Re: [Declude.JunkMail] ATTACH Still not working. Bah.
Here's the text from the spamattach email. I would recommend trying to latest interim release, from http://www.declude.com/release/176i/declude.exe . There have been several changes in the interim release that may affect how this situation is handled. If it continues with the latest interim release, the next step will be the debug mode. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ATTACH Still not working. Bah.
OK, I did what John said last nite (with the logs set to 'high' and the spool name on) and what Scott said (use the interim release) this morning. Here's the log entry. I picked something going to me so I could say for sure it showed up in my inbox (it did, and it most definitely was spam). Set the logs to 'debug' and will follow up with a sample shortly. 11/05/2003 07:46:12 Q1ad9014900d05f2b Triggered CONTAINS filter GIBBERISHSUB on qr [weight-0; qr7]. 11/05/2003 07:46:12 Q1ad9014900d05f2b GIBBERISHSUB:3 NOABUSE:3 NOPOSTMASTER:3 REVDNS:5 . Total weight = 14 11/05/2003 07:46:12 Q1ad9014900d05f2b Using [incoming] CFG file C:\IMail\Declude\$default$.junkmail. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed GIBBERISHSUB (Message failed GIBBERISHSUB test (78)). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOPOSTMASTER (Not supporting [EMAIL PROTECTED]). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed IPNOTINMX (). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOLEGITCONTENT (No content unique to legitimate E-mail detected.). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed REVDNS (This E-mail was sent from a MUA/MTA 221.196.22.47 with no reverse DNS entry.). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed WEIGHT1319 (Total weight between 13 and 19.). Action=ATTACH. 11/05/2003 07:46:12 Q1ad9014900d05f2b L1 Message OK 11/05/2003 07:46:12 Q1ad9014900d05f2b Subject: hello1nqr7 11/05/2003 07:46:12 Q1ad9014900d05f2b From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 221.196.22.47 ID: 11/05/2003 07:46:12 Q1ad9014900d05f2b Last action = IGNORE. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ATTACH Still not working. Bah.
Look at last action, Ignore. Is there a White list anywhere that could affect that? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Matt Robertson Sent: Wednesday, November 05, 2003 7:58 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] ATTACH Still not working. Bah. OK, I did what John said last nite (with the logs set to 'high' and the spool name on) and what Scott said (use the interim release) this morning. Here's the log entry. I picked something going to me so I could say for sure it showed up in my inbox (it did, and it most definitely was spam). Set the logs to 'debug' and will follow up with a sample shortly. 11/05/2003 07:46:12 Q1ad9014900d05f2b Triggered CONTAINS filter GIBBERISHSUB on qr [weight-0; qr7]. 11/05/2003 07:46:12 Q1ad9014900d05f2b GIBBERISHSUB:3 NOABUSE:3 NOPOSTMASTER:3 REVDNS:5 . Total weight = 14 11/05/2003 07:46:12 Q1ad9014900d05f2b Using [incoming] CFG file C:\IMail\Declude\$default$.junkmail. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed GIBBERISHSUB (Message failed GIBBERISHSUB test (78)). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOPOSTMASTER (Not supporting [EMAIL PROTECTED]). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed IPNOTINMX (). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOLEGITCONTENT (No content unique to legitimate E-mail detected.). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed REVDNS (This E-mail was sent from a MUA/MTA 221.196.22.47 with no reverse DNS entry.). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed WEIGHT1319 (Total weight between 13 and 19.). Action=ATTACH. 11/05/2003 07:46:12 Q1ad9014900d05f2b L1 Message OK 11/05/2003 07:46:12 Q1ad9014900d05f2b Subject: hello1nqr7 11/05/2003 07:46:12 Q1ad9014900d05f2b From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 221.196.22.47 ID: 11/05/2003 07:46:12 Q1ad9014900d05f2b Last action = IGNORE. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ATTACH Still not working. Bah.
I do have an external whitelist, but it consists of stuff like WHITELIST FROM @amazon.com WHITELIST FROM @ebay.com WHITELIST FROM @expedia.com And is a total of 22 entries long. Then I have AUTOWHITELIST ON so my users can make their own white lists. There are only two entries in my book (aliases.txt), and of course this is affecting everyone; not just me. Interestingly, there appears to be a blank line in my address book drop-down; both in the selector in the Compose window and in the addr book editor. I tried deleting it in the editor but no soap. Supposed to be there? The line -- which is on the first position in the webmail drop-down -- is not in the physical file. Looks like its built in to Imail's html select box for some reason. I also have WHITELIST AUTH set in global.cfg. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Wednesday, November 05, 2003 8:27 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] ATTACH Still not working. Bah. Look at last action, Ignore. Is there a White list anywhere that could affect that? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Matt Robertson Sent: Wednesday, November 05, 2003 7:58 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] ATTACH Still not working. Bah. OK, I did what John said last nite (with the logs set to 'high' and the spool name on) and what Scott said (use the interim release) this morning. Here's the log entry. I picked something going to me so I could say for sure it showed up in my inbox (it did, and it most definitely was spam). Set the logs to 'debug' and will follow up with a sample shortly. 11/05/2003 07:46:12 Q1ad9014900d05f2b Triggered CONTAINS filter GIBBERISHSUB on qr [weight-0; qr7]. 11/05/2003 07:46:12 Q1ad9014900d05f2b GIBBERISHSUB:3 NOABUSE:3 NOPOSTMASTER:3 REVDNS:5 . Total weight = 14 11/05/2003 07:46:12 Q1ad9014900d05f2b Using [incoming] CFG file C:\IMail\Declude\$default$.junkmail. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed GIBBERISHSUB (Message failed GIBBERISHSUB test (78)). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOPOSTMASTER (Not supporting [EMAIL PROTECTED]). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed IPNOTINMX (). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOLEGITCONTENT (No content unique to legitimate E-mail detected.). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed REVDNS (This E-mail was sent from a MUA/MTA 221.196.22.47 with no reverse DNS entry.). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed WEIGHT1319 (Total weight between 13 and 19.). Action=ATTACH. 11/05/2003 07:46:12 Q1ad9014900d05f2b L1 Message OK 11/05/2003 07:46:12 Q1ad9014900d05f2b Subject: hello1nqr7 11/05/2003 07:46:12 Q1ad9014900d05f2b From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 221.196.22.47 ID: 11/05/2003 07:46:12 Q1ad9014900d05f2b Last action = IGNORE. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ATTACH Still not working. Bah.
Matt: Not related to your question but... I highly recommend that you reconsider your WHITELIST FROM entries. We have the following instead. WHITELIST REVDNS .amazon.com WHITELIST REVDNS .ebay.com WHITELIST REVDNS .expedia.com As has been discussed in the list quite a lot lately, the above is much harder to forge. What you have will cause you get a lot of spam from the spammers that just use [EMAIL PROTECTED] Just an FYI. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Robertson Sent: Wednesday, November 05, 2003 11:54 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] ATTACH Still not working. Bah. I do have an external whitelist, but it consists of stuff like WHITELIST FROM @amazon.com WHITELIST FROM @ebay.com WHITELIST FROM @expedia.com And is a total of 22 entries long. Then I have AUTOWHITELIST ON so my users can make their own white lists. There are only two entries in my book (aliases.txt), and of course this is affecting everyone; not just me. Interestingly, there appears to be a blank line in my address book drop-down; both in the selector in the Compose window and in the addr book editor. I tried deleting it in the editor but no soap. Supposed to be there? The line -- which is on the first position in the webmail drop-down -- is not in the physical file. Looks like its built in to Imail's html select box for some reason. I also have WHITELIST AUTH set in global.cfg. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Wednesday, November 05, 2003 8:27 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] ATTACH Still not working. Bah. Look at last action, Ignore. Is there a White list anywhere that could affect that? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Matt Robertson Sent: Wednesday, November 05, 2003 7:58 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] ATTACH Still not working. Bah. OK, I did what John said last nite (with the logs set to 'high' and the spool name on) and what Scott said (use the interim release) this morning. Here's the log entry. I picked something going to me so I could say for sure it showed up in my inbox (it did, and it most definitely was spam). Set the logs to 'debug' and will follow up with a sample shortly. 11/05/2003 07:46:12 Q1ad9014900d05f2b Triggered CONTAINS filter GIBBERISHSUB on qr [weight-0; qr7]. 11/05/2003 07:46:12 Q1ad9014900d05f2b GIBBERISHSUB:3 NOABUSE:3 NOPOSTMASTER:3 REVDNS:5 . Total weight = 14 11/05/2003 07:46:12 Q1ad9014900d05f2b Using [incoming] CFG file C:\IMail\Declude\$default$.junkmail. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed GIBBERISHSUB (Message failed GIBBERISHSUB test (78)). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOPOSTMASTER (Not supporting [EMAIL PROTECTED]). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed IPNOTINMX (). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOLEGITCONTENT (No content unique to legitimate E-mail detected.). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed REVDNS (This E-mail was sent from a MUA/MTA 221.196.22.47 with no reverse DNS entry.). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed WEIGHT1319 (Total weight between 13 and 19.). Action=ATTACH. 11/05/2003 07:46:12 Q1ad9014900d05f2b L1 Message OK 11/05/2003 07:46:12 Q1ad9014900d05f2b Subject: hello1nqr7 11/05/2003 07:46:12 Q1ad9014900d05f2b From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 221.196.22.47 ID: 11/05/2003 07:46:12 Q1ad9014900d05f2b Last action = IGNORE. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com
RE: [Declude.JunkMail] ATTACH Still not working. Bah.
John wrote: Where was the message sent from? Various spammers all over the planet. Since this morning Scott and I have been trading detailed debug logs, and doing stuff to try to track this down. I had to sit back for a bit while a client of mine did a big mailer to their membership (I throttle down their mail xmit rate via ColdFusion, so the wait was awhile). Can't have a debug log when something like that is passing thru. Just got a reading and am passing it off to Scott. I did find that I had catchallmails enabled, although it wasn't actually doing anything. That may have been the problem. -- Original Message -- From: John Tolmachoff \(Lists\) [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 5 Nov 2003 13:02:04 -0800 I also have WHITELIST AUTH set in global.cfg. Time for a DEBUG log. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ATTACH Still not working. Bah.
Just got a reading and am passing it off to Scott. I did find that I had catchallmails enabled, although it wasn't actually doing anything. That may have been the problem. Gotcha. I just got back from a client and had not seen any update. BTW, the catchallmails has called other problems before. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ATTACH Still not working. Bah.
John wrote: BTW, the catchallmails has called other problems before. I'm not surprised. I had no idea I was running it. Must've del'd the comment by accident as I've never used the thing. Easy to fix. Unfortunately a short time after I received more of the same, so that wasn't it. :-( -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ATTACH Still not working. Bah.
Per Scott's earlier suggestion I fixed the spamattach.eml. I've gotten three of these in the last several minutes: a completely intact spam with no sign of Declude acting on it except for the headers (below). No proper 'you've got spam' attachment msgs rcvd yet What version of Declude are you running? What is the log file showing for one of these E-mails? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ATTACH Still not working. Bah.
