2008 3:00 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] OT: Virus pb Hi all i have an infected w2k server sending traffic to random IP local port is 1044 and remote port 161 (snmp) All the AV i tried found nothing Is there an easy way to find what application/process is generating this traffic ? (tried fport, didnt help) Anyone has an idea about what this application/virus might be ? TIA and Regards --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Virus pb
Hi all i have an infected w2k server sending traffic to random IP local port is 1044 and remote port 161 (snmp) All the AV i tried found nothing Is there an easy way to find what application/process is generating this traffic ? (tried fport, didnt help) Anyone has an idea about what this application/virus might be ? TIA and Regards --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Fprot 6
I curently use only the built in virus scanner But I'm just curious, anyone tested Fpscan from fprot6 ? and what command line options needs to be used ? TIA Serge --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Fprot 6
I know about pricing But was just wondering about technical aspect did anyone test it ? Regards - Original Message - From: Michael Thomas - Mathbox [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Sunday, January 27, 2008 9:00 PM Subject: RE: [Declude.JunkMail] Fprot 6 Serge, Frisk licensing for mail server use is not the same as consumer or general business use. Pricing for mail server use is prohibitive. Michael Thomas Mathbox 978-683-6718 1-877-MATHBOX (Toll Free) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Sunday, January 27, 2008 3:31 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Fprot 6 I curently use only the built in virus scanner But I'm just curious, anyone tested Fpscan from fprot6 ? and what command line options needs to be used ? TIA Serge --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Message authenticator
David Can you please add this on the requested features list Regards - Original Message - From: David Barker To: declude.junkmail@declude.com Sent: Thursday, January 24, 2008 4:54 PM Subject: RE: [Declude.JunkMail] Message authenticator It is recorded in the Q file for IMail. If I remember correctly it would be capital A eg. [EMAIL PROTECTED] Declude filters do not check q(envelope) files though. David B From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (lists) Sent: Thursday, January 24, 2008 11:37 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Message authenticator Out of the box, not that I am aware of. It is recorded in the Imail SMTP log. This however would be a good feature request for Declude. John T From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Wednesday, January 23, 2008 5:05 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Message authenicator Is there a way in declude filters (or even in imail rules) to find who authenticated the message from the Q.smd file ? TIA --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Message authenicator
Is there a way in declude filters (or even in imail rules) to find who authenticated the message from the Q.smd file ? TIA --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Hardware Upgrade
Matt, John, Adrew Thank you all for your valuable input Matt, please contact me offline if you have time to help us if/when we decide to install alligate. Regards - Original Message - From: Matt To: declude.junkmail@declude.com Sent: Saturday, December 22, 2007 12:50 AM Subject: Re: [Declude.JunkMail] Hardware Upgrade I mostly concur with Andrew here, but let me add some specifics. 1) Memory - for the 5000 series of chips using FB-DIMMs you need 4 total sticks to max out the memory bandwidth. 4 gets you twice the memory bandwidth of 2, though you can use just 2. The real-world benchmarks show maybe a 5% improvement, though this depends largely on what you are doing. I'm not aware of any advantage to getting faster memory as I believe these systems will run the memory at the speed dictated by the processors. The amount of memory for this particular application will depend on how many cores you have. I would do 2GB with 4 cores, and 4GB with 8 cores, but only if you are going to be pushing hard on them (and you probably won't be). 2) CPU - You should be fine with just 4 cores, in fact Windows will not likely be able to max out 8 cores with Declude due to heap issues (limitations in memory allocations). I run 8 x 1.86 Ghz cores and I start getting a lot of errors if I press the system to 100% from Declude, which with my config is somewhere between 150 and 200 messages being scanned concurrently. How much load per message will depend on what you are running in your Declude config. Mine is rather heavy, though I still couldn't get more out of the server in terms of total utilization due to the heap issues, though the messages would process more quickly with a lighter config. So I would guess that with 4 x 2.33 Ghz cores, you could do about 100 concurrent messages. Also take note that there are lower wattage quad-core Xeons out now that begin with L. These run about 50 Watts instead of 80 Watts for the standard quads. This does add up, especially when you consider that cooling and other supportive processes will at least 1 to 2 times that amount of power for what the server actually uses. If you pay your own power bills, the L series processors should pay for themselves. 3) Disk and RAID - SATA is the way to go. Try to stay away from the 2.5 drives if you can. Modern SATA controllers can handle RAID 5 without a bottleneck, and on a 4 drive system with a modern RAID controller, RAID 5 will definitely outperform RAID 10. I recommend 3Ware 9550sx controllers, but you should be safe with any SATA II controller that supports a battery backup for the cache. I would stay away from zero-channel RAID cards, and definitely anything that is host RAID or software RAID because they are much more likely to require physical intervention in the event of a drive failure. There is no need to separate the OS onto a different drive system for this purpose. I would get 250 GB drives since they will initialize faster and the extra space likely isn't needed. I run my 8 core system on a 4 drive RAID 5 array with SATA II drives and it works great. 4) Pre-scanning Gateway - Most Declude servers will save between 30% and 50% CPU utilization by adding an Alligate server in front of it (much more if you have catch-alls or aren't doing address verification at all). You will also block significantly more spam that way, especially the zombie stuff. I have helped many set up Alligate, and we can even host a backup server or set something up as a test if you were interested. Alligate doesn't require a lot of processing power, though the system needs to be a stand-alone system. Even a single-core server with a single drive would handle this great, though it makes sense to have a backup. Note that out of the box Alligate won't do near what it can when configured by an experienced administrator, and you can block a ton of spam and other attacks with virtually no false positives (definitely +99.99% accuracy is possible while rejecting over 80% of all connection traffic). There is another hidden benefit to using Alligate; many of the killer messages that can affect both Declude and IMail are stopped by a properly configured Alligate pre-scanning gateway, and virtually all of the automatically-spreading viruses too. Matt Colbeck, Andrew wrote: Hello, Serge. I'm happy to chime in here, but let me start off with saying that you will get divergent opinions here, and that nobody will be absolutely right, as our answers are coloured by own experiences, and each implementation is unique. I'll also start off with asking you for your current and your intended message volumes, general architecture and software mix. Answering these details will help you keep the arguments comparing apples to apples because what is true for one respondent with low volume will not be true for another respondent with crushingly high volumes! My answers: 1
[Declude.JunkMail] Hardware Upgrade
Hi We are planning a hardware upgrade for february, after 5 years on the previous ML370G2 We will buy a 2slot QuadXeon Motherboard, 1.333FSB, and 2x2.33GHz QuadXeon, 2GB DDR2 and have some technichal questions for the resident techies 1- Should we get the fastest memory available, or should the memory speed be a divider of 1333 or 2.33 ? 2- Does a mail server realy need SCSI or SAS @15K/Minute ? or regular SATA @ 7K or 10K enough ? 3- We are planning on using : 2 HD in Raid1 for System 2 HD in Raid1 for Mailboxes 2 HD in Raid1 for Spool Where should we put the virtual Memory ? Or, is it better to have 2 HD in Raid1 for System 2 HD in Raid1 for Mailboxes 1 HD Spool 1 HD for VM You all have a good weekend and a merry christmas next week Serge Dergham --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Loop
Dear all I have a mail loop between my server and my client mail server Please give hints/solutions on how to resolve this Regards Received: from st07.edmsa.net [216.226.209.212] by mail.cefib.com with ESMTP (SMTPD-8.22) id A7900608; Sat, 15 Dec 2007 23:47:28 + Received: from edmsms.edm-sa.com.ml ([10.100.2.68]) by st07.edmsa.net with Microsoft SMTPSVC(6.0.3790.1830); Sat, 15 Dec 2007 23:40:23 + Received: from fwedmsa.edm-sa.com.ml (unknown [10.100.2.67]) by edmsms.edm-sa.com.ml (Symantec Mail Security) with SMTP id 44EEF1052; Sat, 15 Dec 2007 22:13:01 + (WET) Received: from mail.cefib.com ([217.170.144.6]) by fwedmsa.edm-sa.com.ml via smtpd (for [10.100.2.68] [10.100.2.68]) with SMTP; Sat, 15 Dec 2007 23:45:38 + Received: from st07.edmsa.net [216.226.209.212] by mail.cefib.com with ESMTP (SMTPD-8.22) id A4FC06C8; Sat, 15 Dec 2007 23:36:28 + Message-Id: [EMAIL PROTECTED] Received: from edmsms.edm-sa.com.ml ([10.100.2.68]) by st07.edmsa.net with Microsoft SMTPSVC(6.0.3790.1830); Sat, 15 Dec 2007 23:29:58 + Received: from fwedmsa.edm-sa.com.ml (unknown [10.100.2.67]) by edmsms.edm-sa.com.ml (Symantec Mail Security) with SMTP id 9FFFA1053; Sat, 15 Dec 2007 22:02:36 + (WET) Received: from mail.cefib.com ([217.170.144.6]) by fwedmsa.edm-sa.com.ml via smtpd (for [10.100.2.68] [10.100.2.68]) with SMTP; Sat, 15 Dec 2007 23:35:13 + Received: from st07.edmsa.net [216.226.209.212] by mail.cefib.com with ESMTP (SMTPD-8.22) id A1EE0500; Sat, 15 Dec 2007 23:23:26 + Received: from edmsms.edm-sa.com.ml ([10.100.2.68]) by st07.edmsa.net with Microsoft SMTPSVC(6.0.3790.1830); Sat, 15 Dec 2007 23:16:26 + Received: from fwedmsa.edm-sa.com.ml (unknown [10.100.2.67]) by edmsms.edm-sa.com.ml (Symantec Mail Security) with SMTP id 464BF1054; Sat, 15 Dec 2007 21:49:04 + (WET) Received: from mail.cefib.com ([217.170.144.6]) by fwedmsa.edm-sa.com.ml via smtpd (for [10.100.2.68] [10.100.2.68]) with SMTP; Sat, 15 Dec 2007 23:21:41 + Received: from st07.edmsa.net [216.226.209.212] by mail.cefib.com with ESMTP (SMTPD-8.22) id AF1E09D0; Sat, 15 Dec 2007 23:11:26 + Message-Id: [EMAIL PROTECTED] Received: from edmsms.edm-sa.com.ml ([10.100.2.68]) by st07.edmsa.net with Microsoft SMTPSVC(6.0.3790.1830); Sat, 15 Dec 2007 23:04:20 + Received: from fwedmsa.edm-sa.com.ml (unknown [10.100.2.67]) by edmsms.edm-sa.com.ml (Symantec Mail Security) with SMTP id A2A241054; Sat, 15 Dec 2007 21:36:59 + (WET) Received: from mail.cefib.com ([217.170.144.6]) by fwedmsa.edm-sa.com.ml via smtpd (for [10.100.2.68] [10.100.2.68]) with SMTP; Sat, 15 Dec 2007 23:09:35 + Received: from st07.edmsa.net [216.226.209.212] by mail.cefib.com with ESMTP (SMTPD-8.22) id AC8906D4; Sat, 15 Dec 2007 23:00:25 + Message-Id: [EMAIL PROTECTED] Received: from edmsms.edm-sa.com.ml ([10.100.2.68]) by st07.edmsa.net with Microsoft SMTPSVC(6.0.3790.1830); Sat, 15 Dec 2007 22:53:43 + Received: from fwedmsa.edm-sa.com.ml (unknown [10.100.2.67]) by edmsms.edm-sa.com.ml (Symantec Mail Security) with SMTP id EC2DA1054; Sat, 15 Dec 2007 21:26:22 + (WET) Received: from mail.cefib.com ([217.170.144.6]) by fwedmsa.edm-sa.com.ml via smtpd (for [10.100.2.68] [10.100.2.68]) with SMTP; Sat, 15 Dec 2007 22:58:59 + Received: from st07.edmsa.net [216.226.209.212] by mail.cefib.com with ESMTP (SMTPD-8.22) id AA0C07C0; Sat, 15 Dec 2007 22:49:48 + Message-Id: [EMAIL PROTECTED] Received: from edmsms.edm-sa.com.ml ([10.100.2.68]) by st07.edmsa.net with Microsoft SMTPSVC(6.0.3790.1830); Sat, 15 Dec 2007 22:53:22 + Received: from fwedmsa.edm-sa.com.ml (unknown [10.100.2.67]) by edmsms.edm-sa.com.ml (Symantec Mail Security) with SMTP id E11F91054; Sat, 15 Dec 2007 21:26:01 + (WET) Received: from mail.cefib.com ([217.170.144.6]) by fwedmsa.edm-sa.com.ml via smtpd (for [10.100.2.68] [10.100.2.68]) with SMTP; Sat, 15 Dec 2007 22:58:38 + Received: from st07.edmsa.net [216.226.209.212] by mail.cefib.com with ESMTP (SMTPD-8.22) id A9F40574; Sat, 15 Dec 2007 22:49:24 + Message-Id: [EMAIL PROTECTED] Received: from edmsms.edm-sa.com.ml ([10.100.2.68]) by st07.edmsa.net with Microsoft SMTPSVC(6.0.3790.1830); Sat, 15 Dec 2007 22:53:00 + Received: from fwedmsa.edm-sa.com.ml (unknown [10.100.2.67]) by edmsms.edm-sa.com.ml (Symantec Mail Security) with SMTP id 699A01053; Sat, 15 Dec 2007 21:25:36 + (WET) Received: from 77-100-15-232.cable.ubr06.harb.blueyonder.co.uk ([77.100.15.232]) by fwedmsa.edm-sa.com.ml via smtpd (for [10.100.2.68] [10.100.2.68]) with SMTP; Sat, 15 Dec 2007 22:58:13 + Received: from [77.100.15.232] by mail.bondwave.com; Sat, 15 Dec 2007 15:44:47 + Message-ID: [EMAIL PROTECTED] From: Bolton [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Hey you Date: Sat, 15 Dec 2007 15:44:47 + MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=windows-1250;
