[Declude.JunkMail] ComCast delivery failure?

[Don Schreiner]

 

Anyone having problems sending to ComCast? We have a customer and in past
week unable to get mail forwarded to their ComCast address. No changes on
our end, not in any Spam DB.s, DNS report checks out for their domain, etc.
Log snippet below of error. Any help appreciated.

 

20080208 093247 127.0.0.1   SMTP (67320b10193c) >MAIL
FROM:<[EMAIL PROTECTED]>

20080208 093248 127.0.0.1   SMTP (67690b10f043) 452 4.1.0 ...
temporary failure

20080208 093248 127.0.0.1   SMTP (67690b10f043) SMTP_DELIV_FAILED

20080208 093248 127.0.0.1   SMTP (67690b10f043) >QUIT

20080208 093248 127.0.0.1   SMTP (67690b10f043) 221 2.0.0
IMTA05.westchester.pa.mail.comcast.net comcast closing connection.

 

Don Schreiner

CompBiz, Inc.

407-322-8654



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: Re[4]: [Declude.JunkMail] Blackice Server EndOfLife - need replacement

[Don Schreiner]

I placed on a test machine and then trial on a production IMail server. I
really want this thing to work, but as I train and set-up, found that the
SMTP service stops and will not restart and getting a cannot find DLL and
SMTP. Sandy - have you experienced anything along this line?

-Don

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford
Whiteman
Sent: Saturday, January 05, 2008 2:46 PM
To: Craig Edmonds
Subject: Re[4]: [Declude.JunkMail] Blackice Server EndOfLife - need
replacement

> Can you use eEye's Blink on a mail server?

O'course.

--Sandy



Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]

SpamAssassin plugs into Declude!
 
http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release
/

Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail
Aliases!
 
http://www.imprimia.com/products/software/freeutils/exchange2aliases/downloa
d/release/
 
http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/re
lease/



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Blackice Server EndOfLife - need replacement

[Don Schreiner]

We too use Black Ice with great success (except Windows 2003R2 will not
install and run).  The replacement is IMP Proventia and very expensive at
about $700 per server.  We are also looking for a more cost-effective
replacement.

 

-Don

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon
Sent: Friday, January 04, 2008 3:47 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Blackice Server EndOfLife - need replacement

 

The best part of Black Ice is it's easy to read interface to see what
hitting the server.  I will continue to use it just for that purpose, with
an ACL in the router ahead of the server to do the heavy lifting of access
control.  It is an effective blocker for UDP port probes, when used in
conjunction with an ACL which blocks the TCP and IP port probes, so an
outsider cannot execute anything.  On the other side, I would never use a
software application on the server as the primary defense...been there, done
that years ago when the Witty.A virus struck.

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Friday, January 04, 2008 12:21 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Blackice Server EndOfLife - need replacement

I'm sure that there are many opinions around here, but I don't think that
servers should be the place where you enforce security with a software
firewall.  Although you might like some of what it tells you, I would think
that a firewall and AV software would do the trick perfectly fine.  Of
course you can tune your firewall to your heart's content, and do things
like limit outgoing ports, run IDS, etc.  If you have enough servers, you
might also want to set up off-site vulnerability scanning on a scheduled
basis.  If you are worried about inside your network you should set up
VLANs.

As we saw a couple of years ago with Blackice, and then again last year with
Symantec Corporate, software that intercepts packets from the network are
themselves vulnerable to exploitation, and this is a good reason to use a
hardware firewall as at least a first level of defense, and only allow in
what is necessary.

Matt



Howard Smith (N.O.R.A.D.) wrote: 

To replace blackice functions as to load on a server  and monitor and block
what applications sends out on individual ports . I have an offending app or
task that trying to send out on random ports , I am trying to find it and
block it 
 
 
Howard Smith
N.O.R.A.D. Inc.
P.O. Box 680116
Miami, Florida 33168  
www.norad.com 
www.securetrek.com
www.siteshuttle.com
www.audiovideotrek.com
[EMAIL PROTECTED]
Office - (305) NETWORK (638-9675)
Sales - (786) 206-0045
Fax 1 - (305) 359-5144
 
 
Confidentiality Notice: This email message, including any Attachments, is
for the sole use of the intended recipient(s) and may contain confidential
and privileged information. Any unauthorized review, use, disclosure or
distribution is prohibited. If you are not the intended recipient, please
contact  [EMAIL PROTECTED] by email and destroy all copies of the original
message. 
 
 
 
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Friday, January 04, 2008 2:25 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Blackice Server Settings
 
In relation to spam or in relation to security?
 
My answers would be Alligate (on a separate server) and a firewall, 
respectively.
 
Matt
 
 
 
Howard Smith (N.O.R.A.D.) wrote:
  

ISS  no longer supports blackice  and it is no longer in production , what
are users  replacing it with ?
 
 
Howard Smith
. 
 
 
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave
Beckstrom
Sent: Wednesday, September 27, 2006 5:58 PM
To: declude.junkmail@declude.com
Cc: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Blackice Server Settings
 
I've gotten some requests to post the information on how to use Blackice
Server to block email harvesting attacks.  So here it is!
 
 
Before you install Blackice Server you must turn Data Execution Prevention
OFF on your server.  Blackice and DEP will not coexist.  On your server
right click on "MY COMPUTER" then go to properties and then go to


advanced.
  

Under performance, select the SETTINGS button and then click on the Data
Execution Prevention tab.  If DEP is listed as enabled for anything,


remove
  

it for the listed services.
 
Next, you can install Blackice.
 
When you install Blackice server you should install it with the trusting
mode enabled to allow all inbound traffic.  I believe it asks you what you
want when you install Blackice.  I don't recall for sure if it does or not
because it has been several years since I installed it.   If it doesn't


ask
  

you the protection level that you want, after you install blackice you can
go into the GUI and go to the firewall tab and under protection level you
can select "trusting: allow all inboun

RE: [Declude.JunkMail] AntiVirus Recommendations

[Don Schreiner]

I tried the Clam AV less than 1 year ago and it seemed to use more resources
than the F-Prot. However, since my original post asking about this I
discussed with Declude support and they helped me with trouble shooting the
high CPU. By increasing threads in declude.cfg and turning on AVAFTERJM and
PRESCAN in my virus.cfg went a long way. Thanks for reply.

-Don

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd
Sent: Thursday, July 12, 2007 11:00 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] AntiVirus Recommendations


How long ago did you try the Clan AV?  I know they released a newer version
a while back that was supposed to run more efficiently under windows and
reduce resource utilization.  

I am old school about AV, I think multiple virus scanners are a must.  But
then I have run multiple scanners for years and I always find virus detected
by the second scanner that shouldn't have gotten past the first.  Its kind
of enlightening when you think you are covered and then you add a second
scanner and see its catch things that should be there.  


Todd Hunter
Progressive Systems




-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Don
Schreiner
Sent: Thursday, July 05, 2007 8:23 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] AntiVirus Recommendations

We have been using F-Prot for several years with great success. Their new
mail server licensing change is too expensive. We tried the free Clam AV,
but with heavy volume CPU was reaching 100%. I know Declude has built-in
Virus Scanner, but we have always run F-Prot in addition. It seems necessary
for extra protection, but perhaps now overkill? What are others using or
recommend?  What is best Virus scanner to keep the CPU cycles reasonable? We
are running IMail 8.22, Declude 4.X, Message Sniffer, and invURI. Thanks.

-Don 
 

 
Sent via CompBiz.net


 
   


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.






---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] AntiVirus Recommendations

[Don Schreiner]

We have been using F-Prot for several years with great success. Their new mail 
server licensing change is too expensive. We tried the free Clam AV, but with 
heavy volume CPU was reaching 100%. I know Declude has built-in Virus Scanner, 
but we have always run F-Prot in addition. It seems necessary for extra 
protection, but perhaps now overkill? What are others using or recommend?  What 
is best Virus scanner to keep the CPU cycles reasonable? We are running IMail 
8.22, Declude 4.X, Message Sniffer, and invURI. Thanks.

-Don 
 

 
Sent via CompBiz.net


 
   


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Stopping Unwanted Virus Notifications

[Don Schreiner]

Thanks for reply and helping me decide best to remove these notifications
all together. It seems the Declude manual would warn against same.

 

-Don

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Wednesday, January 03, 2007 8:03 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Stopping Unwanted Virus Notifications

 

Don,

More than 99% of viruses forge the sender, so therefore there is no utility
in notifying anyone since 99% of it would be misplaced.  The only
non-forging viruses that you are likely to see are macro viruses and they
are quite rare these days.

The only notifications that I send out are from bannotify.eml which is for
banned extensions.  These will only be triggered when a banned extension is
seen and a virus is not detected.  I also skip sending these for encrypted
archives using the following in my bannotify.eml file:

SKIPIFEXT ZIP-EXE
SKIPIFEXT ZIP-SCR
SKIPIFEXT ZIP-PIF
SKIPIFEXT ZIP-COM
SKIPIFEXT RAR-EXE
SKIPIFEXT RAR-SCR
SKIPIFEXT RAR-PIF
SKIPIFEXT RAR-COM

You should also add a SKIPIFEXT line for every BANNAME entry in your
virus.cfg file.

Still with this config, during an outbreak like the one last week where my
scanners lagged detection by one to two days, I was creating a ton of
backscatter.  This can be improved by running JunkMail before Virus and
applying an action of either HOLD or DELETE on certain weights so that such
messages if scored high enough, will not need to be bounced.  If you use
ROUTETO and have only one domain that you capture spam in, then you should
also add to your bannnotify.eml file a line that has "SKIPIFRECIP
@your-capture-domain.com" so that things that are captured as spam, but not
deleted, will not generate bannotify.eml bounces.

During any given time my system receives between 5% an 10% of all connection
traffic from backscatter, virtually all of it to invalid addresses on the
domains that I protect.  This volume is so tremendous that it out paces
legitimate E-mail by as much as three times.  I would implore everyone here
to stop using postmaster.eml, sender.eml and recipient.eml bounces entirely
even if they take care to try to keep up with forging virus names.  When
over 99% of it is forging, it makes no sense to be bouncing any of it when
it is detected as a virus.

Matt



Don Schreiner wrote: 

I am looking for the best approach to stop notifications to both sender and
recipients of virus detection (to reduce what I call back scatter). However,
if one of our own customers sends an e-mail and whereas a virus is detected,
I certainly want them to receive a notification about same so they can check
their computer. What is the best way to set this up in Declude 4.0+?

 

Reviewing the Declude Manual for 4.08 (while it does not specifically state
this), if you remove the Recipient.eml and the Postmaster.eml, this would be
one method to stop the notifications, but I am unsure what other wanted
notification functions this would break?

 

Another approach I used prior to upgrade was to modify the EML files with
the following. I am not sure this is still the best approach? Is there a
more up-to-date list of Virus' that forge the sender address? 

 

SKIPIFVIRUSNAMEHAS Magistr

SKIPIFVIRUSNAMEHAS Vulnerability

SKIPIFVIRUSNAMEHAS Klez

SKIPIFVIRUSNAMEHAS Bugbear

SKIPIFVIRUSNAMEHAS W32/[EMAIL PROTECTED]

SKIPIFVIRUSNAMEHAS W32/[EMAIL PROTECTED]

 

Thanks.

 

-Don

 


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Stopping Unwanted Virus Notifications

[Don Schreiner]

I am looking for the best approach to stop notifications to both sender and
recipients of virus detection (to reduce what I call back scatter). However,
if one of our own customers sends an e-mail and whereas a virus is detected,
I certainly want them to receive a notification about same so they can check
their computer. What is the best way to set this up in Declude 4.0+?

 

Reviewing the Declude Manual for 4.08 (while it does not specifically state
this), if you remove the Recipient.eml and the Postmaster.eml, this would be
one method to stop the notifications, but I am unsure what other wanted
notification functions this would break?

 

Another approach I used prior to upgrade was to modify the EML files with
the following. I am not sure this is still the best approach? Is there a
more up-to-date list of Virus' that forge the sender address? 

 

SKIPIFVIRUSNAMEHAS Magistr

SKIPIFVIRUSNAMEHAS Vulnerability

SKIPIFVIRUSNAMEHAS Klez

SKIPIFVIRUSNAMEHAS Bugbear

SKIPIFVIRUSNAMEHAS W32/[EMAIL PROTECTED]

SKIPIFVIRUSNAMEHAS W32/[EMAIL PROTECTED]

 

Thanks.

 

-Don

 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Seeking IMail Expert and Consultant for Hire - Follow Up

[Don Schreiner]

Remember this post I made back on November 10, 2006 (see below)? A lot of
list members have since e-mailed asking if I ever found someone and how it
was coming along. In follow-up to those same folks on the list we finally
completed upgrade to our Declude installs from 1.82  to 4.3.23. Once again
(since Scott left) I am comfortable with controlling Spam using Declude. We
remain at IMail 8.22 until such time I feel comfortable their Web Mail and
other Web based security/functionality issues get resolved.

 

I want to thank those who specifically responded offering help (Darrell with
Invariant, Dave Doherty, and Matt with Mail Pure), and also all the folks on
this list who have provided help to me over the years. All of you are the
best in the business and I would never have remained a Declude client for
the last 5 years without same. Folks like Sandy, John, Len, Doug, Andy,
Darin (and may others) who make posts make it possible to keep learning
moving forward.

 

Darrell with Invariant (http://www.invariantsystems.com) was the first to
respond and offered his help free of charge. I was not looking for free
help, but a consultant to work with. Regardless, I decided to take him up on
his offer and insisted to compensate something for his time. He never did
give me a fee or schedule, so I came up with one on my own and he was worth
every penny and more!!!

 

One of my major concerns was losing the ability reviewing False Positives
(as I was using the old Spam Review). That came to rest when I discovered
his Invariant False Positive Review software product. It is the best tool I
have ever used and loaded with all kinds of features like on-the-fly
reporting to Sniffer, Filter file updating, DNS lookups, and a lot more. If
anyone needs a cool tool to review your held Spam and built-in tools to
manage same, I highly recommend this FP Review product. Invariant also has
several other good products I strongly recommend including invURIBL which is
also helping us tag Spam. Darrell never really pushed his products on us,
but rather kept to helping me better understand our E-mail System, how best
to use and configure Declude, Sniffer, Filters, Weighting, and more. I made
the decision to purchase his products without pressure.

 

In summary, based on number of servers, accounts, and volume, it was not
cost-effective for us to farm out our Spam filtering. I strongly considered
doing this and it may be the most appropriate for other companies with
different circumstances. I needed to learn how to manage on our own with
what limited resources we had in place. Darrell was very sensitive to this,
our CPU usage, and other items. As we grow, we may need to implement a
Gateway server like IMGate, Alligate, ASSP, etc.(all of which I am studying)
, but for now we are hanging in there (about 60K messages daily on one
server, 40K on another, across multiple domains, about 3500 users). I am
also open to other products like MX Guard, but we have invested so much in
Declude it is difficult to switch at this point. We are stopping lots more
Spam thanks to Darrell's assistance and strongly recommend him to anyone
needing an E-mail server consultant.

 

Anyone interested in details, please e-mail me off-list and be glad to
share. Seasons greetings and peace to all!  Thanks.

 

-Don

 

CompBiz.Inc.

407-322-8654

 

- Original Message - 

From: Don   Schreiner 

To: declude.junkmail@declude.com 

Sent: Friday, November 10, 2006 6:36 AM

Subject: [Declude.JunkMail] Seeking IMail Expert and Consultant for Hire

 

Dear Declude List,

 

I am seeking an IMail/Declude/Sniffer, etc. expert for consultation and hire
via telephone, e-mail, and remote Terminal Server. Please contact me off
list if interested in helping teach this old dog new tricks. Below is some
info about our situation.

 

With ongoing issues, bugs, and version changes (both IMail and Declude), we
need help with not only decision making moving forward, but the best
configurations for our clients filtering Spam and Virus'. All our licenses
and SA's are up-to-date, but we remain at IMail 8.22 and Declude 1.82. Our
license renewal dates are forthcoming for IMail in December, and Declude
next year. Product knowledge with great results of other technologies like
MXGuard, invURIBl, ASSP, ClamAV, Log Analyzers, etc. is desired, as we are
certainly would consider if better alternatives can be proven. I recently
tried implementing MXGuard and invURIBL with limited success and reverted
back to our original set-up, as it seemed to be catching more Spam. Not sure
it was these products fault, but perhaps myself in the set-up? We have been
using IMail/Declude since early version 4.0 days and with mostly acceptable
filtering results until these last few years, and growing worse in recent
months with .gif and stock spams. I currently need some concentrated help
with set-up, upgrades, and guidance. While we are a small hosting and
Coldfusion Dev firm (ab

RE: [Declude.JunkMail] Seeking IMail Expert and Consultant for Hire

[Don Schreiner]

Hi Jay and thanks for reply. Yes we seriously considered SmarterMail, but
need IMail ODBC due to a Coldfusion application we wrote and requires
database backend. Rewriting all the code over to XML that SmarterMail uses,
proved too resource intensive and costly. Yes we agree about message Sniffer
and have been using for years and continue to do so. I believe it is the one
thing that has allowed us to hang in there this long. I received some good
replies from folks off list and going to help us out. Thanks.

-Don

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay
Sudowski - Handy Networks LLC
Sent: Friday, November 10, 2006 1:26 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Seeking IMail Expert and Consultant for Hire

Hi Don -

Have you considered moving away from iMail?  SmarterMail is a great value
and it sounds like things are only going to continue to improve with
SmarterMail 4.0, which is due early next year.  Also, have you looked at
Message Sniffer (www.armresearch.com)?  It's about $450/yr, but worth every
penny. 

-
Jay Sudowski // Handy Networks LLC

Director of Technical Operations
Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003
Hosting Solutions
Tel: 877-70 HANDY x882 |  Fax: 888-300-2FAX

www.handynetworks.com



From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Don
Schreiner
Sent: Friday, November 10, 2006 6:37 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Seeking IMail Expert and Consultant for Hire

Dear Declude List,
 
I am seeking an IMail/Declude/Sniffer, etc. expert for consultation and hire
via telephone, e-mail, and remote Terminal Server. Please contact me off
list if interested in helping teach this old dog new tricks. Below is some
info about our situation.
 