What version of Declude? 1.76b. Downloaded it yesterday. What does the log show? See below for the latest arrival in my inbox. Included are the headers, plus Declude and Imail logs; the latter of which looks pretty normal. If I switch back to bounce they bounce as expected. Complete headers from the mailpiece: Received: from hcimail2.hostcentric.net [216.65.31.208] by msb1.mysecretbase.net with ESMTP (SMTPD32-8.02) id AFC224F002A; Tue, 04 Nov 2003 13:53:06 -0800 Received: from SMTP32-FWD by msbdesigns.com (SMTP32) id A04F4; Tue, 4 Nov 2003 16:45:45 -0500 Received: from 200-208-213-20.papalegua.com.br [200.208.213.20] by hcimail2.hostcentric.net (SMTPD32-7.15) id AE07FBF00E8; Tue, 04 Nov 2003 16:45:43 -0500 Message-ID: [EMAIL PROTECTED] From: Garry Glover [EMAIL PROTECTED] Reply-To: Garry Glover [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Fwd: attention free great offer hxx e ohzsrh Date: Tue, 04 Nov 2003 23:40:03 +0200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=B1DEFA..910.54 X-IMAIL-SPAM-VALFROM: (38731818) X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: NOPOSTMASTER: Not supporting [EMAIL PROTECTED] X-RBL-Warning: HELOBOGUS: Domain hcimail2.hostcentric.net has no MX or A records. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: SNIFFER: Message failed SNIFFER: 63. X-Declude-Sender: [EMAIL PROTECTED] [216.65.31.208] X-Note: This E-mail was sent from hcimail2.hostcentric.net ([216.65.31.208]). X-Note: This E-mail was scanned by MSB Designs Inc. Anti-Spam Services. X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, HELOBOGUS, IPNOTINMX, NOLEGITCONTENT, SNIFFER, WEIGHT1319 X-Spam-Message-Weight: 18 X-RCPT-TO: [EMAIL PROTECTED] Status: R X-UIDL: 366233215 DECLUDE LOG: --- 11/04/2003 13:54:02 Q1fc2024f002acd29 NOABUSE:3 NOPOSTMASTER:3 HELOBOGUS:5 SNIFFER:7 . Total weight = 18 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed NOPOSTMASTER (Not supporting [EMAIL PROTECTED]). Action=WARN. 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed HELOBOGUS (Domain hcimail2.hostcentric.net has no MX or A records.). Action=WARN. 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed IPNOTINMX (). Action=WARN. 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed NOLEGITCONTENT (No content unique to legitimate E-mail detected.). Action=WARN. 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed SNIFFER (Message failed SNIFFER: 63.). Action=WARN. 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed WEIGHT1319 (Total weight between 13 and 19.). Action=ATTACH. 11/04/2003 13:54:02 Q1fc2024f002acd29 L1 Message OK 11/04/2003 13:54:02 Q1fc2024f002acd29 Subject: Fwd: attention free great offer hxx e ohzsrh 11/04/2003 13:54:02 Q1fc2024f002acd29 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 216.65.31.208 ID: A04F4 IMAIL LOG: - 11:04 13:53 SMTPD(024F002A) [216.198.221.162] connect 216.65.31.208 port 3718 11:04 13:53 SMTPD(024F002A) [216.65.31.208] EHLO hcimail2.hostcentric.net 11:04 13:53 SMTPD(024F002A) [216.65.31.208] MAIL FROM:[EMAIL PROTECTED] 11:04 13:53 SMTPD(024F002A) [216.65.31.208] RCPT To:[EMAIL PROTECTED] 11:04 13:53 SMTPD(024F002A) [216.65.31.208] C:\IMail\spool\D1fc2024f002acd29.SMD 2820 11:04 13:53 SMTPD(024F002A) performing antispam checks 11:04 13:54 SMTP-(111C00F1) processing C:\IMail\spool\Q1fc2024f002acd29.SMD 11:04 13:54 SMTP-(111C00F1) ldeliver mysecretbase.com matt-main (1) [EMAIL PROTECTED] 3551 11:04 13:54 SMTP-(111C00F1) finished C:\IMail\spool\Q1fc2024f002acd29.SMD status=1 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ATTACH Still not working. Bah.