Re: [Declude.JunkMail] my DNS tests
Scott, Darell and Gary, thank you all for the input - Original Message - From: Gary Steiner [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 08, 2007 8:15 PM Subject: re: [Declude.JunkMail] my DNS tests VISI has been down for a while. http://www.dnsbl.com/2007/02/status-of-relaysvisicom-dead.html Original Message From: Serge [EMAIL PROTECTED] Sent: Wednesday, November 07, 2007 8:17 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] my DNS tests To all, Please quikly brows my tests below and let me know of any that you know are oudated/needs to be deleted or replaced TIA AHBLRELAYS ip4r dnsbl.ahbl.org 127.0.0.2 2 0 AHBLPROXIES ip4r dnsbl.ahbl.org 127.0.0.3 2 0 AHBLSOURCES ip4r dnsbl.ahbl.org 127.0.0.4 2 0 AHBLSUPPORT ip4r dnsbl.ahbl.org 127.0.0.7 2 0 AHBLEXEMPT ip4r exemptions.ahbl.org 127.0.0.2 -5 0 AHBL-DOMAINS RHSBL rhsbl.ahbl.org127.0.0.2 7 0 BONDEDSENDERip4rquery.bondedsender.org 127.0.0.10 -5 0 IPWHOIS ip4r ipwhois.rfc-ignorant.org * 3 0 NJABL ipr4 dnsbl.njabl.org 127.0.0.2 3 0 NJABLDUL ipr4 dnsbl.njabl.org127.0.0.3 3 0 NJABLFORMMAIL ipr4 dnsbl.njabl.org127.0.0.8 3 0 NJABLMULTI ipr4 dnsbl.njabl.org127.0.0.5 3 0 NJABLPROXIES ipr4 dnsbl.njabl.org127.0.0.9 3 0 NJABLSOURCES ipr4 dnsbl.njabl.org127.0.0.4 3 0 CSMA-SBL ip4r sbl.csma.biz 127.0.0.2 5 0 RSL ip4r relays.visi.com 127.0.0.2 5 0 ZEN ip4rzen.spamhaus.org 127.0.0.250 SPAMBAG ip4r blacklist.spambag.org * 5 0 SPAMCOP ip4r bl.spamcop.net 127.0.0.2 10 0 CBL ip4r cbl.abuseat.org 127.0.0.2 5 0 DSBL ip4r list.dsbl.org * 5 0 MXRATE-BLACKip4r pub.mxrate.net 127.0.0.2 5 0 DSN rhsbl dsn.rfc-ignorant.org 127.0.0.2 3 0 MAILPOLICE-Fraud rhsbl fraud.rhs.mailpolice.com127.0.0.2 5 0 MAILPOLICE-BULK rhsbl bulk.rhs.mailpolice.com 127.0.0.2 5 0 NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 2 0 NOPOSTMASTER rhsbl postmaster.rfc-ignorant.org 127.0.0.3 2 0 FIVETEN-SPAM ip4rblackholes.five-ten-sg.com 127.0.0.21 0 FIVETEN-BULK ip4rblackholes.five-ten-sg.com 127.0.0.42 0 FIVETEN-MULTISTAGE ip4rblackholes.five-ten-sg.com 127.0.0.5 2 0 FIVETEN-SPAMSUPPORT ip4rblackholes.five-ten-sg.com 127.0.0.7 30 FIVETEN-MISC ip4rblackholes.five-ten-sg.com 127.0.0.92 0 FIVETEN-FREEip4rblackholes.five-ten-sg.com 127.0.0.12 20 SORBS ip4rdnsbl.sorbs.net * 2 0 SORBS-HTTP ip4rdnsbl.sorbs.net 127.0.0.2 4 0 SORBS-SOCKS ip4rdnsbl.sorbs.net 127.0.0.3 4 0 SORBS-MISC ip4rdnsbl.sorbs.net 127.0.0.4 4 0 SORBS-SPAM ip4rdnsbl.sorbs.net 127.0.0.6 4 0 SORBS-ZOMBIE ip4rdnsbl.sorbs.net 127.0.0.9 4 0 SORBS-DUL ip4rdnsbl.sorbs.net 127.0.0.10 2 0 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] my DNS tests
To all, Please quikly brows my tests below and let me know of any that you know are oudated/needs to be deleted or replaced TIA AHBLRELAYS ip4r dnsbl.ahbl.org 127.0.0.2 2 0 AHBLPROXIES ip4r dnsbl.ahbl.org 127.0.0.3 2 0 AHBLSOURCES ip4r dnsbl.ahbl.org 127.0.0.4 2 0 AHBLSUPPORT ip4r dnsbl.ahbl.org 127.0.0.7 2 0 AHBLEXEMPT ip4r exemptions.ahbl.org 127.0.0.2 -5 0 AHBL-DOMAINS RHSBL rhsbl.ahbl.org127.0.0.2 7 0 BONDEDSENDERip4rquery.bondedsender.org 127.0.0.10 -5 0 IPWHOIS ip4r ipwhois.rfc-ignorant.org * 3 0 NJABL ipr4 dnsbl.njabl.org 127.0.0.2 3 0 NJABLDUL ipr4 dnsbl.njabl.org127.0.0.3 3 0 NJABLFORMMAIL ipr4 dnsbl.njabl.org127.0.0.8 3 0 NJABLMULTI ipr4 dnsbl.njabl.org127.0.0.5 3 0 NJABLPROXIES ipr4 dnsbl.njabl.org127.0.0.9 3 0 NJABLSOURCES ipr4 dnsbl.njabl.org127.0.0.4 3 0 CSMA-SBL ip4r sbl.csma.biz 127.0.0.2 5 0 RSL ip4r relays.visi.com 127.0.0.2 5 0 ZEN ip4rzen.spamhaus.org 127.0.0.250 SPAMBAG ip4r blacklist.spambag.org * 5 0 SPAMCOP ip4r bl.spamcop.net 127.0.0.2 10 0 CBL ip4r cbl.abuseat.org 127.0.0.2 5 0 DSBL ip4r list.dsbl.org * 5 0 MXRATE-BLACKip4r pub.mxrate.net 127.0.0.2 5 0 DSN rhsbl dsn.rfc-ignorant.org 127.0.0.2 3 0 MAILPOLICE-Fraud rhsbl fraud.rhs.mailpolice.com127.0.0.2 5 0 MAILPOLICE-BULK rhsbl bulk.rhs.mailpolice.com 127.0.0.2 5 0 NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 2 0 NOPOSTMASTER rhsbl postmaster.rfc-ignorant.org 127.0.0.3 2 0 FIVETEN-SPAM ip4rblackholes.five-ten-sg.com 127.0.0.210 FIVETEN-BULK ip4rblackholes.five-ten-sg.com 127.0.0.420 FIVETEN-MULTISTAGE ip4rblackholes.five-ten-sg.com 127.0.0.52 0 FIVETEN-SPAMSUPPORT ip4rblackholes.five-ten-sg.com 127.0.0.7 30 FIVETEN-MISC ip4rblackholes.five-ten-sg.com 127.0.0.920 FIVETEN-FREEip4rblackholes.five-ten-sg.com 127.0.0.12 20 SORBS ip4rdnsbl.sorbs.net * 2 0 SORBS-HTTP ip4rdnsbl.sorbs.net 127.0.0.2 4 0 SORBS-SOCKS ip4rdnsbl.sorbs.net 127.0.0.3 4 0 SORBS-MISC ip4rdnsbl.sorbs.net 127.0.0.4 4 0 SORBS-SPAM ip4rdnsbl.sorbs.net 127.0.0.6 4 0 SORBS-ZOMBIE ip4rdnsbl.sorbs.net 127.0.0.9 4 0 SORBS-DUL ip4rdnsbl.sorbs.net 127.0.0.10 2 0 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Re: HELP, Declude stoped functioning
Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] HELP, Declude stoped functioning
Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spammer authenticating
Dear all Last week, i caught a spammer authenticating to my sever (using admin and test account) I deleted these accounts (how does he found the passwords ?) Today, i found same, using info account But i have no info account, only alias Looking at logs, found that he autanticated using [EMAIL PROTECTED] Any idea what is he doing ? why is the qfile showing [EMAIL PROTECTED] ? QF:\Imail\spool\D07420039c9ac.SMD Hmail.mydomain.com I07420039c9ac T3 E0, S[EMAIL PROTECTED] Y1 V0 [EMAIL PROTECTED] NRCPT To:[EMAIL PROTECTED] R[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Loop
Hi all seems i am having a loop problem between my server [217.170.144.6] and my client server please look at header below and let me know if you understand what is going on I dont ! or maybe im too tired TIA Received: from st07.edmsa.net [216.226.209.212] by mail.cefib.com with ESMTP (SMTPD-8.22) id A94007CC; Mon, 14 May 2007 14:59:12 + Received: from edmsms.edm-sa.com.ml ([10.100.2.68]) by st07.edmsa.net with Microsoft SMTPSVC(6.0.3790.1830); Mon, 14 May 2007 14:49:00 + Received: from fwedmsa.edm-sa.com.ml (unknown [10.100.2.67]) by edmsms.edm-sa.com.ml (Symantec Mail Security) with SMTP id 93F19FD5; Mon, 14 May 2007 14:11:49 + (WET) Received: from mail.cefib.com ([217.170.144.6]) by fwedmsa.edm-sa.com.ml via smtpd (for [10.100.2.68] [10.100.2.68]) with SMTP; Mon, 14 May 2007 14:49:24 + Received: from st07.edmsa.net [216.226.209.212] by mail.cefib.com with ESMTP (SMTPD-8.22) id A66A04C0; Mon, 14 May 2007 14:47:06 + Message-Id: [EMAIL PROTECTED] Received: from edmsms.edm-sa.com.ml ([10.100.2.68]) by st07.edmsa.net with Microsoft SMTPSVC(6.0.3790.1830); Mon, 14 May 2007 14:36:51 + Received: from fwedmsa.edm-sa.com.ml (unknown [10.100.2.67]) by edmsms.edm-sa.com.ml (Symantec Mail Security) with SMTP id 2C520FD3; Mon, 14 May 2007 13:59:42 + (WET) Received: from mail.cefib.com ([217.170.144.6]) by fwedmsa.edm-sa.com.ml via smtpd (for [10.100.2.68] [10.100.2.68]) with SMTP; Mon, 14 May 2007 14:37:17 + Received: from st07.edmsa.net [216.226.209.212] by mail.cefib.com with ESMTP (SMTPD-8.22) id A39E0340; Mon, 14 May 2007 14:35:10 + Received: from edmsms.edm-sa.com.ml ([10.100.2.68]) by st07.edmsa.net with Microsoft SMTPSVC(6.0.3790.1830); Mon, 14 May 2007 14:25:00 + Received: from fwedmsa.edm-sa.com.ml (unknown [10.100.2.67]) by edmsms.edm-sa.com.ml (Symantec Mail Security) with SMTP id AC28FFD3; Mon, 14 May 2007 13:47:55 + (WET) Received: from mail.cefib.com ([217.170.144.6]) by fwedmsa.edm-sa.com.ml via smtpd (for [10.100.2.68] [10.100.2.68]) with SMTP; Mon, 14 May 2007 14:25:30 + Received: from st07.edmsa.net [216.226.209.212] by mail.cefib.com with ESMTP (SMTPD-8.22) id A0CF05E8; Mon, 14 May 2007 14:23:11 + Received: from edmsms.edm-sa.com.ml ([10.100.2.68]) by st07.edmsa.net with Microsoft SMTPSVC(6.0.3790.1830); Mon, 14 May 2007 14:13:15 + Received: from fwedmsa.edm-sa.com.ml (unknown [10.100.2.67]) by edmsms.edm-sa.com.ml (Symantec Mail Security) with SMTP id 71410FD4; Mon, 14 May 2007 13:36:09 + (WET) Received: from mail.cefib.com ([217.170.144.6]) by fwedmsa.edm-sa.com.ml via smtpd (for [10.100.2.68] [10.100.2.68]) with SMTP; Mon, 14 May 2007 14:13:44 + Received: from st07.edmsa.net [216.226.209.212] by mail.cefib.com with ESMTP (SMTPD-8.22) id AE190290; Mon, 14 May 2007 14:11:37 + Received: from edmsms.edm-sa.com.ml ([10.100.2.68]) by st07.edmsa.net with Microsoft SMTPSVC(6.0.3790.1830); Mon, 14 May 2007 14:01:42 + Received: from fwedmsa.edm-sa.com.ml (unknown [10.100.2.67]) by edmsms.edm-sa.com.ml (Symantec Mail Security) with SMTP id 2B070FCA; Mon, 14 May 2007 13:24:36 + (WET) Received: from mail.cefib.com ([217.170.144.6]) by fwedmsa.edm-sa.com.ml via smtpd (for [10.100.2.68] [10.100.2.68]) with SMTP; Mon, 14 May 2007 14:02:10 + Received: from st07.edmsa.net [216.226.209.212] by mail.cefib.com with ESMTP (SMTPD-8.22) id AB6A08DC; Mon, 14 May 2007 14:00:10 + Received: from edmsms.edm-sa.com.ml ([10.100.2.68]) by st07.edmsa.net with Microsoft SMTPSVC(6.0.3790.1830); Mon, 14 May 2007 14:00:16 + Received: from fwedmsa.edm-sa.com.ml (unknown [10.100.2.67]) by edmsms.edm-sa.com.ml (Symantec Mail Security) with SMTP id 2BCD2FD1; Mon, 14 May 2007 13:23:10 + (WET) Received: from mail.cefib.com ([217.170.144.6]) by fwedmsa.edm-sa.com.ml via smtpd (for [10.100.2.68] [10.100.2.68]) with SMTP; Mon, 14 May 2007 14:00:45 + Received: from st07.edmsa.net [216.226.209.212] by mail.cefib.com with ESMTP (SMTPD-8.22) id AB0206B4; Mon, 14 May 2007 13:58:26 + Received: from edmsms.edm-sa.com.ml ([10.100.2.68]) by st07.edmsa.net with Microsoft SMTPSVC(6.0.3790.1830); Mon, 14 May 2007 13:58:22 + Received: from fwedmsa.edm-sa.com.ml (unknown [10.100.2.67]) by edmsms.edm-sa.com.ml (Symantec Mail Security) with SMTP id 79B6AFD4; Mon, 14 May 2007 13:21:47 + (WET) Received: from eqt162.neoplus.adsl.tpnet.pl ([83.20.87.162]) by fwedmsa.edm-sa.com.ml via smtpd (for [10.100.2.68] [10.100.2.68]) with SMTP; Mon, 14 May 2007 13:59:21 + Received: from 209.216.61.101 (HELO MAIL.LUCRECORP.COM) by edm-sa.com.ml with esmtp (MYUG3-N169D 0AD'W4) id =7G90I-KT62+8-=7 for [EMAIL PROTECTED]; Tue, 15 May 2007 13:57:39 -0100 Date: Tue, 15 May 2007 13:57:39 -0100 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
[Declude.JunkMail] Built in AV
BlankDavid, For some reason i do not see scanner 0 in my logs anymore, does this mean the built in scanner is not working ? How do I check ? How do i activate it ? V 4.3.23 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Blank Bkgrd.gif Description: GIF image
Re: [Declude.JunkMail] Help: Domain not found
Blank i added the spaces to prevent harvesting should have mentioned this sorry - Original Message - From: Darrell ([EMAIL PROTECTED]) To: declude.junkmail@declude.com Sent: Tuesday, February 27, 2007 3:46 AM Subject: Re: [Declude.JunkMail] Help: Domain not found Is there really a space in the logs or is that just a formatting issue? philippe @ malivsion.com Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Serge To: declude.junkmail@declude.com ; Imail_Forum@list.ipswitch.com Sent: Monday, February 26, 2007 10:31 PM Subject: [Declude.JunkMail] Help: Domain not found I have a client having problems sending emails to some servers No thank you rejected: Domain not found DNSSTUFF shows no major problem with malivision.com Would appreciate any help to resolve this issue 20070226 183127 127.0.0.1 SMTP (276b023cf3f9) Trying mail.com (0) 20070226 183128 127.0.0.1 SMTP (276b023cf3f9) Connect mail.com [208.36.123.68:25] (1) 20070226 183130 127.0.0.1 SMTP (276b023cf3f9) 220 spf8.us4.outblaze.com ESMTP Postfix 20070226 183130 127.0.0.1 SMTP (276b023cf3f9) EHLO mail.cefib.com 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-spf8.us4.outblaze.com 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-PIPELINING 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-SIZE 1024 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-ETRN 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250 8BITMIME 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) MAIL FROM:philippe @ malivsion.com 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250 Ok 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) RCPT To:mathioye @ mail.com 20070226 183132 127.0.0.1 SMTP (276b023cf3f9) 550 philippe @ malivsion.com: No thank you rejected: Domain not found 20070226 183132 127.0.0.1 SMTP (276b023cf3f9) QUIT --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Blank Bkgrd.gif Description: GIF image
Re: [Declude.JunkMail] Help: Domain not found
BlankDUH !!! I read this several time and didn't catch it. I think it is time for me to retire. Thanks - Original Message - From: Michael Jaworski To: declude.junkmail@declude.com Sent: Tuesday, February 27, 2007 4:00 AM Subject: RE: [Declude.JunkMail] Help: Domain not found Is the example the same as the original?? Malivision is misspelled, missing an i. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Monday, February 26, 2007 7:32 PM To: declude.junkmail@declude.com; Imail_Forum@list.ipswitch.com Subject: [Declude.JunkMail] Help: Domain not found I have a client having problems sending emails to some servers No thank you rejected: Domain not found DNSSTUFF shows no major problem with malivision.com Would appreciate any help to resolve this issue 20070226 183127 127.0.0.1 SMTP (276b023cf3f9) Trying mail.com (0) 20070226 183128 127.0.0.1 SMTP (276b023cf3f9) Connect mail.com [208.36.123.68:25] (1) 20070226 183130 127.0.0.1 SMTP (276b023cf3f9) 220 spf8.us4.outblaze.com ESMTP Postfix 20070226 183130 127.0.0.1 SMTP (276b023cf3f9) EHLO mail.cefib.com 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-spf8.us4.outblaze.com 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-PIPELINING 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-SIZE 1024 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-ETRN 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250 8BITMIME 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) MAIL FROM:philippe @ malivsion.com 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250 Ok 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) RCPT To:mathioye @ mail.com 20070226 183132 127.0.0.1 SMTP (276b023cf3f9) 550 philippe @ malivsion.com: No thank you rejected: Domain not found 20070226 183132 127.0.0.1 SMTP (276b023cf3f9) QUIT --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. image001.gif Description: GIF image