With ongoing issues, bugs, and version changes (both IMail and Declude), we
need help with not only decision making moving forward, but the best
configurations for our clients filtering Spam and Virus'. All our licenses
and SA's are up-to-date, but we remain at IMail 8.22 and Declude 1.82. Our
license renewal dates are forthcoming for IMail in December, and Declude
next year. Product knowledge with great results of other technologies like
MXGuard, invURIBl, ASSP, ClamAV, Log Analyzers, etc. is desired, as we are
certainly would consider if better alternatives can be proven. I recently
tried implementing MXGuard and invURIBL with limited success and reverted
back to our original set-up, as it seemed to be catching more Spam. Not sure
it was these products fault, but perhaps myself in the set-up? We have been
using IMail/Declude since early version 4.0 days and with mostly acceptable
filtering results until these last few years, and growing worse in recent
months with .gif and stock spams. I currently need some concentrated help
with set-up, upgrades, and guidance. While we are a small hosting and
Coldfusion Dev firm (about 100 hosting clients since the early 90's), we
also work with a lot of churches and the recent Spam getting through is not
acceptable. Our current issues are not with performance/volume of e-mail as
we only process about 30-40k messages in/out daily. We want to upgrade to
our licensed latest version of IMail (and Declude), but "any" existing IMail
and Web Mail issues would not be acceptable to our clients (i.e. slowness,
miscalculated bytes, etc.)
 
Our current set-up and tools are as follows:
 
-Windows 2000 Advanced Server
-IMail 8.22 / Declude 1.82 / Sniffer
-SQL 7 Database (separate server and do not use IMail registry)
-F-Prot
-BlackIce (use for intrusion detection and tar-pitting dictionary attacks)
-The old Spam Review to ID False Positives
 
I hope some folks here are interested and no problem reimbursing for same.
 Again, please contact me off list if interested. Thanks.
 
-Don
 
Don Schreiner
CompBiz, Inc.
www.CompBiz.net
407-322-8654
 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

--
CompBiz.Net scanned for Virus'





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Seeking IMail Expert and Consultant for Hire

[Don Schreiner]

Dear Declude List,

 

I am seeking an IMail/Declude/Sniffer, etc. expert for consultation
and hire via telephone, e-mail, and remote Terminal Server. Please contact me
off list if interested in helping teach this old dog new tricks. Below is some
info about our situation.

 

With ongoing issues, bugs, and version changes (both IMail and
Declude), we need help with not only decision making moving forward, but the
best configurations for our clients filtering Spam and Virus’. All our
licenses and SA’s are up-to-date, but we remain at IMail 8.22 and Declude
1.82. Our license renewal dates are forthcoming for IMail in December, and
Declude next year. Product knowledge with great results of other technologies like
MXGuard, invURIBl, ASSP, ClamAV, Log Analyzers, etc. is desired, as we are certainly
would consider if better alternatives can be proven. I recently tried implementing
MXGuard and invURIBL with limited success and reverted back to our original
set-up, as it seemed to be catching more Spam. Not sure it was these products
fault, but perhaps myself in the set-up? We have been using IMail/Declude since
early version 4.0 days and with mostly acceptable filtering results until these
last few years, and growing worse in recent months with .gif and stock spams. I
currently need some concentrated help with set-up, upgrades, and guidance. While
we are a small hosting and Coldfusion Dev firm (about 100 hosting clients since
the early 90’s), we also work with a lot of churches and the recent Spam
getting through is not acceptable. Our current issues are not with performance/volume
of e-mail as we only process about 30-40k messages in/out daily. We want to
upgrade to our licensed latest version of IMail (and Declude), but “any”
existing IMail and Web Mail issues would not be acceptable to our clients (i.e.
slowness, miscalculated bytes, etc.)

 

Our current set-up and tools are as follows:

 

-Windows 2000 Advanced Server

-IMail 8.22 / Declude 1.82 / Sniffer

-SQL 7 Database (separate server and do not use IMail registry)
-F-Prot

-BlackIce (use for intrusion detection and tar-pitting
dictionary attacks)

-The old Spam Review to ID False Positives

 

I hope some folks here are interested and no problem reimbursing
for same.  Again, please contact me off list if interested. Thanks.

 

-Don

 

Don Schreiner

CompBiz, Inc.

www.CompBiz.net

407-322-8654

 







---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.

RE: [Declude.JunkMail] Email Servers and Declude

[Don Schreiner]

Not familiar with the Gateway yet and
thanks for info. Anyone running on same server? Our volume not at point to
justify separate gateway server.

 

-Don









From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox
Sent: Thursday, October 26, 2006
9:43 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail]
Email Servers and Declude



 



That would be Declude's gateway product.  Since it
works as a gateway, it's not tied to any one mail server.






Darin.





 





 





- Original Message - 



From: Don Schreiner 





To: declude.junkmail@declude.com






Sent: Thursday, October
26, 2006 8:40 AM





Subject: [Declude.JunkMail]
Email Servers and Declude







 



Does anyone know if Declude has been configured to work with
other E-mail Servers other than IMail and SmarterMail? I thought to remember
someone discussing this after Scott left and the new ownership was ramping up.
 Perhaps I am thinking of Message Sniffer?

 

We are not comfortable renewing our 2 upcoming IMail
SA’s. We remain at 8.22 and customer since version 4.0 days. We cannot
risk installing 2006 with the existing Web Mail bugs (our clients use heavily) and
other 2006 server engine issues. We cannot switch to Smarter Mail because they
lack SQL ODBC required for our Community software. Converting to XML is too
great a cost right now.

 

I am even questioning our 2 Declude SA’s upcoming this
year. We remain at 1.82 and still uncomfortable with upgrading. I want to keep
Declude/Message Sniffer, as it has served us well over the years and why I
remain renewing each year.

 

Anyone have suggestions given our situation needing ODBC
Mail Server, Declude / Message Sniffer? Please feel free to reply off list if
desired. Thanks.

 

-Don

 

Don S

CompBiz, Inc.

www.CompBiz.net

407-322-8654

 


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 






---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.
---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.

[Declude.JunkMail] Email Servers and Declude

[Don Schreiner]

Does anyone know if Declude has been configured to work with
other E-mail Servers other than IMail and SmarterMail? I thought to remember someone
discussing this after Scott left and the new ownership was ramping up.  Perhaps
I am thinking of Message Sniffer?

 

We are not comfortable renewing our 2 upcoming IMail SA’s.
We remain at 8.22 and customer since version 4.0 days. We cannot risk installing
2006 with the existing Web Mail bugs (our clients use heavily) and other 2006 server
engine issues. We cannot switch to Smarter Mail because they lack SQL ODBC required
for our Community software. Converting to XML is too great a cost right now.

 

I am even questioning our 2 Declude SA’s upcoming this
year. We remain at 1.82 and still uncomfortable with upgrading. I want to keep Declude/Message
Sniffer, as it has served us well over the years and why I remain renewing each
year.

 

Anyone have suggestions given our situation needing ODBC
Mail Server, Declude / Message Sniffer? Please feel free to reply off list if
desired. Thanks.

 

-Don

 

Don S

CompBiz, Inc.

www.CompBiz.net

407-322-8654

 







---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.

RE: Re[4]: [Declude.JunkMail] Yahoo.com Resources temporarily unavailable

[Don Schreiner]

SpiderHost is our Data Center co-locator (Level3 facility). Below is beyond
my DNS expertise. What would I have them do? Thanks.

-Don 

Don Schreiner
CompBiz, Inc.
www.CompBiz.net
407-322-8654

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of William
Stillwell
Sent: Tuesday, August 08, 2006 2:50 PM
To: declude.junkmail@declude.com
Subject: RE: Re[4]: [Declude.JunkMail] Yahoo.com Resources temporarily
unavailable



Ahh, I see your problem now.. 

Asking d.root-servers.net for 194.241.57.65.in-addr.arpa PTR record:  
   d.root-servers.net says to go to indigo.arin.net. (zone:
65.in-addr.arpa.)
Asking indigo.arin.net. for 194.241.57.65.in-addr.arpa PTR record:  
   indigo.arin.net [192.31.80.32] says to go to NS1.LEVEL3.NET. (zone:
57.65.in-addr.arpa.)
Asking NS1.LEVEL3.NET. for 194.241.57.65.in-addr.arpa PTR record:  
   ns1.level3.net [209.244.0.1] says to go to ns2.spiderhost.com. (zone:
241.57.65.in-addr.arpa.)
Asking ns2.spiderhost.com. for 194.241.57.65.in-addr.arpa PTR record:
Reports vacant.compbiz.net. [from 66.192.101.2]

Who is SpriderHost ?



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford
Whiteman
Sent: Tuesday, August 08, 2006 1:33 PM
To: William Stillwell
Subject: Re[4]: [Declude.JunkMail] Yahoo.com Resources temporarily
unavailable

> Set the MX to point to the server reported by the HELO statement

> Holisticmoms.org MX sneezy.xerocom.net

That doesn't solve the roundtrip failure.

If   the   receiving   server   checks  the  roundtrip,  it  needs  an
IP-PTR-HELO-A sync. It doesn't care what the MX is for the purposes of that
test.

--Sandy



Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]

SpamAssassin plugs into Declude!
 
http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release
/

Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail
Aliases!
 
http://www.imprimia.com/products/software/freeutils/exchange2aliases/downloa
d/release/
 
http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/re
lease/



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

--
CompBiz.Net scanned for Virus'




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: Re[4]: [Declude.JunkMail] Yahoo.com Resources temporarily unavailable

[Don Schreiner]

Thanks to all for the replies. I use Enom registrar for customer domains and
their DNS tools. Instead of DNS MX setting to the simple IP (65.57.241.194)
of the email server, if I change to the MX to the hostname of the server
(sneezy.xerocom.net) would this solve this roundtrip failure issue and still
using Virtual domain name for holisticmoms.org under IMail? Thanks.

-Don

Don Schreiner
CompBiz, Inc.
www.CompBiz.net
407-322-8654

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford
Whiteman
Sent: Tuesday, August 08, 2006 1:33 PM
To: William Stillwell
Subject: Re[4]: [Declude.JunkMail] Yahoo.com Resources temporarily
unavailable

> Set the MX to point to the server reported by the HELO statement

> Holisticmoms.org MX sneezy.xerocom.net

That doesn't solve the roundtrip failure.

If   the   receiving   server   checks  the  roundtrip,  it  needs  an
IP-PTR-HELO-A sync. It doesn't care what the MX is for the purposes of
that test.

--Sandy



Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]

SpamAssassin plugs into Declude!
 
http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release
/

Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail
Aliases!
 
http://www.imprimia.com/products/software/freeutils/exchange2aliases/downloa
d/release/
 
http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/re
lease/



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

--
CompBiz.Net scanned for Virus'




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Yahoo.com Resources temporarily unavailable

[Don Schreiner]

I was wondering the same thing about the
reverse DNS. 

 

We have the customer (holisticmoms.org) set-up
as a Virtual Domain under IMail. The DNS for their MX record we have set-up
pointing to our e-mail server IP number which is 65.57.241.194 (our mail server
name = sneezy.xerocom.net, however our router at the data center replies
vacant.compbiz.net. According to DNSReport.com, the reverse DNS passes. Does
anyone know if our set-up for this customer should be changed in anyway to
avoid these types of issues?

 

Thanks.

 

-Don

 



Don Schreiner

CompBiz, Inc.

www.CompBiz.net

407-322-8654











From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Craig
Edmonds
Sent: Tuesday, August 08, 2006
8:43 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail]
Yahoo.com Resources temporarily unavailable
Importance: High



 


I used to have these problems too on a mass scale. 

I have my server set to try every 30 minutes for a 48 hour period to delievr
email.

There is no way their "resources" are busy for that long.

When I got my reverse dns sorted out properly on all my servers sending
cdonts emails, coincidentality the bounces stopped.

Kindest Regards
Craig Edmonds
123 Marbella Internet
W: www.123marbella.com
E : [EMAIL PROTECTED]



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Shayne
Embry
Sent: Tuesday, August 08, 2006 2:29 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Yahoo.com Resources temporarily unavailable

We see this happening frequently on very small lists. On a 1,400 user
mailing last week, 272 out of 280 Yahoo addresses bounced. We tried the next
day with the same results. According to their site, the "resources
temporarily unavailable" message is a 421, yet these are all returned with
a
451 code. This does make it difficult to pinpoint the problem, even though
we all know the problem is Yahoo. Put them right up there with AOL in terms
of stupidity and arrogance.

Shayne


 Original Message ----
> From: "Don Schreiner" <[EMAIL PROTECTED]>
> Sent: Tuesday, August 08, 2006 6:02 AM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] Yahoo.com Resources temporarily 
> unavailable
> 
> Found my own answer here at
> http://help.yahoo.com/help/us/mail/defer/defer-03.html.
Unfortunately, 
> I have seen this Yahoo.com resources unavailable before which accounts 
> for hundreds of undeliverable on a bulk mail list of a few thousand.
Thanks.
> 
>  
> 
> -Don
> 
>   _
> 
> From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf
Of 
> Don Schreiner
> Sent: Tuesday, August 08, 2006 6:27 AM
> To: declude.junkmail@declude.com
> Subject: [Declude.JunkMail] Yahoo.com Resources temporarily 
> unavailable
> 
>  
> 
> We handle some small bulk mails for our clients on occasion. Has 
> anyone seen the following response from Yahoo before and know what may 
> be the cause? We are receiving thee back on what appear to be 
> legitimate yahoo.com e-mail addresses. Running IMAIL 8.22 and Declude
1.82. Thanks.
> 
>  
> 
> -Don
> 
>  
> 
> 
> From: "Postmaster"
>
<http://mail.holisticmoms.org:8383/newmsg.cgi?mbx=Main&[EMAIL PROTECTED]
> cmoms.org> <[EMAIL PROTECTED]>   
> To : <[EMAIL PROTECTED]>
> CC : 
> Date : Mon, 7 Aug 2006 13:07:24 -0400
> Subject : Undeliverable Mail
> 
>  
> 
> 
> Delivery failed 8 attempts: [EMAIL PROTECTED]
> 
> Body of message generated response: 
> 451 mta331.mail.re4.yahoo.com Resources temporarily unavailable. 
> Please try again later.  [#4.16.4:190].
> 
> Original message follows. 
> 
> Received: from dev [65.57.241.194] by holisticmoms.org with ESMTP 
>   (SMTPD32-8.12) id A9115A80012C; Mon, 07 Aug 2006 10:07:13
-0400
> Organization: Holistic Moms Network
> Reply-To: [EMAIL PROTECTED]
> Message-ID:
> <http://mail.holisticmoms.org:8383/newmsg.cgi?mbx=Main&to=2db97484b9f7
> 93d51a
> [EMAIL PROTECTED]>
> <[EMAIL PROTECTED]>
> From: "Holistic Moms News"
>
<http://mail.holisticmoms.org:8383/newmsg.cgi?mbx=Main&[EMAIL PROTECTED].
> org> <[EMAIL PROTECTED]>
> To:
> <http://mail.holisticmoms.org:8383/newmsg.cgi?mbx=Main&to=RACHELWEISSM
> [EMAIL PROTECTED]
> HOO.COM> <[EMAIL PROTECTED]>
> Subject: =?windows-1252?Q?Don't_Miss_2006!!?=
> Date: Mon, 7 Aug 2006 09:59:19 -0400
> MIME-Version: 1.0
> Content-Type: text/html;
> charset="windows-1252" 
> Content-Transfer-Encoding: quoted-printable
> X-Declude-Sender: [EMAIL PROTECTED]
[65.57.241.194]
> X-Declude-Spoolname: D49115a80012c6c22.SMD
> X-Note: CompBiz scanned with Declude JunkMail
> X-Spam-Tests-Failed:

RE: [Declude.JunkMail] Yahoo.com Resources temporarily unavailable

[Don Schreiner]

Found my own answer here at http://help.yahoo.com/help/us/mail/defer/defer-03.html.
Unfortunately, I have seen this Yahoo.com resources unavailable before which
accounts for hundreds of undeliverable on a bulk mail list of a few thousand. Thanks.

 

-Don









From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Don Schreiner
Sent: Tuesday, August 08, 2006
6:27 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail]
Yahoo.com Resources temporarily unavailable



 

We handle some small bulk mails for our clients on occasion.
Has anyone seen the following response from Yahoo before and know what may be
the cause? We are receiving thee back on what appear to be legitimate yahoo.com
e-mail addresses. Running IMAIL 8.22 and Declude 1.82. Thanks.

 

-Don

 


 
  
  
  From: "Postmaster" <[EMAIL PROTECTED]>
  
  
   
  To : <[EMAIL PROTECTED]>
  CC : 
  Date : Mon, 7 Aug 2006 13:07:24 -0400
  Subject : Undeliverable Mail 
  
   
  
 
 
  
  Delivery failed 8
  attempts: [EMAIL PROTECTED] 
  
  Body of message generated response: 
  451 mta331.mail.re4.yahoo.com Resources temporarily unavailable. Please try
  again later.  [#4.16.4:190]. 
  
  Original message follows. 
  
  Received: from dev [65.57.241.194] by holisticmoms.org with ESMTP 
    (SMTPD32-8.12) id A9115A80012C; Mon, 07 Aug 2006 10:07:13 -0400 
  Organization: Holistic Moms Network 
  Reply-To: [EMAIL PROTECTED] 
  Message-ID: <[EMAIL PROTECTED]>
  
  From: "Holistic Moms News" <[EMAIL PROTECTED]>
  
  To: <[EMAIL PROTECTED]>
  
  Subject: =?windows-1252?Q?Don't_Miss_2006!!?= 
  Date: Mon, 7 Aug 2006 09:59:19 -0400 
  MIME-Version: 1.0 
  Content-Type: text/html; 
  charset="windows-1252" 
  Content-Transfer-Encoding: quoted-printable 
  X-Declude-Sender: [EMAIL PROTECTED] [65.57.241.194] 
  X-Declude-Spoolname: D49115a80012c6c22.SMD 
  X-Note: CompBiz scanned with Declude JunkMail 
  X-Spam-Tests-Failed: Whitelisted [0] 
  Organization: Abuse reports to [EMAIL PROTECTED]
  
 


 

 

Don Schreiner

CompBiz, Inc.

www.CompBiz.net

407-322-8654

 






---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.
---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.

[Declude.JunkMail] Yahoo.com Resources temporarily unavailable

[Don Schreiner]

We handle some small bulk mails for our clients on occasion.
Has anyone seen the following response from Yahoo before and know what may be
the cause? We are receiving thee back on what appear to be legitimate yahoo.com
e-mail addresses. Running IMAIL 8.22 and Declude 1.82. Thanks.

 

-Don

 


 
  
  
  From: "Postmaster" <[EMAIL PROTECTED]>
   
  To : <[EMAIL PROTECTED]>
  CC : 
  Date : Mon, 7 Aug 2006 13:07:24 -0400
  Subject : Undeliverable Mail 
  
   
  
 
 
  
  Delivery failed 8
  attempts: [EMAIL PROTECTED] 
  
  Body of message generated response: 
  451 mta331.mail.re4.yahoo.com Resources temporarily unavailable. Please try
  again later.  [#4.16.4:190]. 
  
