Re: [Declude.JunkMail] Spool and overflow building
Another thing to check is your DNS and if it is resolving properly. It could be that a reboot might resolve problems in DNS, or with IMail connecting to DNS. It might also be a good idea to configure IMail for Unfortuantly, Declude does not utilize the second DNS server if specified in IMail. In turn if you use several RBL's will still cause huge queue backup's. We learned this lesson a couple months back. Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] What is this test?
Mike, The Easynet-Dyna test is an external ip4r DNS test setup in your global.cfg file. See the Declude link below to see further info on this. http://www.declude.com/Junkmail/support/ip4r.htm Keith -Original Message- From: Michael Graveen [mailto:[EMAIL PROTECTED] Sent: Thu 10/16/2003 10:14 PM To: [EMAIL PROTECTED] Cc: Subject: [Declude.JunkMail] What is this test? I have a client that has a domain that we host. They sent an email through the mail server and it failed the following tests: X-Spam-Tests-Failed: EASYNET-DYNA, IPNOTINMX [3] My question is, what is EASYNET-DYNA? I don't see it in the JunkMail manual. Thanks, Mike [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. <>
Re: [Declude.JunkMail] What is this test?
Hi Michael EASYNET-DYNA is the blacklist of dynablock.easynet.nl see: http://www.declude.com/Junkmail/support/ip4r.htm . Use WHITELIST AUTH in your GLOBAL.CFG file if you have Imail V8.X and declude V1.75 so authenticated users will be whitelisted or do not check outgoing emails. Cheers Adrian - - Original Message - From: "Michael Graveen" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, October 17, 2003 12:14 PM Subject: [Declude.JunkMail] What is this test? > I have a client that has a domain that we host. They sent an email through > the mail server and it failed the following tests: > > X-Spam-Tests-Failed: EASYNET-DYNA, IPNOTINMX [3] > > My question is, what is EASYNET-DYNA? I don't see it in the JunkMail manual. > > Thanks, > > Mike > > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] What is this test?
I have a client that has a domain that we host. They sent an email through the mail server and it failed the following tests: X-Spam-Tests-Failed: EASYNET-DYNA, IPNOTINMX [3] My question is, what is EASYNET-DYNA? I don't see it in the JunkMail manual. Thanks, Mike [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Hold action
I'm not seeing the value in the hold action... does this mean that an administrator type has to search the server's hold directory periodically and scroll through messages looking for false positives? Then I assume you would want to manually move them back into the recipient's inbox? Seems like an unending thankless task which noone really has time for, in addition to filling up the HDD with spam. Am I right in understanding that the hold action simply puts the email in a separate directory? Or am I missing something? That's exactly what the HOLD action does. What were you looking for? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Hold action
I'm not seeing the value in the hold action... does this mean that an administrator type has to search the server's hold directory periodically and scroll through messages looking for false positives? Then I assume you would want to manually move them back into the recipient's inbox? Seems like an unending thankless task which noone really has time for, in addition to filling up the HDD with spam. Am I right in understanding that the hold action simply puts the email in a separate directory? Or am I missing something? so far I've seen no false positives on weight10, so I'm just about ready to start deleting. I see many of you with much higher weights for hold/delete. Maybe because you "provide" email to clients and you need to let them make their own decisions? (I'm a small company and can afford to make those command decisions for my users.) Thanks. John. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spool and overflow building
Is it me, or is this the third or fourth such message in a day or so? That's quite strange. It's making me think that maybe a recent Microsoft, Ipswitch or Declude patch/upgrade might be the root of the problem (likely the first of course). Another list member said that rebooting his server resolved the problem. Another thing to check is your DNS and if it is resolving properly. It could be that a reboot might resolve problems in DNS, or with IMail connecting to DNS. It might also be a good idea to configure IMail for a backup DNS server just in case of a failure with the primary. Matt Lenny Bauman wrote: Hello List Any idea why my spool and overflow directory are buildingThey are at over 85,000 messages each. I am running a dual P3 866 with one gig memory. The CPU is going from 5% to 90% up and down all day looks like a nice sine wave. I am getting mail from 2 days ago in my box now. but the count in the spool directory is building every min. Lenny Bauman LRBCG.COM, Inc. Phone 419-621-5770 Toll Free 1-800-NET-ACCESS (638-2223) E-mail [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spool and overflow building
Hello List Any idea why my spool and overflow directory are buildingThey are at over 85,000 messages each. I am running a dual P3 866 with one gig memory. The CPU is going from 5% to 90% up and down all day looks like a nice sine wave. I am getting mail from 2 days ago in my box now. but the count in the spool directory is building every min. Lenny Bauman LRBCG.COM, Inc. Phone 419-621-5770 Toll Free 1-800-NET-ACCESS (638-2223) E-mail [EMAIL PROTECTED] - Original Message - From: "William Baumbach" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, October 13, 2003 10:46 PM Subject: Re: [Declude.JunkMail] WANTED: your kill lists > use at your own risk, there might be good email addresses in this list, not > sure, however its the one i use for my Imail Kill.lst > > Sincerely, > > William J. Baumbach II [EMAIL PROTECTED] > 9975 Pennsylvania Ave. Manassas, Va. 20110-2028 > Ph: 703-367-7900 ext:1708 Fax: 703-691-0946 > - > > - Original Message - > From: "Joseph Acac" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Monday, October 13, 2003 7:39 PM > Subject: [Declude.JunkMail] WANTED: your kill lists > > > anyone willing to send me a copy of their kill list? I am far behind in > the filtering spam war, and would appreciate a 'cheat sheet' to update our > kill list here at Primate. I'm tired of sifting through held emails via > Spam Review. Thanks for your help. > > Joseph C. Acac > CNPRC > University of California at Davis > [EMAIL PROTECTED] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > [ scanned for spam to: [EMAIL PROTECTED] incoming > http://www.DcMetroNet.com on 10/13/2003 at 19:43:44-0500et. ] > > [ scanned for viruses to: [EMAIL PROTECTED] incoming > http://www.DcMetroNet.com on 10/13/2003 at 19:43:48-0500et. ] > > > --- [This E-mail scanned for viruses by LRBCG.COM, Inc.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail/Web mail
Fred, Actually, that doesn't work great. It just repeats the first address over and over. My mistake. I looked into this more thoroughly and it appears that the IMAIL.##From## variable is actually an array, and it isn't specific to the From address as it will spit out the To address when you are viewing the Sent mail folder. Unfortunately IMAIL.##To## isn't a valid tag, and I tried/looked for others that might do the trick and none of them worked. It appears that the programming switch that changes the functionality of this tag has something to do with whether or not you are viewing the Sent or Drafts folders or not. I couldn't figure out what causes it to change behaviors though. One work around would be for you to create a Sent folder in Web Mail for that account and then just move the messages over there. You might even be able to move the messages there automatically by setting up Declude to deliver the messages to a sub-account like [EMAIL PROTECTED] (this might not be allowed though). BTW, if you want to change the label for that button, the file is: config_LabelButtonSortBySender.cgi Matt Frederick Samarelli wrote: Wow that worked great. Do you know where they keep the Column Title"From" I would like to change it to "TO". If you every figure out how to add a column to have both To and From that would be best. I really appreciate this. Thanks. Fred - Original Message - From: Matthew Bramble To: [EMAIL PROTECTED] Sent: Thursday, October 16, 2003 5:49 PM Subject: Re: [Declude.JunkMail] Imail/Web mail Fred, I took a look at it and here's what you do. In the msgsum.html file search for the following string: Replace that with: If you have users that also access Killer Web Mail, they will see the changes you make in the global file, so it is recommended that you set up Killer Web Mail by copying the Web directory over to a particular domain and then make the changes for that domain only (choose a domain that no one is using WebMail on. The default templates are typically located at the following address: C:\IMail\Web\ Copy those over to where you keep your E-mail by creating a sub directory under the root for domain users. The default location is under the IMail directory, though you might have changed that: C:\IMail\some-domain.com\Web\ I verified this and it works on my machine. Matt Frederick Samarelli wrote: Thanks. Looked at the code. Beyond me - Original Message - From: Matthew Bramble To: [EMAIL PROTECTED] Sent: Thursday, October 16, 2003 4:36 PM Subject: Re: [Declude.JunkMail] Imail/Web mail Fred, you can't by default. If you are savvy with their code, you could probably change the templates to list the To: address in place of the From: address in their list interface (probably a matter of changing a single variable in a single file), but be careful not to apply the changes to a domain where others are using the Interface. Jeff, Killer WebMail is an add-on product that is now offered by Ipswitch: http://www.ipswitch.com/Products/IMail_Server/killer_web.html Matt Frederick Samarelli wrote: I use Killer Web Mail but how do you show and sort by TO: Address. - Original Message - From: "Matthew Bramble" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, October 16, 2003 3:36 PM Subject: Re: [Declude.JunkMail] Imail/Web mail I do pretty much the same thing, though I use Killer Web Mail for this purpose. I think you are talking about the list of messages, in which case you might have to re-code your Web Mail templates to get that to work. You can though do things like add the weight to the subject and probably even the To address using the SUBJECT functionality in your Default.$Junkmail$ file. I append the weight to the messages with SUBJECT [%WEIGHT%] for a redundant fail weight test, and then sort by subject since I never see FP's above a certain score. This comes in real handy for testing new filters. The only drawback of course is that all BCC data is lost when you block with Declude. Matt Frederick Samarelli wrote: Does anyone know of a way you can display the sender in the Web Mail for IMAIL. I am Routing email to a Web account and would like to display both the TO: and FROM: Thanks. Fred
[Declude.JunkMail] re: Another ebay scam
This is the link in the form tag http://www.muahaha.us/d.php It asks for username and password and ther redirects to ebay. Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] (805) 520-5800 x7332 Changing the way industry works. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Test for nothing in the subject line?