[Declude.JunkMail] NOTIFY=FAILURE,DELAY
Can someone explain what this failure mean ? Also, even though i sent this message from oe, and configured my server as smtp server, aparently, the isp intercepted the message, and sent it from smtp.neuf.fr Is this policy widely used ? 20070215 222434 127.0.0.1 SMTPD (dda202070335) [217.170.144.6] connect 84.96.92.11 port 39910 20070215 222435 127.0.0.1 SMTPD (dda202070335) [84.96.92.11] EHLO smtp.Neuf.fr 20070215 222435 127.0.0.1 SMTPD (dda202070335) [84.96.92.11] MAIL FROM:[EMAIL PROTECTED] 20070215 222435 127.0.0.1 SMTPD (dda202070335) [84.96.92.11] RCPT TO:[EMAIL PROTECTED] NOTIFY=FAILURE,DELAY ORCPT=rfc822;[EMAIL PROTECTED] 20070215 222437 127.0.0.1 SMTPD (dda202070335) [84.96.92.11] F:\Imail\spool\Ddda202070335.SMD 36608 20070215 222437 127.0.0.1 SMTPD (dda202070335) performing antispam checks 20070215 222458 127.0.0.1 SMTP (dda202070335) processing F:\Imail\spool\qdda202070335.smd 20070215 222459 127.0.0.1 SMTP (dda202070335) forwarded message to [EMAIL PROTECTED] using new file: ddba0968e973 20070215 222459 127.0.0.1 SMTP (dda202070335) finished F:\Imail\spool\qdda202070335.smd status=1 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Slipping through Declude
We had the same pb about 2 months ago upgrading declude from 4.3.0 to 4.3.23 and Imail from 8.15 to 8.22 resolved the issue Unfortunatly, i cant tell you if it was the declude or the Imail upgrade that resolved the issue What versions are you using.? - Original Message - From: Keith Johnson [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, February 03, 2007 9:08 PM Subject: [Declude.JunkMail] Slipping through Declude It has been rare, although not uncommon, that from time to time I will see emails slip through and not scanned by Declude, however, today I have gotten 5 in a row carrying the same, or similar, body information and no insertion of X-tags. I have attached a header that illustrates this. Is anyone else seeing this same type of email come through your system unscanned? I have sent this off to Declude Support for further looks. -Keith --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ORDB.Org Shutting Down
MessageThanks for the tips below are the remote tests i'm curently using can someone brows thru and let me know if other should be removed (Dead, redundant, or useless) we tag at 10 and delete at 30 also have a bunch of filters, + sniffer (W=15) and invurl Thanks in advance AHBLRELAYS ip4r dnsbl.ahbl.org 127.0.0.2 2 0 AHBLPROXIES ip4r dnsbl.ahbl.org 127.0.0.3 2 0 AHBLSOURCES ip4r dnsbl.ahbl.org 127.0.0.4 2 0 AHBLSUPPORT ip4r dnsbl.ahbl.org 127.0.0.7 2 0 AHBLEXEMPT ip4r exemptions.ahbl.org 127.0.0.2 -5 0 BONDEDSENDERip4rquery.bondedsender.org 127.0.0.10 -5 0 EXSILIA-SPAM ip4r spam.exsilia.net* 3 0 IPWHOIS ip4r ipwhois.rfc-ignorant.org * 3 0 NJABL ipr4 dnsbl.njabl.org 127.0.0.2 3 0 NJABLDUL ipr4 dnsbl.njabl.org127.0.0.3 3 0 NJABLFORMMAIL ipr4 dnsbl.njabl.org127.0.0.8 3 0 NJABLMULTI ipr4 dnsbl.njabl.org127.0.0.5 3 0 NJABLPROXIES ipr4 dnsbl.njabl.org127.0.0.9 3 0 NJABLSOURCES ipr4 dnsbl.njabl.org127.0.0.4 3 0 CSMA-SBL ip4r sbl.csma.biz 127.0.0.2 5 0 RSL ip4r relays.visi.com 127.0.0.2 5 0 SPAMHAUS ip4rsbl-xbl.spamhaus.org127.0.0.250 XBLip4rsbl-xbl.spamhaus.org127.0.0.450 BLITZEDALL ip4rsbl-xbl.spamhaus.org127.0.0.650 SPAMBAG ip4r blacklist.spambag.org * 5 0 SBL ip4r sbl.spamhaus.org 127.0.0.2 6 0 SPAMCOP ip4r bl.spamcop.net 127.0.0.2 10 0 CBL ip4r cbl.abuseat.org 127.0.0.2 5 0 DSBL ip4r list.dsbl.org * 5 0 MXRATE-BLACKip4r pub.mxrate.net 127.0.0.2 5 0 SBLXBL4 ip4r xbl.spamhaus.org 127.0.0.4 5 0 DSN rhsbl dsn.rfc-ignorant.org 127.0.0.2 3 0 MAILPOLICE-BULK rhsbl bulk.rhs.mailpolice.com 127.0.0.2 5 0 MAILPOLICE-PORN rhsbl porn.rhs.mailpolice.com 127.0.0.2 5 0 NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 2 0 NOPOSTMASTER rhsbl postmaster.rfc-ignorant.org 127.0.0.3 2 0 - Original Message - From: Colbeck, Andrew To: declude.junkmail@declude.com Sent: Monday, December 18, 2006 6:21 PM Subject: RE: [Declude.JunkMail] ORDB.Org Shutting Down Thanks, Michael. That was a good tip. Andrew. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michael Jaworski Sent: Monday, December 18, 2006 10:09 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] ORDB.Org Shutting Down Ordb.org is shutting down today. Time to review/edit config files. http://ordb.org/news/?id=38 Mike --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Changing the IP address of the mail server and the primary DNS server
OT: Changing the IP address of the mail server and the primary DNS serveri had to do this a couple of times, here's what i did in summary: put a second nic in the server have one nic connected to the old network with the old ips and the other nic to the new network with new ips add the new ns to your dns change the secondarys so they update from the new ip change the ns ip with the retgistrar (if registered) bind your dns to the new ip change the registry to bind imail to the new ip (make sure all refference to old ip is changed) after 24 hours disconnect from the old network deactivate nic you can choose to keep the server connected to the old network as backup to do this add an mx with higher number with the old ip - Original Message - From: Sharyn Schmidt To: declude.junkmail@declude.com Sent: Monday, December 18, 2006 8:32 PM Subject: [Declude.JunkMail] OT: Changing the IP address of the mail server and the primary DNS server Need to pick the brain's of the experts out there. We are changing from a cable internet connection to a fiber one. The cable connection is staying in place, so we will actually have 2 internet connections at my main site. The cable one is going to serve as sort of a guest/public internet connection, whereas the fiber becomes our main connection We are getting an entirely new block of static IP addresses with our new fiber connection. I am going to need to change the IP address of both my primary nameserver (which I host here) and mail server (also hosted here) to reflect the new static addresses. The mailserver and the primary nameserver are the same physical box. I am unsure what is the best way/order to do this.The new connections will be totally independent of the old one, different firewalls, different switches, etc. My internal network will be attached to the firewall behind the new fiber connection. I'll check the IMAIL KB for the best way to handle this within Imail. My biggest concern is the best way to get the Internet aware of the change, and the timing involved. Suggestions are welcome. TIA, Sharyn --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] AVG
Hi scott how does ClamAV/service compare to fpcmd in cpu usage ? And, do you have a link to download and config Thanls in advance - Original Message - From: Scott Fisher To: declude.junkmail@declude.com Sent: Sunday, December 17, 2006 12:32 AM Subject: Re: [Declude.JunkMail] AVG AVG ClamAV as a service Mcafee may need to look at again. - Original Message - From: Serge To: declude.junkmail@declude.com Sent: Friday, December 15, 2006 7:33 PM Subject: [Declude.JunkMail] AVG For those on 4.2.X, are you still using Fprot and/or McAfee ..., or are sticking with buit in AVG alone ? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] AVG
For those on 4.2.X, are you still using Fprot and/or McAfee ..., or are sticking with buit in AVG alone ? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude 4.3.24 AVG Interim
David, I am on 4.3.23, but have always used the upgrade version so my built in anti virus is not installed I need help installing it whithout changing my other configs is there a link or should i open a support ticket ? TIA - Original Message - From: David Barker [EMAIL PROTECTED] To: declude.junkmail@declude.com; declude.virus@declude.com Sent: Tuesday, December 12, 2006 5:21 PM Subject: [Declude.JunkMail] Declude 4.3.24 AVG Interim This version is available as an interim release, for those of you who have the login to interim, it is the same, be sure to download your appropriate decludeproc and the avgsdk.dll. If want to try the interim release email me directly. David Barker Director of Product Management Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] testfailed in filters
the manual says that MINWEIGHTTOFAIL is the total weight attributed by the filter I need the weight ON STARTING the filter What I want, is a test of messages that did NOT fail TestA, but do have a TOTAL weight 10 - Original Message - From: John T (Lists) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, December 09, 2006 9:26 AM Subject: RE: [Declude.JunkMail] testfailed in filters Weight tests are last. What are you trying to do? Maybe something like this? MINWEIGHTTOFAIL 10 TESTSFAILED END CONTAINS TESTA John T eServices For You Life is a succession of lessons which must be lived to be understood. Ralph Waldo Emerson (1802-1882) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Friday, December 08, 2006 11:19 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] testfailed in filters Hi all I am trying to write a filter file so it fails if: Messgae did not fail TESTA WEIGHT 10 I tried TESTSFAILED END CONTAINS TESTA TESTSFAILED 0 CONTAINS WEIGHT10 The above did not work I assume all Weight tests are added to TESTFAILED after all other test are processed? even if the filter line is after Weight10 in global.cfg. Am i correct ? and, how to achieve what i am trying to do ? TIA --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] testfailed in filters
In fact, I am thinking maybe of simulating the weight test with a filter has anybody tried Filter1: myweight.txt SKIPIFWEIGHT 10 (Some way to trigger this filter if not skipped above) Filter 2: filter2.txt TESTSFAILED END CONTAINS TESTA TESTSFAILED 0 CONTAINS myweight So: 1- Has anyone tried something similar ? 2- what is the easiest way to force Filter1 to trigger ? 3- would this consume much CPU, since we have to use 2 filters intsead of one ? AND, 4- Is there a way in declude (by analyzing logs, or ... ), to see cpu usage by different tests ? - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, December 09, 2006 4:03 PM Subject: Re: [Declude.JunkMail] testfailed in filters I'm not sure you can do it without a change in Declude. I've requested a SKIPIFMINWEIGHT addition to filters, but no luck getting that added. I would think the code to add it would be extremely similiar to add since the SKIPIFWEIGHT for a max weight already exists. Sounds like you just flip that to a ... - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, December 09, 2006 8:30 AM Subject: Re: [Declude.JunkMail] testfailed in filters the manual says that MINWEIGHTTOFAIL is the total weight attributed by the filter I need the weight ON STARTING the filter What I want, is a test of messages that did NOT fail TestA, but do have a TOTAL weight 10 - Original Message - From: John T (Lists) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, December 09, 2006 9:26 AM Subject: RE: [Declude.JunkMail] testfailed in filters Weight tests are last. What are you trying to do? Maybe something like this? MINWEIGHTTOFAIL 10 TESTSFAILED END CONTAINS TESTA John T eServices For You Life is a succession of lessons which must be lived to be understood. Ralph Waldo Emerson (1802-1882) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Friday, December 08, 2006 11:19 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] testfailed in filters Hi all I am trying to write a filter file so it fails if: Messgae did not fail TESTA WEIGHT 10 I tried TESTSFAILED END CONTAINS TESTA TESTSFAILED 0 CONTAINS WEIGHT10 The above did not work I assume all Weight tests are added to TESTFAILED after all other test are processed? even if the filter line is after Weight10 in global.cfg. Am i correct ? and, how to achieve what i am trying to do ? TIA --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] testfailed in filters
if you are bad then you are really bad Not really, my goal is doing some analysis on TESTA (see why high weight messages did not fail testA) , using an action on Filter2 (copy or route), not to add weight - Original Message - From: John T (Lists) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, December 09, 2006 5:23 PM Subject: RE: [Declude.JunkMail] testfailed in filters the manual says that MINWEIGHTTOFAIL is the total weight attributed by the filter I need the weight ON STARTING the filter OOPS, your right. Forgot that. What I want, is a test of messages that did NOT fail TestA, but do have a TOTAL weight 10 To do what, run the filter or cause a failure? If it is to cause a test failure, that is then like saying if you are bad then you are really bad it kind of goes against the premise of what the foundation of the weighting system is. John T eServices For You Life is a succession of lessons which must be lived to be understood. Ralph Waldo Emerson (1802-1882) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] testfailed in filters