  Original message follows. 
  
  Received: from dev [65.57.241.194] by holisticmoms.org with ESMTP 
    (SMTPD32-8.12) id A9115A80012C; Mon, 07 Aug 2006 10:07:13 -0400 
  Organization: Holistic Moms Network 
  Reply-To: [EMAIL PROTECTED] 
  Message-ID: <[EMAIL PROTECTED]>
  
  From: "Holistic Moms News" <[EMAIL PROTECTED]>
  
  To: <[EMAIL PROTECTED]>
  
  Subject: =?windows-1252?Q?Don't_Miss_2006!!?= 
  Date: Mon, 7 Aug 2006 09:59:19 -0400 
  MIME-Version: 1.0 
  Content-Type: text/html; 
  charset="windows-1252" 
  Content-Transfer-Encoding: quoted-printable 
  X-Declude-Sender: [EMAIL PROTECTED] [65.57.241.194] 
  X-Declude-Spoolname: D49115a80012c6c22.SMD 
  X-Note: CompBiz scanned with Declude JunkMail 
  X-Spam-Tests-Failed: Whitelisted [0] 
  Organization: Abuse reports to [EMAIL PROTECTED]
  
 


 

 

Don Schreiner

CompBiz, Inc.

www.CompBiz.net

407-322-8654

 







---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.

RE: [Declude.JunkMail] Deleting emails based solely on Sniffer?

[Don Schreiner]

If you delete, you should delete based on achieving a minimum weight
accumulated. Sniffer on occasion may detect something as a false positive.
For example, it may misinterpret a legitimate e-mail as Spam with an
attachment based on conversion of the attachment to characters and a series
triggering something in Sniffer rules. I have seen this on occasion. In our
scenario, we hold on a certain weight range for review, and higher weight
range we auto-delete. We also will hold if failing Sniffer alone and no
other tests. HTH's

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Joey Proulx
Sent: Thursday, April 14, 2005 8:50 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Deleting emails based solely on Sniffer?

Can someone please explain to me why, if an email is flagged as spam by 
Sniffer, I shouldn't just delete it outright?  Are there instances where 
Sniffer is wrong?  Or is this the way you all use it already?

Reason I ask is that I have Sniffer setup with a weight of 10...and I hold 
messages with a weight of 10-14.  This morning I got a Nigerian-type scam 
that sniffer flagged, but it only scored a total weight of 5.  I'll have to 
check through my global.cfg when I get back from my 9am meeting, but 
something added a weight of -5 somewhere, meaning the email got 
through.  If I had deleted all Sniffer-found spam outright, this would not 
have happened.

Thoughts?

_
Joey Proulx
SAU #21 Technology Support Staff
2 Alumni Drive
Hampton, NH 03842
(603) 926-8992, ext 115
[EMAIL PROTECTED]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
CompBiz.Net scanned for Virus'


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] bounce unwanted email - should be interesting....

[Don Schreiner]

Last year there was a thread about a similar technology, but was shot down
by many on this list as contributing to the Spam problem and questionable
legalities. If memory serves me, you installed an app from one of the large
ISPs and your PC was part of a network sending e-mails to spam servers. A
concern was innocent forged servers getting attacked. 

IBM's approach seems different sending back what was sent to you. I am not
absolutely sure because they reference use of a database? I wonder if IBM
has already been using this technology in-house? The article references a
reduction via a February report. Do others here think their approach has
merit?

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli
Sent: Tuesday, March 22, 2005 8:53 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] bounce unwanted email - should be
interesting

Spamming spammers?
Report: IBM to offer service to bounce unwanted e-mail back to the computers
that sent them.
March 22, 2005: 7:00 AM EST

 

NEW YORK (CNN/Money) - IBM is set to unveil a service Tuesday that will send
unwanted e-mail back to the spammers who send them, according to a published
report Tuesday.

 

http://money.cnn.com/2005/03/22/technology/ibm_spam/index.htm?cnn=yes

 

 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] filter files

[Don Schreiner]

I also strongly recommend Sniffer. We have used for a couple of years. As
spam patterns and variants change daily, it's rule base also changes and is
updated. It significantly reduced the time we spent managing Spam. 

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED]
Sent: Tuesday, March 22, 2005 10:36 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] filter files

I would definitely recommend message sniffer.

Stu


At 07:54 PM 3/21/2005 -0600, you wrote:
>Thanks to both of you.  I am looking to get mostly obscene stuff, but the
medical stuff would be very good to catch also.  I will start with this and
then adventure out on my own:D
>On a side note has anyone used Message Sniffer, and would it help with this
type of stuff or am i looking in the wrong direction?
>
>Thanks again,
>
>Joe
>
>
>-- Original Message --
>From: "David Barker" <[EMAIL PROTECTED]>
>Reply-To: Declude.JunkMail@declude.com
>Date:  Mon, 21 Mar 2005 16:04:55 -0500
>
>>Joe here is a very basic filter but hopefully will help get you started:
>> 
>>SKIPIFWEIGHT 16
>> 
>>MINWEIGHTTOFAIL  3
>>MAXWEIGHT   12
>> 
>>#Subject
>>SUBJECT 3 CONTAINS Online Pharmacy
>> 
>>#Words
>>BODY 5 CONTAINS Meds
>>BODY 2 CONTAINS cheap Perscriptions
>>BODY 2 CONTAINS No prescription required
>>BODY 2 CONTAINS No Doctor Visits
>> 
>>#Medication
>>BODY 2 CONTAINS codiene
>>BODY 2 CONTAINS Codeine
>>BODY 2 CONTAINS vicodin
>>BODY 2 CONTAINS viagra
>>BODY 2 CONTAINS Cialis
>> 
>>#URBL
>>BODY 12 CONTAINS fopq.org
>>BODY 12 CONTAINS awayhowbad.com
>>BODY 12 CONTAINS royalmeds.info
>>BODY 12 CONTAINS uncompromisingmind.com
>>BODY 12 CONTAINS simply-meds.com
>>BODY 12 CONTAINS ritheworldofall.com
>>BODY 12 CONTAINS medberthgood.com
>> 
>>#Spam Indicators
>>BODY 12 CONTAINS Cia|is
>>BODY 12 CONTAINS Cialls
>>
>>Here are some good links too:
>>
>>http://www.mailpure.com/software/decludefilters/
>>http://it.farmprogress.com/declude/declude.htm
>>http://www.declude.com/Articles.asp?ID=100
>>
>>David B
>>www.declude.com
>>
>>
>>
>>From: [EMAIL PROTECTED]
>>[mailto:[EMAIL PROTECTED] On Behalf Of Joe Raykiewicz
>>Sent: Monday, March 21, 2005 3:44 PM
>>To: declude.junkmail@declude.com
>>Subject: [Declude.JunkMail] filter files
>>
>>
>>
>>I am currently thinking about using a filter file to filter out some
>>unwanted messages.  Does anyone have some sample filter files that I could
>>use as a starting point?  I sure would appreciate some help getting
started
>>on this.
>>
>> 
>>
>>Joe
>>
>>
>>
>>__ NOD32 1.1030 (20050319) Information __
>>
>>This message was checked by NOD32 antivirus system.
>>http://www.nod32.com
>>
>>
>>---
>>This E-mail came from the Declude.JunkMail mailing list.  To
>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>>type "unsubscribe Declude.JunkMail".  The archives can be found
>>at http://www.mail-archive.com.
>>
> 
>
> 
>___
>Webmail delivered by Microlandcomputers.com
>
>
> 
>   
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>
>

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
CompBiz.Net scanned for Virus'


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] OT: Reverse DNS and 554 Denied

[Don Schreiner]

Thanks for reply. I am still unsure what to do. The IP ending .196 is our 
IIS server and with the news. Web site. All domains on server are virtual 
and use host headers.  The vacant.compbiz.net is also used and set-up by our 
data center router. I thought the issue might have been via our Mail server 
ending .197 and our office IP I saw being insrted in the headers.

-Don

- Original Message - 
From: "Dave Doherty" <[EMAIL PROTECTED]>
To: 
Sent: Monday, March 21, 2005 10:43 PM
Subject: Re: [Declude.JunkMail] OT: Reverse DNS and 554 Denied


Hi, Don-

news.holisticmoms.org reports its IP address as 65.57.241.196

65.57.241.196 reports its name as vacant.compbiz.net.

You should have your provider set up a reverse lookup (pointer) record for
65.57.241.196 that points to news.holisticmoms.org instead of
vacant.compbiz.net

-d





- Original Message ----- 
From: "Don Schreiner" <[EMAIL PROTECTED]>
To: 
Sent: Monday, March 21, 2005 10:02 PM
Subject: [Declude.JunkMail] OT: Reverse DNS and 554 Denied


> While the AOL filter is fixed, I am now getting 554 Denied on some servers
> (see below). I am also getting unsolicited bulk mail undeliverable.
>
> I am using Group Mail in our office on dedicated IP authenticating SMTP to
> their virtual domain on our IMail server. Do I need to make an additional
> DNS entry of our office IP for their domain and what would I do?
>
> Again, the e-mail we are sending is here at
> http://news.holisticmoms.org/index_email.htm.
>
>
> Body of message generated response:
> 554 5.7.1 This message appears to be unsolicited bulk mail...reverse DNS
> problem with 65.57.241.197...Try plain text
>
> Original message follows.
>
> Received: from holisticmoms.org [68.209.181.166] by holisticmoms.org with
> ESMTP
>  (SMTPD32-8.12) id A27353BE00EE; Mon, 21 Mar 2005 21:26:59 -0500
> Message-ID: <[EMAIL PROTECTED]>
> To: "HMN Members" <[EMAIL PROTECTED]>
> Organization: Holistic Moms Network
> From: "Holistic Moms News" <[EMAIL PROTECTED]>
> Subject: Holistic Moms Network News March 2005
> Date: Mon, 21 Mar 2005 21:25:53 -0500
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary="=_NextPart_30681132292922553481"
> X-Declude-Sender: [EMAIL PROTECTED] [68.209.181.166]
> X-Declude-Spoolname: D827353be00eedffd.SMD
> X-Note: CompBiz scanned with Declude JunkMail
> X-Spam-Tests-Failed: None [-5]
> Organization: Abuse reports to [EMAIL PROTECTED]
>
>
>
> From: "Postmaster" <[EMAIL PROTECTED]>  Save Address | Headers
> To : <[EMAIL PROTECTED]>
> CC :
> Date : Mon, 21 Mar 2005 21:28:52 -0500
> Subject : Undeliverable Mail
> 
> 
>
> undeliverable to [EMAIL PROTECTED]
>
> Body of message generated response:
> 554 Denied
>
> undeliverable to [EMAIL PROTECTED]
>
> Body of message generated response:
> 554 Denied
>
>
>
> Original message follows.
>
> Received: from holisticmoms.org [68.209.181.166] by holisticmoms.org with
> ESMTP
>  (SMTPD32-8.12) id A286418D00F0; Mon, 21 Mar 2005 21:27:18 -0500
> Message-ID: <[EMAIL PROTECTED]>
> To: "HMN Members" <[EMAIL PROTECTED]>
> Organization: Holistic Moms Network
> From: "Holistic Moms News" <[EMAIL PROTECTED]>
> Subject: Holistic Moms Network News March 2005
> Date: Mon, 21 Mar 2005 21:26:00 -0500
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary="=_NextPart_1949814226871226091"
> X-Declude-Sender: [EMAIL PROTECTED] [68.209.181.166]
> X-Declude-Spoolname: D8285418d00f0e016.SMD
> X-Note: CompBiz scanned with Declude JunkMail
> X-Spam-Tests-Failed: None [-5]
> Organization: Abuse reports to [EMAIL PROTECTED]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>
>


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
CompBiz.Net scanned for Virus'


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] OT: Reverse DNS and 554 Denied

[Don Schreiner]

While the AOL filter is fixed, I am now getting 554 Denied on some servers
(see below). I am also getting unsolicited bulk mail undeliverable. 

I am using Group Mail in our office on dedicated IP authenticating SMTP to
their virtual domain on our IMail server. Do I need to make an additional
DNS entry of our office IP for their domain and what would I do?

Again, the e-mail we are sending is here at
http://news.holisticmoms.org/index_email.htm.


Body of message generated response: 
554 5.7.1 This message appears to be unsolicited bulk mail...reverse DNS
problem with 65.57.241.197...Try plain text

Original message follows. 

Received: from holisticmoms.org [68.209.181.166] by holisticmoms.org with
ESMTP 
  (SMTPD32-8.12) id A27353BE00EE; Mon, 21 Mar 2005 21:26:59 -0500 
Message-ID: <[EMAIL PROTECTED]> 
To: "HMN Members" <[EMAIL PROTECTED]> 
Organization: Holistic Moms Network 
From: "Holistic Moms News" <[EMAIL PROTECTED]> 
Subject: Holistic Moms Network News March 2005 
Date: Mon, 21 Mar 2005 21:25:53 -0500 
MIME-Version: 1.0 
Content-Type: multipart/alternative; 
boundary="=_NextPart_30681132292922553481" 
X-Declude-Sender: [EMAIL PROTECTED] [68.209.181.166] 
X-Declude-Spoolname: D827353be00eedffd.SMD 
X-Note: CompBiz scanned with Declude JunkMail 
X-Spam-Tests-Failed: None [-5] 
Organization: Abuse reports to [EMAIL PROTECTED] 



From: "Postmaster" <[EMAIL PROTECTED]>  Save Address | Headers
To : <[EMAIL PROTECTED]>
CC : 
Date : Mon, 21 Mar 2005 21:28:52 -0500
Subject : Undeliverable Mail 


 
undeliverable to [EMAIL PROTECTED] 

Body of message generated response: 
554 Denied 

undeliverable to [EMAIL PROTECTED] 

Body of message generated response: 
554 Denied 



Original message follows. 

Received: from holisticmoms.org [68.209.181.166] by holisticmoms.org with
ESMTP 
  (SMTPD32-8.12) id A286418D00F0; Mon, 21 Mar 2005 21:27:18 -0500 
Message-ID: <[EMAIL PROTECTED]> 
To: "HMN Members" <[EMAIL PROTECTED]> 
Organization: Holistic Moms Network 
From: "Holistic Moms News" <[EMAIL PROTECTED]> 
Subject: Holistic Moms Network News March 2005 
Date: Mon, 21 Mar 2005 21:26:00 -0500 
MIME-Version: 1.0 
Content-Type: multipart/alternative; 
boundary="=_NextPart_1949814226871226091" 
X-Declude-Sender: [EMAIL PROTECTED] [68.209.181.166] 
X-Declude-Spoolname: D8285418d00f0e016.SMD 
X-Note: CompBiz scanned with Declude JunkMail 
X-Spam-Tests-Failed: None [-5] 
Organization: Abuse reports to [EMAIL PROTECTED]  

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client

[Don Schreiner]

Matt/Darin/John/Andrew,

Inserting the trailing / on the URLs ending with a directory - did the trick
and passed the AOL filter. I learned something again today. Thanks for your
help! This list is the best!


-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matt Robertson
Sent: Monday, March 21, 2005 6:59 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a
Client

What Don is doing is something thats been around for quite a while,
and not just in ColdFusion.  In CF its commonly called a FakeURL and
the intent of it is to make a url search engine safe by removing the
?'s and &'s and replacing them with slashes.

Its been around for years.  I've never heard of anything like what AOL
is doing.  If they're serious about blacklisting this sort of thing
then it would break zillions of web sites, or more accurately any
email pointing to them.

-- 
--mattRobertson--
Janitor, MSB Web Systems
mysecretbase.com
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
CompBiz.Net scanned for Virus'


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client

[Don Schreiner]

Darin,

The entire problem here is the page is dynamically generated via CF and
database and the correct page will not come up any other way, only the home
page of the site. This code has been in use about 6 years this way and would
be a major deal to change all. Found an AOL test subject and going to try
Johns suggestion on ending with /. Let you know what happens.

-Don


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox
Sent: Monday, March 21, 2005 6:47 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a
Client

Nope...I'm saying it should either end at

http://www.holisticmoms.org/index.cfm

Or be reparsed as something like

http://www.holisticmoms.org/index.cfm?about

Basically there shouldn't be any more to the path after index.cfm.

Darin.


- Original Message - 
From: "Don Schreiner" <[EMAIL PROTECTED]>
To: 
Sent: Monday, March 21, 2005 6:33 PM
Subject: RE: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a
Client


Darin,

Got it now. The link is valid to the directory not ending with the index
file which is as follows for example:

http://www.holisticmoms.org/index.cfm/about

but you are saying AOL wants to see full path...

http://www.holisticmoms.org/index.cfm/about/index.cfm.

Will let you know if it works. Thanks.

-Don


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox
Sent: Monday, March 21, 2005 6:22 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a
Client

Look at the About HMN link, for example...

http://www.holisticmoms.org/index.cfm/about

See what I mean?  There are three links like this in the nav that AOL is
complaining about since they don't end with the filename...the path keeps
going.

Darin.


- Original Message - 
From: "Don Schreiner" <[EMAIL PROTECTED]>
To: 
Sent: Monday, March 21, 2005 6:15 PM
Subject: RE: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a
Client


Darin/Andrew,

I do not know anyone or have an AOL account to test. Anyone have one by
chance? I checked left NAV and all links look valid, however I am a little
suspect of the Bee Well Therapy Advertiser link with no www and going to
change. Where did you see a bad link in the left NAV? Also the link Andrew
found with the space I am going to look at changing. Thanks guys for
looking!

-Don


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox
Sent: Monday, March 21, 2005 5:43 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a
Client

Check your left-hand nav...you have some bad links there...

Darin.


----- Original Message - 
From: "Don Schreiner" <[EMAIL PROTECTED]>
To: 
Sent: Monday, March 21, 2005 5:29 PM
Subject: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a
Client


We sent a bulk mailing this morning for a client to 532 addresses. We use
Group Mail and authenticate from our office dedicated IP to our IMAIL server
via the clients account virtual domain. However, the e-mail was rejected to
any AOL address stating that URLs are improperly formatted. We have verified
all formatting of the URL's. Below is what we get back from AOL.

Body of message generated response:
554-:  (HVU:NR) http://postmaster.info.aol.com/errors/554hvunr.html
554 TRANSACTION FAILED

Below is the URL of the actual e-mail/file itself we sent. The only thing I
can think of is they do not like the sub-domain we are using
news.holisticmoms.org which is what we directed for the plain text folks.
The actual e-mail itself can be viewed at
http://news.holisticmoms.org/index_email.htm.

Also, perhaps they do not like our dedicated office IP number even though we
are sending via our IMail server and authenticated via their virtual domain
account.

Does anyone have any clues about this or the errors of my ways? Thanks.

