Re: [Declude.JunkMail] Passed spam filters

2002-07-18 Thread R. Scott Perry


I have the following two filters set:

SUBJECT 10 CONTAINS limited time grants
SUBJECT 4 CONTAINS $
SUBJECT 4 CONTAINS ,000

However, the following message got through without triggering anything. 
Any idea why?

Subject: LIMITED TIME Grants. Up to $156,000!

The first suspect is a whitelist.

If that isn't the problem, I would ask if you have seen any of the filters 
working properly, to see if it may be a problem with the setup of the 
filters, rather than this specific E-mail.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.JunkMail] Passed spam filters

2002-07-18 Thread Scott MacLean

oops. I thought; no WAY this would be on my whitelist. Turns out I had 
lycos.com on the whitelist. Thanks.

At 08:35 AM 7/18/2002, R. Scott Perry wrote:


I have the following two filters set:

SUBJECT 10 CONTAINS limited time grants
SUBJECT 4 CONTAINS $
SUBJECT 4 CONTAINS ,000

However, the following message got through without triggering anything. 
Any idea why?

Subject: LIMITED TIME Grants. Up to $156,000!

The first suspect is a whitelist.

If that isn't the problem, I would ask if you have seen any of the filters 
working properly, to see if it may be a problem with the setup of the 
filters, rather than this specific E-mail.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.JunkMail] Permitting Mail by Word in Subject Line

2002-07-18 Thread R. Scott Perry


Is there a way with Declude I can configure to allow these automated
e-mail messages through using the Subject Line and the word Quote but
not change my weighting system? Thanks.

With the filtering in the latest beta release, this can be 
accomplished.  It would require using the weighting system, but wouldn't 
require changing the weights of any other tests.

To do this, you would need to set up a filter, and have the following line 
in it:

 SUBJECT  -10  CONTAINS  Quote

This will subtract 10 from the total weight of E-mails with Quote in the 
subject, helping counteract the weight for the yahoo.com domain, but still 
preventing some Get the best insurance quote type spam from getting 
through if it fails a lot of tests.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



[Declude.JunkMail] Newbie

2002-07-18 Thread Marv Gordon
Title: Message



Just purchased and 
people are loving it already!

Question/suggestion

1. As a new 
user I'm a little unclear if some of the questions are related to the current 
production or beta release. For example, there was a response related to 
using a negative weighting factor. Would it help to suggest using a tag in 
the subject line saying "beta xyz" "production abc" to identify what product 
release is in question?

2. The 
Production 1.53 junkmail file shows a ROUTETO option in the comments. How 
does this work? or is this actually for the beta release?

3.The HEADER 
option states you must specify text. Is the format 
(ex):
 WEIGHT10 HEADER "TEST TEXT" 
or
 WEIGHT10 HEADER TEST TEST 
or
am I way off base? 
:)

Thanks in 
advance.

==
Marv Gordon
Technical Support Manager
PrimeNet Marketing Services
651-405-4048
==



Re: [Declude.JunkMail] Newbie

2002-07-18 Thread R. Scott Perry


1.  As a new user I'm a little unclear if some of the questions are 
related to the current production or beta release.  For example, there was 
a response related to using a negative weighting factor.  Would it help to 
suggest using a tag in the subject line saying beta xyz production abc 
to identify what product release is in question?

Part of the problem is that with something like this (the negative 
weighting), while the negative weighting has been available since about 
v1.28, it was likely discussed in conjunction with a beta feature (such as 
the new filtering).

It would be a good idea, though, for people to specifically mention if a 
feature is in beta when discussing it.

2.  The Production 1.53 junkmail file shows a ROUTETO option in the 
comments.  How does this work? or is this actually for the beta release?

That's part of the next beta, actually.  The config files are constantly 
updated, and will sometimes have new beta features shown in them that 
aren't available in the latest released version.

