[sniffer] Re: Declude header not modified correctly

[Herb Guenther]

Hi Guys; I thought I would provide a little bit of follow up on the declude issues we had been discussing.  I know that many folks use sniffer/declude/smartermail which is the setup I use so this may help others as well. 1. They will be removing the link on the declude web site talking about logging in to submit a problem and open a ticket.  That feature is not on the site. 2.  Declude has had a problem with submissions to [EMAIL PROTECTED] for the last 10 days or so in which about 10% of submitted tickets would get a reply and ticket number, but in actuality not get in the support ticket database.  This is now supposed to be fixed. 3.  The latest version of declude, 4.3.14 still does not mark some messages such as the broken graphic "love drug" spam messages correctly. It will create a new header stub at the bottom of the message file rather than modifying the existing header.  I would guess that this exploit will be used by spammers to bypass declude filtered mail. 4.  When doing a declude update in a smartermail environment the new decludeproc.exe file is not always put in the correct location.  There are two ways of determining if your update has not happened. Look at the diags.txt file in your declude folder, the time and date should corrispond to the last time you started decludeproc.exe. Declude 4.3.14 Diagnostics Compilation Platform: SmarterMail Copyright (c) 2000-2005 Declude, Inc. Host Name                             xxxxxx.xxxxxxx.xxx Daisy Chain                             DNS Server                              xxx.xxx.xxx.xxx Product Details      JunkMail                           Pro      EVA                                Pro      Hijack                             Pro Tests Defined                           31....... Make sure that the top line is for the version that you have installed. Also, look at your services, under the decludeproc service make sure that the path is where your new version is.  You can also look at your smartermail settings to see where it wants declude to live.  (Log in as the admin, go to settings/general settings/spool and you will see where it is running the declude.exe app from (note this file is about a year old and does not generally change between versions)  This is where the active declude config files will be. Hope that this helps. Herb   Herb Guenther wrote: Me either, I guess I will have to call them in the AM as it seems to be a general problem.  As an aside, I am largely happy with the product but this one has been a long term issue and seems from my experience to be getting exploited by spammers. Andy Schmidt wrote: What's the magic trick to OPENING a ticket on Declude's site. I logged into the customer area, and see no way to open a ticket. But, if I go to the support page, it specifically instructs me to log into the customer area to open a ticket? Best Regards Andy Schmidt Phone:  +1 201 934-3414 x20 (Business) Fax:    +1 201 934-9206   From: Message Sniffer Community [mailto:sniffer@sortmonster.com] On Behalf Of Herb Guenther Sent: Monday, October 16, 2006 05:58 PM To: Message Sniffer Community Subject: [sniffer] Re: Declude header not modified correctly It is frustrating because sniffer is catching them and they are not getting marked so they still end up in the ol inbox.  Have opened some tickets at declude a few times and never got a response.  So no one has a magic bullet on this one? Herb Kami Razvan wrote: We see that a lot too.. we run 2.14   Kami From: Message Sniffer Community [mailto:sniffer@sortmonster.com] On Behalf Of Darin Cox Sent: Monday, October 16, 2006 5:44 PM To: Message Sniffer Community Subject: [sniffer] Re: Significant increase in false positives We see this occasionally with Declude 1.82.  What version are you running? Darin.     ----- Original Message ----- From: Herb Guenther To: Message Sniffer Community Sent: Monday, October 16, 2006 5:35 PM Subject: [sniffer] Re: Significant increase in false positives Hi Darin; Not seeing a lot of false pos messages, but there are lots of spam messages sneaking through our system because  declude is not modifying the header correctly.  It is adding a header stub to the bottom of the message so that users mail client filters which look for the modified subject line is not working.  Anyone else having that issue? Herb -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way.