No trouble, James. It came up in this list before, which is how I knew it. It's not in the current manual, but BODY 0 ISBLANK is noted as a new feature in the release notes web page. MAILFROM 0 ISBLANK can also be useful, but as always, I stress not going overboard in the weight assigned. Andrew 8) -Original Message- From: James James [mailto:[EMAIL PROTECTED] Sent: Thursday, October 16, 2003 3:01 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Test for nothing in the subject line? Thanks Andrew. I do have JunkMail Pro and I just set this up, but I hate asking a list when I can look it up myself. Where did you find this? Thanks, James - Original Message - From: "Colbeck, Andrew" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, October 16, 2003 2:32 PM Subject: RE: [Declude.JunkMail] Test for nothing in the subject line? > If you have JunkMail Pro, you can create a filter text file with a line > like: > > SUBJECT 0 ISBLANK > > The weight, of course, is up to you. > > Andrew 8) > > -Original Message- > From: James James [mailto:[EMAIL PROTECTED] > Sent: Thursday, October 16, 2003 2:04 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Test for nothing in the subject line? > > > Greetings all > > I have some users who are starting to get spam with nothing in the subject > and nothing in the body, save a single link to a picture on the internet. Is > there a test for nothing in subject? I already have the subjectchars test > setup, but that only tests for subjects over a certian link. It would be > nice to add a few points for an email that fails this. > > Thanks > James James > Help Desk/Systems Administration > Lile International > www.lile.net > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail/Web mail
Wow that worked great. Do you know where they keep the Column Title"From" I would like to change it to "TO". If you every figure out how to add a column to have both To and From that would be best. I really appreciate this. Thanks. Fred - Original Message - From: Matthew Bramble To: [EMAIL PROTECTED] Sent: Thursday, October 16, 2003 5:49 PM Subject: Re: [Declude.JunkMail] Imail/Web mail Fred,I took a look at it and here's what you do.In the msgsum.html file search for the following string: Replace that with: If you have users that also access Killer Web Mail, they will see the changes you make in the global file, so it is recommended that you set up Killer Web Mail by copying the Web directory over to a particular domain and then make the changes for that domain only (choose a domain that no one is using WebMail on.The default templates are typically located at the following address: C:\IMail\Web\Copy those over to where you keep your E-mail by creating a sub directory under the root for domain users. The default location is under the IMail directory, though you might have changed that: C:\IMail\some-domain.com\Web\I verified this and it works on my machine.MattFrederick Samarelli wrote: Thanks. Looked at the code. Beyond me - Original Message - From: Matthew Bramble To: [EMAIL PROTECTED] Sent: Thursday, October 16, 2003 4:36 PM Subject: Re: [Declude.JunkMail] Imail/Web mail Fred, you can't by default. If you are savvy with their code, you could probably change the templates to list the To: address in place of the From: address in their list interface (probably a matter of changing a single variable in a single file), but be careful not to apply the changes to a domain where others are using the Interface.Jeff, Killer WebMail is an add-on product that is now offered by Ipswitch: http://www.ipswitch.com/Products/IMail_Server/killer_web.htmlMattFrederick Samarelli wrote: I use Killer Web Mail but how do you show and sort by TO: Address. - Original Message - From: "Matthew Bramble" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, October 16, 2003 3:36 PM Subject: Re: [Declude.JunkMail] Imail/Web mail I do pretty much the same thing, though I use Killer Web Mail for this purpose. I think you are talking about the list of messages, in which case you might have to re-code your Web Mail templates to get that to work. You can though do things like add the weight to the subject and probably even the To address using the SUBJECT functionality in your Default.$Junkmail$ file. I append the weight to the messages with SUBJECT [%WEIGHT%] for a redundant fail weight test, and then sort by subject since I never see FP's above a certain score. This comes in real handy for testing new filters. The only drawback of course is that all BCC data is lost when you block with Declude. Matt Frederick Samarelli wrote: Does anyone know of a way you can display the sender in the Web Mail for IMAIL. I am Routing email to a Web account and would like to display both the TO: and FROM: Thanks. Fred
Re[2]: [Declude.JunkMail] Null Sender Spam for Valid Accounts
Reply to: John Tolmachoff (Lists) Re: [Declude.JunkMail] Null Sender Spam for Valid Accounts on Thursday 11:15:50 AM This is what I was doing but Spam Review might have 2000-10,000 of bounced mails... too much to do in deleting them... -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - J> You could put in a temporary rule that holds or routes all message with a J> blank or <> as sender, that way the end user will not see them, but you will J> still be complying with the requirements. J> John Tolmachoff MCSE CSSA J> Engineer/Consultant J> eServices For You J> www.eservicesforyou.com >> -Original Message- >> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- >> [EMAIL PROTECTED] On Behalf Of Roger Heath >> Sent: Thursday, October 16, 2003 1:53 AM >> To: R. Scott Perry >> Subject: [Declude.JunkMail] Null Sender Spam for Valid Accounts >> >> Looking at Scott's response below, I'd like to have the Refuse Null >> Sender switch off, but we have a situation where spammers are forging >> valid e-mail addresses. We have thousands of bounces showing up for >> messages never sent from valid accounts here. For example, >> [EMAIL PROTECTED] may be a valid account but he is not a >> spammer. But a spammer uses [EMAIL PROTECTED] forges tens of >> thousands of messages with this as the 'reply to' account in headers. >> Since the spammer has many unvalid accounts in his spamming, >> [EMAIL PROTECTED] is swamped with thousands of bounced mails for >> mails that he did not even send... This is now happening to hundreds >> of accounts here because it looks like the spammer's software is >> randomly selecting them from a spam list. >> >> I have re-enabled 'Refuse Null Senders' to relieve this problem, but >> would like to find a more compliant solution. Does any one know how to >> attack this issue in another way? >> >> -- >> Roger Heath >> [EMAIL PROTECTED] >> www.rleeheath.com >> >> R> Well, the real question is why do you think that you are safer by >> R> rejecting those E-mails? I'm not aware of any safety issues. The >> R> only issue I am aware of is that a small percentage of spammers >> R> send their spam that way. >> R> >> R> The NULL <> sender has been used for over 20 years for bounce >> R> messages and other automated messages (such as vacation messages, >> R> and those awful spam confirmation E-mails, and Delivery Status >> R> Notifications). >> R> >> R> So the choices are : >> R> >> R> [1] Comply (leave "Refuse NULL <> Senders" at the default UNchecked >> R> setting). Pros: Your mailserver will act as expected. Cons: As very >> R> small percentage of spam is sent this way, but it can be detected >> R> using standard spam control. >> R> >> R> [2] Refuse NULL <> senders. Pros: You'll have that "safe" feeling. >> R> Cons: You won't receive all your E-mail, because you're blocking >> R> someofit,andbecauseyou'llgetlisted at >> R> http://www.rfc-ignorant.org . >> R> >> R> -Scott >> >> >> >> >> >> -- >> ActivatorMail(tm) ver.01010031 Scanned for all viruses by >> www.activatormail.com intelligent anti-virus anti-spam service >> >> --- >> [This E-mail was scanned for viruses by Declude Virus J> (http://www.declude.com)] >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. J> --- J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J> --- J> This E-mail came from the Declude.JunkMail mailing list. To J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J> type "unsubscribe Declude.JunkMail". The archives can be found J> at http://www.mail-archive.com. J> -- J> ActivatorMail(tm) ver.01010031 Scanned for all viruses by J> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.01010031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Test for nothing in the subject line?
Thanks Andrew. I do have JunkMail Pro and I just set this up, but I hate asking a list when I can look it up myself. Where did you find this? Thanks, James - Original Message - From: "Colbeck, Andrew" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, October 16, 2003 2:32 PM Subject: RE: [Declude.JunkMail] Test for nothing in the subject line? > If you have JunkMail Pro, you can create a filter text file with a line > like: > > SUBJECT 0 ISBLANK > > The weight, of course, is up to you. > > Andrew 8) > > -Original Message- > From: James James [mailto:[EMAIL PROTECTED] > Sent: Thursday, October 16, 2003 2:04 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Test for nothing in the subject line? > > > Greetings all > > I have some users who are starting to get spam with nothing in the subject > and nothing in the body, save a single link to a picture on the internet. Is > there a test for nothing in subject? I already have the subjectchars test > setup, but that only tests for subjects over a certian link. It would be > nice to add a few points for an email that fails this. > > Thanks > James James > Help Desk/Systems Administration > Lile International > www.lile.net > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail/Web mail
Fred, I took a look at it and here's what you do. In the msgsum.html file search for the following string: Replace that with: If you have users that also access Killer Web Mail, they will see the changes you make in the global file, so it is recommended that you set up Killer Web Mail by copying the Web directory over to a particular domain and then make the changes for that domain only (choose a domain that no one is using WebMail on. The default templates are typically located at the following address: C:\IMail\Web\ Copy those over to where you keep your E-mail by creating a sub directory under the root for domain users. The default location is under the IMail directory, though you might have changed that: C:\IMail\some-domain.com\Web\ I verified this and it works on my machine. Matt Frederick Samarelli wrote: Thanks. Looked at the code. Beyond me - Original Message - From: Matthew Bramble To: [EMAIL PROTECTED] Sent: Thursday, October 16, 2003 4:36 PM Subject: Re: [Declude.JunkMail] Imail/Web mail Fred, you can't by default. If you are savvy with their code, you could probably change the templates to list the To: address in place of the From: address in their list interface (probably a matter of changing a single variable in a single file), but be careful not to apply the changes to a domain where others are using the Interface. Jeff, Killer WebMail is an add-on product that is now offered by Ipswitch: http://www.ipswitch.com/Products/IMail_Server/killer_web.html Matt Frederick Samarelli wrote: I use Killer Web Mail but how do you show and sort by TO: Address. - Original Message - From: "Matthew Bramble" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, October 16, 2003 3:36 PM Subject: Re: [Declude.JunkMail] Imail/Web mail I do pretty much the same thing, though I use Killer Web Mail for this purpose. I think you are talking about the list of messages, in which case you might have to re-code your Web Mail templates to get that to work. You can though do things like add the weight to the subject and probably even the To address using the SUBJECT functionality in your Default.$Junkmail$ file. I append the weight to the messages with SUBJECT [%WEIGHT%] for a redundant fail weight test, and then sort by subject since I never see FP's above a certain score. This comes in real handy for testing new filters. The only drawback of course is that all BCC data is lost when you block with Declude. Matt Frederick Samarelli wrote: Does anyone know of a way you can display the sender in the Web Mail for IMAIL. I am Routing email to a Web account and would like to display both the TO: and FROM: Thanks. Fred
RE: [Declude.JunkMail] Test for nothing in the subject line?