What does the log show? See below for the latest arrival in my inbox. Included are the headers, plus Declude and Imail logs; the latter of which looks pretty normal. If I switch back to bounce they bounce as expected. If you type \IMail\Declude -diag from a command prompt (without changing the path!), does it show Declude JunkMail Status: Pro version registered? Have you double-checked that the spamattach.eml file is correct? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ATTACH Still not working. Bah.
Matt, I don't know the answer, but here's another question. on these lines in your JM log: 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed WEIGHT1319 (Total weight between 13 and 19.). Action=ATTACH. 11/04/2003 13:54:02 Q1fc2024f002acd29 L1 Message OK How can it be OK and failing at the same time?? Am I misreading something here? Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ATTACH Still not working. Bah.
Yup. Pro Registered jm and std reg virus. Here's the text from the spamattach email. Message-ID: [EMAIL PROTECTED] From: Declude JunkMail [EMAIL PROTECTED] To: %ALLRECIPS% Subject: You have spam Date: %RFCDATETIME% MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=%RANDOMSTRING% This is a multi-part message in MIME format. --%RANDOMSTRING% Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 7bit You have spam! Subject:%SUBJECT% From: %MAILFROM% Tests Failed: %TESTSFAILED% To view the E-mail, just click the attachment. --%RANDOMSTRING% Content-Type: message/rfc822; name=spam.eml Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=spam.eml --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ATTACH Still not working. Bah.
Paul wrote: How can it be OK and failing at the same time?? Am I misreading something here? No, you aren't missing anything. This isn't supposed to happen. ere's a msg from 11/2, a couple of days ago. This one was a bounce as expected. The only real difference is that in $default$.junkmail the test is set to ATTACH instead of BOUNCE. I'm setting it back to bounce again to see what happens. 11/02/2003 00:16:12 Qbd3d0d5500eaf766 CBL:6 SDERB:3 SPAMCOP:6 . Total weight = 15 11/02/2003 00:16:12 Qbd3d0d5500eaf766 Msg failed CBL (Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=62.204.117.193). Action=WARN. 11/02/2003 00:16:12 Qbd3d0d5500eaf766 Msg failed SDERB (Usenet Message-ID spam source, see URL:http://www.msgid.bl.gweep.ca/.). Action=WARN. 11/02/2003 00:16:12 Qbd3d0d5500eaf766 Msg failed SPAMCOP (Blocked - see http://www.spamcop.net/bl.shtml?62.204.117.193). Action=WARN. 11/02/2003 00:16:12 Qbd3d0d5500eaf766 Msg failed IPNOTINMX (). Action=WARN. 11/02/2003 00:16:12 Qbd3d0d5500eaf766 Msg failed WEIGHT1319 (Total weight between 13 and 19.). Action=BOUNCE. 11/02/2003 00:16:12 Qbd3d0d5500eaf766 Subject: buy vicdoin at homexyxc4j 11/02/2003 00:16:12 Qbd3d0d5500eaf766 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 62.204.117.193 ID: --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ATTACH Still not working. Bah.
I wrote: I'm setting it back to bounce again to see what happens. I did and its back to normal log entries and behavior using 1.79b -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ATTACH Still not working. Bah.