Not if you need the results real time to continiously modify TESTA. it is less cpu intensive than contiously analysing logs. Also, it is easier to keep a copy of the specific emails, instead of all emails. And, maybe it is easier for me ta add a simple declude test than to write a log analyzer that does what i need, I am not that good with scripts :) - Original Message - From: John T (Lists) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, December 09, 2006 6:33 PM Subject: RE: [Declude.JunkMail] testfailed in filters Not really, my goal is doing some analysis on TESTA (see why high weight messages did not fail testA) , using an action on Filter2 (copy or route), not to add weight AH, now see, if you had answered my question that I posted 9 hours ago... Now that we know the WHY... Using Declude in that manner is IMHO a really poor way of using up CPU resources. You would be a lot better off to view this as a job for log analysis. John T eServices For You Life is a succession of lessons which must be lived to be understood. Ralph Waldo Emerson (1802-1882) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] testfailed in filters
Hi all I am trying to write a filter file so it fails if: Messgae did not fail TESTA WEIGHT 10 I tried TESTSFAILED END CONTAINS TESTA TESTSFAILED 0 CONTAINS WEIGHT10 The above did not work I assume all Weight tests are added to TESTFAILED after all other test are processed? even if the filter line is after Weight10 in global.cfg. Am i correct ? and, how to achieve what i am trying to do ? TIA --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] OT: Clustering solution
thank you all for your help specially you sandy we had major problems with sqlserver, and chosed to move away to hyperfile C/S (Which is almost free) and are very satisfied 3500 for double take seems ok, i will try to add it on 07 budget Is it easy to install ? and do you get free support ? do they have good support ? - Original Message - From: Sanford Whiteman [EMAIL PROTECTED] To: Sanford Whiteman declude.junkmail@declude.com Sent: Monday, November 13, 2006 12:26 AM Subject: Re[2]: [Declude.JunkMail] OT: Clustering solution Seriously, what's low? ...I ask because clustering's ROI is kind of a hard target. Unfortunately, I almost always find it easier to justify clustering solutions for my clients *after* they haven't heeded an initial clustering suggestion and have had outages and/or data loss (or if I get them as I clients after such an incident). We use Double-Take as a pseudo-standard, as it has broad industry support and works equally well over the local and wide area. It's going to run you upwards of $3500 for one two-server cluster. Is that low? I'vedemoedandamintriguedbyXGForce's eCluster http://www.xgforce.com/news_eCluster.html, which has much more accessible pricing. I plan to purchase it in place of DT for my next rollout and see if I can trust it. But for now, I can't vouch for it, though if you get into it, please let me know. :) --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/download/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/release/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Messages bypassing declude
Dear declude support, We are having more and more messages that seems to bypass declude No declude headers (see attached file) I need your help on how to trace this issue, and how to correct it ? is this an issue with imail ? or with declude ? how to find out ? We do have a current support contract using imail 8.15 HF2 with declude 4.3.0 regards Serge Dergham Cefib --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Received: from emg210.internetdsl.tpnet.pl [213.77.85.5] by mail.cefib.com with ESMTP (SMTPD32-8.15) id AD5C34E500E8; Thu, 30 Nov 2006 14:40:28 + Return-Path: [EMAIL PROTECTED] Received: from 212.74.112.75 (HELO mk-mx-1.b2b.uk.tiscali.com) by mail.cefib.com with esmtp (,(B4S/N ,0EO37) id 8TI9.P-87.3?N-*E for [EMAIL PROTECTED]; Thu, 30 Nov 2006 14:40:51 -0060 From: Lesa Francis [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Lowest rates approved Date: Thu, 30 Nov 2006 14:40:51 -0060 Message-ID: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_000_0006_01C71495.EA129F00 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.4115 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2905 Importance: Normal X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 376475836 What a regular mail with declude headers should look like Received: from cpe-72-178-168-162.rgv.res.rr.com [72.178.168.162] by mail.cefib.com with ESMTP (SMTPD32-8.15) id A9E658E50148; Fri, 01 Dec 2006 00:40:06 + Return-Path: agreetreatise'[EMAIL PROTECTED] Received: from 207.217.125.16 (HELO mx00-dom.earthlink.net) by cefib.com with esmtp (7-M1LD/A ,=T,2-) id A'3.RP-/1I(K0-2+ for [EMAIL PROTECTED]; Fri, 1 Dec 2006 02:46:20 +0480 From: OTC Financial network agreetreatise'[EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: [Spam=29]EQSE News Date: Fri, 1 Dec 2006 02:46:20 +0480 Message-ID: [EMAIL PROTECTED]'s MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-2 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Office Outlook, Build 11.0.6353 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Thread-Index: Aca6Q4.(6(Y74(3;S9@+A)1,GI6I)== X-RBL-Warning: IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: Failed GIBBERISH Filter X-RBL-Warning: Failed GIBBERISHSUB Filter X-RBL-Warning: SIZE-S: Message failed SIZE-S: 11. X-RBL-Warning: Failed HELOISIP X-RBL-Warning: SNIFFER: Message failed SNIFFER: 57. X-RBL-Warning: SORBS: Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml?72.178.168.162; X-RBL-Warning: SORBS-DUL: Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml?72.178.168.162; X-Declude-Sender: agreetreatise'[EMAIL PROTECTED] [72.178.168.162] X-Declude-Spoolname: D79e658e50148239c.smd Organization: CEFIB Internet (Incoming) X-CEFIB-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-CEFIB-Note: Declude version: 4.3.0 X-CEFIB-Note: Spam-Tests-Failed: IPNOTINMX [0], NOLEGITCONTENT [0], GIBBERISH [3], GIBBERISHSUB [4], SIZE-S [0], HELOISIP [3], SNIFFER [15], SORBS [2], SORBS-DUL [2], WEIGHT10 [10], DWEIGHT10 [10], DWEIGHT20 [20], DWEIGHT25 [25], CATCHALLMAILS [0] X-CEFIB-Note: weight: 29 X-CEFIB-Note: This E-mail was sent from cpe-72-178-168-162.rgv.res.rr.com ([72.178.168.162]). X-CEFIB-Note: Country Chain: UNITED STATES-destination X-CEFIB-Note: MailFrom: agreetreatise'[EMAIL PROTECTED] X-RCPT-TO: [EMAIL PROTECTED] Status: U X-IMail-Rule: H~DWEIGHT10:spam Data- DWEIGHT10 [10], DWEIGHT20 [20] X-UIDL: 464867977 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Inreased spam
We are getting more and more spam that do not have the declude headers Are these bypassing declude ? how, and how to correct the pb ? Thanks in advance. Received: from nohnfjkk [88.108.152.180] by mail.cefib.com (SMTPD32-8.15) id A62C2BCD00DE; Wed, 29 Nov 2006 22:14:04 + Message-ID: [EMAIL PROTECTED] Date: Wed, 29 Nov 2006 21:26:09 + From: grannie harv [EMAIL PROTECTED] User-Agent: Thunderbird 1.5.0.5 (Windows/20060719) MIME-Version: 1.0 To: perceval maje [EMAIL PROTECTED] Subject: klaus Content-Type: multipart/alternative; boundary=-0090.01C713FC X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 376475800 This is a multi-part message in MIME format. ---0090.01C713FC Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Become a SUPERLOVER tonight! http://neroje.com/et/ way they were headed, at what bounty hunter --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SMTP service pb
thank you john will look into that - Original Message - From: John T (Lists) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, November 21, 2006 10:41 AM Subject: RE: [Declude.JunkMail] SMTP service pb Using imail 8.15 and declude 4.3.0 We are having problems with imail smtp service. It stops responding (even though it shows as running in the services admin), and needs to be shut down and restared several times a week any solution/hints will be appreciated Thanks in advance Serge Although not a Declude issue, the answer is most likely here: http://www.mail-archive.com/imail_forum@list.ipswitch.com/msg108335.html John T eServices For You Life is a succession of lessons which must be lived to be understood. Ralph Waldo Emerson (1802-1882) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Clustering solution
I am looking for a low cost clustering sw/solution for our database server (Hyperfile C/S) TIA --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Raid Controller
My compaq/hp raid controller (5i) died today, I replaced it with a spare 6i i had in stock, but i am not able to read any data from the HDs any hints on what i can do ? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Help: Delivery failures
I am beiing bombarded by delivery failures The heading of the returned messages are of the form below Can't find any ip in the headings somename and [EMAIL PROTECTED]are not valid user or adresses on my server in my logs, can't find any "MAIL FROM:[EMAIL PROTECTED] apparently, some spamer is using [EMAIL PROTECTED]in his from address. What is going on ? and how can invetigate this any further ? TIA Message-ID: [EMAIL PROTECTED]From:somename [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: The president's so-called 2Date: Thu, 21 Sep 2006 21:00:07 -0400MIME-Version: 1.0X-Mailer: Internet Mail Service (5.5.2657.72)X-MS-Embedded-Report: X-Mailer: The Bat! (v3.71.04) ProfessionalContent-Type: multipart/mixed;boundary="_=_NextPart_002_01C6DDD7.7CB7171E" ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] Help: Delivery failures
For those of you who can read headers better than me, here is a more interesting one this time, we have some ips, "Received: from 217.170.144.6 (HELO mail.cefib.com)" can be valid, but 1- there is no traces in my logs of sending this message 2- second part of the header says cwmagic.com received from217.170.144.6, but first part says 196.205.224.128, either i am missing something, or there is contradiction is "the bat" faking the header ? please help Received: from host-196-205-224-128.static.link.com.eg ([196.205.224.128]) by SERVER.Compuwizards.local with Microsoft SMTPSVC(5.0.2195.6713); Thu, 21 Sep 2006 10:52:36 -0700Return-Path: [EMAIL PROTECTED]Received: from 217.170.144.6 (HELO mail.cefib.com) by cwmagic.com with esmtp (DA5X015JX7 X0Z5) id 5K23MB-BX0IOM-7E for [EMAIL PROTECTED]; Tue, 21 Mar 2006 18:33:33 -0120Date:Tue, 21 Mar 2006 18:33:33 -0120From:"Mario Hamlin" [EMAIL PROTECTED].comX-Mailer: The Bat! (v3.51) HomeX-Priority: 3 (Normal)Message-ID: [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: THURSDAY.rq MIME-Version: 1.0Content-Type: multipart/mixed; boundary="--6E54096EC8425409"X-Spam: Not detectedX-OriginalArrivalTime: 21 Sep 2006 17:52:37.0671 (UTC) FILETIME=[B9B6C370:01C6DDA6] - Original Message - From: Serge To: declude.junkmail@declude.com Sent: Friday, September 22, 2006 2:13 AM Subject: [Declude.JunkMail] Help: Delivery failures I am beiing bombarded by delivery failures The heading of the returned messages are of the form below Can't find any ip in the headings somename and [EMAIL PROTECTED]are not valid user or adresses on my server in my logs, can't find any "MAIL FROM:[EMAIL PROTECTED] apparently, some spamer is using [EMAIL PROTECTED]in his from address. What is going on ? and how can invetigate this any further ? TIA Message-ID: [EMAIL PROTECTED]From:somename [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: The president's so-called 2Date: Thu, 21 Sep 2006 21:00:07 -0400MIME-Version: 1.0X-Mailer: Internet Mail Service (5.5.2657.72)X-MS-Embedded-Report: X-Mailer: The Bat! (v3.71.04) ProfessionalContent-Type: multipart/mixed;boundary="_=_NextPart_002_01C6DDD7.7CB7171E" ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] OT SNMP Monitor Program
if you have a single customer per cisco interface, use mrtg if you have many customers on the same interace, you need to use cisco NetFlow output. for unix platform, you have many (inexpensive) choices, if you want windows, i recommend webspy. - Original Message - From: dfn Systems [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Sunday, August 06, 2006 12:58 AM Subject: [Declude.JunkMail] OT SNMP Monitor Program Quiet times are good for off topic subjects Right? I need a Monitoring program that will show me bandwidth utilization of my dsl customers to help track down compromised/infected machines. Regular sniffer programs won't work because the customers connect through ATM PVC and go out to the Internet through another PVC without ever leaving the router. Something that will read and graph from a cisco MIB on SNMP is what I'm seeking. It doesn't have to be robust or even incredibly stable. Cheap would be good. Free (Open Source) would be even better. Any leads would be greatly appreciated. Bill Green dfn Systems --- [This E-mail scanned for viruses by Declude EVA] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] F-Prot Licensing