-Don

Also, below is the undeliverable return header they provided:

Received: from holisticmoms.org [68.209.181.166] by holisticmoms.org with
ESMTP
  (SMTPD32-8.12) id AB3337EB002A; Mon, 21 Mar 2005 08:25:07 -0500
Message-ID: <[EMAIL PROTECTED]>
To: "HMN Members" <[EMAIL PROTECTED]>
Organization: Holistic Moms Network
From: "Holistic Moms News" <[EMAIL PROTECTED]>
Subject: Holistic Moms Network News March 2005
Date: Mon, 21 Mar 2005 08:23:59 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_NextPart_8310132123562132359893"
X-Declude-Sender: [EMAIL PROTECTED] [68.209.181.166]
X-Declude-Spoolname: Dcb3237eb002a698e.SMD
X-Note: CompBiz scanned with Declude JunkMail
X-Spam-Tests-Failed: None [-5]
Organization: Abuse reports to [EMAIL PROTECTED]



---
This E-mail came from the Declude.JunkMail mailing lis

RE: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client

[Don Schreiner]

Darin,

Got it now. The link is valid to the directory not ending with the index
file which is as follows for example:

http://www.holisticmoms.org/index.cfm/about

but you are saying AOL wants to see full path...

http://www.holisticmoms.org/index.cfm/about/index.cfm.

Will let you know if it works. Thanks.

-Don


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox
Sent: Monday, March 21, 2005 6:22 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a
Client

Look at the About HMN link, for example...

http://www.holisticmoms.org/index.cfm/about

See what I mean?  There are three links like this in the nav that AOL is
complaining about since they don't end with the filename...the path keeps
going.

Darin.


- Original Message - 
From: "Don Schreiner" <[EMAIL PROTECTED]>
To: 
Sent: Monday, March 21, 2005 6:15 PM
Subject: RE: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a
Client


Darin/Andrew,

I do not know anyone or have an AOL account to test. Anyone have one by
chance? I checked left NAV and all links look valid, however I am a little
suspect of the Bee Well Therapy Advertiser link with no www and going to
change. Where did you see a bad link in the left NAV? Also the link Andrew
found with the space I am going to look at changing. Thanks guys for
looking!

-Don


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox
Sent: Monday, March 21, 2005 5:43 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a
Client

Check your left-hand nav...you have some bad links there...

Darin.


- Original Message - 
From: "Don Schreiner" <[EMAIL PROTECTED]>
To: 
Sent: Monday, March 21, 2005 5:29 PM
Subject: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a
Client


We sent a bulk mailing this morning for a client to 532 addresses. We use
Group Mail and authenticate from our office dedicated IP to our IMAIL server
via the clients account virtual domain. However, the e-mail was rejected to
any AOL address stating that URLs are improperly formatted. We have verified
all formatting of the URL's. Below is what we get back from AOL.

Body of message generated response:
554-:  (HVU:NR) http://postmaster.info.aol.com/errors/554hvunr.html
554 TRANSACTION FAILED

Below is the URL of the actual e-mail/file itself we sent. The only thing I
can think of is they do not like the sub-domain we are using
news.holisticmoms.org which is what we directed for the plain text folks.
The actual e-mail itself can be viewed at
http://news.holisticmoms.org/index_email.htm.

Also, perhaps they do not like our dedicated office IP number even though we
are sending via our IMail server and authenticated via their virtual domain
account.

Does anyone have any clues about this or the errors of my ways? Thanks.

-Don

Also, below is the undeliverable return header they provided:

Received: from holisticmoms.org [68.209.181.166] by holisticmoms.org with
ESMTP
  (SMTPD32-8.12) id AB3337EB002A; Mon, 21 Mar 2005 08:25:07 -0500
Message-ID: <[EMAIL PROTECTED]>
To: "HMN Members" <[EMAIL PROTECTED]>
Organization: Holistic Moms Network
From: "Holistic Moms News" <[EMAIL PROTECTED]>
Subject: Holistic Moms Network News March 2005
Date: Mon, 21 Mar 2005 08:23:59 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_NextPart_8310132123562132359893"
X-Declude-Sender: [EMAIL PROTECTED] [68.209.181.166]
X-Declude-Spoolname: Dcb3237eb002a698e.SMD
X-Note: CompBiz scanned with Declude JunkMail
X-Spam-Tests-Failed: None [-5]
Organization: Abuse reports to [EMAIL PROTECTED]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
CompBiz.Net scanned for Virus'


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
CompBiz.Net scanned for Virus'


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client

[Don Schreiner]

Darin/Andrew,

I do not know anyone or have an AOL account to test. Anyone have one by
chance? I checked left NAV and all links look valid, however I am a little
suspect of the Bee Well Therapy Advertiser link with no www and going to
change. Where did you see a bad link in the left NAV? Also the link Andrew
found with the space I am going to look at changing. Thanks guys for
looking!

-Don


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox
Sent: Monday, March 21, 2005 5:43 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a
Client

Check your left-hand nav...you have some bad links there...

Darin.


- Original Message - 
From: "Don Schreiner" <[EMAIL PROTECTED]>
To: 
Sent: Monday, March 21, 2005 5:29 PM
Subject: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a
Client


We sent a bulk mailing this morning for a client to 532 addresses. We use
Group Mail and authenticate from our office dedicated IP to our IMAIL server
via the clients account virtual domain. However, the e-mail was rejected to
any AOL address stating that URLs are improperly formatted. We have verified
all formatting of the URL's. Below is what we get back from AOL.

Body of message generated response:
554-:  (HVU:NR) http://postmaster.info.aol.com/errors/554hvunr.html
554 TRANSACTION FAILED

Below is the URL of the actual e-mail/file itself we sent. The only thing I
can think of is they do not like the sub-domain we are using
news.holisticmoms.org which is what we directed for the plain text folks.
The actual e-mail itself can be viewed at
http://news.holisticmoms.org/index_email.htm.

Also, perhaps they do not like our dedicated office IP number even though we
are sending via our IMail server and authenticated via their virtual domain
account.

Does anyone have any clues about this or the errors of my ways? Thanks.

-Don

Also, below is the undeliverable return header they provided:

Received: from holisticmoms.org [68.209.181.166] by holisticmoms.org with
ESMTP
  (SMTPD32-8.12) id AB3337EB002A; Mon, 21 Mar 2005 08:25:07 -0500
Message-ID: <[EMAIL PROTECTED]>
To: "HMN Members" <[EMAIL PROTECTED]>
Organization: Holistic Moms Network
From: "Holistic Moms News" <[EMAIL PROTECTED]>
Subject: Holistic Moms Network News March 2005
Date: Mon, 21 Mar 2005 08:23:59 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_NextPart_8310132123562132359893"
X-Declude-Sender: [EMAIL PROTECTED] [68.209.181.166]
X-Declude-Spoolname: Dcb3237eb002a698e.SMD
X-Note: CompBiz scanned with Declude JunkMail
X-Spam-Tests-Failed: None [-5]
Organization: Abuse reports to [EMAIL PROTECTED]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
CompBiz.Net scanned for Virus'


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client

[Don Schreiner]

We sent a bulk mailing this morning for a client to 532 addresses. We use
Group Mail and authenticate from our office dedicated IP to our IMAIL server
via the clients account virtual domain. However, the e-mail was rejected to
any AOL address stating that URLs are improperly formatted. We have verified
all formatting of the URL's. Below is what we get back from AOL. 

Body of message generated response: 
554-:  (HVU:NR) http://postmaster.info.aol.com/errors/554hvunr.html   
554 TRANSACTION FAILED 

Below is the URL of the actual e-mail/file itself we sent. The only thing I
can think of is they do not like the sub-domain we are using
news.holisticmoms.org which is what we directed for the plain text folks.
The actual e-mail itself can be viewed at
http://news.holisticmoms.org/index_email.htm.

Also, perhaps they do not like our dedicated office IP number even though we
are sending via our IMail server and authenticated via their virtual domain
account.

Does anyone have any clues about this or the errors of my ways? Thanks.

-Don 

Also, below is the undeliverable return header they provided:

Received: from holisticmoms.org [68.209.181.166] by holisticmoms.org with
ESMTP 
  (SMTPD32-8.12) id AB3337EB002A; Mon, 21 Mar 2005 08:25:07 -0500 
Message-ID: <[EMAIL PROTECTED]> 
To: "HMN Members" <[EMAIL PROTECTED]> 
Organization: Holistic Moms Network 
From: "Holistic Moms News" <[EMAIL PROTECTED]> 
Subject: Holistic Moms Network News March 2005 
Date: Mon, 21 Mar 2005 08:23:59 -0500 
MIME-Version: 1.0 
Content-Type: multipart/alternative; 
boundary="=_NextPart_8310132123562132359893" 
X-Declude-Sender: [EMAIL PROTECTED] [68.209.181.166] 
X-Declude-Spoolname: Dcb3237eb002a698e.SMD 
X-Note: CompBiz scanned with Declude JunkMail 
X-Spam-Tests-Failed: None [-5] 
Organization: Abuse reports to [EMAIL PROTECTED]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Exclude BABEXT Notify for COM

[Don Schreiner]

Matt,

This will work for the meantime and thank you very much!

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Monday, March 21, 2005 8:17 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Exclude BABEXT Notify for COM

There seems to be a bug in all versions where a bogus COM file is still 
bounced as a banned extension (unlike other 'bogus' types that are 
detected).

The workaround is to add "SKIPIFEXT COM" to the top of your 
bannotify.eml, however this will stop all bounces for COM files 
regardless of whether or not they are found to be 'bogus'.

Matt



Don Schreiner wrote:

>I am getting a lot of postmaster rejects from bad addresses after turning
on
>BANEXT for COM attachments. I would like to exclude notifications on my
>BANnotify.EML file. Can I do this by inserting SKIPIFBANEXTNAMEHAS COM at
>the top of EML file? I am just guessing based on feature to use
>SKIPIFVIRUSNAMEHAS VIRUS_NAME.
>
>I am still sitting on 1.82 waiting until comfortable with upgrade. I have
>looked for the Declude Manuals on the site but see no reference other than
>the install manual? I got to tell you guys the Declude site is a real pain
>in the rear finding the manuals. I logged on to my account which is no use.
>It does not have either of my 2 licenses listed. Nor does it have any links
>to the manual. I even downloaded the most recent release version and I see
>no readme.txt or manual there either. 
>
>Ohh well... any assistance on the BANEXT COM and excluding the notify for
>same on EML file would be most appreciated. Thanks.
>
>-Don
>
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>
>
>  
>

-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
CompBiz.Net scanned for Virus'


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Exclude BABEXT Notify for COM

[Don Schreiner]

I am getting a lot of postmaster rejects from bad addresses after turning on
BANEXT for COM attachments. I would like to exclude notifications on my
BANnotify.EML file. Can I do this by inserting SKIPIFBANEXTNAMEHAS COM at
the top of EML file? I am just guessing based on feature to use
SKIPIFVIRUSNAMEHAS VIRUS_NAME.

I am still sitting on 1.82 waiting until comfortable with upgrade. I have
looked for the Declude Manuals on the site but see no reference other than
the install manual? I got to tell you guys the Declude site is a real pain
in the rear finding the manuals. I logged on to my account which is no use.
It does not have either of my 2 licenses listed. Nor does it have any links
to the manual. I even downloaded the most recent release version and I see
no readme.txt or manual there either. 

Ohh well... any assistance on the BANEXT COM and excluding the notify for
same on EML file would be most appreciated. Thanks.

-Don


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] 2005 SpamHeaders Glitch?

[Don Schreiner]

It did affect us throwing weight higher on emails that would not have
otherwise failed the Spam Header Filter. We hold on a relatively low weight
of 13 compared to other configs I have seen posted with weights of 100, 200,
etc. The bottom line is if I did not stroll in here on New Years and catch
the posts about the bug, there would have been a lot more of my customer
e-mails not getting through due to this. It was not that big a deal for us,
and yes I took action and commented out, and now more Spam possibly getting
through not reaching same weight we would hold or delete upon. So now I have
to possibly adjust another test I guess to make up for it, until the fix? I
am monitoring and hoping Sniffer will fill the gap if any.

If I had not seen the posts, would the affect for us and our clients have
been detrimental? Not really because most of my customers away for holidays
too and we are not a huge firm with huge commercial clients. But... if I did
have a huge commercial client base - the point of sharing the info and a
little advise as a result does seem very prudent. It's not the product, it
is communication to me the customer with better warning like "if this bug
affects you, do the following until we get it fixed." I guess I am making a
mountain out of a mole hill spoiled with great support and communication in
the past. But remember this is a primary reason I have always "went out of
my way" to praise Declude too! 

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Monday, January 03, 2005 5:01 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] 2005 SpamHeaders Glitch?


>1. An acknowledgement on the list from someone that they knew about the
>problem - it WAS a holiday and I think people should have lives - but just
a
>"hey we know" within 24 hours would've been nice.

Yes, that would have been nice.  It did take a bit more than 24 hours for 
an official response on the list.

>2. A simple e-mail note to all customers ASAP stating "The spamheaders test
>has a bug causing it to catch and add weight to every e-mail sent in 2005.
>It is suggested that you comment it out or reduce (or remove) its weight to
>avoid false positives.  We are working on a fix and will post it to the
>website as soon as possible"

The main reason this wasn't done was because it wasn't clear that this was 
going to be as big an issue for our customers as it turned out to be.  The 
thought was that since this is normally a relatively minor test, anyone 
that it does affect adversely would just comment out the test.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.



This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
CompBiz.Net scanned for Virus'


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] 2005 SpamHeaders Glitch?

[Don Schreiner]

We are up-to-date with our support agreements way into 2005 and I am
awaiting a fix. I am not sure I understand the talk here about forced
license upgrade unless a customer support agreement has expired? I also
agree it would have been nice to have a warning announcement about the Spam
Header test being broken officially from Declude, more timely, and along
with advice what to do in the interim. This is not the same Declude
operation to me as in years past!

-Don


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Imail Admin
Sent: Monday, January 03, 2005 3:20 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] 2005 SpamHeaders Glitch?

I think Jerry has this right.  Both our Declude and IMail support agreements
are currently lapsed.  We were planning on renewing both in early 2005 when
Ipswitch had their big fiasco over discontinuing IMail as a stand-alone
program.  So we plan on dropping IMail and we postponed renewing the Declude
support contract.  I'm sure that if we switch to SmarterMail that we'll
renew the Declude contract, but that could be months out.  In the meanwhile,
we were happy with our current version of Declude until this bug popped up.
Since this is a major bug, I consider Declude responsible.  I'll be
interested to see what they do.

Actually, I could think of one compromise solution: release an update/fixed
version, require a support contract for the download, but offer (for a
limited time) a substantial discount on the support contract.  Or, if you
don't like that, then offer a short-term support contract (three months for
one quarter of the usual price).  I really am a big fan of Declude; I just
don't like being forced into an upgrade.

Ben
BC Web

- Original Message - 
From: "Jerry Murdock" <[EMAIL PROTECTED]>
To: 
Sent: Monday, January 03, 2005 8:22 AM
Subject: Re: [Declude.JunkMail] 2005 SpamHeaders Glitch?


> I don't think that's fair for a bug like this.  Declude has never been
> presented as being a "time sensitive" licensed product.
>
> I know some of my old installs are still probably using older versions
> without other issues.  I've made my successors aware of this and it's up
> to them now.
>
> There are a lot of folks out there that will be looking for an iMail
> replacement, and may consider Smartermail/Declude, but won't if they feel
> CPHZ is not doing right. CPHZ should release a 1.82 or a 1.8101 and make
> it available for all licensed users.  They would then get a "phone home"
> version out to more users, and generate good will instead of ill will.
>
> I'm surprised the conspiracy theorists haven't chimed in already that this
> is just a way to force an upgrade.  I don't believe that, but some will be
> thinking it.
>
> Jerry
>
>
> - Original Message - 
> From: "Ncl Admin" <[EMAIL PROTECTED]>
> To: 
> Sent: Monday, January 03, 2005 10:51 AM
> Subject: RE: [Declude.JunkMail] 2005 SpamHeaders Glitch?
>
>
> > At 07:59 AM 1/2/2005 +1100, you wrote:
> > >Great way to increase sales due to the need to update service
> agreements.
> >
> > Anyone that runs production software without service agreements gets
> what
> > they deserve.
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
CompBiz.Net scanned for Virus'


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] ETA for SPAMHEADERS glitch

[Don Schreiner]

Well I just made a post, and this is the post I was expecting/looking for.
Thanks Scott!

-Don


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Monday, January 03, 2005 3:34 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] ETA for SPAMHEADERS glitch

Just to let everyone know, we have identified the issue with the 
SPAMHEADERS test.  As most people realized, most E-mails sent with a date 
involving a year after 2004 were failing the SPAMHEADERS test.

For those that are interested in the details, if the SPAMHEADERS code 
matches the bitmask 0x4800, it means that an invalid year was detected 
for the SPAMHEADERS test.  Normally, a code such as 0x4802 would be 
seen, but others such as 0xC0001802 could also be seen.  And I feel that it 
is only fair for me to point out that this glitch was in code that I wrote 
(several years ago, actually).

We expect to have a v1.82 ready by tomorrow morning that takes care of this 
issue.

Part of the reason for the delay (aside from it first being reported on a 
holiday during a weekend) was that the fix involves changing old source 
code, which is something that has never been done with Declude before.  In 
the past, when issues such as this were detected, a change would be made to 
the latest code (v2.0b in this case).  However, management made the 
decision that it would be in the best interest for everyone to make the 
change to the 1.81 as well, which requires a more complicated procedure for 
implementing the change.



This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
CompBiz.Net scanned for Virus'


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Smarter Mail and ODBC

[Don Schreiner]

We have to determine if worth changing over the email account portion of our
apps to XML and writing/running scripts on the database for conversion. A
difficult decision. Thanks all for their feedback.

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty
Sent: Saturday, December 25, 2004 11:50 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Smarter Mail and ODBC

Hi Don-
 
>From what I read in the IMail converter wizard docs, SM keeps all data in an
XML file, and does not appear to support ODBC:

Every SmarterMail server has a domainList.xml file that tells
SmarterMail what domains it controls and where the root directory to each
domain can be found. This file is found in the Service directory in the
SmarterMail installation directory. By default this is found at "c:\program
files\smartertools\smartermail\service\domainList.xml".

...and...