3. The HEADER option states you must specify text.  Is the format (ex):
 WEIGHT10HEADER   TEST TEXT  or
 WEIGHT10HEADERTEST TEST   or
am I way off base? :)

Both will work fine.  You only need the quotes in there if you want them to 
appear in the header.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.JunkMail] declude queue / imail spool problems?

2002-07-18 Thread R. Scott Perry


I am having some trouble with my mail server.  About once a week, I find my
spool folder overflowing.  There are usually only about 200 files in that
folder, but when this weird thing happens, there are 5000+ in both the spool
and in the overflow folder.

If there are lots of D*.SMD files in the spool directory, and lots of 
Q*.SMD files in the overflow directory, then IMail reached its maximum 
capacity and Declude Queue took over.  Without Declude Queue, you would 
have seen all those files in the spool directory, and they would get sent 
out more slowly.

If I move all the files from the overflow back into the spool, they clear
out pretty quickly, but more keep showing up in the overflow at a rate of
about 100 per few minutes.

What could be causing this?  Where do I start to try to figure it out.
There is nothing unusual in the imail log and there is nothing about queue
in any of the logs.

If you run regedit, what is the entry at 
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SMTPD32\Parameters\MaxQueProc 
set to?  That controls how many processes can be running at once.  If your 
server is capable, you could try increasing that value.

Specifically, Declude Queue will start moving those files to the overflow 
directory when the maximum number of processes is reached (at which point 
IMail would normally keep the file in the queue, and not even attempt to 
deliver it until the next queue run, typically 20-30 minutes later).

What you really need to do is find out *why* so much E-mail is being 
sent/received; in many cases, it is a spammer or other undesirable (such as 
a mail loop).
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.JunkMail] declude queue / imail spool problems?

2002-07-18 Thread Jim Jones, Jr.

Here's what I did to fix it:

1) I turned off declude junkmail (by renaming the global.cfg file)
2) Moved all the files from the overflow directory to the spool directory

They all cleared out and things are back to normal.

Now (an hour after i turned junkmail off) I am going to turn junkmail back
on and see what happens.

From what I could tell, most of the extra email was spam.  I could not find
any trace of a mail loop, though.

Our mail server is a Dell 2450 with 2 866processors and 512mb ram.  it has a
caching raid controller and some very fast drives.  How high do you think I
could get away with setting that max processes value?

In the imail admin for 7.11 there is an advanced tab under the smtp service.
One of the values that can be set there is max processes.  Is this the same
thing?

Thanks,

Jim
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, July 18, 2002 12:37 PM
Subject: Re: [Declude.JunkMail] declude queue / imail spool problems?



 I am having some trouble with my mail server.  About once a week, I find
my
 spool folder overflowing.  There are usually only about 200 files in that
 folder, but when this weird thing happens, there are 5000+ in both the
spool
 and in the overflow folder.

 If there are lots of D*.SMD files in the spool directory, and lots of
 Q*.SMD files in the overflow directory, then IMail reached its maximum
 capacity and Declude Queue took over.  Without Declude Queue, you would
 have seen all those files in the spool directory, and they would get sent
 out more slowly.

 If I move all the files from the overflow back into the spool, they clear
 out pretty quickly, but more keep showing up in the overflow at a rate of
 about 100 per few minutes.
 
 What could be causing this?  Where do I start to try to figure it out.
 There is nothing unusual in the imail log and there is nothing about
queue
 in any of the logs.

 If you run regedit, what is the entry at

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SMTPD32\Parameters\MaxQ
ueProc
 set to?  That controls how many processes can be running at once.  If your
 server is capable, you could try increasing that value.

 Specifically, Declude Queue will start moving those files to the overflow
 directory when the maximum number of processes is reached (at which point
 IMail would normally keep the file in the queue, and not even attempt to
 deliver it until the next queue run, typically 20-30 minutes later).

