[Declude.JunkMail] How did this one get through
I have this email address blocked [EMAIL PROTECTED] Yet it is still getting passed my Declude Scanner. Can anyone help with this? Received: from postoffice.inreach.com [209.142.2.45] by mail.nfti.com with ESMTP (SMTPD32-6.06) id A3B91450046; Sun, 11 Aug 2002 02:27:05 -0400 Received: from Dqnf ([65.66.218.213]) by postoffice.inreach.com (Post.Office MTA v3.5.3 release 223 ID# 0-68376U62000L6200S0V35) with SMTP id com for [EMAIL PROTECTED]; Sat, 10 Aug 2002 23:26:54 -0700 From: manxminx [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: A special good tool MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=CT3W66032BOb391463O59Y1rHfN0qG8 Message-Id: [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [209.142.2.45] X-Declude-Spoolname: D03b9046.SMD X-Note: This E-mail was scanned by NFTISERV's Declude JunkMail for spam. X-Spam-Tests-Failed: None X-Weight: 0 X-Note: This E-mail was sent from ([209.142.2.45]). Thanks, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] FW: Morning update for the Kill file
--- Steven Cmajdalka [EMAIL PROTECTED] The Graphics Group 2800 Taylor St Dallas, TX 75226 --- Here is one to add to your kill list. -- @forum.dk ID-20020812-000319 -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How did this one get through
I have this email address blocked [EMAIL PROTECTED] Yet it is still getting passed my Declude Scanner. Can anyone help with this? Where is it blocked? In a sender blacklist (fromfile)? Are other blocked E-mail addresses getting blocked? Do you have any whitelists that would allow the E-mail through (which would override any blacklists)? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How did this one get through
It's in the sender blacklist... and it's is not in my whitelist. greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Monday, August 12, 2002 10:04 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] How did this one get through I have this email address blocked [EMAIL PROTECTED] Yet it is still getting passed my Declude Scanner. Can anyone help with this? Where is it blocked? In a sender blacklist (fromfile)? Are other blocked E-mail addresses getting blocked? Do you have any whitelists that would allow the E-mail through (which would override any blacklists)? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
DSN:RE: [Declude.JunkMail] Morning update for the Declude Kill list 08/09/02
Thanks for the Utility Scott MacLean !!, I set it up this AM Works great. Ed McNichols, MCP Archiventure, Inc. [EMAIL PROTECTED] http://www.archiventure.net Tel. 570.253.1986 Fax. 570.253.4343 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Scott MacLean Sent: Friday, August 09, 2002 10:35 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Morning update for the Declude Kill list 08/09/02 I liked this idea so much (of a downloadable spam domain file) that I wrote a small utility that automatically downloaded the full list, incorporated it into my own list and wrote out a combined list. Anyone who wants to use it is welcome: http://www.nerosoft.com/Files/KillListGenInst.exe Once installed, it creates a config file named KillListGen.txt that must be in the same directory as the EXE file. It looks like this: ' Configuration file for Kill List Generator - [EMAIL PROTECTED] ' URL to retrieve list of current spam addresses/domains ListURL=http://www.imagefxonline.net/apps/delog/fromfile.txt ' Source file of local addresses you wish to keep on the list permanently. ' Comment out if no local address list is used. SourceFile=c:\IMail\Declude\Source.txt ' Destination file that IMail reads which will be combined Source file and retrieved list DestFile=c:\IMail\Declude\Destination.txt The first line ListURL specifies the URL to download the list from. The second line SourceFile specifies the local path of a file containing your own address/domain list that you want incorporated into the final list. The third line DestFile specifies the local path of the destination file it's all written to, and should be the Blacklist file that Declude is looking for. I've got mine running on a schedule, updating twice a day. At 06:17 PM 8/9/2002, Tom wrote: You can download the full list from the following URL: http://www.imagefxonline.net/apps/delog/fromfile.txt This list is not provided by the authors of DECLUDE. However, it is just an optional file you can use to block potential or known spam sites. To get more information on using Blacklists with Declude please visit the following URL: http://www.declude.com/JunkMail/manual.htm Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ___ Scott MacLean [EMAIL PROTECTED] ICQ: 9184011 http://www.nerosoft.com
RE: [Declude.JunkMail] How did this one get through
It's in the sender blacklist... Is the sender blacklist set up properly (are other blacklisted domains/addresses working properly)? What does the line look like in your sender blacklist file? and it's is not in my whitelist. Do you have any whitelist entries? Often, mistakes are made such as whitelisting all mail from Hotmail because mail.com was whitelisted. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude Console question