If you have JunkMail Pro, you can create a filter text file with a line like: SUBJECT 0 ISBLANK The weight, of course, is up to you. Andrew 8) -Original Message- From: James James [mailto:[EMAIL PROTECTED] Sent: Thursday, October 16, 2003 2:04 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Test for nothing in the subject line? Greetings all I have some users who are starting to get spam with nothing in the subject and nothing in the body, save a single link to a picture on the internet. Is there a test for nothing in subject? I already have the subjectchars test setup, but that only tests for subjects over a certian link. It would be nice to add a few points for an email that fails this. Thanks James James Help Desk/Systems Administration Lile International www.lile.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail/Web mail
Thanks. Looked at the code. Beyond me - Original Message - From: Matthew Bramble To: [EMAIL PROTECTED] Sent: Thursday, October 16, 2003 4:36 PM Subject: Re: [Declude.JunkMail] Imail/Web mail Fred, you can't by default. If you are savvy with their code, you could probably change the templates to list the To: address in place of the From: address in their list interface (probably a matter of changing a single variable in a single file), but be careful not to apply the changes to a domain where others are using the Interface.Jeff, Killer WebMail is an add-on product that is now offered by Ipswitch: http://www.ipswitch.com/Products/IMail_Server/killer_web.htmlMattFrederick Samarelli wrote: I use Killer Web Mail but how do you show and sort by TO: Address. - Original Message - From: "Matthew Bramble" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, October 16, 2003 3:36 PM Subject: Re: [Declude.JunkMail] Imail/Web mail I do pretty much the same thing, though I use Killer Web Mail for this purpose. I think you are talking about the list of messages, in which case you might have to re-code your Web Mail templates to get that to work. You can though do things like add the weight to the subject and probably even the To address using the SUBJECT functionality in your Default.$Junkmail$ file. I append the weight to the messages with SUBJECT [%WEIGHT%] for a redundant fail weight test, and then sort by subject since I never see FP's above a certain score. This comes in real handy for testing new filters. The only drawback of course is that all BCC data is lost when you block with Declude. Matt Frederick Samarelli wrote: Does anyone know of a way you can display the sender in the Web Mail for IMAIL. I am Routing email to a Web account and would like to display both the TO: and FROM: Thanks. Fred
[Declude.JunkMail] Test for nothing in the subject line?
Greetings all I have some users who are starting to get spam with nothing in the subject and nothing in the body, save a single link to a picture on the internet. Is there a test for nothing in subject? I already have the subjectchars test setup, but that only tests for subjects over a certian link. It would be nice to add a few points for an email that fails this. Thanks James James Help Desk/Systems Administration Lile International www.lile.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail/Web mail
http://www.ipswitch.com/Support/IMail/templates.html - Original Message - From: "Jeff Maze - Hostmaster" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, October 16, 2003 4:03 PM Subject: RE: [Declude.JunkMail] Imail/Web mail Where do you get Kill Web Mail? Does it come with iMail 8? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli Sent: Thursday, October 16, 2003 3:01 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Imail/Web mail I use Killer Web Mail but how do you show and sort by TO: Address. - Original Message - From: "Matthew Bramble" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, October 16, 2003 3:36 PM Subject: Re: [Declude.JunkMail] Imail/Web mail > I do pretty much the same thing, though I use Killer Web Mail for this > purpose. > > I think you are talking about the list of messages, in which case you > might have to re-code your Web Mail templates to get that to work. > You can though do things like add the weight to the subject and > probably even the To address using the SUBJECT functionality in your > Default.$Junkmail$ file. I append the weight to the messages with > SUBJECT [%WEIGHT%] for a redundant fail weight test, and then sort by > subject since I never see FP's above a certain score. This comes in > real handy for testing new filters. The only drawback of course is > that all BCC data is lost when you block with Declude. > > Matt > > > Frederick Samarelli wrote: > > >Does anyone know of a way you can display the sender in the Web Mail > >for IMAIL. > > > >I am Routing email to a Web account and would like to display both > >the TO: > >and FROM: > > > >Thanks. > > > >Fred > > > >--- > >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > >"unsubscribe Declude.JunkMail". The archives can be found at > >http://www.mail-archive.com. > > > > > > > > > > -- > === > Matthew S. Bramble > President and Technical Coordinator > iGaia Incorporated, Operator of NYcars.com > --- > Office Phone: (518) 862-9042 > Cellular: (518) 229-3375 > Fax: (518) 862-9044 > E-mail: [EMAIL PROTECTED] or [EMAIL PROTECTED] > === > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail/Web mail
Fred, you can't by default. If you are savvy with their code, you could probably change the templates to list the To: address in place of the From: address in their list interface (probably a matter of changing a single variable in a single file), but be careful not to apply the changes to a domain where others are using the Interface. Jeff, Killer WebMail is an add-on product that is now offered by Ipswitch: http://www.ipswitch.com/Products/IMail_Server/killer_web.html Matt Frederick Samarelli wrote: I use Killer Web Mail but how do you show and sort by TO: Address. - Original Message - From: "Matthew Bramble" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, October 16, 2003 3:36 PM Subject: Re: [Declude.JunkMail] Imail/Web mail I do pretty much the same thing, though I use Killer Web Mail for this purpose. I think you are talking about the list of messages, in which case you might have to re-code your Web Mail templates to get that to work. You can though do things like add the weight to the subject and probably even the To address using the SUBJECT functionality in your Default.$Junkmail$ file. I append the weight to the messages with SUBJECT [%WEIGHT%] for a redundant fail weight test, and then sort by subject since I never see FP's above a certain score. This comes in real handy for testing new filters. The only drawback of course is that all BCC data is lost when you block with Declude. Matt Frederick Samarelli wrote: Does anyone know of a way you can display the sender in the Web Mail for IMAIL. I am Routing email to a Web account and would like to display both the TO: and FROM: Thanks. Fred
Re: [Declude.JunkMail] Unknown Weight Assssignment
My log file shows the test nHELOBOGUS with a weight of 2, but nHELOBOGUS doesn't appear in either the global or junkmail files. 10/16/2003 00:00:08 Q25d7164f0020f12d SPAMCOP:8 EASYNET-DNSBL:8 nHELOBOGUS:2 SNIFFER:7 . Total weight = 25 The "n" means "negative". You have the HELOBOGUS test set to have a negative weight of 2, so that E-mail that does *not* fail the HELOBOGUS test has a weight of 2 added to it. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Unknown Weight Assssignment
My log file shows the test nHELOBOGUS with a weight of 2, but nHELOBOGUS doesn't appear in either the global or junkmail files. The test HELOBOGUS is in both the log and the global or junkmail files. What is nHELOBOGUS and where could it be coming from? Example of log below: 10/16/2003 00:00:08 Q25d7164f0020f12d SPAMCOP:8 EASYNET-DNSBL:8 nHELOBOGUS:2 SNIFFER:7 . Total weight = 25 10/16/2003 00:00:08 Q25d7164f0020f12d Msg failed SPAMCOP (Blocked - see http://www.spamcop.net/bl.shtml?63.87.243.230). Action=WARN. 10/16/2003 00:00:08 Q25d7164f0020f12d Msg failed EASYNET-DNSBL (Blacklisted by easynet.nl DNSBL - http://blackholes.easynet.nl/errors.html). Action=WARN. 10/16/2003 00:00:08 Q25d7164f0020f12d Msg failed SNIFFER (Message failed SNIFFER: 57.). Action=WARN. 10/16/2003 00:00:08 Q25d7164f0020f12d Msg failed WEIGHT5 (Weight of 25 reaches or exceeds the limit of 5.). Action=WARN. 10/16/2003 00:00:08 Q25d7164f0020f12d Msg failed WEIGHT8 (Weight of 25 reaches or exceeds the limit of 8.). Action=WARN. 10/16/2003 00:00:08 Q25d7164f0020f12d Msg failed WEIGHT10 (Weight of 25 reaches or exceeds the limit of 10.). Action=DELETE. 10/16/2003 00:00:08 Q25d7164f0020f12d Msg failed WEIGHT20 (Weight of 25 reaches or exceeds the limit of 20.). Action=WARN. 10/16/2003 00:00:08 Q25d7164f0020f12d Deleting spam from [EMAIL PROTECTED] to [EMAIL PROTECTED] 10/16/2003 00:00:08 Q25d7164f0020f12d Subject: I made $250K, Using OTHER People's Money 10/16/2003 00:00:08 Q25d7164f0020f12d From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 63.87.243.230 ID: 10/16/2003 00:00:08 Q25d730df0032f2e2 NOABUSE:2 NOPOSTMASTER:1 BASE64:4 HELOBOGUS:4 SPAMHEADERS:4 SNIFFER:7 . Total weight = 22 10/16/2003 00:00:08 Q25d730df0032f2e2 Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 10/16/2003 00:00:08 Q25d730df0032f2e2 Msg failed NOPOSTMASTER (Not supporting [EMAIL PROTECTED]). Action=WARN. 10/16/2003 00:00:08 Q25d730df0032f2e2 Msg failed BASE64 (A binary encoded text or HTML section was found in this E-mail.). Action=WARN. 10/16/2003 00:00:08 Q25d730df0032f2e2 Msg failed HELOBOGUS (Domain D89TF911 returns a server failure for MX or A records.). Action=WARN. 10/16/2003 00:00:08 Q25d730df0032f2e2 Msg failed SPAMHEADERS (This E-mail has headers consistent with spam [420e].). Action=WARN. 10/16/2003 00:00:08 Q25d730df0032f2e2 Msg failed SNIFFER (Message failed SNIFFER: 52.). Action=WARN. 10/16/2003 00:00:08 Q25d730df0032f2e2 Msg failed WEIGHT5 (Weight of 22 reaches or exceeds the limit of 5.). Action=WARN. 10/16/2003 00:00:08 Q25d730df0032f2e2 Msg failed WEIGHT8 (Weight of 22 reaches or exceeds the limit of 8.). Action=WARN. 10/16/2003 00:00:08 Q25d730df0032f2e2 Msg failed WEIGHT10 (Weight of 22 reaches or exceeds the limit of 10.). Action=DELETE. 