So, declude will turn out to be the biggest winner in fprot price increase! Hope it is not declude that alerted frisk about how fprot is beiing used :) Anyway, I do not care, i have a perpetual license. - Original Message - From: John T (Lists) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Monday, July 17, 2006 9:06 PM Subject: RE: [Declude.JunkMail] F-Prot Licensing Declude Suite now includes an integrated AVG scanner as part of the price of the Suite. John T eServices For You Seek, and ye shall find! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of AlamoHost Admin Sent: Monday, July 17, 2006 1:37 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] F-Prot Licensing Is the subscription to AVG part of Declude now or does the user need to purchase a subscription from AVG in order to get definition updates? The prices for the AVG mail server version isn't much better than F-Prot. They only list prices up to 100 mailboxes - $1,030 for 2 years. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT user profile settings
In fact, i should already stated, MyDocuments is not at issue, it was moved out of C: long time ago; Space is an issue, but not the only issue OE mailboxes are about 2GB and growing, I know how to move it out of documents an settings, and will do that this week. But again, i prefer to move everything once and for all (OE, favorites, ,) I think John Dobbin method is great for XP pro, guess it is time to upgrade my laptop :) Anyway, thank you all guys, but i dont want to waist your time anymore on this issue. Back to real work Upgrading from 2.0.6 to 4.1 tonight wish me luck - Original Message - From: Kevin Bilbee [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Sunday, April 23, 2006 6:36 AM Subject: RE: [Declude.JunkMail] OT user profile settings Do you need to move the profile or just the MyDocuments folder. If you just want to move the my documents folder. Right click the folder choose properties then change the location the click move. This will only move the my documents folder not the entire profile. And this does work on XP Home. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Friday, April 21, 2006 7:57 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT user profile settings several reasons first, i am almost out of space on c:, but i also find easier to maintain, and i do not like having my files on the system partition, in case i need to reformat or something - Original Message - From: John T (Lists) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, April 22, 2006 1:08 AM Subject: RE: [Declude.JunkMail] OT user profile settings Serge, basic question here: What is the purpose for moving it in the first place? John T eServices For You Seek, and ye shall find! -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Serge Sent: Friday, April 21, 2006 5:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT user profile settings Thank you John, Once that is done, go to computer management, right click the username, select properties. On the profile tab, enter the path to the profile. Now 1-that is not possible with a laptop that has xp home, Correct ? any workarround ? 2-in xppro, will that move all the subdirectories of document and settings ? - Original Message - From: John Dobbin [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 21, 2006 8:54 PM Subject: RE: [Declude.JunkMail] OT user profile settings You can also right click on My Computer select properties, select the advanced tab, click the settings button in the profiles section select the profile you want to move (you can't be logged in as the one you want to move) and select Copy To. Select the path you want to move it to. Once that is done, go to computer management, right click the username, select properties. On the profile tab, enter the path to the profile. Now it will look to the new path for the profile. This is real useful if you keep user profiles on a server to allow roaming profiles. John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Friday, April 21, 2006 3:42 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT user profile settings I would like to move all my documents and settings folder to a different drive/directory (not only my documents), out of c: same user is OK MSFT has a KB article where you have to edit the registry keys one by one (there are hundreds). I figured somebody should have writen some utility that does exactly that Looked on google, found COA2 and TweakUI to help edit registry, but none is specific to what i want to do. Plus, i think the registry sometime contains aliases,ie %userprofile%\documents and settings\user so searching for c:\documents...\user may not find all occurences. Can't believe MSFT didn't provide a utility to do this, even on their tech forums their engineers shy away from this and can't provide a simple solution. I think under W2K, it was much more straightforward. But somebody, somewhere, must have written a utility. No ? - Original Message - From: John T (Lists) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 21, 2006 8:49 AM Subject: RE: [Declude.JunkMail] OT user profile settings Meaning move to a new user or a different location all together? John T eServices For You Seek, and ye shall find! -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Serge Sent: Thursday, April 20
[Declude.JunkMail] 4.1 GUI
Ok, Upgrade completed for some reason i had to manualy install decludeproc (had to guess about decludeproc -i switch), also had to manualy delete declude.exe (i stopped all imail services, and run the upgrade 3 times, but still had 2.0.6 version in imail directory) anyway, all seem working now, except for the GUI can someone (including declude) tell me where to find it (and how to use it) ? is the a user manual for installin/using the new GUI ? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT user profile settings
I would like to move all my documents and settings folder to a different drive/directory (not only my documents), out of c: same user is OK MSFT has a KB article where you have to edit the registry keys one by one (there are hundreds). I figured somebody should have writen some utility that does exactly that Looked on google, found COA2 and TweakUI to help edit registry, but none is specific to what i want to do. Plus, i think the registry sometime contains aliases,ie %userprofile%\documents and settings\user so searching for c:\documents...\user may not find all occurences. Can't believe MSFT didn't provide a utility to do this, even on their tech forums their engineers shy away from this and can't provide a simple solution. I think under W2K, it was much more straightforward. But somebody, somewhere, must have written a utility. No ? - Original Message - From: John T (Lists) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 21, 2006 8:49 AM Subject: RE: [Declude.JunkMail] OT user profile settings Meaning move to a new user or a different location all together? John T eServices For You Seek, and ye shall find! -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Serge Sent: Thursday, April 20, 2006 10:29 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] OT user profile settings Hi all i need a utility that easily move a user documents and settings folder to a new location under XP TIA --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT user profile settings
Thank you John, Once that is done, go to computer management, right click the username, select properties. On the profile tab, enter the path to the profile. Now 1-that is not possible with a laptop that has xp home, Correct ? any workarround ? 2-in xppro, will that move all the subdirectories of document and settings ? - Original Message - From: John Dobbin [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 21, 2006 8:54 PM Subject: RE: [Declude.JunkMail] OT user profile settings You can also right click on My Computer select properties, select the advanced tab, click the settings button in the profiles section select the profile you want to move (you can't be logged in as the one you want to move) and select Copy To. Select the path you want to move it to. Once that is done, go to computer management, right click the username, select properties. On the profile tab, enter the path to the profile. Now it will look to the new path for the profile. This is real useful if you keep user profiles on a server to allow roaming profiles. John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Friday, April 21, 2006 3:42 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT user profile settings I would like to move all my documents and settings folder to a different drive/directory (not only my documents), out of c: same user is OK MSFT has a KB article where you have to edit the registry keys one by one (there are hundreds). I figured somebody should have writen some utility that does exactly that Looked on google, found COA2 and TweakUI to help edit registry, but none is specific to what i want to do. Plus, i think the registry sometime contains aliases,ie %userprofile%\documents and settings\user so searching for c:\documents...\user may not find all occurences. Can't believe MSFT didn't provide a utility to do this, even on their tech forums their engineers shy away from this and can't provide a simple solution. I think under W2K, it was much more straightforward. But somebody, somewhere, must have written a utility. No ? - Original Message - From: John T (Lists) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 21, 2006 8:49 AM Subject: RE: [Declude.JunkMail] OT user profile settings Meaning move to a new user or a different location all together? John T eServices For You Seek, and ye shall find! -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Serge Sent: Thursday, April 20, 2006 10:29 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] OT user profile settings Hi all i need a utility that easily move a user documents and settings folder to a new location under XP TIA --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT user profile settings
several reasons first, i am almost out of space on c:, but i also find easier to maintain, and i do not like having my files on the system partition, in case i need to reformat or something - Original Message - From: John T (Lists) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, April 22, 2006 1:08 AM Subject: RE: [Declude.JunkMail] OT user profile settings Serge, basic question here: What is the purpose for moving it in the first place? John T eServices For You Seek, and ye shall find! -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Serge Sent: Friday, April 21, 2006 5:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT user profile settings Thank you John, Once that is done, go to computer management, right click the username, select properties. On the profile tab, enter the path to the profile. Now 1-that is not possible with a laptop that has xp home, Correct ? any workarround ? 2-in xppro, will that move all the subdirectories of document and settings ? - Original Message - From: John Dobbin [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 21, 2006 8:54 PM Subject: RE: [Declude.JunkMail] OT user profile settings You can also right click on My Computer select properties, select the advanced tab, click the settings button in the profiles section select the profile you want to move (you can't be logged in as the one you want to move) and select Copy To. Select the path you want to move it to. Once that is done, go to computer management, right click the username, select properties. On the profile tab, enter the path to the profile. Now it will look to the new path for the profile. This is real useful if you keep user profiles on a server to allow roaming profiles. John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Friday, April 21, 2006 3:42 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT user profile settings I would like to move all my documents and settings folder to a different drive/directory (not only my documents), out of c: same user is OK MSFT has a KB article where you have to edit the registry keys one by one (there are hundreds). I figured somebody should have writen some utility that does exactly that Looked on google, found COA2 and TweakUI to help edit registry, but none is specific to what i want to do. Plus, i think the registry sometime contains aliases,ie %userprofile%\documents and settings\user so searching for c:\documents...\user may not find all occurences. Can't believe MSFT didn't provide a utility to do this, even on their tech forums their engineers shy away from this and can't provide a simple solution. I think under W2K, it was much more straightforward. But somebody, somewhere, must have written a utility. No ? - Original Message - From: John T (Lists) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 21, 2006 8:49 AM Subject: RE: [Declude.JunkMail] OT user profile settings Meaning move to a new user or a different location all together? John T eServices For You Seek, and ye shall find! -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Serge Sent: Thursday, April 20, 2006 10:29 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] OT user profile settings Hi all i need a utility that easily move a user documents and settings folder to a new location under XP TIA --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
[Declude.JunkMail] OT user profile settings
Hi all i need a utility that easily move a user documents and settings folder to a new location under XP TIA --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] REVDNS
So it would be interesting know what's exactly in his text filter file REVDNS-TIMEOUT I'm going to try REVDNS END CONTAINS (timeout) if somebody have a better idea, please post - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, December 12, 2005 7:42 AM Subject: RE: [Declude.JunkMail] REVDNS I think it may be (timeout). I know Scott Fisher posted a filter the other day that had the exact text on what it is when rev dns times out. It was a message from Scott Fisher on the cbl-thread and as I can see he posted a line TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT So it would be interesting know what's exactly in his text filter file REVDNS-TIMEOUT Markus --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] REVDNS