I've been curious about how messages show up in the Declude Console as they stream through. In the top third of the console window messages are labeled as I, O, IS, OS, IV, or OV (I assume these standing for incoming/outgoing, SPAM, and Virus). Here's my question: If a message shows up as IS or OS does this mean it has failed *any* SPAM test, or has it failed enough tests to be deleted (or held or bounced)? I work for a medium-sized ISP and about 75-80% of the 200,000 messages going through every day are showing up as IS or OS. I've set up fairly aggressive filtering and all mail that fails the WEIGHT10 test gets deleted. I'm considering easing the tests if indeed 75-80% of our users' mail is getting deleted. However, if this only means that 75-80% of the mail is failing one of the tests (but not necessarily getting deleted) then I think I'll keep the test settings the same. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude Console question
I've been curious about how messages show up in the Declude Console as they stream through. In the top third of the console window messages are labeled as I, O, IS, OS, IV, or OV (I assume these standing for incoming/outgoing, SPAM, and Virus). That is correct. Here's my question: If a message shows up as IS or OS does this mean it has failed *any* SPAM test, or has it failed enough tests to be deleted (or held or bounced)? It means that it has failed any spam test. So even if the E-mail just fails the SPAMHEADERS test, for example, it would show up with an S in the Declude Console. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Feature Request, Declude Console
Request to be able to view the console via terminal services. John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Feature Request, Declude Console
Request to be able to view the console via terminal services. As soon as we find out why Microsoft won't display the console via terminal services, we'll do our best to take care of that request. :) The problem is that there doesn't seem to be any logical reason why it does not display. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Feature Request, Declude Console
I just got an idea, I will try it and report. John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Monday, August 12, 2002 10:36 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Feature Request, Declude Console Request to be able to view the console via terminal services. As soon as we find out why Microsoft won't display the console via terminal services, we'll do our best to take care of that request. :) The problem is that there doesn't seem to be any logical reason why it does not display. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Feature Request, Declude Console
From what I have read, in Win2k terminal services cannot connect to the console session, however the next release of server will include this capability, so will have remote control rather than a mere terminal. Many programs have the same issue since the default action for a service that intereacts with the desktop (i.e. when smtpd32.exe, a service, kicks off declude, which opens console, it all happens under the same context as smtpd32.exe), is to open it only in the console session. My DNS server has the same issue with it's built in monitor app. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Monday, August 12, 2002 12:36 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Feature Request, Declude Console Request to be able to view the console via terminal services. As soon as we find out why Microsoft won't display the console via terminal services, we'll do our best to take care of that request. :) The problem is that there doesn't seem to be any logical reason why it does not display. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail]
Messages originating from a mailto script from one of our webservers are failing the spamheaders and badheaders tests. Here's what I get from Declude's site: Code: c020020c. The E-mail failed the BADHEADERS and SPAMHEADERS tests. This E-mail has a bogus Date: header. Here's the full header info from the message (with the email address changed): Received: from computer [204.57.118.20] by imail.stic.net (SMTPD32-7.12) id A6E4AB2028E; Mon, 12 Aug 2002 14:05:08 -0500 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: SARA Relocation Message-Id: 200208121405609.SM02260@computer X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [c020020c]. X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [c020020c]. X-RBL-Warning: WEIGHT10: Weight of 15 reaches or exceeds the limit of 10. X-Declude-Spoolname: D06e40ab2028e3d43.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: BADHEADERS, SPAMHEADERS, WEIGHT10, WEIGHT5 Date: Mon, 12 Aug 2002 14:05:20 -0500 X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 326891288 Can someone explain to me why the Date: header is faulty (or send me a link that would explain it)? Sorry if this is a dumb question, but I'm kinda new to this. Thanks. Bart Lackorn STIC.NET --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail]