The conversion wizard will not convert the following:

*   Shared Address Book 
*   Content Filtering 
*   Users in domains configured in LDAP or ODBC data source.
Only IMail Database domains are currently supported 

-d
 
 
- Original Message ----- 
From: "Don Schreiner" <[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> >
To: mailto:Declude.JunkMail@declude.com> >
Sent: Friday, December 24, 2004 7:01 AM
Subject: [Declude.JunkMail] Smarter Mail and ODBC


>I cannot find where Smarter Mail supports ODBC? Our IMail set-up is with
SQL
> database for usernames and passwords integrated with our Cold Fusion
> applications. Does anyone know if Smarter Mail will work with database?
> Thanks.
> 
> -Don 
> 
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com <http://www.declude.com> )]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]> , and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com <http://www.mail-archive.com> .
> 
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Smarter Mail and ODBC

[Don Schreiner]

I cannot find where Smarter Mail supports ODBC? Our IMail set-up is with SQL
database for usernames and passwords integrated with our Cold Fusion
applications. Does anyone know if Smarter Mail will work with database?
Thanks.

-Don 


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Service Agreements

[Don Schreiner]

So $264 for Declude AV/JM regardless if Pro or Standard, or multiple
SA's?

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Wednesday, December 01, 2004 12:42 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Service Agreements


>I seem to recall that the license code is based on the fqdn of the mail
>server. Wouldn't that mean that an individual license would be required
for
>each server it is installed on in order to function?

That is correct.  The Declude software is licensed per-server, so if you

have multiple servers, you need multiple copies of Declude (just as you 
would need multiple copies of Windows and IMail).  Even if the hostnames

are the same, multiple licenses are necessary.

>I also think that the updates covered by the service agreement are for
all
>products anyway since there is only one codebase for all products but
>individual config file for each product. That would mean that  if you
had
>just JM, the updates also includes the code for AV and HJ as well.

Correct.  The activation codes determine which products are being run;
the 
declude.exe file contains the code for all of them, so upgrading one 
upgrades them all.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in
mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.



This outgoing message is guaranteed to be authentic by Message Level
users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
CompBiz.Net scanned for Virus'


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Email being released today - Advance Notice

[Don Schreiner]

Barry,

Please see below email. I am also working on finding in my archive
another email between Scott and self clarifying Service Agreements this
same topic. Apparently you are saying SA has changed and does not cover
all products purchased in past?

-Don

-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, January 14, 2003 2:41 PM
To: [EMAIL PROTECTED]
Subject: Declude Service Agreement

Thank you for your order for a Service Agreement.

This E-mail confirms the purchase of your 1 Year Service Agreement,
which 
will be good through January 31, 2004.

The Service Agreement entitles you to free upgrades and support during
the 
term of the service agreement.  The Service Agreement covers all Declude

programs that you have purchased in the past.  You do not need a new 
activation code; your current activation code will continue to work.

Please note that we now have a special E-mail address for urgent support

issues ([EMAIL PROTECTED]).  Standard support questions can be sent to 
[EMAIL PROTECTED]

If you have any questions, please let me know.  Thanks.
 -Scott

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Barry Simpson
Sent: Wednesday, December 01, 2004 11:10 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Email being released today - Advance
Notice


Explanation of Service Agreements

1. Service Agreements have always been "Per Server", that is to say that
if
you own JunkMail on Two Servers then you should have paid two service
agreements. In the past this would have cost you $295 * 2 - $590. Today
it
will be $132 * 2 = $264. A significant saving.

2. The rules on upgrades have always been that an upgrade between
product
levels e.g. Lite to Standard, does NOT include any extension in Service
Agreement.

Both these rules have been set by Scott years ago.

- Barry

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Don Schreiner
Sent: Wednesday, December 01, 2004 10:58 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Email being released today - Advance
Notice

That is how I recall it too, but not sure based on the sites verbiage.
We 
have license for Declude Pro AV/JM on one server and separate license
for 
Declude Standard AV/JM at another server/location. Does the $264 JM/AV 
Service Agreement option cover both these licenses as in the past?

-Don

- Original Message - 
From: "Darin Cox" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 01, 2004 10:34 AM
Subject: Re: [Declude.JunkMail] Email being released today - Advance
Notice


Sounds like some good changes.

How does upgrading one or more products affect service agreements?  For 
example, if we have JM and AV standard, and upgrade one to Pro, what
service

agreement would we end up with?

I believe in the old model, upgrading one would effectively result in a
year

support for both, but I may be incorrect.

Darin.


- Original Message - 
From: Barry Simpson
To: [EMAIL PROTECTED]
Sent: Wednesday, December 01, 2004 10:10 AM
Subject: [Declude.JunkMail] Email being released today - Advance Notice




This is a preview of an email being shortly released by Declude and
being 
sent to all customers.



_



"We recently promised you information about our plans as and when it
became 
available. Here are two pieces of news:



A Beta release of Declude 2.0 will be available on or around December
16th 
that will include new functionality and also support for an additional 
windows based mail server as an affordable alternative to IMail. This
opens 
up the options for a reasonably priced, fully functional gateway.



In order to provide more equitable pricing on Service Agreements we will

introduce a new mechanism which will be available immediately. There
will be

server/product based support agreements rather than a blanket cost which

penalizes the smaller user. Please visit our Service Agreements page to
see 
more details.



On a less positive note we have been monitoring downloads and
activations of

Declude software and have discovered that there are a significant number
of 
non licensed copies being used. These include customers downloading the 
latest release without a valid Service Agreement and others who have 
installed multiple copies of unlicensed software. We encourage all
customers

who are participating in these activities to regularize their legal
position

by December 31st, 2004. If you have any questions as to the validity of
your

installation please email us at [EMAIL PROTECTED] or call us at (866) 
332-5833 between 8.00 am and 5 pm Eastern Time, Monday thru Friday."











---
[This E-mail was 

RE: [Declude.JunkMail] Email being released today - Advance Notice

[Don Schreiner]

Barry,

I hate to disagree with you!  See below email. I am also working on
finding in my archive another email between Scott and self clarifying
Service Agreements this same topic.

-Don

-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, January 14, 2003 2:41 PM
To: [EMAIL PROTECTED]
Subject: Declude Service Agreement

Thank you for your order for a Service Agreement.

This E-mail confirms the purchase of your 1 Year Service Agreement,
which 
will be good through January 31, 2004.

The Service Agreement entitles you to free upgrades and support during
the 
term of the service agreement.  The Service Agreement covers all Declude

programs that you have purchased in the past.  You do not need a new 
activation code; your current activation code will continue to work.

Please note that we now have a special E-mail address for urgent support

issues ([EMAIL PROTECTED]).  Standard support questions can be sent to 
[EMAIL PROTECTED]

If you have any questions, please let me know.  Thanks.
 -Scott

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Barry Simpson
Sent: Wednesday, December 01, 2004 11:10 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Email being released today - Advance
Notice


Explanation of Service Agreements

1. Service Agreements have always been "Per Server", that is to say that
if
you own JunkMail on Two Servers then you should have paid two service
agreements. In the past this would have cost you $295 * 2 - $590. Today
it
will be $132 * 2 = $264. A significant saving.

2. The rules on upgrades have always been that an upgrade between
product
levels e.g. Lite to Standard, does NOT include any extension in Service
Agreement.

Both these rules have been set by Scott years ago.

- Barry

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Don Schreiner
Sent: Wednesday, December 01, 2004 10:58 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Email being released today - Advance
Notice

That is how I recall it too, but not sure based on the sites verbiage.
We 
have license for Declude Pro AV/JM on one server and separate license
for 
Declude Standard AV/JM at another server/location. Does the $264 JM/AV 
Service Agreement option cover both these licenses as in the past?

-Don

- Original Message - 
From: "Darin Cox" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 01, 2004 10:34 AM
Subject: Re: [Declude.JunkMail] Email being released today - Advance
Notice


Sounds like some good changes.

How does upgrading one or more products affect service agreements?  For 
example, if we have JM and AV standard, and upgrade one to Pro, what
service

agreement would we end up with?

I believe in the old model, upgrading one would effectively result in a
year

support for both, but I may be incorrect.

Darin.


- Original Message - 
From: Barry Simpson
To: [EMAIL PROTECTED]
Sent: Wednesday, December 01, 2004 10:10 AM
Subject: [Declude.JunkMail] Email being released today - Advance Notice




This is a preview of an email being shortly released by Declude and
being 
sent to all customers.



_



"We recently promised you information about our plans as and when it
became 
available. Here are two pieces of news:



A Beta release of Declude 2.0 will be available on or around December
16th 
that will include new functionality and also support for an additional 
windows based mail server as an affordable alternative to IMail. This
opens 
up the options for a reasonably priced, fully functional gateway.



In order to provide more equitable pricing on Service Agreements we will

introduce a new mechanism which will be available immediately. There
will be

server/product based support agreements rather than a blanket cost which

penalizes the smaller user. Please visit our Service Agreements page to
see 
more details.



On a less positive note we have been monitoring downloads and
activations of

Declude software and have discovered that there are a significant number
of 
non licensed copies being used. These include customers downloading the 
latest release without a valid Service Agreement and others who have 
installed multiple copies of unlicensed software. We encourage all
customers

who are participating in these activities to regularize their legal
position

by December 31st, 2004. If you have any questions as to the validity of
your

installation please email us at [EMAIL PROTECTED] or call us at (866) 
332-5833 between 8.00 am and 5 pm Eastern Time, Monday thru Friday."











---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came f

Re: [Declude.JunkMail] Email being released today - Advance Notice

[Don Schreiner]

That is how I recall it too, but not sure based on the sites verbiage. We 
have license for Declude Pro AV/JM on one server and separate license for 
Declude Standard AV/JM at another server/location. Does the $264 JM/AV 
Service Agreement option cover both these licenses as in the past?

-Don

- Original Message - 
From: "Darin Cox" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 01, 2004 10:34 AM
Subject: Re: [Declude.JunkMail] Email being released today - Advance Notice


Sounds like some good changes.

How does upgrading one or more products affect service agreements?  For 
example, if we have JM and AV standard, and upgrade one to Pro, what service 
agreement would we end up with?

I believe in the old model, upgrading one would effectively result in a year 
support for both, but I may be incorrect.

Darin.


- Original Message - 
From: Barry Simpson
To: [EMAIL PROTECTED]
Sent: Wednesday, December 01, 2004 10:10 AM
Subject: [Declude.JunkMail] Email being released today - Advance Notice




This is a preview of an email being shortly released by Declude and being 
sent to all customers.

_



"We recently promised you information about our plans as and when it became 
available. Here are two pieces of news:



A Beta release of Declude 2.0 will be available on or around December 16th 
that will include new functionality and also support for an additional 
windows based mail server as an affordable alternative to IMail. This opens 
up the options for a reasonably priced, fully functional gateway.



In order to provide more equitable pricing on Service Agreements we will 
introduce a new mechanism which will be available immediately. There will be 
server/product based support agreements rather than a blanket cost which 
penalizes the smaller user. Please visit our Service Agreements page to see 
more details.



On a less positive note we have been monitoring downloads and activations of 
Declude software and have discovered that there are a significant number of 
non licensed copies being used. These include customers downloading the 
latest release without a valid Service Agreement and others who have 
installed multiple copies of unlicensed software. We encourage all customers 
who are participating in these activities to regularize their legal position 
by December 31st, 2004. If you have any questions as to the validity of your 
installation please email us at [EMAIL PROTECTED] or call us at (866) 
332-5833 between 8.00 am and 5 pm Eastern Time, Monday thru Friday."









---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] F-Prot Windows 3.16 Update Missing F-Prot.exe

[Don Schreiner]

I missed that in the release notes - ouch! So... the fpcmd.exe should be 
used as Darin stated. I did not notice in the Declude Virus manual when 
reviewing this morning, just double checked and sure is there as one of the 
2 choices depending on version. All back to normal and thanks guys.

-Don


- Original Message - 
From: "Jeff Pereira" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, November 23, 2004 8:57 AM
Subject: Re: [Declude.JunkMail] F-Prot Windows 3.16 Update Missing 
F-Prot.exe


They certainly could have made it more noticeable, but

>From the Release Notes:

The DOS scanner is now no longer installed on NT/2000/XP/2003.
If version 3.16 is installed as an upgrade then the previous DOS
version is removed.  The DOS scanner is not suitable for use on
the NTFS file system, now more popular as the result of increased
use of Windows XP.  The Command-Line Scanner (fpcmd.exe) should be
used instead of the DOS scanner.


- Original Message -
From: "Don Schreiner" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, November 23, 2004 8:49 AM
Subject: [Declude.JunkMail] F-Prot Windows 3.16 Update Missing F-Prot.exe


> I posted this to Declude.Virus, but apparently no longer subscribed and
> wanted to give folks a heads up here.
>
> Yesterday upgraded to most recent version of F-Prot Windows (fp-win_316_m)
> and this morning "by chance" I checked my declude virus log and noticed a
> bunch of "Your virus scanner DOES NOT EXIST ..." entries. Sure enough was
> missing F-Prot.exe file. I rolled back to version fp-win_315b_m  and all
> back to normal including install of F-Prot.exe. Wish the folks at F-Prot
let
> us know about this! Performing full scan now to see what may have slipped
> through last 36 hours.
>
> -Don
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> [This E-mail scanned for viruses by Declude Virus]
>
>

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
CompBiz.Net scanned for Virus'


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Blocking Dictionary Attacks

[Don Schreiner]

Thanks for reply. One thing I found this morning on IMail list recent post 
was BlackIce settings whereas will auto-block IP for 3 failed non-existent 
user attempts within 30 seconds.  The BlackIce documentation is poor on this 
subject and never figured it out myself over the years we have been using, 
but an IMail poster posted good instructions from a fellow who wrote the 
manual on Blackice apparently. Anyhoo... I set-up this morning and have been 
monitoring. It is working well so far and at least I am only seeing only 3 
log entries now in Imail logs on non-existent users vs. hundreds per IP. I 
am still very concerned that I may end up blocking legitimate IP's via 
zombies and going to watch closely for awhile. The other trade off is 
BlackIce may be working harder now and seeing 4-6% on CPU, but think this 
was typical anyway. BlackIce also does a decent job on other things like 
infected Zip signatures and attached exe's etc. I feel comfortable with it 
as another security layer. For example on our SQL server, we use it to block 
the hundreds probing our port 1433 daily. We handle light email volume in 
comparison to others here and I am sure if someone out there floods us hard, 
the IMail box and BlackIce would not hold up. But on limited volume and 
budget this may be the ticket for us now. I know the gateway is the "best" 
way to go. Thanks for the feedback - most appreciated and always learning 
here.

-Don


- Original Message - 
From: "Darin Cox" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, November 23, 2004 8:59 AM
Subject: Re: [Declude.JunkMail] Blocking Dictionary Attacks


A gateway is the only solution I know of for distributed dictionary attacks.
Since the attacks are coming from all over the place, there's no IP to
block.

All the gateway does is move the brunt of the attack off of the primary mail
server to the gateway server.  The gateway server should then become your
primary MX record, replacing your existing server, and the "real" primary
should be locked down to only receive SMTP traffic from your gateway.  That
way attackers who cache your MX records won't be able to continue to hit it.

Darin.


- Original Message - 
From: "Don Schreiner" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, November 23, 2004 5:20 AM
Subject: [Declude.JunkMail] Blocking Dictionary Attacks


Are there any new strategies for blocking dictionary attacks with Declude?
Our log files are growing and mostly due to the following stacking up it
seems a zillion times over...

ERR MAIL.DOMAIN.NET invalid user

We have used BlackIce for years and helps a lot for those that try X number
SMTP fails in X seconds, but does not handle all these invalid user
attempts. I searched archives and found good thread back in March this year
"How do they do it?" and Scott replied a Declude solution may be possibly
forthcoming. We only handle about 15k messages a day and small shop. Len's
IMgate or another Postfix gateway solution I know would be best - but not
affordable for us right now installing and managing a separate Linux box. It
is difficult for me to keep up-to-date with daily posts, so wondering if any
new strategies I might have missed.  Thanks!

-Don


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
CompBiz.Net scanned for Virus'


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] F-Prot Windows 3.16 Update Missing F-Prot.exe

[Don Schreiner]

According to Declude Virus manual states f-prot.exe in their example. I did 
not know or see that recommendation?

-Don

- Original Message - 
From: "Darin Cox" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, November 23, 2004 9:00 AM
Subject: Re: [Declude.JunkMail] F-Prot Windows 3.16 Update Missing 
F-Prot.exe


Don't you want to be using fpcmd anyway?  That's the recommended scanner to
use with Declude.

Darin.


- Original Message - 
From: "Don Schreiner" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, November 23, 2004 8:49 AM
Subject: [Declude.JunkMail] F-Prot Windows 3.16 Update Missing F-Prot.exe


I posted this to Declude.Virus, but apparently no longer subscribed and
wanted to give folks a heads up here.

Yesterday upgraded to most recent version of F-Prot Windows (fp-win_316_m)
and this morning "by chance" I checked my declude virus log and noticed a
bunch of "Your virus scanner DOES NOT EXIST ..." entries. Sure enough was
missing F-Prot.exe file. I rolled back to version fp-win_315b_m  and all
back to normal including install of F-Prot.exe. Wish the folks at F-Prot let
us know about this! Performing full scan now to see what may have slipped
through last 36 hours.

-Don

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
CompBiz.Net scanned for Virus'


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] F-Prot Windows 3.16 Update Missing F-Prot.exe

[Don Schreiner]

I posted this to Declude.Virus, but apparently no longer subscribed and 
wanted to give folks a heads up here.

Yesterday upgraded to most recent version of F-Prot Windows (fp-win_316_m) 
and this morning "by chance" I checked my declude virus log and noticed a 
bunch of "Your virus scanner DOES NOT EXIST ..." entries. Sure enough was 
missing F-Prot.exe file. I rolled back to version fp-win_315b_m  and all 
back to normal including install of F-Prot.exe. Wish the folks at F-Prot let 
us know about this! Performing full scan now to see what may have slipped 
through last 36 hours.

-Don

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Blocking Dictionary Attacks

[Don Schreiner]

Are there any new strategies for blocking dictionary attacks with Declude? 
Our log files are growing and mostly due to the following stacking up it 
seems a zillion times over...

ERR MAIL.DOMAIN.NET invalid user

We have used BlackIce for years and helps a lot for those that try X number 
SMTP fails in X seconds, but does not handle all these invalid user 
attempts. I searched archives and found good thread back in March this year 
"How do they do it?" and Scott replied a Declude solution may be possibly 
forthcoming. We only handle about 15k messages a day and small shop. Len's 
IMgate or another Postfix gateway solution I know would be best - but not 
affordable for us right now installing and managing a separate Linux box. It 
is difficult for me to keep up-to-date with daily posts, so wondering if any 
new strategies I might have missed.  Thanks!

