I have reported between 5 and 10 I guess.
Sniffer get some of them.
Cordially,
Heimir Eidskrem
i360, Inc.
2825 Wilcrest, Suite 675
Houston, TX 77042
Ph: 713-981-4900
Fax: 832-242-6632
[EMAIL PROTECTED]
www.i360.net
www.i360hosting.com
www.realister.com
Houston's Leading Internet Consulting
Nice, bouncing spam..
Good job...
Original Message
Subject:RE: Re: [sniffer] Damn viagra spam
Date: Wed, 14 Sep 2005 13:08:46 -0700
From: [EMAIL PROTECTED]
Reply-To: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
MDaemon has identified your message as spam
to the spam problem.
Darin.
- Original Message -
From: Russ Lists [EMAIL PROTECTED]
To: sniffer@SortMonster.com
Sent: Wednesday, September 14, 2005 3:53 PM
Subject: Re: [sniffer] Damn viagra spam
Heimir Eidskrem wrote:
We are getting tons of spam for viagra and other drugs.
Not being
ty jay
- Original Message -
From: Jay Sudowski - Handy Networks LLC [EMAIL PROTECTED]
To: sniffer@SortMonster.com
Sent: Monday, September 12, 2005 3:22 AM
Subject: RE: [sniffer] OT test settings
DSBL ip4r list.dsbl.org *
15 0
MXRATE-BLACKip4r pub.mxrate.net 127.0.0.2 15
To: Ali Resting
Subject: Re: [sniffer] False positive
On Friday, September 9, 2005, 2:17:31 AM, Ali wrote:
AR Hi Peter,
AR I have submited 3 email to [EMAIL PROTECTED] with all the required
AR fields as per you instaructions on the website, I have not received
any
AR feedback whether
DSBLip4rlist.dsbl.org *
15 0
MXRATE-BLACKip4r pub.mxrate.net 127.0.0.2 15
0
SBLXBL4 ip4rxbl.spamhaus.org127.0.0.4
15 0
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Here is another copy of my initial reply.
_M
On Friday, September 9, 2005, 2:17:31 AM, Ali wrote:
AR Hi Peter,
AR I have submited 3 email to [EMAIL PROTECTED] with all the required
AR fields as per you instaructions on the website, I have not received any
AR feedback whether this request has
On Friday, September 9, 2005, 2:17:31 AM, Ali wrote:
Apologies to the list... I intended to send those responses directly.
_M
This E-Mail came from the Message Sniffer mailing list. For information and
(un)subscription instructions go to
]
To: sniffer@SortMonster.com
Sent: Thursday, September 08, 2005 11:48 AM
Subject: Re: [sniffer] Sniffer Resources
It was suggested that I put AVAFTERJM in my Declude configuration and that
has made a huge difference...I have my old server back...I hope this does
not cause other problems..we
How does AVAFTERJM help? Unless you had JunkMail delete the message it
would seem that it has to be scanned for viruses either way.
This is more appropriate on the Declude list - but with that said you are
correct in order for it to make a major impact you need to have actions that
either
Pete,
Perfect. I will work on setting up this account for you. What email
address can I use to send over the POP info?
Keith
From: [EMAIL PROTECTED] on behalf of Pete McNeil
Sent: Tue 9/6/2005 11:00 PM
To: Keith Johnson
Subject: Re: [sniffer
, September 05, 2005 9:43 AM
Subject: Re: [sniffer] Integration with today's new ORF version:
On Monday, September 5, 2005, 9:26:38 AM, Andy wrote:
AS http://www.vamsoft.com/orf/agentdefs.asp
AS
AS It says to contact vendor. Here I am G.
Yes indeed.
How may I help you?
_M
This E-Mail came
1.800.548.3877 Tech Support
Crossroads to a Cleaner Internet
- Original Message -
From: Pete McNeil [EMAIL PROTECTED]
To: Andy Schmidt sniffer@SortMonster.com
Sent: Monday, September 05, 2005 9:43 AM
Subject: Re: [sniffer] Integration with today's new ORF version:
On Monday, September 5
On Monday, September 5, 2005, 9:26:38 AM, Andy wrote:
AS http://www.vamsoft.com/orf/agentdefs.asp
AS
AS It says to contact vendor. Here I am G.