should this be (Timeout) or (timeout) ? - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, December 12, 2005 2:58 PM Subject: Re: [Declude.JunkMail] REVDNS REVDNS 10 IS (Timeout) - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, December 12, 2005 1:42 AM Subject: RE: [Declude.JunkMail] REVDNS I think it may be (timeout). I know Scott Fisher posted a filter the other day that had the exact text on what it is when rev dns times out. It was a message from Scott Fisher on the cbl-thread and as I can see he posted a line TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT So it would be interesting know what's exactly in his text filter file REVDNS-TIMEOUT Markus --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] REVDNS
I use tests that were posted long time ago by kami I use them for aol, hotmail, yahoo, ... i think they are much more flexible than spamdomains, and they test mailfrom, revdns and helo (i think spamdomains only test mailfrom and revdns) there was a long discussion at that time, i do not remember all the details, try checking the archives. - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, December 12, 2005 3:14 PM Subject: RE: [Declude.JunkMail] REVDNS Thank you Scott, Serge, why do you use such a filter? A SpamDomain-Test should do this even bether. Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Monday, December 12, 2005 3:58 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] REVDNS REVDNS 10 IS (Timeout) - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, December 12, 2005 1:42 AM Subject: RE: [Declude.JunkMail] REVDNS I think it may be (timeout). I know Scott Fisher posted a filter the other day that had the exact text on what it is when rev dns times out. It was a message from Scott Fisher on the cbl-thread and as I can see he posted a line TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT So it would be interesting know what's exactly in his text filter file REVDNS-TIMEOUT Markus --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] REVDNS
I have good homail messages failing the false hotmail test below the reason is REVDNS timeouts the filter should end at the first line, but does not any workarround? REVDNS END ENDSWITH .hotmail.com MAILFROM 3 ENDSWITH @hotmail.com HELO 5 ENDSWITH hotmail.com --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HoldAnalyzer
we use imail spool viewer v1.2.4 has all the options we need (check envelope, header, delete, move to spool, ...) great tool --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HoldAnalyzer
Hi Kevin, you mean an asp app where users can log in and check the hold mail ? how does it exactly work ? do you have a single hold dir for all users ? that will not work in an ISP environment . or is there a way to filter user access to only his own messages ? TIA - Original Message - From: Kevin Bilbee [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, December 06, 2005 9:25 PM Subject: RE: [Declude.JunkMail] HoldAnalyzer With a Hold Analyzer you know longer have to do that for the user. Users recover their own messages. Having users recover their own messages lets the admin know what the recipient thinks is spam and what is not spam. I find it difficult to read their minds. when I did this in the past I made incorrect assumptions on what was spam. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Serge Sent: Tuesday, December 06, 2005 1:04 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] HoldAnalyzer we use imail spool viewer v1.2.4 has all the options we need (check envelope, header, delete, move to spool, ...) great tool --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Grep help needed
Need a quick grep script to get the number of messages sent by IP, and another by authenticated users sort by number of messages TIA --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: another SOBERing though
hijack will work, but it will be much better if it works based on the authenticated user instead of ip also we need to be able to set different limits/categories for different users declude, are listening? - Original Message - From: Markus Gufler To: Declude.JunkMail@declude.com Sent: Thursday, November 17, 2005 6:36 PM Subject: RE: [Declude.JunkMail] OT: another SOBERing though Wow! It's like 1995 - 2005 had never been. :-| ok, I must say I never worked with Declude Hijack. It's not simply this what we need now? Markus From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, AndrewSent: Thursday, November 17, 2005 6:41 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] OT: another SOBERing though You can read about or get your own version of the password stealing app here: http://www.nirsoft.net/utils/pspv.html Andrew 8)
Re: [Declude.JunkMail] OT: another SOBERing though
not sure how using port 587 will solve this cant the spammers/virus writers eventualy use this port why would that be a long term solution ? - Original Message - From: Matt To: Declude.JunkMail@declude.com Sent: Thursday, November 17, 2005 7:24 PM Subject: Re: [Declude.JunkMail] OT: another SOBERing though I think one of the issues here is that Hijack was designed to solve a problem that existed due to omission on the part of IMail, but being a separate app, it might not be the most optimal method, though for now it definitely is.Most servers on the Internet have no policies in place to restrict the volume of E-mail through authenticated accounts. This is a gaping hole and it is now being exploited. The best way to effectively stop such things is to integrate that functionality into the servers themselves, and all servers need such settings defaulted to being enabled in order to protect the Internet from the garbage that hacked accounts can spew.Clearly people aren't taking this seriously enough, including the often exploited likes of HotMail/Microsoft and Yahoo. I figure that eventually everyone will begin to take this seriously, but only after things have become much worse. Keep in mind that most of us were operating as open relays up until about 2000, and most of us had no alternative. E-mail systems with their very loose or completely lacking policy enforcement in combination with being the most often attacked system on the Internet with the most financial gain should be a primary focus as far as security goes.What really gets me is that in the last couple of years, there was a huge focus on SPF, Caller-ID and Domain Keys, but very little focus on propagating port 587/AUTH-only support on mail servers, and seemingly no focus in getting E-mail clients to auto-negotiate such settings. Now we are seeing another completely predictable situation in which spammers and virus writers are automating the hacking of E-mail accounts, and there are virtually no protections in place. IMO, it's a shame that the biggest players were pushing for what I consider to be almost valueless functionality while the big names behind them were also the ones that were being exploited the most and still are. These are also the same fools that paid-off the Congress so that they 'can'-Spam.MattSerge wrote: hijack will work, but it will be much better if it works based on the authenticated user instead of ip also we need to be able to set different limits/categories for different users declude, are listening? - Original Message - From: Markus Gufler To: Declude.JunkMail@declude.com Sent: Thursday, November 17, 2005 6:36 PM Subject: RE: [Declude.JunkMail] OT: another SOBERing though Wow! It's like 1995 - 2005 had never been. :-| ok, I must say I never worked with Declude Hijack. It's not simply this what we need now? Markus From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Colbeck, AndrewSent: Thursday, November 17, 2005 6:41 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] OT: another SOBERing though You can read about or get your own version of the password stealing app here: http://www.nirsoft.net/utils/pspv.html Andrew 8)
Re: [Declude.JunkMail] OT: another SOBERing though
Andrew I understand the need for 587 auth We are an ISP, and we have been blocking outbound port 25 for years Moving to port 587 auth only will be a major undertaking, until all mail clients become auto-negotiating It was already a long undertaking toforce all our clients to smtp auth on port 25 Anyway I was only reffering to the subject of this thread; the threats of a new type of viruses and i think we agree on this issue, port 587 is not a solution - Original Message - From: Colbeck, Andrew To: Declude.JunkMail@declude.com Sent: Thursday, November 17, 2005 11:31 PM Subject: RE: [Declude.JunkMail] OT: another SOBERing though Serge, that's a misleading line of reasoning. Here's the thing: Auth on port 587 is the right best practice for ISPs (and some corporations) so that they can properly secure their MTA against misuse by 3rd parties, including worms on their client subnets. It cuts off large swaths of current flaws: the ISP won't have any open relays, won't have whitelisted client subnets, thereby allowing the ISP to firewall outbound port 25 from their personal clients. Auth on 587 also allows the client to wander all over the Internet with their laptop and still send mail with their own mailfrom name from the expected ISP's MTA. As you've surmised, this doesn't help if the bad guys have auth that they've stolen from one of your clients. However, this becomes the same case as if the bad guy is one one of your clients, and the answers are the same; the ISP needs traffic logging and alerts, e.g. the mail volume restrictions over time that were discussed earlier today. Is that clearer? Andrew 8) From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of SergeSent: Thursday, November 17, 2005 3:12 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] OT: another SOBERing though not sure how using port 587 will solve this cant the spammers/virus writers eventualy use this port why would that be a long term solution ? - Original Message - From: Matt To: Declude.JunkMail@declude.com Sent: Thursday, November 17, 2005 7:24 PM Subject: Re: [Declude.JunkMail] OT: another SOBERing though I think one of the issues here is that Hijack was designed to solve a problem that existed due to omission on the part of IMail, but being a separate app, it might not be the most optimal method, though for now it definitely is.Most servers on the Internet have no policies in place to restrict the volume of E-mail through authenticated accounts. This is a gaping hole and it is now being exploited. The best way to effectively stop such things is to integrate that functionality into the servers themselves, and all servers need such settings defaulted to being enabled in order to protect the Internet from the garbage that hacked accounts can spew.Clearly people aren't taking this seriously enough, including the often exploited likes of HotMail/Microsoft and Yahoo. I figure that eventually everyone will begin to take this seriously, but only after things have become much worse. Keep in mind that most of us were operating as open relays up until about 2000, and most of us had no alternative. E-mail systems with their very loose or completely lacking policy enforcement in combination with being the most often attacked system on the Internet with the most financial gain should be a primary focus as far as security goes.What really gets me is that in the last couple of years, there was a huge focus on SPF, Caller-ID and Domain Keys, but very little focus on propagating port 587/AUTH-only support on mail servers, and seemingly no focus in getting E-mail clients to auto-negotiate such settings. Now we are seeing another completely predictable situation in which spammers and virus writers are automating the hacking of E-mail accounts, and there are virtually no protections in place. IMO, it's a shame that the biggest players were pushing for what I consider to be almost valueless functionality while the big names behind them were also the ones that were being exploited the most and still are. These are also the same fools that paid-off the Congress so that they 'can'-Spam.MattSerge wrote: hijack will work, but it will be much better if it works based on the authenticated user instead of ip also we need to be able to set different limits/categories for different users declude, are listening
[Declude.JunkMail] Whitelisting
Title: Message Hi all I am tryi,g to find why an email was whitelisted I suspect autowhitelist, but how can i confirm ? the logs shows this: 10/31/2005 07:23:52 QC64AD3B100E67716 Skipping4 E-mail from [EMAIL PROTECTED] ; whitelisted [EMAIL PROTECTED] ].
Re: [Declude.JunkMail] Whitelisting
Title: Message thanks scott, that confirms mythoughts - Original Message - From: Scott Fisher To: Declude.JunkMail@declude.com Sent: Monday, October 31, 2005 2:38 PM Subject: Re: [Declude.JunkMail] Whitelisting I'm pretty confident that the "Skipping4 E-mail from " means an address book whitelist. - Original Message - From: Serge To: Declude.JunkMail@declude.com Sent: Monday, October 31, 2005 3:35 AM Subject: [Declude.JunkMail] Whitelisting Hi all I am tryi,g to find why an email was whitelisted I suspect autowhitelist, but how can i confirm ? the logs shows this: 10/31/2005 07:23:52 QC64AD3B100E67716 Skipping4 E-mail from [EMAIL PROTECTED] ; whitelisted [EMAIL PROTECTED] ].