-Don


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: Re[2]: [Declude.JunkMail] Declude/Smartermail

[Don Schreiner]

Holding off on SmarterMail here too and again need SQL DB with email account 
info for our integrated member applications. Do you have a link to MailMax? 
I am just as upset as others about IMail recent policies and been using 
since version 4.0. Today I saw a post you can renew unlimted version SA for 
$310 through a reseller. For some reason over the years never thought to 
price out with a reseller. I want a SA with whatever email server we go 
forward with. Whether it be short or long term. I feel at that reseller 
price we can handle for awhile longer until something else comes along we 
are comfortable (being ODBC/Declude/Sniffer/Good Web Mail). Seems to me with 
the talent at CH could handle with proper funding - but again probably a 
huge task to undertake full blown MTA with comparable IMail 
functionality/features.

-Don
- Original Message - 
From: "Wolf Tombe" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, November 08, 2004 7:32 PM
Subject: RE: Re[2]: [Declude.JunkMail] Declude/Smartermail


Has anyone load tested Smartermail?  It looks pretty good, but being 
rather
new on the market and only showing smaller clients as their customers I'm
wondering how many domains and users they can really scale to.  This is 
the
one major concern I have with them (and also the primary reason I've been
looking at MailMax as a potential iMail replacement).

- Wolf
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of David Sullivan
Sent: Monday, November 08, 2004 9:56 AM
To: [EMAIL PROTECTED]
Subject: Re[2]: [Declude.JunkMail] Declude/Smartermail
Hello Eric,
Monday, November 8, 2004, 9:30:42 AM, you wrote:
EK> What about SQL support in another product?  I'd look at
EK> switching but the db storage is key to me.  I rebuilt a machine
EK> after a crash and had imail back running with 100+ domains and
EK> 2000 users quickly with all the account info coming from their.
That's probably biggest drawback for us as well. We have about 50
domains on SQL2k BUT would be willing to rewrite our app to support
Smartermail's file system/xml storage that's manageable completely by
web service. No registry to deal with, makes backup/restore a complete
dream.
-David
--
Best regards,
Davidmailto:[EMAIL PROTECTED]
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
CompBiz.Net scanned for Virus'

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: Re[2]: [Declude.JunkMail] Declude/Smartermail

[Don Schreiner]

We are probably leaning this way too but still unsure because of sign-up 
applications we run require we store email account user info into SQL.

-Don
- Original Message - 
From: "David Sullivan" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, November 08, 2004 11:38 AM
Subject: Re[2]: [Declude.JunkMail] Declude/Smartermail



We're moving our installs to SM as well, hoping to see Declude support
for it ):
J> Ditto! One more vote for SM.
Looks like we're going that route as well with our 2 (soon to be 3)
installations.
Really hope to be able to take Declude with us. If not, will probably 
migrate to MXGuard.

-David
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
CompBiz.Net scanned for Virus'

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Client TOS Notifications from AOL

[Don Schreiner]

Good question and I am curious too. We actually have a no-forwarding
e-mail policy and not just to AOL. But... sometimes the customer
dictates what they want or will go elsewhere and we then allow on a
case-by-case basis. If we allowed for every customer I bet we would be
blacklisted already. I am still fearful AOL may blacklist on what little
traffic we do have getting forwarded. Thanks.

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Steve Flook
Sent: Wednesday, October 06, 2004 12:43 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Client TOS Notifications from AOL

On this note, what are other's policy on forwarding client's addresses
to AOL accounts?  We signed up with this feedback loop program quite
some time and realized that 95% of the reported "spam's" where coming
from forwarded messages to AOL accounts.  In the event of forwarded
messages, our IMail box takes the blame instead of the original MTA.

I have considered creating a policy of not allowing mail forwarding to
AOL accounts for fear of getting blacklisted from AOL.

Steve 

> -Original Message-
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of Don Schreiner
> Sent: Wednesday, October 06, 2004 11:37 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] Client TOS Notifications from AOL
> 
> Kami  & John,
> 
> Thanks a ton guys! That was me that registered on the AOL 
> feedback loop using our abuse addy, but going back months ago 
> and did not realize. So much to keep up with battling Spam! 
> Just a few more points on my Declude weight and would not 
> have made it to AOL - ohhh well - will keep tweaking our config.
> 
> -Don
> 
> - Original Message -
> From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Wednesday, October 06, 2004 10:31 AM
> Subject: RE: [Declude.JunkMail] Client TOS Notifications from AOL
> 
> 
> Some one at your company signed up and registered to receive 
> these feedback
> loop messages.
> 
> http://postmaster.info.aol.com/tools/fbl.html
> 
> John Tolmachoff
> Engineer/Consultant/Owner
> eServices For You
> 
> > -Original Message-
> > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> > [EMAIL PROTECTED] On Behalf Of Don Schreiner
> > Sent: Wednesday, October 06, 2004 7:09 AM
> > To: [EMAIL PROTECTED]
> > Subject: [Declude.JunkMail] Client TOS Notifications from AOL
> >
> > Declude Folks,
> >
> > I need some help figuring out why we are receiving e-mails from
> > [EMAIL PROTECTED] Subject Line: Client TOS Notification, and the Sent To
> address
> > is [EMAIL PROTECTED] I am not sure if these 
> are coming back
> to
> > me in our abuse or postmaster account? There is nothing in 
> the body of the
> > e-mail, only an attachment of e-mail apparently getting 
> rejected. Anyone
> > else seeing these? The client we host forwards his e-mail 
> automatically to
> > his AOL account. For example, below is the header of an 
> e-mail that was
> > attached whereas a spam e-amail appears to have been sent 
> to our client
> > (lamphier.com) hosted on our IMail server (sneezy.xerocom.net -
> > vacant.spiderhost.com is router) which was forwarded to his 
> AOL account.
> > Unfortunately it did not weight enough under our Declude config, nor
> Sniffer
> > to get held as Spam. Any ideas what AOL is doing or what I 
> should do to
> > eliminate these most appreciated. Worried about getting on 
> the wrong side
> of
> > AOL. Thanks.
> >
> > -Don
> >
> > Return-Path: <[EMAIL PROTECTED]>
> > Received: from  rly-xa05.mx.aol.com (rly-xa05.mail.aol.com 
> [172.20.64.41])
> > by air-xa03.mail.aol.com (v101_r1.4) with ESMTP id
> MAILINXA31-7341621d0d322;
> > Tue, 05 Oct 2004 00:03:36 -0400
> > Received: from  SNEEZY.XEROCOM.NET (vacant.spiderhost.com 
> [65.57.241.197])
> > by rly-xa05.mx.aol.com (v101_r1.5) with ESMTP id
> > MAILRELAYINXA55-7341621d0d322; Tue, 05 Oct 2004 00:03:25 -0400
> > Received: from SMTP32-FWD by lamphier.com
> >   (SMTP32) id A1BF42BA100B8F0C3; Mon,  4 Oct 2004 23:58:48
> > Received: from pelxavirus3.terra.com.pe [200.48.36.5] by
> SNEEZY.XEROCOM.NET
> > with ESMTP
> >   (SMTPD32-8.12) id ABF42BA100B8; Mon, 04 Oct 2004 23:58:44 -0400
> > Received: from anamaria (unknown [200.106.79.108])
> >  by pelxavirus3.terra.com.pe (Postfix) with ESMTP id 295EDB7CA4;
> >  Mon,  4 Oct 2004 23:07:07 -0500 (PET)
> > Message-ID: <[EMAIL PROTECTED]>
> > To: 
> > From: "Anni" <[EMAIL PROTECTED]>
> &g

Re: [Declude.JunkMail] Client TOS Notifications from AOL

[Don Schreiner]

Kami  & John,

Thanks a ton guys! That was me that registered on the AOL feedback loop
using our abuse addy, but going back months ago and did not realize. So much
to keep up with battling Spam! Just a few more points on my Declude weight
and would not have made it to AOL - ohhh well - will keep tweaking our
config.

-Don

- Original Message - 
From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, October 06, 2004 10:31 AM
Subject: RE: [Declude.JunkMail] Client TOS Notifications from AOL


Some one at your company signed up and registered to receive these feedback
loop messages.

http://postmaster.info.aol.com/tools/fbl.html

John Tolmachoff
Engineer/Consultant/Owner
eServices For You

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Don Schreiner
> Sent: Wednesday, October 06, 2004 7:09 AM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] Client TOS Notifications from AOL
>
> Declude Folks,
>
> I need some help figuring out why we are receiving e-mails from
> [EMAIL PROTECTED] Subject Line: Client TOS Notification, and the Sent To
address
> is [EMAIL PROTECTED] I am not sure if these are coming back
to
> me in our abuse or postmaster account? There is nothing in the body of the
> e-mail, only an attachment of e-mail apparently getting rejected. Anyone
> else seeing these? The client we host forwards his e-mail automatically to
> his AOL account. For example, below is the header of an e-mail that was
> attached whereas a spam e-amail appears to have been sent to our client
> (lamphier.com) hosted on our IMail server (sneezy.xerocom.net -
> vacant.spiderhost.com is router) which was forwarded to his AOL account.
> Unfortunately it did not weight enough under our Declude config, nor
Sniffer
> to get held as Spam. Any ideas what AOL is doing or what I should do to
> eliminate these most appreciated. Worried about getting on the wrong side
of
> AOL. Thanks.
>
> -Don
>
> Return-Path: <[EMAIL PROTECTED]>
> Received: from  rly-xa05.mx.aol.com (rly-xa05.mail.aol.com [172.20.64.41])
> by air-xa03.mail.aol.com (v101_r1.4) with ESMTP id
MAILINXA31-7341621d0d322;
> Tue, 05 Oct 2004 00:03:36 -0400
> Received: from  SNEEZY.XEROCOM.NET (vacant.spiderhost.com [65.57.241.197])
> by rly-xa05.mx.aol.com (v101_r1.5) with ESMTP id
> MAILRELAYINXA55-7341621d0d322; Tue, 05 Oct 2004 00:03:25 -0400
> Received: from SMTP32-FWD by lamphier.com
>   (SMTP32) id A1BF42BA100B8F0C3; Mon,  4 Oct 2004 23:58:48
> Received: from pelxavirus3.terra.com.pe [200.48.36.5] by
SNEEZY.XEROCOM.NET
> with ESMTP
>   (SMTPD32-8.12) id ABF42BA100B8; Mon, 04 Oct 2004 23:58:44 -0400
> Received: from anamaria (unknown [200.106.79.108])
>  by pelxavirus3.terra.com.pe (Postfix) with ESMTP id 295EDB7CA4;
>  Mon,  4 Oct 2004 23:07:07 -0500 (PET)
> Message-ID: <[EMAIL PROTECTED]>
> To: 
> From: "Anni" <[EMAIL PROTECTED]>
> Subject: Proposal
> Date: Mon, 4 Oct 2004 23:03:21 -0500
> MIME-Version: 1.0
> Content-type: text/plain; charset=US-ASCII
> Content-Transfer-Encoding: quoted-printable
> X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]"
> X-RBL-Warning: HELOBOGUS: Domain pelxavirus3.terra.com.pe has no MX or A
> records [0301].
> X-RBL-Warning: WEIGHT1-9: Total weight between 1 and 9.
> X-Declude-Sender: [EMAIL PROTECTED] [200.48.36.5]
> X-Declude-Spoolname: D1bf42ba100b8f0c3.SMD
> X-Note: CompBiz scanned with Declude JunkMail.
> X-Spam-Tests-Failed: NOABUSE, HELOBOGUS, WEIGHT1-9 [7].
> X-Note: This E-mail was sent from smtp7.terra.com.pe ([200.48.36.5]).
> X-Sender: Sender of E-mail: [EMAIL PROTECTED]
> X-Note: RevDNS Remote Server smtp7.terra.com.pe ([200.48.36.5]).
> X-AOL-IP: 65.57.241.197
> X-Mailer: Unknown (No Version)
>
> Dear Customer,
> =20
> Be the very first listing in the top search engines immediately.
> =20
> Our company will now place any business with a qualified website
> permanently=
>  at the top of the major search engines guaranteed never to move.  This
> prom=
> otion includes unlimited traffic and is not going to last long.  If you
> are=20=
> interested in being guaranteed first position in the top search engines at
> a=
>  promotional fee, please contact us promptly to find out if you qualify
> via=20=
> email at   [EMAIL PROTECTED]   AND INCLUDE THE URL(s) YOUR ARE INTERESTED
> I=
> N PLACING.  This is not pay per click.=20
>
> The following are examples on Yahoo!, MSN and Alta Vista:
> =20
> Company:  Oahu Dive Center
> URL:   http://oahudivecenter.com
> keyword:   oahu scuba diving
> =20
> Company:  California Moves.com
> URL: 

[Declude.JunkMail] Client TOS Notifications from AOL

[Don Schreiner]

Declude Folks,

I need some help figuring out why we are receiving e-mails from
[EMAIL PROTECTED] Subject Line: Client TOS Notification, and the Sent To address
is [EMAIL PROTECTED] I am not sure if these are coming back to
me in our abuse or postmaster account? There is nothing in the body of the
e-mail, only an attachment of e-mail apparently getting rejected. Anyone
else seeing these? The client we host forwards his e-mail automatically to
his AOL account. For example, below is the header of an e-mail that was
attached whereas a spam e-amail appears to have been sent to our client
(lamphier.com) hosted on our IMail server (sneezy.xerocom.net -
vacant.spiderhost.com is router) which was forwarded to his AOL account.
Unfortunately it did not weight enough under our Declude config, nor Sniffer
to get held as Spam. Any ideas what AOL is doing or what I should do to
eliminate these most appreciated. Worried about getting on the wrong side of
AOL. Thanks.

-Don

Return-Path: <[EMAIL PROTECTED]>
Received: from  rly-xa05.mx.aol.com (rly-xa05.mail.aol.com [172.20.64.41])
by air-xa03.mail.aol.com (v101_r1.4) with ESMTP id MAILINXA31-7341621d0d322;
Tue, 05 Oct 2004 00:03:36 -0400
Received: from  SNEEZY.XEROCOM.NET (vacant.spiderhost.com [65.57.241.197])
by rly-xa05.mx.aol.com (v101_r1.5) with ESMTP id
MAILRELAYINXA55-7341621d0d322; Tue, 05 Oct 2004 00:03:25 -0400
Received: from SMTP32-FWD by lamphier.com
  (SMTP32) id A1BF42BA100B8F0C3; Mon,  4 Oct 2004 23:58:48
Received: from pelxavirus3.terra.com.pe [200.48.36.5] by SNEEZY.XEROCOM.NET
with ESMTP
  (SMTPD32-8.12) id ABF42BA100B8; Mon, 04 Oct 2004 23:58:44 -0400
Received: from anamaria (unknown [200.106.79.108])
 by pelxavirus3.terra.com.pe (Postfix) with ESMTP id 295EDB7CA4;
 Mon,  4 Oct 2004 23:07:07 -0500 (PET)
Message-ID: <[EMAIL PROTECTED]>
To: 
From: "Anni" <[EMAIL PROTECTED]>
Subject: Proposal
Date: Mon, 4 Oct 2004 23:03:21 -0500
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]"
X-RBL-Warning: HELOBOGUS: Domain pelxavirus3.terra.com.pe has no MX or A
records [0301].
X-RBL-Warning: WEIGHT1-9: Total weight between 1 and 9.
X-Declude-Sender: [EMAIL PROTECTED] [200.48.36.5]
X-Declude-Spoolname: D1bf42ba100b8f0c3.SMD
X-Note: CompBiz scanned with Declude JunkMail.
X-Spam-Tests-Failed: NOABUSE, HELOBOGUS, WEIGHT1-9 [7].
X-Note: This E-mail was sent from smtp7.terra.com.pe ([200.48.36.5]).
X-Sender: Sender of E-mail: [EMAIL PROTECTED]
X-Note: RevDNS Remote Server smtp7.terra.com.pe ([200.48.36.5]).
X-AOL-IP: 65.57.241.197
X-Mailer: Unknown (No Version)

Dear Customer,
=20
Be the very first listing in the top search engines immediately.
=20
Our company will now place any business with a qualified website
permanently=
 at the top of the major search engines guaranteed never to move.  This
prom=
otion includes unlimited traffic and is not going to last long.  If you
are=20=
interested in being guaranteed first position in the top search engines at
a=
 promotional fee, please contact us promptly to find out if you qualify
via=20=
email at   [EMAIL PROTECTED]   AND INCLUDE THE URL(s) YOUR ARE INTERESTED
I=
N PLACING.  This is not pay per click.=20

The following are examples on Yahoo!, MSN and Alta Vista:
=20
Company:  Oahu Dive Center
URL:   http://oahudivecenter.com
keyword:   oahu scuba diving
=20
Company:  California Moves.com
URL:   http://steph.cbsocal.com
keyword:   find a home southern california
=20
Sincerely,
=20
IGN
The Search Engine Promotional Consultants


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Citibank - phishing- still live

[Don Schreiner]

I like the postings too and on the Declude JM 
vs. Imail list. We filter and his alerts help us keep up with same. 
Filtering these IMO is more serious than the typical best Mortgage 
Rate and Viagra spams.
 
-Don
 

  - Original Message - 
  From: 
  Markus Gufler 
  
  To: [EMAIL PROTECTED] 
  
  Sent: Tuesday, October 05, 2004 8:41 
  AM
  Subject: RE: [Declude.JunkMail] Citibank 
  - phishing- still live
  
  Kami's postings are more usefull then many others on this 
  list. 
   
  Markus
   
   
  


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Dan 
GeiserSent: Tuesday, October 05, 2004 2:26 PMTo: [EMAIL PROTECTED]Subject: 
Re: [Declude.JunkMail] Citibank - phishing- still live

Hi, Kami,
Well, my users never see them because I have 
"citibank.com" on my "spam domains" list.  I agree that it might be 
important to disseminate currently active phishing URLs but I just don't 
know that the DJM mailing list is the place.
 
Just An Idea,
 
Thanks!
Dan

  - Original Message - 
  From: 
  Kami Razvan 
  To: [EMAIL PROTECTED] 
  
  Sent: Tuesday, October 05, 2004 7:47 
  AM
  Subject: RE: [Declude.JunkMail] 
  Citibank - phishing- still live
  
  Hi Dan:
   
  I post it just in case you want to filter a phishing 
  attempt.
   
  Historically people have posted this to stop the attempts - this 
  way your users will not receive this.
   
  Don't you think it applies?
   
  Kami
  
  
  From: [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of Dan 
  GeiserSent: Tuesday, October 05, 2004 7:23 AMTo: 
  [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] 
  Citibank - phishing- still live
  
  Can I ask why you guys post these to the 
  Declude JunkMail discussion list?  It doesn't seem to have anything 
  to do with the subject matter of this list.
  