 What you really need to do is find out *why* so much E-mail is being
 sent/received; in many cases, it is a spammer or other undesirable (such
as
 a mail loop).
  -Scott

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---

 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  You can E-mail
 [EMAIL PROTECTED] for assistance.  You can visit our web
 site at http://www.declude.com .


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.JunkMail] declude queue / imail spool problems?

2002-07-18 Thread R. Scott Perry


Here's what I did to fix it:

1) I turned off declude junkmail (by renaming the global.cfg file)
2) Moved all the files from the overflow directory to the spool directory

They all cleared out and things are back to normal.

Now (an hour after i turned junkmail off) I am going to turn junkmail back
on and see what happens.

Note that you also did something else here -- by turning off Declude 
JunkMail, you sped up delivery of *new* E-mails, especially if you are 
using an old spam test that times out (causing the E-mail to be in memory 
for 10+ extra seconds).  That may be a factor.

 From what I could tell, most of the extra email was spam.

It sounds like you may be dealing with a massive distributed spam attack, 
where a spammer compromises thousands of computers, and sends spam via a 
dictionary-like attack (sending to thousands and thousands of made-up 
addresses, hoping a few will receive the E-mail).  If you have a nobody 
alias, this can shut down your server.

Our mail server is a Dell 2450 with 2 866processors and 512mb ram.  it has a
caching raid controller and some very fast drives.  How high do you think I
could get away with setting that max processes value?

It's impossible to say -- only trial and error will tell for sure.  The 
problem is that Microsoft doesn't document the pertinent information about 
the problem.  The problem is that if you go too high, Microsoft will run 
out of a special type of memory and choke, causing all new processes to 
fail upon loading.  With the best information we can get from Microsoft, it 
shouldn't be possible for this to happen with recent versions of Declude 
(although it definitely will happen without Declude).

A value of 30 is the default, so if it is lower, you should be able to 
raise it to 30 with no problem.

In the imail admin for 7.11 there is an advanced tab under the smtp service.
One of the values that can be set there is max processes.  Is this the same
thing?

Ah, yes -- I forgot about that (a nice new feature).  That is the same thing.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.JunkMail] declude queue / imail spool problems?

2002-07-18 Thread Jim Jones, Jr.

I turned it back on and the number of files in the spool started growing at
a very fast pace.

I'm running declude v1.53 if that helps.

We do get lots of dictionary attacks, but they don't actually get in as
files do they?  don't the emails to bogus users get rejected before they are
written to a file?

The part about dead tests sounds interesting.  Below is a list of the tests
that I am running...

Thanks,

Jim

#ORBZIN  ip4r inputs.orbz.org   127.0.0.2 5 0
#ORBZOUT ip4r outputs.orbz.org  127.0.0.2 5 0
ORDB  ip4r relays.ordb.org   *  14 0
OSDUL  ip4rrelays.osirusoft.com 127.0.0.3 15 0
OSFORM  ip4rrelays.osirusoft.com 127.0.0.8 15 0
OSLIST  ip4rrelays.osirusoft.com 127.0.0.7 15 0
OSRELAY  ip4rrelays.osirusoft.com 127.0.0.2 14 0
OSSMART  ip4rrelays.osirusoft.com 127.0.0.5 15 0
OSSOFT  ip4rrelays.osirusoft.com 127.0.0.6 15 0
OSSRC  ip4rrelays.osirusoft.com 127.0.0.4 15 0
SPAMCOP  ip4r bl.spamcop.net   127.0.0.2 25 0

DSN  rhsbl dsn.rfc-ignorant.org  127.0.0.2 15 0
NOABUSE  rhsbl abuse.rfc-ignorant.org  127.0.0.4 15 0
NOPOSTMASTER rhsbl postmaster.rfc-ignorant.org 127.0.0.3 15 0

ADULT  adult  x x 30 0

BADHEADERS badheaders x x 10 0
MAILFROMenvfrom  x x 15 0
PERCENT  percent  x x 15 0
REVDNS  revdnsexists x x 15 0
ROUTING  spamrouting x x 15 0
SPAMHEADERS spamheaders x x 15 0

SNIFFER  external nonzero e:\imail\declude\Sniffer\sniffer.exe  29
0

WEIGHT  weight  x x 30 0
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, July 18, 2002 12:59 PM
Subject: Re: [Declude.JunkMail] declude queue / imail spool problems?