Re: [Declude.JunkMail] found something new to me
Matt said: On the other hand, if you want to tag just two tests in combination, this is very easy to do using a different approach. For instance, if you wanted to filter for something that failed both SPAMCOP and XBL (and anything else), you could do so as follows: TESTSFAILED END NOTCONTAINS SPAMCOP TESTSFAILED 0 CONTAINS XBL why can't this approach be used for any number of tests ? TESTSFAILED END NOTCONTAINS SPAMCOP TESTSFAILED END NOTCONTAINS SBL TESTSFAILED 0 CONTAINS XBL will tag a message that failed all 3 tests. No ? - Original Message - From: Matt [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, October 22, 2005 9:06 PM Subject: Re: [Declude.JunkMail] found something new to me Travis, Not exactly. The TESTSFAILED string is a space separated string of tests that failed, so if SPAMCOP, SBL and XBL hit, the string would look like the following: SPAMCOP SBL XBL If you are looking for more than two tests, it requires you to have the order the same as Declude records them, so for instance the above string would need to be matched exactly like so: TESTSFAILED 0 CONTAINS SPAMCOP SBL XBL The following wouldn't hit however because the string wouldn't match: TESTSFAILED 0 CONTAINS SBL XBL SPAMCOP That means that you have to be careful about how you order your tests if you are looking to match more than two, and you also have to be aware of the order in which Declude runs certain types of tests, for instance all blacklists are run before built-in Declude tests, and those are run before External tests, and External tests are run before custom filters. Sometimes you can just make non-scoring filters to tag a certain test in order to guarantee their order just in case there are other tests that can appear in between them. On the other hand, if you want to tag just two tests in combination, this is very easy to do using a different approach. For instance, if you wanted to filter for something that failed both SPAMCOP and XBL (and anything else), you could do so as follows: TESTSFAILED END NOTCONTAINS SPAMCOP TESTSFAILED 0 CONTAINS XBL Why is this so difficult? Because it wasn't designed for combo-ing tests...but you can make it do just that with a little elbow grease. Combo-ing tests is a kludge that came about after the TESTFAILED variable was introduced for a separate reason. Matt Travis Sullivan wrote: I think I got it... I am slow, I know :) global.cfg contents: COMBO filter C:\IMail\Declude\lists\combo.txt x 0 0 combo.txt file contents: TESTSFAILED 10 CONTAINS testname1-testname2 So, any test I want to combo script simply take the testname and seperate them by a hyphen? like: SPAMCOP-SBL ? Thanks, I can definately see how this can further punish emails... allowing us to lower the scores of the individual tests. Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] found something new to me
Are you trying to score a hit if the message failed all 3 tests? Yes. but why the (sybmol afterwords, what is that telling declude to process?) Should not be there, disregard. So, in the example above, say test name is combo-sc-sbl-xbl and info resides in the combo-sc-sbl-xbl.txt filter file, you would just assign a value in the global.cfg file such as: IPBL ipfile E:\IMail\Declude\ipbl.txt x 5 0 should be: IPBL filter E:\IMail\Declude\ipbl.txt x 5 0 - Original Message - From: Travis Sullivan [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Sunday, October 23, 2005 8:27 PM Subject: Re: [Declude.JunkMail] found something new to me TESTSFAILED END NOTCONTAINS SPAMCOP TESTSFAILED END NOTCONTAINS SBL TESTSFAILED 0 CONTAINS XBL Explain the theory of this to me, please. stop testing if the test doesn't contain spamcop, or sbl, but zero if contains xbl Are you trying to score a hit if the message failed all 3 tests? but why the (sybmol afterwords, what is that telling declude to process?) So, in the example above, say test name is combo-sc-sbl-xbl and info resides in the combo-sc-sbl-xbl.txt filter file, you would just assign a value in the global.cfg file such as: IPBL ipfile E:\IMail\Declude\ipbl.txt x 5 0 This will punish the email that failed at least the three tests of spamcop, sbl, and xbl, and add another 5 points to it. Am I finally understanding this? Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Sniffer Invuribl
Hi all, I have been using sniffer for a year and recently add INVURIBL. i am trying to find the corrolation between the 2 test to set the weight. I tag at 10 and delete at 30.. I had sniffer at 14. nowi added invuribl with a max weight of 14. i have spamcop at 9. and a set of negative weight filter to compensate for most FP. Should i lower sniffer now that I added Invuribl ? (this is an isp setting)
[Declude.JunkMail] Sniffer Invuribl
Hi all, I have been using sniffer for a year and recently add INVURIBL. i am trying to find the corrolation between the 2 test to set the weight. I tag at 10 and delete at 30.. I had sniffer at 14. nowi added invuribl with a max weight of 14. i have spamcop at 9. and a set of negative weight filter to compensate for most FP. Should i lower sniffer now that I added Invuribl ? (this is an isp setting)
[Declude.JunkMail] Fprot def updates
Hi all I was using scripts to download fprot def I use to download fp-def.zip and macrdef2.zip I just noticed these file are no longer on their ftp anyone else having this problem ? TIA --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Fprot def updates
I am using the 32bit liscenced version (with 50$ a year, i think i can afford it :) But there are isuses with the built in updater, as sometimes it fails to complete the download, and stay open on the screen FTP was much more reliable - Original Message - From: Matt [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Wednesday, August 31, 2005 6:44 PM Subject: Re: [Declude.JunkMail] Fprot def updates Serge, This doesn't directly answer your question, but this might be some help. I think that the general consensus around here is that paying for the licensed version is the best way to go since it gets you the faster 32-bit command line app instead of the 16-bit one that the free version has, and it has a built-in updater that you can add to Task Scheduler with a single line: C:\Program Files\FSI\F-Prot\FP-Updater\Updater.exe /HIDDEN /INTERNET If you are using the licensed version, try switching to the built-in updater. Matt Serge wrote: Hi all I was using scripts to download fprot def I use to download fp-def.zip and macrdef2.zip I just noticed these file are no longer on their ftp anyone else having this problem ? TIA --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Upgrading from 1.81
Been away for some time, and was not regulary reading this list. I am getting ready to upgrade from 1.81 to a new version . need some advice. 1- Do i need to run the installer with all 2.0.x versions ? or can i do it the old way (get a declude.exe and copy it) 2- What version do you recommend ? 2.0.5 or 2.0.6.16 ? 3- Any changes need to be made to the config files (tests, filters, actions, ...) before upgrading ? TIA --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Upgrading from 1.81
also, what about log format i curently use DLA and VLA do i need to change the log generation options ? - Original Message - From: Serge [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, August 30, 2005 6:24 PM Subject: Upgrading from 1.81 Been away for some time, and was not regulary reading this list. I am getting ready to upgrade from 1.81 to a new version . need some advice. 1- Do i need to run the installer with all 2.0.x versions ? or can i do it the old way (get a declude.exe and copy it) 2- What version do you recommend ? 2.0.5 or 2.0.6.16 ? 3- Any changes need to be made to the config files (tests, filters, actions, ...) before upgrading ? TIA --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPAMSPCE:contract issues
Hi My profile shows exp jan 05 Licensing Host Name: MAIL.CEFIB.COM Exp: 26 Jan 2005 Platform:IMail But the email below indicated september 05 please review the profile and change the date - Original Message - From: "David Barker" [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, November 08, 2004 3:56 PM Subject: [PEM-91539]: New Purchase == Please reply above this line == New Purchase Serge, Your service agreement expires on MAIL.CEFIB.COM 27 Sep 2005, the agreement is from 27 October 2004 when you downloaded the 1.81 upgrade. If you have any further questions, please do not hesitate to contact me either by email or call Toll free 1-866-332-5833 Regards, David Barker www.declude.com
[Declude.JunkMail] Hijack webmail
been having problems with some webmails not beiing delivered just noticed that hijack is holding many mails from 127.0.0.1 should we allow ip 127.0.0.1 so that webmail works correcly ?
[Declude.JunkMail] WebMail Pbs
We are having pbs with Imail 8.15+KWM Local emails fine, but when an email has a remote address, it just vanishes. Had the same issue few weeks back, had to reinstall imail and KWM, fixed the pb. Tiday, pb is back, and do not wan yo keep installing evrything. Anyone have an idea about how to fix this ? TIA --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Authenticating account
Hi Is there a command to filter (in a filter file) based on the account the authenticated the session ? If not, can we write a rule in Imail that will copy messages from session authenticated by a specific account ? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 2005 SpamHeaders Glitch?
I am sure this was not intentional. However, since this is a serious bug, it will be intersting to see how CPH is going to handle the situation. Given the many versions out there a patch cannot do the job, and they cannot release a fixed exe for every version. Meaning the only way would be to upgrade to the yet to be released fix (1.82 or 2.01). Therfore, those who do not have a current service agreement will have to drop a test that is in the specs of the product they bought. Complex situation for both sides. Personaly, given the continuously evolving nature/area of email/virus/spam, i think an annual service agreement should be mendatory, in the license agreement, (like the sniffer folks do), provided they don't increase current prices, which are reasonable. otherwise, i can't see how CPH can survive, and survival is essential for all of us who own the product. A change of the buisness model is needed. - Original Message - From: Glen Harvy [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, January 01, 2005 8:59 PM Subject: RE: [Declude.JunkMail] 2005 SpamHeaders Glitch? Great way to increase sales due to the need to update service agreements. _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bill Landry Sent: Sunday, 2 January 2005 04:36 To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] 2005 SpamHeaders Glitch? - Original Message - From: Dave Doherty [EMAIL PROTECTED] I set it to zero weight temporarily. I also sent an email direct to Scott and Barry. Why run the test at all if you're going to set the weight to zero anyway - just comment out the test until it's fixed. I can see this causing some major problems for users that are not subscribers of this list, or who do not actively monitor it. I'm wondering if the only fix for this is a new declude.exe file? If that's the case, CPHZ has got their early New Year's work cut out for them... Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SmarterMail move, and some complaining
thanks Barry a post from you from time to time on this list will help a lot - Original Message - From: Barry Simpson [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, December 24, 2004 4:19 AM Subject: RE: [Declude.JunkMail] SmarterMail move, and some complaining I did post this morning to both this and the Virus lists but for some reason it did not appear. I will re-post tomorrow when I get to the office. Barry -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Thursday, December 23, 2004 8:43 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] SmarterMail move, and some complaining Oops, i did not mean the customers Went back and read my post, i meant to say why did BARRY not post any explanation here, Not you John :) Also i understand there are anti piracy details that cannot be shared here, he did give some users some details about failsafe measures, cold spare server, ... that Barry could have shared here to make us feel we are not beiing ignored. Concerning anti-piracy measures, as posted here, everybody can also use same MAC address One way to safely fight piracy, for declude and us customers, is a way for declude to phone home with basic information, once an illegal copy is detected, they disable the activation code in their database, and the next time that copy phone home, it disable itself. All this after contacting the original customer, giving him a new code, so not to disable the legal copy That may be one way to do it, i'm sure there are other (and better ways), but the important issue is that the legal customer can change as many ips and macs as he wants, without encoutering any problem, until the declude folks contact him, listen to him, and warn him. But we should have already been warned that changes are taking places, phonning home is already happening, and what failsafe measures are beiing considered Finaly, As always with software, there will always be someone who will reverse engineer the code and create a crack to disable the security mecanisme, that is the price of success. - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, December 24, 2004 12:40 AM Subject: RE: [Declude.JunkMail] SmarterMail move, and some complaining Also, I think it is ironic that, after most of us decided to stay with Imail because of declude, we now are getting this treatment from CPHZ. I do not understand why CPHZ expalined privatly to a few customers about what is going on, and still has not posted something on this list. Should we understand that CPHZ values some customers more than others ? Apparently, some customer were satisfied with the explanation they got. Why not post this explanation here ? I have not posted the explanation because of trust. Barry explained a bit to me knowing I would not spread it out on the Internet. I am sure the others that Barry talked to will say the same. CPHZ values all of its customers. If anything, Scott may dislike me more than others because of the volume of e-mail over time from me he receives. I must hold the record for having tabs and spaces where they do not belong. The root of the problem is, and one which has caused Declude a great deal of grief, is dishonesty and theft. There are those out there, either lurking or being malicious, that recognize Declude as a quality product and either use it without paying, or study what it does to go around it. Per Barry, Declude KNOWS that there is a humongous chunk of declude.exe files in use THAT ARE NOT LICENSED USES! That equals a major chunk of money. About a year ago, there was a lot of discussion over sharing files. I was even going to set up a web site to allow all of us to share our files to help fight this war on spam. However, I had heavy reservations of misuse and abuse. It would have to be done in one of 2 ways. 1: Create a private group where you proved who you are and then are allowed in. Many had privacy concerns about this, and how useful it would actually be. 2: It would be available to all. Problem is that means spammers could also get it, and therefore know how to get around our filters. Bottom line, there is a core group of Declude users who are known and trusted. Outside of that group, there are lurkers, spammers, users with malicious intent, thieves and so forth. The majority of those outside the group however are honest professional admins. The problem is, there is no way to tell you apart from all the bad stuff. Now please understand, the above paragraph is not meant to elevate or put down anyone. It has to do with a time honored thing called trust. (Although no matter how I put it some will take offense even though none is intended.) Therefore, Declude has to come up with a way to protect its products and name, and receive
[Declude.JunkMail] SmarterMail move, and some complaining