10/16/2003 00:00:08 Q25d730df0032f2e2 Msg failed WEIGHT20 (Weight of 22 reaches or exceeds the limit of 20.). Action=WARN. 10/16/2003 00:00:08 Q25d730df0032f2e2 Deleting spam from [EMAIL PROTECTED] to [EMAIL PROTECTED] 10/16/2003 00:00:08 Q25d730df0032f2e2 Subject: Mortage is still at a all time low get Get approved today rates as low as 4.7 ..,. At 03:50 PM 10/15/2003 -0700, you wrote: X-RBL-Warning: SNIFFER: Message failed SNIFFER: 62. The above is not the Sniffer weight, it the Sniffer category that the test failed (see http://www.sortmonster.com/MessageSniffer/Help/ResultCodesHelp.html). If you look in your log file, you will be able to see the actual weight applied. Bill - Original Message - From: "Wesley M" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, October 15, 2003 2:42 PM Subject: [Declude.JunkMail] Unknown Weight Aignment > I have awarded the sniffer test a weight of 5, but I'm not sure were the > higher weights are coming from. The global.cfg file shows only a weight of > 5 for sniffer, and I don't have special user settings on my account. It > doesn't appear like any other tests are failing based on the header of the > message(other than the weight tests). Any ideas where the weight of nine > is coming from? > > == header of message == > > Received: from paris2.webpipe.net [63.172.126.12] by imail.stic.net with ESMTP > (SMTPD32-8.03) id AC7927330052; Wed, 15 Oct 2003 16:30:33 -0500 > Received: from vinzenz.de ([212.70.36.2]) > by paris2.webpipe.net (8.9.3/8.9.3) with ESMTP id MAA14215; > Wed, 15 Oct 2003 12:50:47 -0400 > Message-ID: <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Cc: <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>, > <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>, > <[EMAIL PROTECTED]> > From: "STephanie Jason" <[EMAIL PROTECTED]> > Subject: TRZA ag Stock OTCBB highest volume trader19057 > Date: Wed, 15 Oct 2003 09:51:10 -1900 > MIME-Version: 1.0 > Content-Type: text/plain; > charset="Windows-1252" > Content-Transfer-Encoding: 7bit > X-RBL-Warning: SNIFFER: Message failed SNIFFER: 62. > X-RBL-Warning: WEIGHT5: Weight of 9 reaches o
RE: [Declude.JunkMail] Imail/Web mail
Where do you get Kill Web Mail? Does it come with iMail 8? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli Sent: Thursday, October 16, 2003 3:01 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Imail/Web mail I use Killer Web Mail but how do you show and sort by TO: Address. - Original Message - From: "Matthew Bramble" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, October 16, 2003 3:36 PM Subject: Re: [Declude.JunkMail] Imail/Web mail > I do pretty much the same thing, though I use Killer Web Mail for this > purpose. > > I think you are talking about the list of messages, in which case you > might have to re-code your Web Mail templates to get that to work. > You can though do things like add the weight to the subject and > probably even the To address using the SUBJECT functionality in your > Default.$Junkmail$ file. I append the weight to the messages with > SUBJECT [%WEIGHT%] for a redundant fail weight test, and then sort by > subject since I never see FP's above a certain score. This comes in > real handy for testing new filters. The only drawback of course is > that all BCC data is lost when you block with Declude. > > Matt > > > Frederick Samarelli wrote: > > >Does anyone know of a way you can display the sender in the Web Mail > >for IMAIL. > > > >I am Routing email to a Web account and would like to display both > >the TO: > >and FROM: > > > >Thanks. > > > >Fred > > > >--- > >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > >"unsubscribe Declude.JunkMail". The archives can be found at > >http://www.mail-archive.com. > > > > > > > > > > -- > === > Matthew S. Bramble > President and Technical Coordinator > iGaia Incorporated, Operator of NYcars.com > --- > Office Phone: (518) 862-9042 > Cellular: (518) 229-3375 > Fax: (518) 862-9044 > E-mail: [EMAIL PROTECTED] or [EMAIL PROTECTED] > === > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail/Web mail
I use Killer Web Mail but how do you show and sort by TO: Address. - Original Message - From: "Matthew Bramble" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, October 16, 2003 3:36 PM Subject: Re: [Declude.JunkMail] Imail/Web mail > I do pretty much the same thing, though I use Killer Web Mail for this > purpose. > > I think you are talking about the list of messages, in which case you > might have to re-code your Web Mail templates to get that to work. You > can though do things like add the weight to the subject and probably > even the To address using the SUBJECT functionality in your > Default.$Junkmail$ file. I append the weight to the messages with > SUBJECT [%WEIGHT%] for a redundant fail weight test, and then sort by > subject since I never see FP's above a certain score. This comes in > real handy for testing new filters. The only drawback of course is that > all BCC data is lost when you block with Declude. > > Matt > > > Frederick Samarelli wrote: > > >Does anyone know of a way you can display the sender in the Web Mail for > >IMAIL. > > > >I am Routing email to a Web account and would like to display both the TO: > >and FROM: > > > >Thanks. > > > >Fred > > > >--- > >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >type "unsubscribe Declude.JunkMail". The archives can be found > >at http://www.mail-archive.com. > > > > > > > > > > -- > === > Matthew S. Bramble > President and Technical Coordinator > iGaia Incorporated, Operator of NYcars.com > --- > Office Phone: (518) 862-9042 > Cellular: (518) 229-3375 > Fax: (518) 862-9044 > E-mail: [EMAIL PROTECTED] or [EMAIL PROTECTED] > === > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAM DOMAINS
Hello, Darrell, It depends on the FQDN (Fullly Qualified Domain Name) that you extracted mac.com from. For example, if legit e-mail sometimes uses either @mac.com or @.mac.com you could add two entries to your Spam Domain text file... @mac.com apple.com .mac.com apple.com Later, Dan Geiser [EMAIL PROTECTED] - Original Message - From: "Darrell LaRock" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, October 16, 2003 1:34 PM Subject: [Declude.JunkMail] SPAM DOMAINS > We have a listing in our spam domains file > mac.com apple.com > > this line seems to be tripping off on the following > X-RBL-Warning: SPAMDOMAINS: Spamdomain 'mac.com' found: Address of > [EMAIL PROTECTED] sent from invalid [No Reverse DNS]. > > How do I prevent the "mac.com" spam domain entry from picking up on for > example freediemac.com? > > Thanks > Darrell > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > Sign up for virus-free and spam-free e-mail with Nexus Technology Group > http://www.nexustechgroup.com/mailscan > > --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spam Filtering on Store and Forward Domains
If I use Declude JunkMail to do Spam Filtering on a domain name, e.g. acme.com, that I am doing IMail Store and Forward (http://support.ipswitch.com/kb/IM-19980116-DM01.htm) for can I exert control over the per-domain spam filtering by creating an acme.com directory (with associated $default$.junkmail in that directory) underneath the \imail\declude\ directory as I do with all of my other domains which are local (aren't Store and Forward)? Yes, you can. Assuming the answer is yes, if I don't create the acme.com directory is global.cfg used to control the spam filtering for Store and Forward domains? Correct. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spam Filtering on Store and Forward Domains
Hello, All, If I use Declude JunkMail to do Spam Filtering on a domain name, e.g. acme.com, that I am doing IMail Store and Forward (http://support.ipswitch.com/kb/IM-19980116-DM01.htm) for can I exert control over the per-domain spam filtering by creating an acme.com directory (with associated $default$.junkmail in that directory) underneath the \imail\declude\ directory as I do with all of my other domains which are local (aren't Store and Forward)? Assuming the answer is yes, if I don't create the acme.com directory is global.cfg used to control the spam filtering for Store and Forward domains? Thanks In Advance, Dan Geiser <[EMAIL PROTECTED]> --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail/Web mail
I do pretty much the same thing, though I use Killer Web Mail for this purpose. I think you are talking about the list of messages, in which case you might have to re-code your Web Mail templates to get that to work. You can though do things like add the weight to the subject and probably even the To address using the SUBJECT functionality in your Default.$Junkmail$ file. I append the weight to the messages with SUBJECT [%WEIGHT%] for a redundant fail weight test, and then sort by subject since I never see FP's above a certain score. This comes in real handy for testing new filters. The only drawback of course is that all BCC data is lost when you block with Declude. Matt Frederick Samarelli wrote: Does anyone know of a way you can display the sender in the Web Mail for IMAIL. I am Routing email to a Web account and would like to display both the TO: and FROM: Thanks. Fred --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- === Matthew S. Bramble President and Technical Coordinator iGaia Incorporated, Operator of NYcars.com --- Office Phone: (518) 862-9042 Cellular: (518) 229-3375 Fax: (518) 862-9044 E-mail: [EMAIL PROTECTED] or [EMAIL PROTECTED] === --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Selective queue delete based on string?
Thanks Scott and others - this approach did the trick. -- Original Message -- From: "R. Scott Perry" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Thu, 16 Oct 2003 12:15:24 -0400 > >>As a follow up to my previous issue with overflowing overflow, bad luck >>continues today with a mail bomb consisting of the Nigerian scam to a >>specific user...38,000 copies give or take a few. So, a lesson in mail >>bomb recovery... >> >>Hence my question, is there a decent utility or script to selectively >>remove from the queue based on specific text in the message? >> >>I can identify the messages using any number of text search utilities, but >>I am hesitant to just delete them knowing that there is a corresponding >>message in the overflow queueis it a matter of just getting the >>messageID's into a file and then zapping them from the /imail/spool and >>the /imail/spool/overflow in pairs? > >That would work. What I would recommend is moving the files to another >directory, where you can search them again to make sure that none were >accidentally caught. > >I'm not aware of any utilities that can do this automatically, >however. It's about time someone writes such a utility for IMail though. > >-Scott >--- >Declude JunkMail: The advanced anti-spam solution for IMail mailservers. >Declude Virus: Catches known viruses and is the leader in mailserver >vulnerability detection. >Find out what you've been missing: Ask about our free 30-day evaluation. > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Imail/Web mail
Does anyone know of a way you can display the sender in the Web Mail for IMAIL. I am Routing email to a Web account and would like to display both the TO: and FROM: Thanks. Fred --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAM DOMAINS
- Original Message - From: "Darrell LaRock" <[EMAIL PROTECTED]> > We have a listing in our spam domains file > mac.com apple.com > > this line seems to be tripping off on the following > X-RBL-Warning: SPAMDOMAINS: Spamdomain 'mac.com' found: Address of > [EMAIL PROTECTED] sent from invalid [No Reverse DNS]. > > How do I prevent the "mac.com" spam domain entry from picking up on for > example freediemac.com? Try using: "@mac.com apple.com" (without the quote make, of course) in your spamdomains file. The "@" sign will delimit the from address to those that are only from @mac.com. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Mail server slow on delivering messages and spool is building and spool is building
I have seen messages in the last couple of day on this list and the IMail list about the spool directory filling and showing an overflow directory. I have in the last 4 days seem the spool fill to 68,000 message with the overflow having a like number of Qxxx-xxx.smd files.I see some mail come into the server and delivered to the mailbox quickly, I see mail delayed by an hour and some delayed by many hours. I have checked the logs both Imail and Declude I do not see and problems. So an E-mail that is delayed by many hours has entries in the IMail and Declude log files that are at the same time (IE log file entries are at 09:54 and 09:55, but the E-mail was delivered at 11:35)? This started on the 13 th There is 39,000 messages form that day. 14,000 form the 14th and about 14,000 from the 15th and 3,000 from today most of them came in the last hour. Were there any major changes made that day (upgrades, for example)? Is your primary DNS server working? Is your mail volume much higher now than it was before the 13th? My question is why if the queue timer is set to 30 Mins with 20 attempts which is 10 hours why are the so many messages fro the 13th still in the spool and over flow directory. Because the queue timer is designed to determine how often E-mails will be retried after the first attempt. If it takes IMail 2 hours to try an E-mail for the first time, it isn't going to be able to try it 30 minutes after it was received. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter question
So now I would ask what the source of the E-mail shows? This particular one, came in plain text, I just realized. That is probably why I didn't use the source to begin with. When I right click on it, view source is greyed out. I would be happy to forward the email to the list but I did that earlier and I'm thinking everyone's filter blocked it but mine. Sharyn We are the worldwide producer and marketer of the award winning Cruzan Single Barrel Rum, judged "Best in the World" at the annual San Francisco Wine and Spirits Championships. For more information, please click (go to) http://www.cruzanrums.com";>www.cruzanrums.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPAM DOMAINS
We have a listing in our spam domains file mac.com apple.com this line seems to be tripping off on the following X-RBL-Warning: SPAMDOMAINS: Spamdomain 'mac.com' found: Address of [EMAIL PROTECTED] sent from invalid [No Reverse DNS]. How do I prevent the "mac.com" spam domain entry from picking up on for example freediemac.com? Thanks Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Dial-ups
Scott, can you clarify something about the "DUL" and "DYNA" fragments in the test name? I've got an "ipfile" test that I'd like to only run against the first IP, so I renamed it YADDA-DYNA but it is still running against my full hop count. Does the nifty "DUL" and "DYNA" name hop restriction only work for "ip4r" tests? Sorry, they only work for the ip4r tests. The ipfile test types only work with the IP of the remote mailserver (the first IP that isn't bypassed with the IPBYPASS or HOP settings). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter question
I cut and pasted it from what I was viewing in the email, NOT from the source, hence my original question. I did go back and run the -diag and I am definitely running JM 1.75 So now I would ask what the source of the E-mail shows? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Dial-ups
Scott, can you clarify something about the "DUL" and "DYNA" fragments in the test name? I've got an "ipfile" test that I'd like to only run against the first IP, so I renamed it YADDA-DYNA but it is still running against my full hop count. Does the nifty "DUL" and "DYNA" name hop restriction only work for "ip4r" tests? Andrew 8) -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Wednesday, October 15, 2003 10:55 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Dial-ups >With regard to the headers below, 68.116.154.119 should not be >considered by the dial-ups test, correct? It is failing, however. >Do I have a config issue? > > >DIALUPS ip4rdialups.visi.com The problem is that Declude JunkMail doesn't know that "DIALUPS" is a test that should only be checked against the first IP. The test name needs to have "DUL" or "DYNA" in it in order for Declude JunkMail to only run the test on the first IP. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Null Sender Spam for Valid Accounts
You could put in a temporary rule that holds or routes all message with a blank or <> as sender, that way the end user will not see them, but you will still be complying with the requirements. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Roger Heath > Sent: Thursday, October 16, 2003 1:53 AM > To: R. Scott Perry > Subject: [Declude.JunkMail] Null Sender Spam for Valid Accounts > > Looking at Scott's response below, I'd like to have the Refuse Null > Sender switch off, but we have a situation where spammers are forging > valid e-mail addresses. We have thousands of bounces showing up for > messages never sent from valid accounts here. For example, > [EMAIL PROTECTED] may be a valid account but he is not a > spammer. But a spammer uses [EMAIL PROTECTED] forges tens of > thousands of messages with this as the 'reply to' account in headers. > Since the spammer has many unvalid accounts in his spamming, > [EMAIL PROTECTED] is swamped with thousands of bounced mails for > mails that he did not even send... This is now happening to hundreds > of accounts here because it looks like the spammer's software is > randomly selecting them from a spam list. > > I have re-enabled 'Refuse Null Senders' to relieve this problem, but > would like to find a more compliant solution. Does any one know how to > attack this issue in another way? > > -- > Roger Heath > [EMAIL PROTECTED] > www.rleeheath.com > > R> Well, the real question is why do you think that you are safer by > R> rejecting those E-mails? I'm not aware of any safety issues. The > R> only issue I am aware of is that a small percentage of spammers > R> send their spam that way. > R> > R> The NULL <> sender has been used for over 20 years for bounce > R> messages and other automated messages (such as vacation messages, > R> and those awful spam confirmation E-mails, and Delivery Status > R> Notifications). > R> > R> So the choices are : > R> > R> [1] Comply (leave "Refuse NULL <> Senders" at the default UNchecked > R> setting). Pros: Your mailserver will act as expected. Cons: As very > R> small percentage of spam is sent this way, but it can be detected > R> using standard spam control. > R> > R> [2] Refuse NULL <> senders. Pros: You'll have that "safe" feeling. > R> Cons: You won't receive all your E-mail, because you're blocking > R> someofit,andbecauseyou'llgetlisted at > R> http://www.rfc-ignorant.org . > R> > R> -Scott > > > > > > -- > ActivatorMail(tm) ver.01010031 Scanned for all viruses by > www.activatormail.com intelligent anti-virus anti-spam service > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter question
Those do look the same. Did you cut and paste it from what you were viewing in the E-mail, or from the source? I cut and pasted it from what I was viewing in the email, NOT from the source, hence my original question. I did go back and run the -diag and I am definitely running JM 1.75 Sharyn We are the worldwide producer and marketer of the award winning Cruzan Single Barrel Rum, judged "Best in the World" at the annual San Francisco Wine and Spirits Championships. For more information, please click (go to) http://www.cruzanrums.com";>www.cruzanrums.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Selective queue delete based on string?
That's great, thanks...I appreciate a little humor in the midst of my spam-induced grief ;) -- Original Message -- From: "Sean Fahey" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Thu, 16 Oct 2003 10:34:01 -0500 >Oh, well then you need to visit this site: > >http://j-walk.com/other/conf/index.htm > > >-Original Message- >On Behalf Of Dan Cummings >Subject: [Declude.JunkMail] Selective queue delete based on string? > > >As a follow up to my previous issue with overflowing overflow, bad luck >continues today with a mail bomb consisting of the Nigerian scam to a >specific user...38,000 copies give or take a few. So, a lesson in mail bomb >recovery... > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter question
Here are the message headers: X-Spam-Tests-Failed: ROUTING OK, it did not fail the INBODYFILTER test. Here is the line in the filter itself: BODY 0 CONTAINS Bachelors and other higher education available in your fields And here is the line, copied and pasted directly from the spam email that should've triggered the filter and didn't: Bachelors and other higher education available in your fields Those do look the same. Did you cut and paste it from what you were viewing in the E-mail, or from the source? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Outlook 2003 file attachments
I took a quick look and here are the extensions I added from the list below that were not in my original list from Outlook 2002 These seem to be new in Outlook 2003 .app Microsoft FoxPro-generated application .csh Unix shell script .fxp Microsoft FoxProR file .ksh Unix shell script .mda Microsoft Access add-in program .mdt Microsoft Access file .mdw Microsoft Access file .mdz Microsoft Access wizard program .ops FoxPro file .prg FoxPro program source file .xsl XML file that can contain script Sincerely, William J. Baumbach II [EMAIL PROTECTED] 9975 Pennsylvania Ave. Manassas, Va. 20110-2028 Ph: 703-367-7900 ext:1708 Fax: 703-691-0946 - - Original Message - From: "Markus Gufler" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, October 15, 2003 3:54 PM Subject: [Declude.JunkMail] Outlook 2003 file attachments This is the list of file extensions that are configured in Outlook 2003 as Level1 (means: file can not be opened or saved to disk) Maybe someone can compare it with his current BANEXT list and add some "new" extensions. .ade Microsoft Access project extension .adp Microsoft Access project .app Microsoft FoxPro-generated application .bas Microsoft Visual BasicR class module .bat Batch file .chm Compiled HTML Help file .cmd Microsoft Windows NTR command script .com Microsoft MS-DOSR program .cpl Control Panel extension .crt Security certificate .csh Unix shell script .exe Executable file or program .fxp Microsoft FoxProR file .hlp Help file .hta HTML program .inf Setup information .ins Internet naming service .isp Internet communication settings .js JscriptR file .jse Jscript-encoded script file .ksh Unix shell script .lnk Shortcut .mda Microsoft Access add-in program .mdb Microsoft Access program .mde Microsoft Access MDE database .mdt Microsoft Access file .mdw Microsoft Access file .mdz Microsoft Access wizard program .msc Microsoft Common Console document .msi Windows Installer package .msp Windows Installer patch .mst Visual Test source files .ops FoxPro file .pcd Photo CD image or Microsoft Visual Test compiled script .pif Shortcut to MS-DOS program .prf Microsoft Outlook Profile Settings .prg FoxPro program source file .reg Registration entries .scf Windows Explorer Command file .scr Screen saver .sct WindowsR script component .shb Shortcut into a document .shs Shell scrap object .url Internet shortcut .vb VBScript file .vbe VBScript-encoded script file .vbs VBScript file .wsc Windows script component .wsf Windows script file .wsh Windows script host settings file .xsl XML file that can contain script --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. [ scanned for spam to: [EMAIL PROTECTED] incoming http://www.DcMetroNet.com on 10/15/2003 at 16:01:19-0500et. ] [ scanned for viruses to: [EMAIL PROTECTED] incoming http://www.DcMetroNet.com on 10/15/2003 at 16:01:22-0500et. ] [ scanned for spam to: [EMAIL PROTECTED] outgoing http://www.DcMetroNet.com on 10/16/2003 at 12:12:56-0500et. ] This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution of this email is prohibited. If you are not the intended recipient, please contact the sender and destroy all paper and electronic copies of this message. [ scanned for viruses to: [EMAIL PROTECTED] outgoing http://www.DcMetroNet.com on 10/16/2003 at 12:12:59-0500et. ] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Mail server slow on delivering messages and spool is building
Hello List, I have seen messages in the last couple of day on this list and the IMail list about the spool directory filling and showing an overflow directory. I have in the last 4 days seem the spool fill to 68,000 message with the overflow having a like number of Qxxx-xxx.smd files.I see some mail come into the server and delivered to the mailbox quickly, I see mail delayed by an hour and some delayed by many hours. I have checked the logs both Imail and Declude I do not see and problems. This started on the 13 th There is 39,000 messages form that day. 14,000 form the 14th and about 14,000 from the 15th and 3,000 from today most of them came in the last hour. My question is why if the queue timer is set to 30 Mins with 20 attempts which is 10 hours why are the so many messages fro the 13th still in the spool and over flow directory. Is the a way to tell what attempt number a message is onI can not load view que from Email admin to look Any help will be greatly appreciated. Lenny Bauman LRBCG.COM, Inc. Phone 419-621-5770 Toll Free 1-800-NET-ACCESS (638-2223) E-mail [EMAIL PROTECTED] --- [This E-mail scanned for viruses by LRBCG.COM, Inc.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Selective queue delete based on string?
As a follow up to my previous issue with overflowing overflow, bad luck continues today with a mail bomb consisting of the Nigerian scam to a specific user...38,000 copies give or take a few. So, a lesson in mail bomb recovery... Hence my question, is there a decent utility or script to selectively remove from the queue based on specific text in the message? I can identify the messages using any number of text search utilities, but I am hesitant to just delete them knowing that there is a corresponding message in the overflow queueis it a matter of just getting the messageID's into a file and then zapping them from the /imail/spool and the /imail/spool/overflow in pairs? That would work. What I would recommend is moving the files to another directory, where you can search them again to make sure that none were accidentally caught. I'm not aware of any utilities that can do this automatically, however. It's about time someone writes such a utility for IMail though. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Selective queue delete based on string?
Here's a follow up, please critique! This seems like it could do the trick...performing findstr in the /imail/spool/overflow directory (or the spool directory depending) findstr /m somestringhere *.smd > kill.txt and then manipulating kill.txt into a batch file using ultraedit or the like to insert 'del' before Q.SMD (for the overflow directory) and del D.SMD (for the corresponding files in the spool directory) and then running each in their respective directories? Klunky, yes, but I'm tired...seems like it should work OK...yes? Thanks! -- Original Message -- From: "Sean Fahey" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Thu, 16 Oct 2003 10:34:01 -0500 >Oh, well then you need to visit this site: > >http://j-walk.com/other/conf/index.htm > > >-Original Message- >On Behalf Of Dan Cummings >Subject: [Declude.JunkMail] Selective queue delete based on string? > > >As a follow up to my previous issue with overflowing overflow, bad luck >continues today with a mail bomb consisting of the Nigerian scam to a >specific user...38,000 copies give or take a few. So, a lesson in mail bomb >recovery... > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Mail server slow on delivering messages an d spool is building d spool is building
Lenny, I had a similar problem about a month or so ago. I found the resolution to be a combination of a fragmented paging file on the server and the use of DNSILLEGAL, DNSMAILLIST, DNSPROMO, and DNSUCE in the decluce junkmail test. I defragged the paging file and took those test out and everything has been working fine since. Daniel == Daniel Ivey GCR Company / GCR Online Voice: 434 - 570 - 1765 Fax: 434 - 572 - 1981 [EMAIL PROTECTED] -Original Message- From: Lenny Bauman [mailto:[EMAIL PROTECTED] Sent: Thursday, October 16, 2003 10:57 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Mail server slow on delivering messages and spool is building Hello List, I have seen messages in the last couple of day on this list and the IMail list about the spool directory filling and showing an overflow directory. I have in the last 4 days seem the spool fill to 68,000 message with the overflow having a like number of Qxxx-xxx.smd files.I see some mail come into the server and delivered to the mailbox quickly, I see mail delayed by an hour and some delayed by many hours. I have checked the logs both Imail and Declude I do not see and problems. This started on the 13 th There is 39,000 messages form that day. 14,000 form the 14th and about 14,000 from the 15th and 3,000 from today most of them came in the last hour. My question is why if the queue timer is set to 30 Mins with 20 attempts which is 10 hours why are the so many messages fro the 13th still in the spool and over flow directory. Is the a way to tell what attempt number a message is onI can not load view que from Email admin to look Any help will be greatly appreciated. Lenny Bauman LRBCG.COM, Inc. Phone 419-621-5770 Toll Free 1-800-NET-ACCESS (638-2223) E-mail [EMAIL PROTECTED] --- [This E-mail scanned for viruses by LRBCG.COM, Inc.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Versioning of interim releases
The way I keep track of what version is to add to the header of all incoming and outgoing emails the version using a Declude variable In the GLOBAL.CFG file I have added these two lines XINHEADER X-In-Note: This E-mail was comming into %LOCALHOST% Declude ver.%VERSION%. XOUTHEADER X-Out-Note: This E-mail was going out of %LOCALHOST% Declude ver.%VERSION%. the two lines above lets me easily see the exact version of Declude and the domain name the email passed through to see what i am talking about just read the headder of this email Sincerely, William J. Baumbach II [EMAIL PROTECTED] 9975 Pennsylvania Ave. Manassas, Va. 20110-2028 Ph: 703-367-7900 ext:1708 Fax: 703-691-0946 - - Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, October 15, 2003 1:52 PM Subject: Re: [Declude.JunkMail] Versioning of interim releases >A simple question or two (I hope) regarding release versions. > >A previous thread referred to release version 1.76i4 and 1.76i6. Also a >reply from Scott provided a link to download a different interim release >(1.76i7). > >How would I find out what specific interim release version I am running? I >ran declude.exe -diag and it only showed 176 as the version. > >Am I missing something? You're not missing anything (except the latest interim release). A released version or beta version will normally be in the format #.## (such as "1.75" or "1.76"). In some cases, they will have an "a" or "b" after them (for example, if we need to make a change immediately after a new beta version is posted online, we may add the "a" or "b", in case anyone downloaded the one without the change). The interim releases always are in the format "#.##i#" or "#.##i##" (the "i" indicating an interim release). So 1.76 is either a beta or released version ( http://www.declude.com/relnotes.htm shows that it is a beta). 1.76i6 is an interim release. >Also, is there a revision history document related to interim releases >available on-line? No. Interim releases are designed to quickly get fixes and new features to the customers who need them. There are obvious advantages to that, but it comes with a price. In order to quickly come out with an interim release, we don't have a list of changes online, and we may require you to go back to a previous version if there are problems. We could change that, but then we would be back to beta versions, which take more time to release. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. [ scanned for spam to: [EMAIL PROTECTED] incoming http://www.DcMetroNet.com on 10/15/2003 at 13:56:32-0500et. ] [ scanned for viruses to: [EMAIL PROTECTED] incoming http://www.DcMetroNet.com on 10/15/2003 at 13:56:36-0500et. ] [ scanned for spam to: [EMAIL PROTECTED] outgoing http://www.DcMetroNet.com on 10/16/2003 at 11:51:27-0500et. ] This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution of this email is prohibited. If you are not the intended recipient, please contact the sender and destroy all paper and electronic copies of this message. [ scanned for viruses to: [EMAIL PROTECTED] outgoing http://www.DcMetroNet.com on 10/16/2003 at 11:51:30-0500et. ] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Selective queue delete based on string?
Oh, well then you need to visit this site: http://j-walk.com/other/conf/index.htm -Original Message- On Behalf Of Dan Cummings Subject: [Declude.JunkMail] Selective queue delete based on string? As a follow up to my previous issue with overflowing overflow, bad luck continues today with a mail bomb consisting of the Nigerian scam to a specific user...38,000 copies give or take a few. So, a lesson in mail bomb recovery... --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter question
Remember that failing a test and flagging (or any other action) are very different. In this case, the original question made it seem as though the E-mail wasn't failing the test, whereas it may be that the E-mail did fail the test but an action other than the one you wanted was used. The email was't failing the test. Im sorry to be so confusing. The only action I have on this body filter is attach, no weights have been applied. The particular email in question shouldve failed this test and been attached, automatically as that what the action is. Here are the message headers: Received: from 200-140-164-090.bsace7024.dsl.brasiltelecom.net.br [200.140.164.90] by todhunter.com (SMTPD32-7.15) id A5EE223500DE; Thu, 16 Oct 2003 08:58:22 -0400 Received: from [244.16.159.174] by 200-140-164-090.bsace7024.dsl.brasiltelecom.net.br with ESMTP id <009310-63652>; Thu, 16 Oct 2003 13:06:30 -0100 Message-ID: <[EMAIL PROTECTED]> From: "Nelson Hurt" <[EMAIL PROTECTED]> Reply-To: "Nelson Hurt" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: 7 How about obtaining a fully recognized University degree at home!!? Date: Thu, 16 Oct 2003 13:06:30 -0100 X-Mailer: QUALCOMM Windows Eudora Version 5.1 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="FF_E90E7._.F0E265C" X-Priority: 3 X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam [210f]. X-Declude-Sender: [EMAIL PROTECTED] [200.140.164.90] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: ROUTING X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 366043108 Here is the line for the filter in my global.cfg InBodyFilter Filter D:\Imail\Declude\inBody.txt x 0 0 Here are the lines in the user junkmail file that the failed email was addressed to: INBODYFILTERATTACH Here is the line in the filter itself: BODY 0 CONTAINS Bachelors and other higher education available in your fields And here is the line, copied and pasted directly from the spam email that should've triggered the filter and didn't: Bachelors and other higher education available in your fields Thanks, Sharyn We are the worldwide producer and marketer of the award winning Cruzan Single Barrel Rum, judged "Best in the World" at the annual San Francisco Wine and Spirits Championships. For more information, please click (go to) http://www.cruzanrums.com";>www.cruzanrums.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help - overflowing overflow
Thanks for the notes...DNS seemed to be OK, but ended up restarting the server and the queue started being processed normally upon restart. Thanks again! -- Original Message -- From: Matthew Bramble <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Wed, 15 Oct 2003 18:02:12 -0400 >Dan, > >Check your DNS settings. Your outgoing E-mail probably can't be >resolved for external mail server addresses. > >Matt > > > >Dan Cummings wrote: > >>Hi, >> >>Have about 800 users on a decently powered Imail box running Declude 1.75. The >>system has been running great for months, but today I received reports of delayed >>mail and found the overflow folder growing (2000+ messages at present). When I >>test, I find that my messages from outside are typically delivered quickly, but from >>local user to local user are delayed. The server appears to be lightly loaded from >>a processor perspective. Questions 1) any idea of specific causes of such behavior >>and 2) how to force delivery of the overflow queue. >> >>Thanks! >> >> > > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Selective queue delete based on string?
As a follow up to my previous issue with overflowing overflow, bad luck continues today with a mail bomb consisting of the Nigerian scam to a specific user...38,000 copies give or take a few. So, a lesson in mail bomb recovery... Hence my question, is there a decent utility or script to selectively remove from the queue based on specific text in the message? I can identify the messages using any number of text search utilities, but I am hesitant to just delete them knowing that there is a corresponding message in the overflow queueis it a matter of just getting the messageID's into a file and then zapping them from the /imail/spool and the /imail/spool/overflow in pairs? Thanks in advance --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPAM Tests
Does anyone know of any good spam tests that I can add to my weighting to help cut down on the amount of SPAM getting through? I currently have the following tests run: DSBLWARN DNSRBL-SPAM WARN ORDBWARN CBL WARN SPAMCOP DELETE FIVETENKLEZ WARN MAILPOLICEPORN WARN MAILPOLICEBULK WARN DSN WARN NOABUSE WARN NOPOSTMASTERWARN BADHEADERS WARN HELOBOGUS WARN MAILFROMWARN PERCENT DELETE REVDNS WARN ROUTING WARN SPAMHEADERS WARN WEIGHT8 WARN WEIGHT10WARN WEIGHT13DELETE Any other tests that are good and reliable are greatly appreciated. == Daniel Ivey GCR Company / GCR Online Voice: 434 - 570 - 1765 Fax: 434 - 572 - 1981 [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter question
In this last example that everyone's filter probably caught, the original email came through unflagged, but when I forwarded it to the list, the filter caught it. Remember that failing a test and flagging (or any other action) are very different. In this case, the original question made it seem as though the E-mail wasn't failing the test, whereas it may be that the E-mail did fail the test but an action other than the one you wanted was used. Does the X-Spam-Tests-Failed: header show the name of the filter test? If so, the E-mail is failing the test (the next step would be to determine which configuration file was used for the outgoing actions). If not, then then the E-mail did not fail the test (posting the source and the filter string would be helpful to determine what happened there -- for example, the spammer may have used 2 spaces instead of one between some words). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spool / overflow problem ?
I am using PopWeasel to collect mail from another pop server (spam trap) and send it to one of the users to try to set Declude JM up. It has seemed to be working good for the last 3 days. This AM Popweasel dumped 179 messages into the system. Within a few minutes most of the messages were delivered to the localuser. However, I still have 34 SMD files in both the spool and the overflow directory. These appear to be copies of the same messages. Is this a problem? It has been almost 2 hours with no traffic to this machine at all and they are still there. I stopped and started QueMgr and they are still there. One time problem with a message stuck or indicative of an underlying problem? What additional info do I need to properly diagnose the problem? Thanks. You don't need to worry about this. This can happen on test servers that don't receive incoming mail. The problem is that when those 179 messages were dumped, IMail couldn't handle the load, and Declude Queue took over (moving the Q*.SMD files to the \IMail\spool\overflow directory). However, since no more E-mails have arrived, there was nothing to "kick" the overflow queue into starting back up. On a live server, E-mail would arrive, which would get the overflow E-mail sent out. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter question
Im using the latest release. In this last example that everyone's filter probably caught, the original email came through unflagged, but when I forwarded it to the list, the filter caught it. I have double checked the per user configs to ensure both my personal email account (where the forwarded spam was caught) and the original account it was sent to, (where it wasn't caught) have the same action for that filter. They do. So why would it get caught on one account, when forwarded, and not on the other, when received originally? Sharyn -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, October 16, 2003 10:05 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Filter question >For the spam that doesn t contain a URL that I can block in my URL >filter, >I have taken to trying to find phrases that I can block in my BODY filter. > >My question is& > >Should I be blocking these phrases using the text in the email that I >can >see, or should I be blocking phrases that appear when you look at the source. That depends. If there is a difference between what you see and what is in the source of the E-mail, you'll need to determine what the difference is. If the E-mail is HTML with comments or HTML codes used to bypass filters, the latest release of Declude JunkMail (1.75) will be able to filter the text. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. We are the worldwide producer and marketer of the award winning Cruzan Single Barrel Rum, judged "Best in the World" at the annual San Francisco Wine and Spirits Championships. For more information, please click (go to) http://www.cruzanrums.com";>www.cruzanrums.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spool / overflow problem ?
I am having a problem with a test machine. I would like to put it into production but am not sure without checking with the more learned. Win2003 Imail8.03 HF1 Declude AV 1.76b Declude JM 1.76b Message Sniffer as an external test P4 2.4GHz 1 GB ram Right now I have only one domain on it with 2 user names. I am using PopWeasel to collect mail from another pop server (spam trap) and send it to one of the users to try to set Declude JM up. It has seemed to be working good for the last 3 days. This AM Popweasel dumped 179 messages into the system. Within a few minutes most of the messages were delivered to the localuser. However, I still have 34 SMD files in both the spool and the overflow directory. These appear to be copies of the same messages. Is this a problem? It has been almost 2 hours with no traffic to this machine at all and they are still there. I stopped and started QueMgr and they are still there. One time problem with a message stuck or indicative of an underlying problem? What additional info do I need to properly diagnose the problem? Thanks. Grant Sent via the KillerWebMail system at kishvet.com ** This E-mail scanned for viruses by EA Media Mail Services * --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Example of body filter not working
Ok, that was weird. My filter nabbed my email to the declude list, but didn't catch the original email. I have checked the per user configs and the attach action is set to both my account and the original account that the email was sent to. Sharyn We are the worldwide producer and marketer of the award winning Cruzan Single Barrel Rum, judged "Best in the World" at the annual San Francisco Wine and Spirits Championships. For more information, please click (go to) http://www.cruzanrums.com";>www.cruzanrums.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Example of body filter not working
This is a perfect example of my body filter not working.. In my BODY filter, I have the following line: BODY 0 CONTAINS Bachelors and other higher education available in your fields I have the attach action set to this entire filter, yet the email below came through, unattached. For those of you who have this nabbed as spam (although I guess I run the risk of some not even seeing this email), maybe you could share with me how you are blocking stuff like this. Thanks, Sharyn -Original Message- From: Nelson Hurt [mailto:[EMAIL PROTECTED] Sent: Thursday, October 16, 2003 10:07 AM To: [EMAIL PROTECTED] Subject: 7 How about obtaining a fully recognized University degree at home!!? Bachelors and other higher education available in your fields Do you want a prosperous future? Do you want to increase your earning power? Based on your life experience Diplomas from prestigious non-accredited universities No required tests, classes, books, or interviews. To Learn More Call 1 775 490 9881 (anytime including weekends and holidays) Confidentiality assured No one is turned down 1 775 490 9881 == Opt-out http://e-greatoffers.net/[EMAIL PROTECTED] 4 We are the worldwide producer and marketer of the award winning Cruzan Single Barrel Rum, judged "Best in the World" at the annual San Francisco Wine and Spirits Championships. For more information, please click (go to) http://www.cruzanrums.com";>www.cruzanrums.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Filter question On Short Keywords
We make extensive use of filters based on keywords. With short keywords like like S_e_x we sometimes run into problems with keyword being triggered based on base64 encoding of an attachment. Example: 10/13/2003 00:00:36 Q236256fe026ef9a4 Triggered CONTAINS filter WORDFILTER on sex [weight->2; SExQlAnjsABzk My Questions: 1.) Is it possible to have a test created that detects attachments? 2.) Is there some kind of general text that is inserted into the headers or body that indicates that an attachment is present? Thanks Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spam Database lookup filter?
It should be very usefull if we can specifiy optionaly a list of Databases to ask for. So I can see in the result list immediatly how much ip4r and rhbsl tests I've in use that return a positive result. That's a good idea -- I'll see if we can add an option that will let you list which databases to check. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter question
For the spam that doesn t contain a URL that I can block in my URL filter, I have taken to trying to find phrases that I can block in my BODY filter. My question is& Should I be blocking these phrases using the text in the email that I can see, or should I be blocking phrases that appear when you look at the source. That depends. If there is a difference between what you see and what is in the source of the E-mail, you'll need to determine what the difference is. If the E-mail is HTML with comments or HTML codes used to bypass filters, the latest release of Declude JunkMail (1.75) will be able to filter the text. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Delete based on word filter!
I hate to say this but what about using a bounce message? As the postmaster you will get all the undeliverable from the spammers using any banned words and legitimate mailers can contact you if they get an erroneous bounce because and encoded attachment had a random convergence that resulted in a dirty word... Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Dan Horne Sent: Wednesday, October 15, 2003 01:36 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Delete based on word filter! This is the best idea I have heard so far. I will suggest it to my superiors. Regards, Dan Horne, CCNA Web Services Administrator TAIS Web Wilcox World Travel & Tours [EMAIL PROTECTED] CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler > Sent: Wednesday, October 15, 2003 11:59 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Delete based on word filter! > > > > > > Prior to this, we haven't deleted anything outright until > > reviewed by the receptionist. Every time I hear them utter > > the word delete, my skin crawls. > > So my request from the list: Can you either give me some > > ammo to back up my side, or provide me with a solution that > > keeps her from having to see the nastygrams while still > > minimizing false-positives? > > My suggestion is: > 1.) Use SpamReview to review the hold messages > 2.) Set up 2 weight actions (for example when you actually hold on 20 > points) > WEIGHT19 SUBJECT [spam%WEIGHT%] > WEIGHT20 HOLD > > Note: Put a space char after the subject string to divide the > original subject and your [spamxx] > > 3.) Now you can sort all hold messages in SpamReview by their > spam-weight (sort by subject) The receptionist can now review > only the messages between 20 and around 40 points. All above > 200% of your hold weight should be really spam and can be > deleted (or in spamreview "move to hold") So you keep all > hold messages and can set a scheduled task that deletes > regulary all hold spam older then ~14 days. > > With this solution we have to review only around 15% of our > hold spam. The rest can be deleted immediatly - we have never > seen a false positive above 200% of our hold weight. > > If you not want to manualy delete (or "move to hold") > messages above 40 points you can also set up a third weight > action "WEIGHT40 delete" > > So I recommend not to delete based on word filter but over a > certain weight. The receptionist will love this solution and > you can walk trough your office and sing "we save one cent, > we save one cent... for every single spam we hold" ;-) > > Markus > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the > Declude.JunkMail mailing list. To unsubscribe, just send an > E-mail to [EMAIL PROTECTED], and type "unsubscribe > Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Filter question
Title: Filter question Good morning, For the spam that doesn’t contain a URL that I can block in my URL filter, I have taken to trying to find phrases that I can block in my BODY filter. My question is… Should I be blocking these phrases using the text in the email that I can see, or should I be blocking phrases that appear when you look at the source. This filter isn't working very well at all so I'm sure I'm doing something wrong. My URL filter works GREAT. Thanks, Sharyn
[Declude.JunkMail] Spam Database lookup filter?
Hi Scott Nothing urgent but I've had now several time the same situation: Some IP (mostly DUL or xDSL-lines) is listed in several spam databases. The Spam Database lookup is very usefull to find out where this IP is blacklisted. But there are a lot of Databases and I've not configured all in my global.cfg file because -it has created to many FP's -it needs a subscription -it's not reccomended -... It should be very usefull if we can specifiy optionaly a list of Databases to ask for. So I can see in the result list immediatly how much ip4r and rhbsl tests I've in use that return a positive result. I know, I can see this also in the declude logfile or in the X-mailheaders but this requires a SMTP-delivery from this IP-address anytime I want to check it. Maybe something like http://www.dnsstuff.com/tools/ip4r.ch?ip=123.123.123.123&filter=XBL,BLARSBL, SPAMCOP Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Null Sender Spam for Valid Accounts
I have re-enabled 'Refuse Null Senders' to relieve this problem, but would like to find a more compliant solution. Does any one know how to attack this issue in another way? This is a very, very common problem -- if you look at the return addresses of your spam, you'll see that about 90% or so are either valid addresses or could be. Those people will all get bounce messages. By using "Refuse NULL Senders" temporarily, you're saying "These bounces are so bad I'm willing not to receive ANY bounce messages temporarily". And, there's the side-effect that these double-bounces will often be seen by systems administrators, who end up doing your job for you (which is why they list people who do this in http://www.rfc-ignornant.org ). Unfortunately, I'm not aware of any way to easily distinguish these bounces from other bounces. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Null Sender Spam for Valid Accounts
Looking at Scott's response below, I'd like to have the Refuse Null Sender switch off, but we have a situation where spammers are forging valid e-mail addresses. We have thousands of bounces showing up for messages never sent from valid accounts here. For example, [EMAIL PROTECTED] may be a valid account but he is not a spammer. But a spammer uses [EMAIL PROTECTED] forges tens of thousands of messages with this as the 'reply to' account in headers. Since the spammer has many unvalid accounts in his spamming, [EMAIL PROTECTED] is swamped with thousands of bounced mails for mails that he did not even send... This is now happening to hundreds of accounts here because it looks like the spammer's software is randomly selecting them from a spam list. I have re-enabled 'Refuse Null Senders' to relieve this problem, but would like to find a more compliant solution. Does any one know how to attack this issue in another way? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com R> Well, the real question is why do you think that you are safer by R> rejecting those E-mails? I'm not aware of any safety issues. The R> only issue I am aware of is that a small percentage of spammers R> send their spam that way. R> R> The NULL <> sender has been used for over 20 years for bounce R> messages and other automated messages (such as vacation messages, R> and those awful spam confirmation E-mails, and Delivery Status R> Notifications). R> R> So the choices are : R> R> [1] Comply (leave "Refuse NULL <> Senders" at the default UNchecked R> setting). Pros: Your mailserver will act as expected. Cons: As very R> small percentage of spam is sent this way, but it can be detected R> using standard spam control. R> R> [2] Refuse NULL <> senders. Pros: You'll have that "safe" feeling. R> Cons: You won't receive all your E-mail, because you're blocking R> someofit,andbecauseyou'llgetlisted at R> http://www.rfc-ignorant.org . R> R> -Scott -- ActivatorMail(tm) ver.01010031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