 Here's what I did to fix it:
 
 1) I turned off declude junkmail (by renaming the global.cfg file)
 2) Moved all the files from the overflow directory to the spool directory
 
 They all cleared out and things are back to normal.
 
 Now (an hour after i turned junkmail off) I am going to turn junkmail
back
 on and see what happens.

 Note that you also did something else here -- by turning off Declude
 JunkMail, you sped up delivery of *new* E-mails, especially if you are
 using an old spam test that times out (causing the E-mail to be in memory
 for 10+ extra seconds).  That may be a factor.

  From what I could tell, most of the extra email was spam.

 It sounds like you may be dealing with a massive distributed spam attack,
 where a spammer compromises thousands of computers, and sends spam via a
 dictionary-like attack (sending to thousands and thousands of made-up
 addresses, hoping a few will receive the E-mail).  If you have a nobody
 alias, this can shut down your server.

 Our mail server is a Dell 2450 with 2 866processors and 512mb ram.  it
has a
 caching raid controller and some very fast drives.  How high do you think
I
 could get away with setting that max processes value?

 It's impossible to say -- only trial and error will tell for sure.  The
 problem is that Microsoft doesn't document the pertinent information about
 the problem.  The problem is that if you go too high, Microsoft will run
 out of a special type of memory and choke, causing all new processes to
 fail upon loading.  With the best information we can get from Microsoft,
it
 shouldn't be possible for this to happen with recent versions of Declude
 (although it definitely will happen without Declude).

 A value of 30 is the default, so if it is lower, you should be able to
 raise it to 30 with no problem.

 In the imail admin for 7.11 there is an advanced tab under the smtp
service.
 One of the values that can be set there is max processes.  Is this the
same
 thing?

 Ah, yes -- I forgot about that (a nice new feature).  That is the same
thing.
 -Scott

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---

 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  You can E-mail
 [EMAIL PROTECTED] for assistance.  You can visit our web
 site at http://www.declude.com .


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.JunkMail] declude queue / imail spool problems?

2002-07-18 Thread R. Scott Perry


We do get lots of dictionary attacks, but they don't actually get in as
files do they?

That depends.  If you have a nobody alias, they do come in as files, and 
are processed by Declude.  If you do not have a nobody alias, then they 
will not be processed (by IMail or Declude).

don't the emails to bogus users get rejected before they are
written to a file?

Yes -- if there is no nobody alias.

The part about dead tests sounds interesting.  Below is a list of the tests
that I am running...

All of those tests are still around, so that shouldn't account for the problem.

Have you tried looking at the logs to see why there is so much mail?
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



DORKZTL:RE: [Declude.JunkMail] declude queue / imail spool problems?

2002-07-18 Thread Jim Rooth

Do I need to setup the ADULT test in anything save the global config
file?  I haven't seen that one and have had quite a few porn email come
through with a weight of 4 and 6 combined.  I figure if I set 'ADULT' to
15 then nothing porn related should get through with a bounce weight of
20.  Is this correct thinking?


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Thursday, July 18, 2002 1:54 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] declude queue / imail spool problems?


We do get lots of dictionary attacks, but they don't actually get in as
files do they?

That depends.  If you have a nobody alias, they do come in as files,
and 
are processed by Declude.  If you do not have a nobody alias, then
they 
will not be processed (by IMail or Declude).

don't the emails to bogus users get rejected before they are
written to a file?

Yes -- if there is no nobody alias.

The part about dead tests sounds interesting.  Below is a list of the
tests
that I am running...