- Original Message - 
From: 
Kami Razvan 
To: [EMAIL PROTECTED] 

Sent: Tuesday, October 05, 2004 
6:56 AM
Subject: [Declude.JunkMail] 
Citibank - phishing- still live

Hi;
the 
following is another phishing attempt- the site still 
live.
 
http://211.158.34.250/citifi/
 
Regards,
Kami
 
 
 
Email
Subject: [37~]Dear customer your details have been 
compromisedMIME-Version: 1.0 (produced by annunciatemarginalia 
8.2)Content-Type: 
multipart/alternative; boundary="--938071008627732911"X-RBL-Warning: 
IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to 
legitimate E-mail detected.X-RBL-Warning: CMDSPACE: Space found in 
RCPT TO: command.X-RBL-Warning: NJABL-DYNA: "Dynamic/Residential IP 
range listed by NJABL dynablock - http://njabl.org/dynablock.html"X-RBL-Warning: 
NJABL-DUL: This E-mail came from 12.107.246.11, a potential spam source 
listed in NJABL-DUL.X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]"X-RBL-Warning: 
SORBS-DUL: "Dynamic IP Address See: http://www.dnsbl.sorbs.net/lookup.shtml?12.107.246.11"X-RBL-Warning: 
IPLINKED: Message failed IPLINKED test (line 198, weight 
13)X-Declude-Sender: [EMAIL PROTECTED] 
[12.107.246.11]X-Declude-Spoolname: D26691b0502409fba.SMDX-Note: 
==X-Note: 
Spam Score: 37 [BLOCKED ON 20+ & DELETED ON 40+]X-Note: Scan 
Time: 00:43:47 on 05 Oct 2004X-Note: Spool File: 
D26691b0502409fba.SMDX-Note: Server Name: 
dialup-12-107-246-11.dtccom.netX-Note: SMTP Sender: [EMAIL PROTECTED]X-Note: 
Reverse DNS & IP: dialup-12-107-246-11.dtccom.net 
[12.107.246.11]X-Note: Country Chain: UNITED 
STATES->destination
938071008627732911Content-Type: 
text/plain; charset="iso-2059-6"Content-Transfer-Encoding: 
quoted-printableContent-Description: nicholson salmonberry 
biblical
 
Dear Customer:
 
Recently there have been a large number of cyber attacks pointing 
our data="">base servers. In order to safeguard your account, we 
require you to sign o=n immediately. 
 
This personal check is requested of you as a precautionary measure 
and to =ensure yourselves that everything is normal with your 
balance and personal= information.
 
This process is mandatory, and if you did not sign on within the 
nearest t=ime your account may be subject to temporary 
suspension.
 
Please make sure you have your Citibank(R) debit card number and 
your User= ID and Password at hand.
 
Ple

Re: [Declude.JunkMail] SPF Text Record Help Needed

[Don Schreiner]

Weird posting to yourself but figured it may be good for the archives for
anyone in the same boat. I never did get a response from anyone on the list
and frankly knew was asking a lot for folks to digest on a busy Monday
morning. Anyway, I got all the SPF set-up and the wizard figured out for our
different client situations. If you have something similar and need help,
hit me and be glad to share. Thanks. -Don

- Original Message - 
From: "Don Schreiner" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, July 19, 2004 9:10 AM
Subject: [Declude.JunkMail] SPF Text Record Help Needed


> I need help understanding the correct SPF text record for a customer
domain
> . I have read the archives, been to the pobox site and read and still not
> absolutely certain. We allow some customers to SMTP relay from their
> dedicated IP and also from their e-mail Contact Form via their web site -
we
> also host on a separate server and within the same network Workgroup. Our
> Workgroup of servers communicate to each other via private IP addresses.
> Thanks in advance to anyone who has the time.  -Don
>
> Our set-up is IMail (8.12) and Declude (1.79). Customer domain is
configured
> as a virtual host on the IMail server.
>
> a) Sample customer dedicated IP is (64.x.x.123) and allowed to SMTP relay
> from their office via IMail.
> b) Sample IMail server Public Host IP is (imail.hosting.com 209.x.x.567)
> c) Sample Web server Private IP is (webA 192.x.x.10) where their Contact
> Form e-mail orginates.
>
> *Note the pobox wixard finds 2 MX records for this sample customers
domain,
> the first
> being as on IMail their MX (mail.customerdomain.com) and the second being
> our colo router (vacant.colodomain.com).
>
> The POBOX Wizard Questions and My Question below...
>
> --
> 1) Let's set up SPF records for mail.customerdomain.com.
>
> mail.customerdomain.com's IP address is 209.x.x.567. Does that server send
> mail from mail.customerdomain.com?
>
> yes no
>
> My Question:
>
> Do I answer yes or no? The domain is configured as (customerdomain.com)
and
> alias of (mail.customerdomain.com) as a virtual host in Imail. They send
> email from their office dedicated IP of (64.x.x.123) and via WebMail for
the
> IMail server public and virtual domain IP (209.x.x.567), and also
> originating from the Web server IP (webA 192.x.x.10) to the Imail server.
>
> --
> 2) This wizard found 2 names for mail.customerdomain.com's MX servers. MX
> servers receive mail for mail.customerdomain.com. Do they also send mail
> from mail.customerdomain.com?
>
> yes no
>
> My Question:
>
> Do I answer yes or no? In addition to the above info for the first
question,
> our DNS only has one primary MX record entered for the
(customerdomain.com)
> (209.x.x.567), but apparently it is also picking up our colo router name
too
> (vacant.colodomain.com) with the same IP number  (209.x.x.567).
>
> --
> 3) Do you want to just approve any host whose name ends in
> mail.customerdomain.com?
>
> yes no
>
> My Question:
>
> Do I answer yes or no? I feel I should answer No, again not sure and
> concerned with this question
> as mail typically identified from this domain as customerdomain.com and
not
> mail.customerdomain.com which is
> the alias configured in Imail.
>
> --
> 4) Do any other servers send mail from mail.customerdomain.com?
>
> My Questions:
>
> Here they provide 3 fields to list other servers with regular hostnames,
MX
> servers, and IP addresses.
>
> A) For the Host names field, do I also list the Web server private Web
> server name (web)? This is where some e-mail is originating from the
> customers Web site contact form. Do I also list our IMail server hostname
> (imail.hosting.com) since the mail.customerdomain.com is virtual? Do I
enter
> the colo router hostname too (vacant.colodomain.com) being identified by
the
> wizard with our IMail host IP?
>
> B) For the MX servers field, I am assuming to enter only the customer MX
> (mail.customerdomain.com) or should I also enter the IMail server primary
> hostname (imail.hosting.com)?
>
> C) For the IP addresses field, do I enter the IP's for the IMail server
> which is the same for the customers virtual domain? Should I also enter
the
> Web server private IP (192.x.x.10) to cover their contact form on the Web
> server?
>
> --
> 5) Could mail from mail.customerdomain.com originate through servers
> belonging to some other domain?
> If you send mail through your ISP's servers, name the ISP here.
>
> My Q

[Declude.JunkMail] SPF Text Record Help Needed

[Don Schreiner]

I need help understanding the correct SPF text record for a customer domain
. I have read the archives, been to the pobox site and read and still not
absolutely certain. We allow some customers to SMTP relay from their
dedicated IP and also from their e-mail Contact Form via their web site - we
also host on a separate server and within the same network Workgroup. Our
Workgroup of servers communicate to each other via private IP addresses.
Thanks in advance to anyone who has the time.  -Don

Our set-up is IMail (8.12) and Declude (1.79). Customer domain is configured
as a virtual host on the IMail server.

a) Sample customer dedicated IP is (64.x.x.123) and allowed to SMTP relay
from their office via IMail.
b) Sample IMail server Public Host IP is (imail.hosting.com 209.x.x.567)
c) Sample Web server Private IP is (webA 192.x.x.10) where their Contact
Form e-mail orginates.

*Note the pobox wixard finds 2 MX records for this sample customers domain,
the first
being as on IMail their MX (mail.customerdomain.com) and the second being
our colo router (vacant.colodomain.com).

The POBOX Wizard Questions and My Question below...

--
1) Let's set up SPF records for mail.customerdomain.com.

mail.customerdomain.com's IP address is 209.x.x.567. Does that server send
mail from mail.customerdomain.com?

yes no

My Question:

Do I answer yes or no? The domain is configured as (customerdomain.com) and
alias of (mail.customerdomain.com) as a virtual host in Imail. They send
email from their office dedicated IP of (64.x.x.123) and via WebMail for the
IMail server public and virtual domain IP (209.x.x.567), and also
originating from the Web server IP (webA 192.x.x.10) to the Imail server.

--
2) This wizard found 2 names for mail.customerdomain.com's MX servers. MX
servers receive mail for mail.customerdomain.com. Do they also send mail
from mail.customerdomain.com?

yes no

My Question:

Do I answer yes or no? In addition to the above info for the first question,
our DNS only has one primary MX record entered for the (customerdomain.com)
(209.x.x.567), but apparently it is also picking up our colo router name too
(vacant.colodomain.com) with the same IP number  (209.x.x.567).

--
3) Do you want to just approve any host whose name ends in
mail.customerdomain.com?

yes no

My Question:

Do I answer yes or no? I feel I should answer No, again not sure and
concerned with this question
as mail typically identified from this domain as customerdomain.com and not
mail.customerdomain.com which is
the alias configured in Imail.

--
4) Do any other servers send mail from mail.customerdomain.com?

My Questions:

Here they provide 3 fields to list other servers with regular hostnames, MX
servers, and IP addresses.

A) For the Host names field, do I also list the Web server private Web
server name (web)? This is where some e-mail is originating from the
customers Web site contact form. Do I also list our IMail server hostname
(imail.hosting.com) since the mail.customerdomain.com is virtual? Do I enter
the colo router hostname too (vacant.colodomain.com) being identified by the
wizard with our IMail host IP?

B) For the MX servers field, I am assuming to enter only the customer MX
(mail.customerdomain.com) or should I also enter the IMail server primary
hostname (imail.hosting.com)?

C) For the IP addresses field, do I enter the IP's for the IMail server
which is the same for the customers virtual domain? Should I also enter the
Web server private IP (192.x.x.10) to cover their contact form on the Web
server?

--
5) Could mail from mail.customerdomain.com originate through servers
belonging to some other domain?
If you send mail through your ISP's servers, name the ISP here.

My Question:

This is not the case for this customer who only sends from a dedicated IP at
their office. Wondering however what you would enter if we also allowed SMTP
auth and they had several employees in the field with different IPS
connects?

--
6) Do the above lines describe all the hosts that send mail from
mail.customerdomain.com?

yes no

My Questions:

For this customer I would assume answering yes, but hate to assume. Would
answering yes be the correct answer? I see the ~all if you answer no, and
the -all if you answer yes and read about Scott's suggestion of ?all being
more appropriate in cases where there is no way to tell the originating SMTP
IP address.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] MTLD test -- Relationship between Viruses and Spam

[Don Schreiner]

Are these zombie machines also not trying to spread the same virus allowing
them to exploit smtp to other machines? This was my understanding this
occurred and my previous reference to using similar strategy with BlackIce
blocking IP's for 24 hours with detected signatures. Thus also blocking Spam
outgoing from these same machines.

-Don

- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Saturday, July 10, 2004 8:16 PM
Subject: Re: [Declude.JunkMail] MTLD test -- Relationship between Viruses
and Spam


>
> >Forgive me, but I don't really see the rationale that because an IP
> >address has been flagged as sending viruses that it is also sending
> >out SPAM.
> >
> >Can someone enlighten me on this ?
>
> Most reports are that more than 50% of all spam is now coming from
> "zombies", which typically are home computers that were infected by a
virus
> that installs a trojan horse that the spammer has control over.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> --
> CompBiz.Net scanned for Virus'
>
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

[Don Schreiner]

Scott et al,

Standing by the sidelines here trying to keep up with this interesting
thread and actually have some extra time to chime in. I am very concerned
about installing this upgrade with the false positives being reported, dlls
and uninstall bug reported, etc. Will Declude be addressing these issues and
providing more information, what the install specifically does, suggested
configurations concerning false postitives, warnings, ?  I do believe this
can be a valuable feature of Declude and like the concept.

We do something similar via BlackIce firewall we have used for years as an
extra layer of security. Over the last year we modifying the issue list file
relating to virus signatures blocking IP's for 24 hours when detected. When
the 24 hour block expires and upon the next connect from the IP with no
virus signature detected the IP is no longer blocked. You can also manually
unblock if a customer requests after verifying their work station is clean
of virus'. Doing so has created a little extra end user support for us from
time-to-time. However, customers love us afterwards because we helped them
identify their workstation was infected by a virus unbeknownst to them.
Something similar to this automation with Declude would seem helpful.
Thanks.

-Don

Don Schreiner
CompBiz, Inc.
www.compbiz.net
407-322-8654

- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Saturday, July 10, 2004 8:08 AM
Subject: Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test
for Declude JunkMail


>
> >An I missing something? When I try to resolve mtldb.declude.com I get;
> >
> > >tracert mtldb.declude.com
> >Unable to resolve target system name mtldb.declude.com.
>
> That is by design -- mtldb.declude.com should not be resolvable.  :)
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> --
> CompBiz.Net scanned for Virus'
>
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Ignoring Negative Weights

[Don Schreiner]

Thanks for reply and yes this is how I use weights, but what I failed to mention is 
that I end up with a negative value often (i.e. -7, -1, etc.) depending on certain 
mail and it gets held. You are saying it should not get held. OK I must have a hold on 
a certain test that is failing even though ends up with negative weight too. For 
example I hold all that fail sniffer and are below weight of 14. Think I figured it 
out. Thanks!

-Don



-- Original Message --
From: "R. Scott Perry" <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Date:  Mon, 16 Jun 2003 10:57:11 -0400

>
>>If I end up with a negative wait, how do I configure to ignore and pass
>>e-mail along.
>
>You don't need to do anything.
>
>The way the weighting system works, you decide what weight ranges to use to 
>detect spam.  For example, some people have it set up to HOLD E-mail based 
>on the WEIGHT10 test (a weight of 10 or higher), and DELETE E-mail that 
>fails the WEIGHT20 test (with a weight of 20 or higher).
>
>In this case, if you have a test that uses negative weights, the total 
>weight of the E-mail will be reduced.  For example, the weight of the 
>E-mail may end up being -6.  In this case, the E-mail would not fail the 
>WEIGHT10 or WEIGHT20 tests.
>
>>Is the following correct?
>>
>>Global.cfg
>>
>>NEGWEIGHT   weightrange x   x   0   -100
>>
>>Default.JunkMail
>>
>>NEGWEIGHT   IGNORE
>
>There's no need to do this, as the IGNORE action does nothing.
>
>-Scott
>---
>Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
>Declude Virus: Catches known viruses and is the leader in mailserver 
>vulnerability detection.
>Find out what you have been missing: Ask for a free 30-day evaluation.
>
>---
>[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>-
>Scanned for Virus' by CompBiz.Net
>
>
 

 
Sent via CompBiz.net


 
   
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Ignoring Negative Weights

[Don Schreiner]

If I end up with a negative wait, how do I configure to ignore and pass
e-mail along. Is the following correct?

Global.cfg

NEGWEIGHT   weightrange x   x   0   -100

Default.JunkMail

NEGWEIGHT   IGNORE

Thanks.

-Don


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: Dictionary Attacks

[Don Schreiner]

Bill,

Also running BI as of few weeks ago and tinkering with firewal.ini.
Would you mind sharing the .ini changes you made. You can e-mail me off
list. Thanks.

Sincerely,

Don Schreiner
CompBiz, Inc.
www.compbiz.net
407-322-8654
800-408-3688

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Bill B.
Sent: Thursday, January 23, 2003 12:16 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] OT: Dictionary Attacks


We started running BlackICE last month and it has been working nice for
us.  It requires a few config changes to get it to auto-block IPs that
send you dictionary attacks, but it is definitely a good solution.

Bill


-Original Message-
From: "R. Scott Perry"
Sent: Thu, 23 Jan 2003 10:58:09 -0500
Subject: Re: [Declude.JunkMail] OT: Dictionary Attacks



>It seems this morning that we have several dictionary attacks happening

>on one of Imail servers. Is there an easy to stop the person doing 
>this? I have looked through the log files and cannot easily spot the 
>person(s) doing this.
>
>Is there software that will prevent people from performing Dictionary 
>Attacks in the future?
>
>The POP3 and Delcude processes are using like 50-09% of the CPU.
>
>Let me know if there is anything I can do...

Are you sure that it is a dictionary attack?  If the POP3 process has 
higher usage than normal, then E-mails are being sent to your users
(which 
would mean that it either isn't a dictionary attack, or a hybrid attack 
where they send spam as part of the dictionary attack).

You might want to check the archives of the IMail Forum for ideas on how
to 
stop a dictionary attack.  Some tricks are using a "nobody" alias (which
I 
believe you are), or using a product like BlackIce Server to stop it.

Unfortunately, Declude can't stop these, because it doesn't have access
to 
the TCP/IP connection (which is where it would need to be stopped).
  -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.
--
Scanned by CompBiz for Viruses http://www.CompBiz.Net.
Save 15 Percent on Virus Software by visiting
http://www.compbiz.net/software_mcafee.cfm for details!


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Our filter & fromfiles.

[Don Schreiner]

Title: Message



This 
is great for sharing and thank you. Is anyone interested in 
sharing their global.cfg and white/black list files and strategies 
that are working well for them. I feel overwhelmed these days keeping up the 
spam battle as mail server admin and all the other daily chores I am 
responsible. We handle a lot of religious and family oriented sites and cannot 
slack on our Spam control.
 
A few 
days ago, I finally bit the bullet and subscribed to sortmonster's sniffer. 
Hoping the $300/yr will decrease my Spam review time spent each day. I 
thought I was doing a pretty good job of eliminating spam - until I put a hold 
for review on all caught by the sniffer filter. Basically 
I discovered that we are only stopping about 1/2 of the Spam 
hitting our server. Some confirmed Spam I reviewed failed no other tests 
other than sniffer. Now I am trying to figure out how to revise my 
weighting so I do not have so much to review in the hold folder. We have 
weight of 20 for hold and 30 for delete. We run about 18 filters all weighted. I 
want more deletes and less to review in the hold folder daily!  Sniffer is 
picking up a lot of false positives too and I know I need to get reporting with 
them and taking advantage of their custom config files for my license. I use 
Tom's updated list ongoing for our blacklist from file and it is a big 
help.
 
Is 
anyone willing to share their global.cfg who are using sniffer, weighting, 
and their effective black and white lists that is working out well for 
them? You can e-mail me off list [EMAIL PROTECTED]. Thanks.
 