Yes indeed.
How may I help you?
_M
This E-Mail came from the Message Sniffer mailing list. For information and
(un)subscription instructions go
-9206
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Pete McNeil
Sent: Monday, September 05, 2005 10:43 AM
To: Andy Schmidt
Subject: Re: [sniffer] Integration with today's new ORF version:
On Monday, September 5, 2005, 9:26:38 AM, Andy wrote:
AS http
I'm not sure what this means.
Is SortMonster being acquired by ARM Research Labs? Vice versa? Just joint
venture?
Sure hope that a plugin to SmarterMail is just around the corner!
-Joe
- Original Message -
From: Pete McNeil [EMAIL PROTECTED]
To: sniffer@sortmonster.com
Sent:
On Thursday, September 1, 2005, 9:12:17 AM, Rick wrote:
RR I'm using Sniffer with MXGuard, and Ipswitch Imail Server.
RR
RR For accounts who have auto-forwarding setup to transfer mail
RR to a remote mail account, I've noticed that they're transferring
RR all mail, including detectable
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Rick Robeson
Sent: Thursday, September 01, 2005 1:17 PM
To: sniffer@SortMonster.com
Subject: RE: [sniffer] can auto-forward be disabled when spam
is detected?
I think I see the problem, though not a quick
]
[mailto:[EMAIL PROTECTED] Behalf Of Craig Deal
Sent: Thursday, September 01, 2005 11:43 AM
To: sniffer@SortMonster.com
Subject: RE: [sniffer] can auto-forward be disabled when spam is
detected?
You can change your rules to forward spam to separate user quarantine
mailbox (not a subfolder or sub
Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Rick Robeson
Sent: Thursday, September 01, 2005 1:54 PM
To: sniffer@SortMonster.com
Subject: RE: [sniffer] can auto-forward be disabled when spam
is detected?
How would that address the fact that imail processes
On Sunday, August 28, 2005, 9:02:05 AM, Serge wrote:
S Hi Pete
S Having problems with my downloaded files not testing ok since friday
S please check, and also let me know if my subscription expired
Nothing has changed on this side and your subscription is up to date.
Renewal time is 2005-11-08.
Usually I
have found this to be due to a rule in the Content Filter. One of the nice
features about MDaemon logging is that every function has its own log. If
you check your Content-Filter log for the date/time of that message, it will
tell you why it was rejected. If it is not in the
: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jorge Asch
Sent: Sunday, August 21, 2005 4:28 PM
To: sniffer@SortMonster.com
Subject: Re: [sniffer] Headers showing up in message body after
switching to Mdaemon
I am using the latest version of MDaemon and the Sniffer plugin and I
can say I
Subject: RE: [sniffer] Headers showing up in message body after switching to
Mdaemon - solution
I encountered the same problem when I activated the XHeader... options.
MDaemon 8.x doesn't like the fact that the X-header didn't have a colon
with
a value following. I rectified the problem
Has anyone ran into this? Any thoughts?I haven't noticed this. I assumer you're using the plugin? I've been using the plugin since 0.1 I think (I was an alpha tester you can say) and I neer noticed those problems you are referring to.-- Jorge Asch RevillaCONEXION DCRwww.conexion.co.cr800-CONEXION
Asch
To: sniffer@SortMonster.com
Sent: Wednesday, August 24, 2005 11:48
AM
Subject: Re: [sniffer] Spam Messages held
in the Bad Message Queue Mdaemon/Sniffer
Has anyone ran into this?
Any thoughts?
I haven't noticed this. I assumer you're using the plugin? I've been
We use both MailEnable and SmarterMail having come from
iMail a couple of years back. You're right, MailEnable does not have any
connectivity to Sniffer or MessageExchange even though it has the MTA, but of course
SmarterMail does.
It would be great if there were plans to introduce
, 2005 4:31
AM
Subject: RE: [sniffer]
MailEnable+sniffer?
We use both MailEnable and SmarterMail having come from
iMail a couple of years back. You're right, MailEnable does not have any
connectivity to Sniffer or MessageExchange even though it has the MTA, but of
course SmarterMail
Same here, MD 8.11 and Sniffer (running from Content Filter) and NOT seeing
the reported behaviour.
Michiel
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Jorge Asch
Sent: zondag 21 augustus 2005 22:28
To: sniffer@SortMonster.com
Subject: Re: [sniffer
We are using Imail/Declude and I have seen this in several messages too.
A part of the header is showing up in the message usually as the last
part of the body content.
I will see if I can find some and send it.
Heimir
Jim Matuska wrote:
Yes, something is going on weird in Mdaemon. The
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Heimir Eidskrem
Sent: Saturday, August 20, 2005 8:43 AM
To: sniffer@SortMonster.com
Subject: Re: [sniffer] Headers showing up in message body after switchingto
Mdaemon
We are using Imail/Declude and I have seen
On Friday, August 19, 2005, 11:22:32 AM, Jim wrote:
JM I'm not sure if this is related to sniffer or related to
JM Mdaemon, but just after the switch all sniffer update
JM notifications have the following headers visible in the message
JM body rather than hidden in the headers. I also am
Pete,
The switch in question was from Imail to Mdaemon,
so far so good other than a few misc bugs, I like the Mdaemon Sniffer
integration much better than the declude integration. Thanks for the info,
that was where I was leaning towards too, It's mainly an asthetic thing though,
so I'm not
/2005 10:02 AM
To: sniffer@SortMonster.com
Subject: Re: [sniffer] false positives which catagories?
I have my sniffer result histories by category posted at:
http://it.farmprogress.com/declude/Testsbymonth.html
Look about 90% down the page.
- Original Message -
From
measurement.
Darin.
- Original Message -
From: Keith Johnson [EMAIL PROTECTED]
To: sniffer@SortMonster.com
Sent: Thursday, August 11, 2005 8:13 AM
Subject: RE: [sniffer] false positives which catagories?
Scott,
HS = Test says ham, final result was spam. This is an inaccurate ham
I'm pretty sure the rule that caused your trouble has been removed.
_M
On Thursday, August 4, 2005, 7:24:09 PM, Robert wrote:
RM After two attempts to email support and two attempts to
RM register a real false positive to [EMAIL PROTECTED], I would be
RM really grateful for some
Ping?
Pong.
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Robert
MathiasSent: Thursday, August 04, 2005 3:59 PMTo:
sniffer@SortMonster.comSubject: [sniffer] Test
Apologies, but need
to test.
Robert
We do respond to all false reports that are made to us if we can
properly identify the sender - and often even if that is not the case.
I will research this further and contact you off list.
Thanks,
_M
On Thursday, August 4, 2005, 7:24:09 PM, Robert wrote:
RM After two attempts to
OK, I have managed to get SOMETHING working, but it still seems too slow
and something is still not right. I originally set up the persistent
sniffer using the instructions from this post:
http://www.mail-archive.com/sniffer@sortmonster.com/msg00169.html
This uses SRVANY.exe. I conjectured
Dan,
I seem to recall trying to use the AppParameters key and having
difficulty with it. I think that you might want to try removing that
key and putting everything in the Parameters key, or at least that
works for me. If you change
.
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
MattSent: Tuesday, August 02, 2005 2:37 PMTo:
sniffer@SortMonster.comSubject: Re: [sniffer] Sniffer taking a long
time?
Dan,I seem to recall trying to use the AppParameters key
and having difficulty with it. I
ter adding that value and
starting the service those files appeared.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of MattSent: Tuesday, August 02, 2005 3:24
PMTo: sniffer@SortMonster.comSubject: Re: [sniffer]
Sniffer taking a long time?
Dan,There is no AppDirectory v
Without regard to content I believe the edits would be made in
CurrentControlSet - not in ControlSetxxx - the later are the backups.
-Nick
Matt wrote:
Dan,
I seem to recall trying to use the AppParameters key and having
difficulty with it. I think that you might want to try removing
You are correct. My bad.
Matt
Nick Hayer wrote:
Without regard to content I believe the edits would be made in
CurrentControlSet - not in ControlSetxxx - the later are the backups.
-Nick
Matt wrote:
Dan,
I seem to recall trying to use the AppParameters key and having
PROTECTED]] On
Behalf Of Matt
Sent: Tuesday, August 02, 2005 2:37 PM
To: sniffer@SortMonster.com
Subject: Re: [sniffer] Sniffer taking a long time?
Dan,
I seem to recall trying to use the AppParameters key and having
difficulty with it. I think that you might want to tr
: Re: [sniffer] FireDaemon
The newest version is not a free version. Older
versions gave you one service for free. The new one does not. Got a
license?
David Payer
- Original Message -
From:
Greg Wanner
To: sniffer@sortmonster.com
Sent: Sunday, July
Here are the sniffer log entries for each of the messages, if that helps
any:
08/01/2005 11:32:51.747 Q40a201cc1a59 SNIFFER: External program
started: M:\IMail\Sniffer2\Distribution\Winx\mysniffer.exe
mysnifferauthcode S:\imail\spool\D40a201cc1a59.SMD
08/01/2005 11:33:46.751
@SortMonster.com
Subject: RE: [sniffer] Sniffer taking a long time?
Here are the sniffer log entries for each of the messages, if
that helps
any:
08/01/2005 11:32:51.747 Q40a201cc1a59 SNIFFER: External program
started: M:\IMail\Sniffer2\Distribution\Winx\mysniffer.exe
to a minute.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dan Horne
Sent: Monday, August 01, 2005 11:58 AM
To: sniffer@SortMonster.com
Subject: RE: [sniffer] Sniffer taking a long time?
Here are the sniffer log entries for each of the messages
, 2005 7:01 PM
Subject: Re: [sniffer] FireDaemon
On Sunday, July 31, 2005, 6:43:36 PM, Greg wrote:
GW Can anybody help me with a problem getting the persistent
GW mode to work with FireDaemon. I loaded the latest version, 1.7.
GW I believe I have everything setup correctly, the right .exe name
The newest version is not a free version. Older
versions gave you one service for free. The new one does not. Got a
license?
David Payer
- Original Message -
From:
Greg Wanner
To: sniffer@sortmonster.com
Sent: Sunday, July 31, 2005 5:43 PM
Subject: [sniffer]
: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of David
PayerSent: Sunday, July 31, 2005 5:16 PMTo:
sniffer@SortMonster.comSubject: Re: [sniffer]
FireDaemon
The newest version is not a free version. Older
versions gave you one service for free. The new one does not. Got
I'm on updates this evening. I'll watch for this. It sounds
like something that requires an abstract rule --- probably
not enough content for the other coders to try it safely... I
am surprized I didn't hear about it though...
Please send me another note with a few of these as
I weight sniffer high enough to hold the message on its own. We use it
as our blacklist and it works great. We get some false positives, but
we whitelist those and move on. Our users forward all spam received in
their inbox to an email address that the sniffer system checks
automatically. It
Iset up declude to delete if it fails sniffer.
[EMAIL PROTECTED] 07/20/05 09:16AM
To other Declude users with Sniffer:
I currently tag subject lines at 10 and delete at 20. Sniffer results are
scored at 9. No two tests currently result in more than 18 and therefore it
takes three failed
Hi John,
I do not.
As you I score some sniffer tests at 9 and tag the subject at 10. I do
occasionaly see fp's with sniffer - particulary with legit newsletters.
So what I have done is leave sniffer where it is and combo it up with
other tests to push it to and over the 10 threshold.
-Nick
on 7/20/05 9:44 AM, Jonathan Schoemann wrote:
Question: Do any of you tag subject lines based on Sniffer alone? My main
problem is that some of my users delete based on the tagged subject line.
I weight each category in Sniffer differently. Some messages are deleted by
Sniffer alone, some
Hi,
I currently tag subject lines at 10 and delete at 20. Sniffer results are
scored at 9. No two tests currently result in more than 18 and therefore
it
takes three failed tests to delete.
I tag at 12, hold on 20 and delete on 27.
Sniffer is at 19, just 1 under hold.
If anything agrees
for
evaluation. Am I missing something at the Sortmonster or Declude web sites?
Thanks again,
John
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of System Administrator
Sent: Wednesday, July 20, 2005 9:38 AM
To: Sniffer
Subject: Re: [sniffer] Declude and Sniffer
on 7/20/05 11:06 AM, John Carter wrote:
I have seen and understand the various Core
Rule Group Result Codes, but am not sure how to separate those out for
evaluation.
In your global.cfg add lines like the sniffer-scams line below
test name - category
Thanks, that helps a lot. Didn't understand the replace nonzero with the
weight number in the Global file.
John
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of System Administrator
Sent: Wednesday, July 20, 2005 10:27 AM
To: Sniffer
Subject: Re
On Tuesday, July 19, 2005, 3:04:28 PM, Chuck wrote:
CS Pete:
CS Could you post where to send notifications like false positives. I had that
CS info but I seem to have misplaced it.
For off-list support questions send your note to our support@ address.
Submit your false positives to our false@
pure-speculation
There is a lot of symantec spam out there (that looks like it's not
from them of course)... It's possible that something used in one of
those made it into their auto confirm, or that a robot picked
something up in a cross reference on a trap.
/pure-speculation
The only way to
, June 16, 2005 6:44
PM
Subject: Re: [sniffer] Spam blocks
loading me up with spam
Scott,
Not to many incoming for me - about 200 out of
about 125K messages. One thing to note is the ones I am getting are
around that block but even lower like 200.49.44.x.
Darrell
MAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of Scott FisherSent: Thursday, June 16, 2005 4:20
PMTo: sniffer@SortMonster.comSubject: Re: [sniffer] Spam
blocks loading me up with spam
I'm also taking out the: 200.49.32.xxx to
200.49.47.xxx addresses with my IPFILE. Most of them
Title: Message
I
haven't noticed this spam leaking through, but at your prompting I did
a:
egrep
".+From: .+To: .+IP: 200\.49\." dec0616.log
and
saw about 46. A glance through these to:from:ip: lines definitely shows
messages that fit your description, along with messages that don't (I'm
Title: Message
Also,
thedomains in the body textare not hitting on SURBL
tests.
Andrew
8)
-Original Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of Colbeck, AndrewSent: Thursday, June 16, 2005 3:34
PMTo: sniffer@SortMonster.comSubject: RE
Title: Message
Hey Andrew,
Are yousending your logs to a UNIX box, or running a
ported version
of grep/egrep for windows?
Mike
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Colbeck,
AndrewSent: Thursday, June 16, 2005 17:34To:
sniffer@SortMonster.comSubject: RE: [sniffer
We have been seeing these.
Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Scott Fisher
Sent: Thursday, June 16, 2005 4:04 PM
To: sniffer@SortMonster.com
Subject: [sniffer] Spam blocks loading me up
Scott,
Not to many incoming for me - about 200 out of
about 125K messages. One thing to note is the ones I am getting are around
that block but even lower like 200.49.44.x.
Darrell
---Check out http://www.invariantsystems.com for
utilities for
Hello,
I was having this problem and found that I
did not have these files in place.
Send-rotate.cmd
Send-stop.cmd
Send-reload.cmd
This would not explain your being able to
execute the process manually though
Sincerely,
Brian W. Packham
Orange County Online, Inc.
Have you checked out ImailSnifferUpdateTools.zip?
It contains detailed instructions and can be downloaded from http://www.sortmonster.com/MessageSniffer/Help/AutomatingUpdatesHelp.html
Bill
From: Glenn \ WCNet [mailto:[EMAIL PROTECTED]
Sent: Wednesday, June 15, 2005 12:43 PMTo:
That is what I'm using. I tried editing the .cmd file to do away
with the variables and hard-wire my parameters into it. It works
either way (before or after eliminating the variables) when executed
manually. It does not work via Program Alias -- my .snf file does
not change when an
folder
(directory) which isn't required but happens to be the way I chose to do it.
George
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Brad Morgan
Sent: Wednesday, June 15, 2005 4:54 PM
To: sniffer@SortMonster.com
Subject: RE: [sniffer] Auto Sniffer
:06 PM
Subject: RE: [sniffer] Auto Sniffer Updates
You might want to try the following which resolved this problem for me (a
while ago)
1. The IMail program alias is: c:\Sniffer\snfupd.bat
2. I created a .bat file which is:
echo off
cd\ c:\sniffer
snfupd.cmd
All of my Sniffer programs and files
Sent: Wednesday, June 15, 2005 5:31 PM
To: sniffer@SortMonster.com
Subject: Re: [sniffer] Auto Sniffer Updates
Well blow me down. That did the trick, least-wise it does for triggering by
a test message! I'll know for sure when the next notification arrives.
Thanks!!!
G.Z.
- Original
if there are other Program Aliases that happen to trigger at the
same time, but I don't have that situation so it should be OK.
G.Z.
- Original Message -
From: George Kulman [EMAIL PROTECTED]
To: sniffer@SortMonster.com
Sent: Wednesday, June 15, 2005 4:54 PM
Subject: RE: [sniffer] Auto Sniffer Updates
Strange, the script does not leave any temp files in my spool directory.
Bill
-Original Message-
From: George Kulman [mailto:[EMAIL PROTECTED]
Sent: Wednesday, June 15, 2005 2:55 PM
To: sniffer@SortMonster.com
Subject: RE: [sniffer] Auto Sniffer Updates
There seemed to be a problem
: Glenn \ WCNet [mailto:[EMAIL PROTECTED]
Sent: Wednesday, June 15, 2005 2:31 PM
To: sniffer@SortMonster.com
Subject: Re: [sniffer] Auto Sniffer Updates
Well blow me down. That did the trick, least-wise it does for triggering by
a test message! I'll know for sure when the next notification arrives
On Monday, June 6, 2005, 5:13:19 PM, Jim wrote:
JM Is anyone else seeing a huge rash of spam/virus messages in
JM the last hour or so? I have multiple users that are getting
JM messages that are forging our own addresses and have a link that
JM appears to go to our website but instead goes
o: sniffer@SortMonster.comCc:
Declude.Virus@declude.comSubject: Re: [sniffer] New Spam/Virus?
Yes I have seen them too:
email starts with:
Dear Valued Member, According to our site policy
you will have to confirm your account by the following link or else your
account will be
Was this the ip?
209.67.220.164
This is the only address I have seen -
-Nick
Scott Fisher wrote:
Yes I have seen them too:
email starts with:
Dear Valued Member,
According to our site policy you will have to confirm your
account by the following link or else
That's the one I am seeing too.
Jim Matuska Jr.Computer Tech2, CCNANez
Perce TribeInformation Systems[EMAIL PROTECTED]
- Original Message -
From:
Nick
Hayer
To: sniffer@SortMonster.com
Sent: Monday, June 06, 2005 2:42 PM
Subject: Re: [sniffer] New
Spam/Virus
Same exact IP
here!
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Nick
HayerSent: Monday, June 06, 2005 5:42 PMTo:
sniffer@SortMonster.comSubject: Re: [sniffer] New
Spam/Virus?
Was this the ip?
209.67.220.164
This is the only address I have seen -
-Nick
Scott Fisher
FYI,
This virus appears to be using multiple forms of infection. One seems
to link to the IP where you are prompted to run/download the infected
program and the others have infected attachments in the E-mail itself.
Based on reviewing my logs and spam capture file, it appears that
initially
] [mailto:[EMAIL PROTECTED] On
Behalf Of Colbeck, AndrewSent: Monday, June 06, 2005 2:41
PMTo: sniffer@SortMonster.comSubject: RE: [sniffer] New
Spam/Virus?
I'm
seeing what Scott sees, but the payload is an encrypted
zip.
VirusTotal.com says:
This is a
report processed
Sheldon,
Saturday, June 4, 2005 you wrote:
The SquirrelMail web interface is not bad although it is PHP 4.
The web admin interface is pretty good, too, and can be php 5.