We curently own Declude Virus Pro, JMPro, and Hijack, and our support contract is up to date If we decide to move from Imail to Smarter mail, do we have to pay any (declude) upgrade fee ? Also, I think it is ironic that, after most of us decided to stay with Imail because of declude, we now are getting this treatment from CPHZ. I do not understand why CPHZ expalined privatly to a few customers about what is going on, and still has not posted something on this list. Should we understand that CPHZ values some customers more than others ? Apparently, some customer were satisfied with the explanation they got. Why not post this explanation here ? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SmarterMail move, and some complaining
Oops, i did not mean the customers Went back and read my post, i meant to say why did BARRY not post any explanation here, Not you John :) Also i understand there are anti piracy details that cannot be shared here, he did give some users some details about failsafe measures, cold spare server, ... that Barry could have shared here to make us feel we are not beiing ignored. Concerning anti-piracy measures, as posted here, everybody can also use same MAC address One way to safely fight piracy, for declude and us customers, is a way for declude to phone home with basic information, once an illegal copy is detected, they disable the activation code in their database, and the next time that copy phone home, it disable itself. All this after contacting the original customer, giving him a new code, so not to disable the legal copy That may be one way to do it, i'm sure there are other (and better ways), but the important issue is that the legal customer can change as many ips and macs as he wants, without encoutering any problem, until the declude folks contact him, listen to him, and warn him. But we should have already been warned that changes are taking places, phonning home is already happening, and what failsafe measures are beiing considered Finaly, As always with software, there will always be someone who will reverse engineer the code and create a crack to disable the security mecanisme, that is the price of success. - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, December 24, 2004 12:40 AM Subject: RE: [Declude.JunkMail] SmarterMail move, and some complaining Also, I think it is ironic that, after most of us decided to stay with Imail because of declude, we now are getting this treatment from CPHZ. I do not understand why CPHZ expalined privatly to a few customers about what is going on, and still has not posted something on this list. Should we understand that CPHZ values some customers more than others ? Apparently, some customer were satisfied with the explanation they got. Why not post this explanation here ? I have not posted the explanation because of trust. Barry explained a bit to me knowing I would not spread it out on the Internet. I am sure the others that Barry talked to will say the same. CPHZ values all of its customers. If anything, Scott may dislike me more than others because of the volume of e-mail over time from me he receives. I must hold the record for having tabs and spaces where they do not belong. The root of the problem is, and one which has caused Declude a great deal of grief, is dishonesty and theft. There are those out there, either lurking or being malicious, that recognize Declude as a quality product and either use it without paying, or study what it does to go around it. Per Barry, Declude KNOWS that there is a humongous chunk of declude.exe files in use THAT ARE NOT LICENSED USES! That equals a major chunk of money. About a year ago, there was a lot of discussion over sharing files. I was even going to set up a web site to allow all of us to share our files to help fight this war on spam. However, I had heavy reservations of misuse and abuse. It would have to be done in one of 2 ways. 1: Create a private group where you proved who you are and then are allowed in. Many had privacy concerns about this, and how useful it would actually be. 2: It would be available to all. Problem is that means spammers could also get it, and therefore know how to get around our filters. Bottom line, there is a core group of Declude users who are known and trusted. Outside of that group, there are lurkers, spammers, users with malicious intent, thieves and so forth. The majority of those outside the group however are honest professional admins. The problem is, there is no way to tell you apart from all the bad stuff. Now please understand, the above paragraph is not meant to elevate or put down anyone. It has to do with a time honored thing called trust. (Although no matter how I put it some will take offense even though none is intended.) Therefore, Declude has to come up with a way to protect its products and name, and receive the revenue it is do for its products. Now, one suggestion that people make is to use the IP address. And all the thieves out there are going to say, lets all make our server have an address of 10.10.10.31. DOESN'T WORK! And for questions about why has not Barry posted himself, I will answer from experience: I have a character flaw. I get hot under the collar easy. When I get hot under the collar, what I say, or type, is not always the best. When I am accused of doing things that are not true, I get hot under the collar. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to
Re: [Declude.JunkMail] SmarterMail move, and some complaining
ok Scott If you say so, fine, you have our full trust At least we know you are listening Hope you'll stay here for a long time :) Merry Christmas to all - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, December 24, 2004 1:53 AM Subject: Re: [Declude.JunkMail] SmarterMail move, and some complaining We curently own Declude Virus Pro, JMPro, and Hijack, and our support contract is up to date If we decide to move from Imail to Smarter mail, do we have to pay any (declude) upgrade fee ? No, there is no upgrade fee. :) Also, I think it is ironic that, after most of us decided to stay with Imail because of declude, we now are getting this treatment from CPHZ. I personally think that the free upgrade (crossgrade?) to the SmarterMail version was a very nice gesture. I do not understand why CPHZ expalined privatly to a few customers about what is going on, and still has not posted something on this list. Should we understand that CPHZ values some customers more than others ? It is the customers that had issues with the new system that were talking to Barry. The licensing system for v2 is still being tweaked, so it would not make sense for us to describe all the details if they are not finalized yet. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude 2.0
It pays to be patient http://www.declude.com/Articles.asp?ID=122 2.00 [Beta testing - Available soon] FIX Fixes an issue where Declude could use an IP address in the E-mail body, if no IP appeared in the E-mail headers. FIX Ensures correct identification of message subject AV ADD Adds support for %REVDNS% variable to show reverse DNS entry of remote mailserver JM FIX Changes DELETE action to only delete the E-mail for recipients using the DELETE action (so it will deliver to any other recipients) JM FIX Changes logging so that all log file entries for a given E-mail will be grouped together. JM ADD Changes HOLDaction so that users can specify the directory to hold spam in. HI ADD Adds support for event logging to Declude Hijack. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] They should try declude :)
They will save an entire department SINGAPORE (AP) -- Forget trying to flood Bill Gates' e-mail inbox with junk. The Microsoft Corp. chairman receives 4 million e-mails a day, but practically an entire department at the company he founded is dedicated to ensuring that nothing unwanted gets into his inbox, the company's chief executive said Thursday. There are two people who probably are the number one spam recipients in the world, Steve Ballmer said. Bill Gates (is first) because he is Bill Gates. Bill literally receives four million pieces of e-mail per day, most of it spam. Spam or junk e-mails are unsolicited messages, generally advertising goods or services and usually sent to many e-mail accounts simultaneously, often indiscriminately. Ballmer said Microsoft has special technology that just filters spam intended for Gates. Literally there's a whole department almost that takes care of it, he said. Ballmer did not name the second most-spammed e-mail account, but said he also ranks among the world's top spam recipients because he hands out his e-mail address -- stevebmicrosoft.com -- whenever he travels or speaks. But being one of the top people at the world's top software company has its perks. Ballmer said only about 10 junk e-mails make it through to his inbox each day because of Microsoft's anti-spam technology. He was in Singapore for the company's Government Leader's forum, which ends Friday. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is DNSStuff Down?
OK, That was TESTSFAILED END CONTAINS SNIFFER TESTSFAILED 0 CONTAINS WEIGHT20 Does not seems the weight tests are processed until everything else is processed Am i correct ? if that is the case, the above will not work, even if the filter is AFTER the Weight20 test in global.cfg can anyone confirm ? scott, how can we trigger a filter if the curent weight is above XX ? is there something like %WEIGHT% 0 GE 20 ? :) (GE Greater or equal) - Original Message - From: Serge [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, November 13, 2004 1:31 AM Subject: Re: [Declude.JunkMail] Is DNSStuff Down? Hi i set the following filter to collect spam messages that are not caught by sniffer not working does the testfailed work on weight test ? If not, how to change the filter to do what I need ? TESTFAILED END CONTAINS SNIFFER TESTFAILED 0 CONTAINS WEIGHT20 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is DNSStuff Down?
Hi i set the following filter to collect spam messages that are not caught by sniffer not working does the testfailed work on weight test ? If not, how to change the filter to do what I need ? TESTFAILED END CONTAINS SNIFFER TESTFAILED 0 CONTAINS WEIGHT20 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is DNSStuff Down?
what i am trying is to copy these messages to a mailbox for further review to help me understand and fine tune my weighing, with the message still going to the final recipient. but i am also interested in automaticaly forwarding to sniffer, now that you mention it :) - Original Message - From: Bill Landry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, November 13, 2004 2:14 AM Subject: Re: [Declude.JunkMail] Is DNSStuff Down? - Original Message - From: Serge [EMAIL PROTECTED] i set the following filter to collect spam messages that are not caught by sniffer not working does the testfailed work on weight test ? If not, how to change the filter to do what I need ? TESTFAILED END CONTAINS SNIFFER TESTFAILED 0 CONTAINS WEIGHT20 Serge, are you trying to setup automatic forwarding to SortMonster of spam messages over a certain weight that were not flagged by Sniffer? If so, I can tell you how I do this. If not, what are you trying to accomplish? Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is DNSStuff Down?
Thanks bill - Original Message - From: Bill Landry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, November 13, 2004 3:17 AM Subject: Re: [Declude.JunkMail] Is DNSStuff Down? - Original Message - From: Serge [EMAIL PROTECTED] what i am trying is to copy these messages to a mailbox for further review to help me understand and fine tune my weighing, with the message still going to the final recipient. First, the TESTSFAILED location parameter is supported in filter files. I think your problem is that you are missing the second s in TESTS. but i am also interested in automaticaly forwarding to sniffer, now that you mention it :) The first thing you need to do before setting up auto-forwarding of messages to SortMonster is to ask them to setup a special spam-trap account for you that you can forward these messages to (they will assign you a specific e-mail address to use). In your global.cfg, setup a specific weight test for special handling of messages over a certain weight: WEIGHT-SPAMBOX weight x x 36 0 In your $declude$.junkmail file, create a new ROUTETO action for this weight test: WEIGHT-SPAMBOX ROUTETO [EMAIL PROTECTED] The configuration of the IMail spambox account is as follows: 1. Create the spambox e-mail account 2. Create two inbound filter rules for this account a. Click Add on the Inbound Rules tab i) Select Rule: If Header Text ii) Select Contains radial button III) Search Text: SNIFFER iv) Check Match Case v) Click Ok vi) Select the Delete radial button b. Click Add again on the Inbound Rules tab i) Select Rule: If Header Text ii) Select Does not Contain radial button III) Search Text: SNIFFER iv) Check Match Case v) Click Ok vi) Select the Forward radial button vii) Enter the special e-mail address SortMonster assigns to you in the Address field c. Click Apply All messages forwarded to this spambox account by Declude JunkMail that contain the work SNIFFER in the headers will be deleted. All messages that do not contain a the word SNIFFER in the headers will be forwarded to the special e-mail address assigned to you by SortMonster. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] 2 actions
If a message results in both a copy and a hold action, will the copy execute ? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 2 actions
is there a workarround ? - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 11, 2004 10:04 PM Subject: Re: [Declude.JunkMail] 2 actions If a message results in both a copy and a hold action, will the copy execute? Yes, but not the way you want. The COPYTO action will execute -- Declude JunkMail will tell IMail to add an extra recipient. But the HOLD action will also execute, which prevents the E-mail from being delivered. That will prevent both the original recipient(s) from receiving the E-mail, as well as the COPYTO address. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Pb with Imail1.exe
Hi Scott, Below are 2 headers sent by Imail1.exe v8.12 1- Why did only one fail the HELOBOGUS test and not the other ? they both do not have HELO/EHLO in the heading (or i am missing something). 2- When will declude fix the problem of using the first IP in the BODY as the remote IP ? 3- How to resolve the HELOBOGUS issue when using Imail1.exe ? TIA Date: Wed, 10 Nov 2004 20:36:45 + Message-Id: [EMAIL PROTECTED] Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii From: Postmaster [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Sniffer update on MAIL X-Mailer: IMail v8.12 X-RBL-Warning: HELOBOGUS: Domain returns a server failure for MX or A records. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: SIZE-S: Message failed SIZE-S: 11. X-Declude-Sender: [EMAIL PROTECTED] [216.88.37.61] X-Declude-Spoolname: D7bdd2194fda5.GSC Organization: CEFIB Internet (Incoming) X-CEFIB-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-CEFIB-Note: Declude version: 1.81 X-CEFIB-Note: Spam-Tests-Failed: HELOBOGUS [7], IPNOTINMX [0], NOLEGITCONTENT [0], SIZE-S [0], CATCHALLMAILS [0] X-CEFIB-Note: weight: 7 X-CEFIB-Note: This E-mail was sent from ([216.88.37.61]). X-CEFIB-Note: Country Chain: X-CEFIB-Note: MailFrom: [EMAIL PROTECTED] X-RCPT-TO: efib.com Status: U X-UIDL: 376453823 * Date: Wed, 10 Nov 2004 20:20:06 + Message-Id: [EMAIL PROTECTED] Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii From: Postmaster [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Sniffer update on MAIL X-Mailer: IMail v8.12 X-RBL-Warning: SPFFAIL: SPF returned FAIL for this E-mail. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: SIZE-S: Message failed SIZE-S: 11. X-Declude-Sender: [EMAIL PROTECTED] [216.88.37.61] X-Declude-Spoolname: D77f63608bf5d.GSC Organization: CEFIB Internet (Incoming) X-CEFIB-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-CEFIB-Note: Declude version: 1.81 X-CEFIB-Note: Spam-Tests-Failed: SPFFAIL [8], IPNOTINMX [0], NOLEGITCONTENT [0], SIZE-S [0], CATCHALLMAILS [0] X-CEFIB-Note: weight: 8 X-CEFIB-Note: This E-mail was sent from ([216.88.37.61]). X-CEFIB-Note: Country Chain: X-CEFIB-Note: MailFrom: [EMAIL PROTECTED] X-RCPT-TO: efib.com Status: U X-UIDL: 376453822 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