Matt, something that might help track this down. Turn on the spool file name on the header like this in the Global.cfg; XSPOOLNAME ON Not saying that it is, but you could be looking at 2 different messages. By have Declude put the spool name in the header, you will know for sure. Also, put you log into HIGH so you can see which .junkmail file is being used. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Matt Robertson Sent: Tuesday, November 04, 2003 2:10 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] ATTACH Still not working. Bah. What version of Declude? 1.76b. Downloaded it yesterday. What does the log show? See below for the latest arrival in my inbox. Included are the headers, plus Declude and Imail logs; the latter of which looks pretty normal. If I switch back to bounce they bounce as expected. Complete headers from the mailpiece: Received: from hcimail2.hostcentric.net [216.65.31.208] by msb1.mysecretbase.net with ESMTP (SMTPD32-8.02) id AFC224F002A; Tue, 04 Nov 2003 13:53:06 -0800 Received: from SMTP32-FWD by msbdesigns.com (SMTP32) id A04F4; Tue, 4 Nov 2003 16:45:45 -0500 Received: from 200-208-213-20.papalegua.com.br [200.208.213.20] by hcimail2.hostcentric.net (SMTPD32-7.15) id AE07FBF00E8; Tue, 04 Nov 2003 16:45:43 -0500 Message-ID: [EMAIL PROTECTED] From: Garry Glover [EMAIL PROTECTED] Reply-To: Garry Glover [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Fwd: attention free great offer hxx e ohzsrh Date: Tue, 04 Nov 2003 23:40:03 +0200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=B1DEFA..910.54 X-IMAIL-SPAM-VALFROM: (38731818) X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: NOPOSTMASTER: Not supporting [EMAIL PROTECTED] X-RBL-Warning: HELOBOGUS: Domain hcimail2.hostcentric.net has no MX or A records. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: SNIFFER: Message failed SNIFFER: 63. X-Declude-Sender: [EMAIL PROTECTED] [216.65.31.208] X-Note: This E-mail was sent from hcimail2.hostcentric.net ([216.65.31.208]). X-Note: This E-mail was scanned by MSB Designs Inc. Anti-Spam Services. X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, HELOBOGUS, IPNOTINMX, NOLEGITCONTENT, SNIFFER, WEIGHT1319 X-Spam-Message-Weight: 18 X-RCPT-TO: [EMAIL PROTECTED] Status: R X-UIDL: 366233215 DECLUDE LOG: --- 11/04/2003 13:54:02 Q1fc2024f002acd29 NOABUSE:3 NOPOSTMASTER:3 HELOBOGUS:5 SNIFFER:7 . Total weight = 18 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed NOPOSTMASTER (Not supporting [EMAIL PROTECTED]). Action=WARN. 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed HELOBOGUS (Domain hcimail2.hostcentric.net has no MX or A records.). Action=WARN. 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed IPNOTINMX (). Action=WARN. 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed NOLEGITCONTENT (No content unique to legitimate E-mail detected.). Action=WARN. 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed SNIFFER (Message failed SNIFFER: 63.). Action=WARN. 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed WEIGHT1319 (Total weight between 13 and 19.). Action=ATTACH. 11/04/2003 13:54:02 Q1fc2024f002acd29 L1 Message OK 11/04/2003 13:54:02 Q1fc2024f002acd29 Subject: Fwd: attention free great offer hxx e ohzsrh 11/04/2003 13:54:02 Q1fc2024f002acd29 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 216.65.31.208 ID: A04F4 IMAIL LOG: - 11:04 13:53 SMTPD(024F002A) [216.198.221.162] connect 216.65.31.208 port 3718 11:04 13:53 SMTPD(024F002A) [216.65.31.208] EHLO hcimail2.hostcentric.net 11:04 13:53 SMTPD(024F002A) [216.65.31.208] MAIL FROM:[EMAIL PROTECTED] 11:04 13:53 SMTPD(024F002A) [216.65.31.208] RCPT To:[EMAIL PROTECTED] 11:04 13:53 SMTPD(024F002A) [216.65.31.208] C:\IMail\spool\D1fc2024f002acd29.SMD 2820 11:04 13:53 SMTPD(024F002A) performing antispam checks 11:04 13:54 SMTP-(111C00F1) processing C:\IMail\spool\Q1fc2024f002acd29.SMD 11:04 13:54 SMTP-(111C00F1) ldeliver mysecretbase.com matt-main (1) [EMAIL PROTECTED] 3551 11:04 13:54 SMTP-(111C00F1) finished C:\IMail\spool\Q1fc2024f002acd29.SMD status=1 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list