Messages originating from a mailto script from one of our webservers are failing the spamheaders and badheaders tests. That's fairly common -- huge numbers of web scripts are out there that don't follow the standard SMTP rules. Here's the full header info from the message (with the email address changed): Received: from computer [204.57.118.20] by imail.stic.net (SMTPD32-7.12) id A6E4AB2028E; Mon, 12 Aug 2002 14:05:08 -0500 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: SARA Relocation Note that there is no Date: or Message-ID: header (I removed the headers that were added by Declude and IMail). The lack of a Date: header breaks RFC-compliancy (and causes much of the E-mail to get lost). The missing Message-ID: header is legal, but only allowed under certain circumstances. Can someone explain to me why the Date: header is faulty (or send me a link that would explain it)? The catch is that IMail adds the Date: and Message-ID: headers if they are present (anything after the first Declude header is something that either Declude or IMail added). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail]
Note that there is no Date: or Message-ID: header (I removed the headers that were added by Declude and IMail). The lack of a Date: header breaks RFC-compliancy (and causes much of the E-mail to get lost). The missing Message-ID: header is legal, but only allowed under certain circumstances. So I just need to get the webserver to stamp a date and a message-ID on it before it hits Imail? Thanks (and sorry for forgetting to put a subject on this thread) Bart --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail]
http://www.declude.com/tools/header.php John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Stic.Net Sent: Monday, August 12, 2002 12:21 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Messages originating from a mailto script from one of our webservers are failing the spamheaders and badheaders tests. Here's what I get from Declude's site: Code: c020020c. The E-mail failed the BADHEADERS and SPAMHEADERS tests. This E-mail has a bogus Date: header. Here's the full header info from the message (with the email address changed): Received: from computer [204.57.118.20] by imail.stic.net (SMTPD32-7.12) id A6E4AB2028E; Mon, 12 Aug 2002 14:05:08 -0500 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: SARA Relocation Message-Id: 200208121405609.SM02260@computer X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [c020020c]. X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [c020020c]. X-RBL-Warning: WEIGHT10: Weight of 15 reaches or exceeds the limit of 10. X-Declude-Spoolname: D06e40ab2028e3d43.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: BADHEADERS, SPAMHEADERS, WEIGHT10, WEIGHT5 Date: Mon, 12 Aug 2002 14:05:20 -0500 X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 326891288 Can someone explain to me why the Date: header is faulty (or send me a link that would explain it)? Sorry if this is a dumb question, but I'm kinda new to this. Thanks. Bart Lackorn STIC.NET --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] FW: Morning update for the Kill file
Here is one to add to your kill list. -- @forum.dk ID-20020812-000319 -- Although I can not read the web site language, it appears to be a legitimate Mail Service. So I would be cautious about blocking their site. Also, if you are going to use the number scheme I have been using, you should try not using numbers that are already assigned. Just refer to my list or don't even add the Identifier when sending it to the Declude list. This will prevent conflicts and allow us to keep the list in order. Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Downloadable list
I liked this idea so much (of a downloadable spam domain file) that I wrote a small utility that automatically downloaded the full list, incorporated it into my own list and wrote out a combined list. Anyone who wants to use it is welcome: http://www.nerosoft.com/Files/KillListGenInst.exe Cool idea, but that does place more pressure on me to keep the list up to date... PS: I hope you don't mind if I download it and post it on our web site. http://www.imagefxonline.net/apps/delog That is as soon as I get a chance. Perhaps Scott will do the same. Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Downloadable list
At 04:36 PM 8/12/2002, Tom wrote: I liked this idea so much (of a downloadable spam domain file) that I wrote a small utility that automatically downloaded the full list, incorporated it into my own list and wrote out a combined list. Anyone who wants to use it is welcome: http://www.nerosoft.com/Files/KillListGenInst.exe Cool idea, but that does place more pressure on me to keep the list up to date... Well, you can always point the URL to someone else's online list. :) Hm, that said, perhaps it should be able to handle multiple source lists, to combine them all... PS: I hope you don't mind if I download it and post it on our web site. http://www.imagefxonline.net/apps/delog That is as soon as I get a chance. Perhaps Scott will do the same. Of course, go right ahead. ___ Scott MacLean [EMAIL PROTECTED] ICQ: 9184011 http://www.nerosoft.com
Re: [Declude.JunkMail] DSN:filter test addition
Is it correct that if the filter file has subject 1contains body 1contains and the global.cfg file has ...\filter.txt x 1 0 That the total of a failed test would be 3 In other words each test section failed in the filter.txt file will count towards the total. But the phrase used will get counted only once per section failed. That is correct. In this case, an E-mail with in both the subject and body would get a weight of 3 (although an E-mail with only in the body, like this E-mail, would get a weight of 2). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