SK Does this really matter for us non programmers?
It does actually. Just make sure to install the PHP 4 version
On this same thread, what can the small guy like me do now that I no
longer own my former business. I also cannot afford the Imail/Declude
solution. I have about 20 domains I host as more of a hobby, but need to
move them off my former mail server soon.
I see someone has said that maybe
hMailServer is free and open source.
I like it!
Once I finish the script work for calling Sniffer and the
work-around for ClamDscan and FPROT I'll post it. Clamdscan is the
service (daemon) for ClamAV. No reason that the daemon version of
Sniffer couldn't be used as well.
Have you looked at MDaemon as an
alternative?
Bill Ball
Lion Network Solutions
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Joe Wolf
Sent: Wednesday, June 01, 2005
4:11 AM
To: sniffer@SortMonster.com
Subject: [sniffer] Sniffer and
SmarterMail?
Not that you would want to do this. But declude does integrate with
smarterMail now. It has for several months.
This E-Mail came from the Message Sniffer mailing list. For information and
(un)subscription instructions go to
http://www.sortmonster.com/MessageSniffer/Help/Help.html
Joe,
Wednesday, June 1, 2005 you wrote:
JW If there's a better option than SmarterMail I'd love to hear it,
JW but I can't compare a $4000+ server to a $600 one.
hMailServer is free and open source.
Once I finish the script work for calling Sniffer and the
work-around for ClamDscan
, lists, etc.)
but I may be wrong.
Thanks,
Joe
- Original Message -
From: Smart Business Support [EMAIL PROTECTED]
To: Joe Wolf sniffer@SortMonster.com
Sent: Wednesday, June 01, 2005 8:55 PM
Subject: Re: [sniffer] Sniffer and SmarterMail?
Joe,
Wednesday, June 1, 2005 you wrote:
JW
solutions.net
David PayerOMNI Internetwww.iowalink.com
- Original Message -
From:
Bill
Ball
To: sniffer@SortMonster.com
Sent: Wednesday, June 01, 2005 5:19
PM
Subject: RE: [sniffer] Sniffer and
SmarterMail?
Have you looked at
MDaemon as an alternative?
Yes it is, at least it is now. Thanks for pointing it out.
Barry
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Marc Catuogno
Sent: Thursday, May 26, 2005 11:23 PM
To: sniffer@SortMonster.com
Subject: [sniffer] sniffer NOT a link on Declude Partners
On Wednesday, May 25, 2005, 9:11:17 AM, Computer wrote:
CHS Dear Pete,
CHS In the past few days, it seems the amount of spam getting through has
CHS increased quite a bit. I am wondering if it is necessary to upgrade to the
CHS latest version of the Declude software. Do you think this would
On Tuesday, May 17, 2005, 1:27:25 PM, Jim wrote:
JM Is anyone else seeing a huge amount of spam increase over
JM the last couple days. Most is being caught by sniffer but the
JM overall number of messages especial foreign language spam messages
JM seems to be very high.
You are probably
Yes, these messages were caused by Sunday'sSober.O
and Sober.P remote update of
previouslyinfected PCs, causing them to send out millions of
neo-nazi mail. The next update (likely a new spam-wave) is scheduled in 10 days. Somepublic
mailboxes got as many as 50,000 emails in 48 hours to a
]
To: Jim Matuska sniffer@SortMonster.com
Sent: Tuesday, May 17, 2005 10:38 AM
Subject: Re: [sniffer] New Spam Storm
On Tuesday, May 17, 2005, 1:27:25 PM, Jim wrote:
JM Is anyone else seeing a huge amount of spam increase over
JM the last couple days. Most is being caught by sniffer but the
JM overall
Matuska Jr.Computer Tech2, CCNANez
Perce TribeInformation Systems[EMAIL PROTECTED]
- Original Message -
From:
Andy Schmidt
To: sniffer@SortMonster.com
Sent: Tuesday, May 17, 2005 10:41
AM
Subject: RE: [sniffer] New Spam
Storm
Yes, these messages were caused
301 - 400 of 1018 matches
Mail list logo