All of those tests are still around, so that shouldn't account for the
problem.

Have you tried looking at the logs to see why there is so much mail?
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



RE: [Declude.JunkMail] Newbie

2002-07-18 Thread John Tolmachoff

A belated welcome.

John Tolmachoff
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



Re: [Declude.JunkMail] declude queue / imail spool problems?

2002-07-18 Thread Jim Jones, Jr.

OK, I confirmed that there are no nobody aliases.  I will start pouring
through the logs... is there a program that would make that any easier?

Thanks,

Jim
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, July 18, 2002 1:54 PM
Subject: Re: [Declude.JunkMail] declude queue / imail spool problems?



 We do get lots of dictionary attacks, but they don't actually get in as
 files do they?

 That depends.  If you have a nobody alias, they do come in as files, and
 are processed by Declude.  If you do not have a nobody alias, then they
 will not be processed (by IMail or Declude).

 don't the emails to bogus users get rejected before they are
 written to a file?

 Yes -- if there is no nobody alias.

 The part about dead tests sounds interesting.  Below is a list of the
tests
 that I am running...

 All of those tests are still around, so that shouldn't account for the
problem.

 Have you tried looking at the logs to see why there is so much mail?
  -Scott

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---

 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  You can E-mail
 [EMAIL PROTECTED] for assistance.  You can visit our web
 site at http://www.declude.com .


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



KITHRUP:RE: Re: DORKZTL:RE: [Declude.JunkMail] declude queue / imail spool problems?

2002-07-18 Thread Jim Rooth

Oh well, I was looking for the golden fleece...thanks for your reply.
Back to the drawing board.
  

Darn ATT and their DORKZTL!!

Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of
[EMAIL PROTECTED]
Sent: Thursday, July 18, 2002 4:25 PM
To: [EMAIL PROTECTED]
Subject: DSN:Re: DORKZTL:RE: [Declude.JunkMail] declude queue / imail
spool problems?

Jim,

The Adult test is officially undocumented and unsupported.

Scott is the only one that can speak to its original intent, status and
reasoning or any future development if any. But I believe it was a test
idea that Declude, for their own internal reasons, has not continued
or
slowed development on.

The results or detections by that test may not be up to the same level
you
see from the other tests. My testing has shown minimal results though
others
on this list may have seen better results.

my $.02

Stu


At 02:04 PM 07/18/2002 -0500, you wrote:
Do I need to setup the ADULT test in anything save the global config
file?  I haven't seen that one and have had quite a few porn email come
through with a weight of 4 and 6 combined.  I figure if I set 'ADULT'
to
15 then nothing porn related should get through with a bounce weight of
20.  Is this correct thinking?


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Thursday, July 18, 2002 1:54 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] declude queue / imail spool problems?


We do get lots of dictionary attacks, but they don't actually get in
as
files do they?

That depends.  If you have a nobody alias, they do come in as files,
and 
are processed by Declude.  If you do not have a nobody alias, then
they 
will not be processed (by IMail or Declude).

don't the emails to bogus users get rejected before they are
written to a file?

Yes -- if there is no nobody alias.

The part about dead tests sounds interesting.  Below is a list of the
tests
that I am running...

All of those tests are still around, so that shouldn't account for the
problem.

Have you tried looking at the logs to see why there is so much mail?
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002
 

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



-
CSOnline Technical Support hours - Monday thru Saturday 7am - 1am 
CSOnline Technical Support Numbers Seneca814-677-2447 
   Clarion   814-227-3638  
   Meadville 814-425-1696
   Parker724-399-1158   
http://www.csonline.net  http://www.cshowcase.com
http://www.learncenter.com  

-

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



ATT RE: (RE: KITHRUP:RE: Re: [Declude.JunkMail] DORKZTL:RE:)

2002-07-18 Thread John Tolmachoff

Take a tire iron to them.

:-)

John Tolmachoff
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .