RE: [Declude.JunkMail] Excel files in zip files spreading
Yeah, I started seeing these today too. Anyone have anything set up to catch them? Todd _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (lists) Sent: Saturday, July 28, 2007 11:59 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Excel files in zip files spreading Yes, I see that now. What caught me off guard was the blank subject line this time, as before the subject line contained the name of the file. Thanks. John T From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Saturday, July 28, 2007 9:46 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Excel files in zip files spreading John, It's just another one of the viruses from the Storm botnet. Same guys as the ones sending fake greeting card viruses and PDF stock spam among other things. Matt John T (lists) wrote: I am not sure what is the purpose yet, but I am catching a lot of emails this morning with a blank subject, Thunderbird in the header, attached zip file and the zip file contains an single xls file. THESE ARE NOT LEGIT EMAILS. Any body else seeing this and know what they are, virus or spam? John T --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Excel files in zip files spreading
Yes, I see that now. What caught me off guard was the blank subject line this time, as before the subject line contained the name of the file. Thanks. John T From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Saturday, July 28, 2007 9:46 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Excel files in zip files spreading John, It's just another one of the viruses from the Storm botnet. Same guys as the ones sending fake greeting card viruses and PDF stock spam among other things. Matt John T (lists) wrote: I am not sure what is the purpose yet, but I am catching a lot of emails this morning with a blank subject, Thunderbird in the header, attached zip file and the zip file contains an single xls file. THESE ARE NOT LEGIT EMAILS. Any body else seeing this and know what they are, virus or spam? John T --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Excel files in zip files spreading
John, It's just another one of the viruses from the Storm botnet. Same guys as the ones sending fake greeting card viruses and PDF stock spam among other things. Matt John T (lists) wrote: I am not sure what is the purpose yet, but I am catching a lot of emails this morning with a blank subject, Thunderbird in the header, attached zip file and the zip file contains an single xls file. THESE ARE NOT LEGIT EMAILS. Any body else seeing this and know what they are, virus or spam? *John T* --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Excel files in zip files spreading
I am not sure what is the purpose yet, but I am catching a lot of emails this morning with a blank subject, Thunderbird in the header, attached zip file and the zip file contains an single xls file. THESE ARE NOT LEGIT EMAILS. Any body else seeing this and know what they are, virus or spam? John T --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelisting/negative weights with DNSWL.org
I'll give it a try. Here's what I will use/ DNSWL-FINANCIAL-NONEdnsbl %IP4R%.list.dnswl.org 127.0.2.0 0 0 DNSWL-FINANCIAL-LOW dnsbl %IP4R%.list.dnswl.org 127.0.2.1 0 0 DNSWL-FINANCIAL-MEDIUM dnsbl %IP4R%.list.dnswl.org 127.0.2.2 -10 0 DNSWL-FINANCIAL-HIGHdnsbl %IP4R%.list.dnswl.org 127.0.2.3 -20 0 DNSWL-NEWSLETTERS-NONE dnsbl %IP4R%.list.dnswl.org 127.0.3.0 0 0 DNSWL-NEWSLETTERS-LOW dnsbl %IP4R%.list.dnswl.org 127.0.3.1 0 0 DNSWL-NEWSLETTERS-MEDIUMdnsbl %IP4R%.list.dnswl.org 127.0.3.2 -10 0 DNSWL-NEWSLETTERS-HIGH dnsbl %IP4R%.list.dnswl.org 127.0.3.3 -20 0 DNSWL-ORGANIZATIONS-NONEdnsbl %IP4R%.list.dnswl.org 127.0.4.0 0 0 DNSWL-ORGANIZATIONS-LOW dnsbl %IP4R%.list.dnswl.org 127.0.4.1 0 0 DNSWL-ORGANIZATIONS-MEDIUM dnsbl %IP4R%.list.dnswl.org 127.0.4.2 -10 0 DNSWL-ORGANIZATIONS-HIGHdnsbl %IP4R%.list.dnswl.org 127.0.4.3 -20 0 DNSWL-ISP-NONE dnsbl %IP4R%.list.dnswl.org 127.0.5.0 0 0 DNSWL-ISP-LOW dnsbl %IP4R%.list.dnswl.org 127.0.5.1 0 0 DNSWL-ISP-MEDIUMdnsbl %IP4R%.list.dnswl.org 127.0.5.2 -10 0 DNSWL-ISP-HIGH dnsbl %IP4R%.list.dnswl.org 127.0.5.3 -20 0 DNSWL-PRIVATE-NONE dnsbl %IP4R%.list.dnswl.org 127.0.6.0 0 0 DNSWL-PRIVATE-LOW dnsbl %IP4R%.list.dnswl.org 127.0.6.1 0 0 DNSWL-PRIVATE-MEDIUMdnsbl %IP4R%.list.dnswl.org 127.0.6.2 -10 0 DNSWL-PRIVATE-HIGH dnsbl %IP4R%.list.dnswl.org 127.0.6.3 -20 0 DNSWL-TRAVEL-NONE dnsbl %IP4R%.list.dnswl.org 127.0.7.0 0 0 DNSWL-TRAVEL-LOWdnsbl %IP4R%.list.dnswl.org 127.0.7.1 0 0 DNSWL-TRAVEL-MEDIUM dnsbl %IP4R%.list.dnswl.org 127.0.7.2 -10 0 DNSWL-TRAVEL-HIGH dnsbl %IP4R%.list.dnswl.org 127.0.7.3 -20 0 DNSWL-GOVERNMENT-NONE dnsbl %IP4R%.list.dnswl.org 127.0.8.0 0 0 DNSWL-GOVERNMENT-LOWdnsbl %IP4R%.list.dnswl.org 127.0.8.1 0 0 DNSWL-GOVERNMENT-MEDIUM dnsbl %IP4R%.list.dnswl.org 127.0.8.2 -10 0 DNSWL-GOVERNMENT-HIGH dnsbl %IP4R%.list.dnswl.org 127.0.8.3 -20 0 DNSWL-MEDIA-NONEdnsbl %IP4R%.list.dnswl.org 127.0.9.0 0 0 DNSWL-MEDIA-LOW dnsbl %IP4R%.list.dnswl.org 127.0.9.1 0 0 DNSWL-MEDIA-MEDIUM dnsbl %IP4R%.list.dnswl.org 127.0.9.2 -10 0 DNSWL-MEDIA-HIGHdnsbl %IP4R%.list.dnswl.org 127.0.9.3 -20 0 DNSWL-SPECIAL-NONE dnsbl %IP4R%.list.dnswl.org 127.0.10.0 0 0 DNSWL-SPECIAL-LOW dnsbl %IP4R%.list.dnswl.org 127.0.10.1 0 0 DNSWL-SPECIAL-MEDIUMdnsbl %IP4R%.list.dnswl.org 127.0.10.2 -10 0 DNSWL-SPECIAL-HIGH dnsbl %IP4R%.list.dnswl.org 127.0.10.3 -20 0 DNSWL-EDUCATION-NONEdnsbl %IP4R%.list.dnswl.org 127.0.11.0 0 0 DNSWL-EDUCATION-LOW dnsbl %IP4R%.list.dnswl.org 127.0.11.1 0 0 DNSWL-EDUCATION-MEDIUM dnsbl %IP4R%.list.dnswl.org 127.0.11.2 -10 0 DNSWL-EDUCATION-HIGHdnsbl %IP4R%.list.dnswl.org 127.0.11.3 -20 0 DNSWL-HEALTHCARE-NONE dnsbl %IP4R%.list.dnswl.org 127.0.12.0 0 0 DNSWL-HEALTHCARE-LOWdnsbl %IP4R%.list.dnswl.org 127.0.12.1 0 0 DNSWL-HEALTHCARE-MEDIUM dnsbl %IP4R%.list.dnswl.org 127.0.12.2 -10 0 DNSWL-HEALTHCARE-HIGH dnsbl %IP4R%.list.dnswl.org 127.0.12.3 -20 0 DNSWL-INDUSTRIAL-NONE dnsbl %IP4R%.list.dnswl.org 127.0.13.0 0 0 DNSWL-INDUSTRIAL-LOWdnsbl %IP4R%.list.dnswl.org 127.0.13.1 0 0 DNSWL-INDUSTRIAL-MEDIUM dnsbl %IP4R%.list.dnswl.org 127.0.13.2 -10 0 DNSWL-INDUSTRIAL-HIGH dnsbl %IP4R%.list.dnswl.org 127.0.13.3 -20 0 DNSWL-RETAIL-NONE dnsbl %IP4R%.list.dnswl.org 127.0.14.0 0 0 DNSWL-RETAIL-LOWdnsbl %IP4R%.list.dnswl.org 127.0.14.1 0 0 DNSWL-RETAIL-MEDIUM dnsbl %IP4R%.list.dnswl.org 127.0.14.2 -10 0 DNSWL-RETAIL-HIGH dnsbl %IP4R%.list.dnswl.org 127.0.14.3 -20 0 DNSWL-FINANCIAL-NONEWARN DNSWL-FINANCIAL-LOW WARN DNSWL-FINANCIAL-MEDIUM WARN DNSWL-FINANCIAL-HIGHWARN DNSWL-NEWSLETTERS-NONE WARN DNSWL-NEWSLETTERS-LOW WARN DNSWL-NEWSLETTERS-MEDIUMWARN DNSWL-NEWSLETTERS-HIGH WARN DNSWL-ORGANIZATIONS-NONEWARN DNSWL-ORGANIZATIONS-LOW WARN DNSWL-O
RE: [Declude.JunkMail] whitelisting/negative weights with DNSWL.org
Ewww. Look at all the return codes! I'd be interested in seeing some rates. Does it hit enough to work? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Friday, July 27, 2007 6:42 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] whitelisting/negative weights with DNSWL.org Is anyone using DNSWL (www.dnswl.org) as a separate Declude test? Seems like it is incorporated into SpamAssassin. Do they seem reliable? Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