Don SchreinerCompBiz, 
Inc.www.compbiz.net407-322-8654800-408-3688
 

-Original Message-From: 
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] 
On Behalf Of Kami RazvanSent: Tuesday, January 21, 2003 6:47 
PMTo: JunkMail ListSubject: [Declude.JunkMail] Our filter 
& fromfiles.
Hi;
 
In case you are 
interested, we have created a simple Access database that contains all of our 
entries in for our fromfile and filter files.
 
Since it is all in 
the database we thought we can simply replicate it with the web site and provide 
it to all to use or consider.
 
You may want to 
visit:
 
http://www.ClickandPledge.com/Support/Mail
 
The 
categories are all separated since we have a different file for each filter 
type.
 
Just 
for the records:  We hold on weight 20 so all weights are based on this 
weight.
 
FreeeMail list - should not be used as a blacklist but 
a weight list.  We add 5 to this list.  This list does not contain 
Hotmail.com or Yahoo.com.  It has other (Yahoo.com.tw) 
domains.
 
Hope it 
helps...
 
Regards,
Kami

RE: [Declude.JunkMail] Filter Questions/Suggestions

[Don Schreiner]

Kami,

Very nice and thanks for sharing. We also use Tom's list - but I see how
this can really augment what we are doing with our declude from file
rules.

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Kami Razvan
Sent: Tuesday, January 14, 2003 4:56 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Filter Questions/Suggestions


Hi; [sorry for the long note]

These files are changing everyday...

Sure..  I hope the list does not mind.  I have asked so we put a link on
a location on our site and keep these files up to date.  Similar to what
Tom has done which has helped us quite a lot.

Here is the legend to the files that are zipped.

Please note:  We hold on weight of 20.  Some of these could be
considered aggressive but believe me we may catch a positive 1 time a
week.

* Filter_Body.txt [filter]:  This file is the words that we search for
in the body.
* Filter_BodyURL.txt [filter]:  The URL's found in the body.
* Filter_Header.txt [filter]: At times we have noticed that there are
some servers that consistently show up in the connections that show up
in our headers.  Ex.  Webhostingtotalk.com.  So we added this to the
header.  We have our HOPHIGH set to 3.

* Filter_MailFrom.txt [filter]:  This is the mailfrom filter and certain
characteristics are listed. If mailfrom email has these words in them.

* Filter_Subject.txt [filter]:  The subject words.  Does subject include
these.

* JMFreeEmails.txt [fromfile]:   This file is a list of all free email
services we have found.  This does not include hotmail.com or Yahoo.com
but includes everything else.  This list receives a weight of 5
regardless of what email.

We have given BASE64 test a weight of 15.  So if an email comes from a
free email and is BASE64 is automatically held.

* JMMailinglist.txt[fromfile]: This is the mailing lists that people
subscribe to, e.g. CNN, etc.  If these lists are caught then we add them
to the list. This list receives -100 weight (negative 100).

* JMBlacklistWgt.txt  [fromfile]: comes from
http://www.imagefxonline.net/apps/delog/fromfile.txt [any listing here
is weight 20 - automatic hold]

* JMBlacklist.txt [fromfile]:  Our blacklist- We have a database and we
run a unique on the list and export it to text.

* JMPorn.txt [fromfile]:   Recently separated from blacklist- emails
from
this list are deleted automatically.

* JMSpammers.txt [fromfile]:   Recently separated from blacklist- emails
from this list are automatically deleted.

* JMWatchList.txt [fromfile]:  If we find an address that we are not
sure we add them to the database.  If additional occurances happen they
will be moved to blacklist.

If interested in knowing the syntax then it is the following:

FILTER-HEADER   filter  d:\IMail\Declude\filter_header.txt
x   0   0
FILTER-MAILFROM filter  d:\IMail\Declude\filter_mailfrom.txt
x   0   0
FILTER-SUBJECT  filter  d:\IMail\Declude\filter_subject.txt
x   0   0
FILTER-BODY filter  d:\IMail\Declude\filter_body.txt
x   0   0
FILTER-BODYURL  filter  d:\IMail\Declude\filter_bodyurl.txt
x   0   0

BLACKLIST   fromfileD:\IMail\Declude\JMBlacklist.txt
x   20  0
WATCHLIST   fromfileD:\IMail\Declude\JMWatchlist.txt
x   20  0
SPAMMERSfromfileD:\IMail\Declude\JMSpammers.txt
x   20  0
PORNfromfileD:\IMail\Declude\JMPorn.txt
x   20  0

BLACKLISTWRNfromfileD:\IMail\Declude\JMBlacklistWgt.txt
x   20  0
FREEEMAILS  fromfile
D:\IMail\Declude\JMFreeEmails.txt
x   5   0

# Negative Lists

MAILINGLISTSfromfile
D:\IMail\Declude\JMMailingLists.txt
x   -1000

I hope this helps.

Regards,
Kami


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff
Sent: Tuesday, January 14, 2003 3:48 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Filter Questions/Suggestions


> So we have an active URL list that if found in the body of emails it
> will weigh them quite high.  These URL's are real consistent and in 
> combination of subject filters we have blocked pretty much all of 
> them.

Kami, that is a great idea. Would you be willing to share the list? Feel
free to e-mail me off list if you like.

John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  

RE: [Declude.JunkMail] An optional web interface for Declude JunkMail?

[Don Schreiner]

Scott,

In response to additional info and questions please see below. When
could we anticipate an ETA?

 Is this something that others would find useful?  It
definitely would be 
easier for us to implement.

***Regarding end user spam control via e-mail subscribe method. This
would be a nice option, but I would prefer Web interface for our
customers and ability to modify that page with instructions, graphics,
support info, etc. I know a lot of pros, cons, opinions here from
others, but I am customer driven. How about the option of both methods?

 First, if we do this, it would initially be for the per-user
settings, with 
two options:  either a "Basic" configuration that would let people
choose 
between several options (such as "No spam control", "Conservative spam 
control", "Aggressive spam control"), or an "Advanced" configuration
that 
would let people fine-tune their settings (such as using specific spam 
tests, and whitelisting/blacklisting).  Later, we would probably add a
way 
to access held E-mail, and possibly per-domain and global settings.

***This would be great for us and our customers!

 What we would most likely not do is use a database..., use
IIS, or any special technologies (such as dot NET, ASP, CF, etc.)...

***This also would be good for us even though we are a CF/SQL shop. We
run IIS anyway on our mail servers to redirect older mail clients.

-Don S.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.
--
Scanned by CompBiz for Viruses http://www.CompBiz.Net.
Save 15 Percent on Virus Software by visiting
http://www.compbiz.net/software_mcafee.cfm for details!


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] An optional web interface for Declude JunkMail?

[Don Schreiner]

I agree with what you are saying and especially no need for GUI for
Declude administrator. Not sure I read Scott's original post correctly?
I was thinking he meant end user on/off/select/remove filters tool.
Filters set-up, defined, and made available for selection by the Declude
administrator. 

Simple non-admin level type on/off Spam control tools to end users
(simplicity similar to Hotmail and Yahoo) would be well received by my
customers anyway. It would actually help me feel better to put the
on/off part in the end users hands in response to the previous poster
(Joe) who described being uneasy filtering Spam.

-Don S.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Dan Patnode
Sent: Tuesday, December 17, 2002 12:05 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] An optional web interface for Declude
JunkMail?


Scott,

I've spent thousands of hours (as many of us have) perfecting a
universally applicable configuration (as diverse as my client base
allows).  

On the server side, when there's a flaw in the system revealed by an FP,
changing the entire system means all other clients benefit from the
change.  Creating an individual exception (like a whiltelist entry) is a
last resort used only when fixing the system would weaken it to much.
If users are making their own changes and not reporting problems, no one
else is benefiting.

On the client side, every time users get ahold of anti spam systems,
they invariably over use them, marking as spam even a newsletter they no
longer want.  A user customizable system then, would need to be more
focused than domain specific, it would need to be user specific.  In my
store & forward configuration, that would mean tracking which aliases
belong to which user, lest they make a change on account A1 and not have
it affect A2.  My itself, this one issue may take more time than this
solutions aims to solve.

Whatever you do, don't make an admin GUI for Declude.  Nothing ruins an
infinitely customizable (and useful) program faster than a limiting
interface.  Others may be facing a gauntlet of user requests that this
would remedy, but IMHO, technical improvements that give more tools to
stop spam are more useful and should have greater priority.

Dan



On Monday, December 16, 2002 16:49, R. Scott Perry
<[EMAIL PROTECTED]> wrote:
>A lot of our customers seem to want a web interface to Declude 
>JunkMail,
>mostly so that customers can turn their spam settings on or
>off.
>
>We haven't come up with something in the past, because it is very
>complicated without a hook into web messaging, and it doesn't look like

>Ipswitch is planning to add an interface to web messaging any
>time soon.
>
>However, we are at the point where we are considering a web interface.

>If
>we do it, it would probably need to be done as an addon to Declude 
>JunkMail, mainly because the development and support costs would be
fairly 
>high.  It would also have some drawbacks, being separate from web 
>messaging.  For example, it would require installing a separate
service, 
>using a different port than 80 or 8383 for web access (which may cause 
>firewall problems), and having users enter their username/password a
second 
>time (if they are already using web messaging).
>
>Is this something that is important enough that it would be worthwhile?
>  -Scott
>
>---
>[This E-mail was scanned for viruses by Declude Virus 
>(http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To 
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
>"unsubscribe Declude.JunkMail".  The archives can be found at 
>http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.
--
Scanned by CompBiz for Viruses http://www.CompBiz.Net.
Save 15 Percent on Virus Software by visiting
http://www.compbiz.net/software_mcafee.cfm for details!


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] An optional web interface for Declude JunkMail?

[Don Schreiner]

Scott,

I vote yes. Our users would love it! If you or another does not create
it - we would eventually work on something for our customers based on
repeat requests. It's either I pay my guys, another, or you.

Several months ago another Decluder here shared files they developed of
end user filter tools working with Declude. It was simple for the end
user and well thought out. If I remember correctly there were limits or
you had to go the long way around because of some JM per user/per domain
issues. I was going to try and work on it some more and use, and then
share back, but other more pressing dev came up for us and not had a
chance to revisit. I will look through my files and try and get you a
name. He is a user here and it fitted the bill nicely. Hopefully he will
see my post and reply.

It was basically select your Spam settings High / Low (predefined
filters) or configure yourself from a list. What would you write it in?
Keep us informed of your plans. Sounds great and I really like the idea
of it being developed by your team to work directly with Declude JM!
Even something very simple to turn on/off certain filters or groups of
filters (i.e. high/low) to start would be nice. I would want to be able
to define a default when setting up new accounts.

-Don S.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Monday, December 16, 2002 7:50 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] An optional web interface for Declude
JunkMail?


A lot of our customers seem to want a web interface to Declude JunkMail,

mostly so that customers can turn their spam settings on or off.

We haven't come up with something in the past, because it is very 
complicated without a hook into web messaging, and it doesn't look like 
Ipswitch is planning to add an interface to web messaging any time soon.

However, we are at the point where we are considering a web interface.
If 
we do it, it would probably need to be done as an addon to Declude 
JunkMail, mainly because the development and support costs would be
fairly 
high.  It would also have some drawbacks, being separate from web 
messaging.  For example, it would require installing a separate service,

using a different port than 80 or 8383 for web access (which may cause 
firewall problems), and having users enter their username/password a
second 
time (if they are already using web messaging).

Is this something that is important enough that it would be worthwhile?
  -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.
--
Scanned by CompBiz for Viruses http://www.CompBiz.Net.
Save 15 Percent on Virus Software by visiting
http://www.compbiz.net/software_mcafee.cfm for details!


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Shared Kill File Stats

[Don Schreiner]

Wow Fritz that's impressive!  Good job and Tom thanks for the info on
the upgrade.

-Don S


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Frederick P.
Squib, Jr.
Sent: Monday, December 16, 2002 9:12 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Shared Kill File Stats


Hi all,
 Since we're "bragging" about our killfie usage...
Sunday was a bit slow, we've been averaging 55,000 messages per day
since the beginning of December.

Declude Log file information:
---
Total amount of unique messages found in log: 36292
Total amount of fromfile IDs found in log: 361
Total amount of fromfile ID failures found in log: 18406
Total Percentage of fromfile effectiveness: 51%
---


Fromfile and Merge file Information:
---
Total amount of addresses in the original fromfile: 857
Total amount of addresses updated from usage: 361
Total amount of addresses added from merge: 6
Total amount of addresses that were removed: 11
Total amount of addresses in the merge file: 7
Total amount of duplicate addresses in merge file: 1
Total amount of addresses now in the fromfile: 852
Total percentage of the fromfiles actual usage: 42%
---

I generally post the results on our webpage for our users to see, just
so they know what we're doing and what we're up against. Feel free to
check it out and as always use my entries at your own risk, they work
well for me and my customers with almost no complaints. The link is
about the middle of our homepage under "Current SPAM filter stats".

Thanks again for the great add-on program Tom!

Fritz

Frederick P. Squib, Jr.
Network Administrator
Citizens Internet Services
http://www.wpa.net


---
[This E-mail scanned for viruses by Citizens Internet Services with
Declude Virus v 1.65]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.
--
Scanned by CompBiz for Viruses http://www.CompBiz.Net.
Save 15 Percent on Virus Software by visiting
http://www.compbiz.net/software_mcafee.cfm for details!


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Shared Kill File Stats

[Don Schreiner]

Tom and other Kill List folks. Thought I would share as I usually do not
get to run stats at end of day before clock strikes 12am. Amazing that
at least 58% of email processed for the day was garbage. If I were to
include the manual deletes and emails that got through our lenient
filters, it would probably be something more like 75%. 

Report ID Version 1.04b Detailed Report for: 12/16/2002 00:07:48

Declude Log file information:
---
Total amount of unique messages found in log: 1570
Total amount of fromfile IDs found in log: 190
Total amount of fromfile ID failures found in log: 915
Total Percentage of fromfile effectiveness: 58%
---

Fromfile and Merge file Information:
---
Total amount of addresses in the original fromfile: 2309
Total amount of addresses updated from usage: 190
Total amount of addresses added from merge: 56
Total amount of addresses that were removed: 0
Total amount of addresses in the merge file: 57
Total amount of duplicate addresses in merge file: 1
Total amount of addresses now in the fromfile: 2365
Total percentage of the fromfiles actual usage: 8%
---

-Don S

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx

[Don Schreiner]

Errr I second that response as I spend my daily morning hour
cleaning Spam from the servers. Tom has a great service with his list
and while an occasional address mistakenly listed - it is incredible how
the addresses are near the same as the addresses we add to our list when
running Read ID and it checks for duplicates. 

-Don S.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:Declude.JunkMail-owner@;declude.com] On Behalf Of Tom
Sent: Thursday, November 14, 2002 8:08 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx
Importance: High

> Well I just wanted to see what the reason was. I assumed since 
> all the entries have a catalogue number that the reason was 
> recorded. In addition I do believe outpost does have removal
> instructions at the bottom of the emails.

Our List:

Our list is a private list, however, we do share it with the 
Declude community.  Image`fx is not in the business to stop
spam, we are a local ISP/Developer not SpamCop.  We don't have
the time and/or resources to become one.  The idea behind the
list was suppose to be for all of us to share or contribute to.
Not many people have contributed to our list, but that's ok, 
we don't need the extra work.  We have also indicated to those
who use the list to use it at their own risk and to consider
using it with a weight value.


IDs:

The ID's were added to work with our program ReadID to help
identify the address inside Declude's log file without using
a separate database.  The ID's contain a date and unique
number as a description.  This description only works with
Declude's fromfile not Imail's kill list.  This unique ID
will indicate to ReadID the last time of usage so it can
clean out addresses that spammers no longer use after X
number of days.

Removal:

While this may be true for most services I don't feel that
we should have to do this, we did not sign up for it, so
why the heck should we sign out from it.  Why would I or
you want to tell them that we actually exist?  Why should
I have to tell them I don't want their stupid little news
letters or pornographic garbage?  I did not ask for it in 
the first place, not only that, it's MY server that they
are using to advertise from.  Well, guess what, they can
kiss my royal spam a$$.  They did not pay for my system.
I did, my blood, my sweat, my hard earned money.  What
right do they have?  A loop whole the law?  Either way
I don't care.  



The problem with those so called removal options is that
you never know what their intentions actually are.  I
did try this method and guess what, I got even MORE SPAM.
So a word to the wise, don't believe everything you see.

It's just as bad a an ANTI SPAM company sending us spam
to stop their spam, what the heck do they think they 
sent us in the first place?

Best Regard,
Tom
Image`fx Productions, Inc.
Provider of ExecNet Internet Services






---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
Scanned by CompBiz for Viruses http://www.CompBiz.Net.
Save 15 Percent on Virus Software by visiting
http://www.compbiz.net/software_mcafee.cfm for details!


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Helo Bogus Question

[Don Schreiner]

>Received: from w0.xxxletter.com [208.202.133.101] by 
>email.catholicweb.com
>with ESMTP
>   (SMTPD32-6.06) id AFB03E4600B8; Thu, 05 Sep 2002 15:33:52 -0500

>This one failed the HELOBOGUS test because the remote mailserver
identified 
>itself as w0.xxxletter.com, but that host doesn't exist (if you try
"ping 
>w0.xxxletter.com", you'll see "Unknown host" or something similar).

Thanks so far on the answers. OK, but it did not fail the HELOBOGUS test
in the sample e-mail I posted the header is the point I was making.
Well at least Declude did not tell me that it failed it - like I have
seen on others we are catching. I think my HELOBOGUS is set-up correctly
because on other e-mails I do see it failing. However, this one like
many others Declude does not indicate it failed HELOBOGUS.

Does that make sense?

I have got to run to a meeting - but will be back soon. Again thanks.

-Don S.


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Friday, September 06, 2002 8:17 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Helo Bogus Question


>I am seeing a lot of these (see header below) whereas the From address
>is the same as the To address of one of our domains (is this spoofing
>the domain?). I am catching them (barely in this case) based on weight
>of other tests, but not sure I understand why these are not failing the
>HELO BOGUS test too.

The HELOBOGUS test looks for "HELO/EHLO" data (where the remote
mailserver 
identifies itself).  It is required to identify itself with a valid host
name.

>I am seeing the HELO BOGUS fail on some of the
>other Spam e-mails, however not always on those like the sample below.
I
>must not be fully understanding the HELO BOGUS test. Is it because the
>Received domain and the IP match up - and only the From address is
being
>forged?

No.  It just checks to see if the host name is valid.

>  When the From Address is being forged like this, what is my best
>defense? I would prefer to just have these auto-deleted when this type
>of forging occurs, as it seems to me - these would 100% of the time
>always be Spam. Or is that incorrect thinking?

The problem is that there are some people out there (in most cases, it's

The Boss) who always Cc: themselves.  And some people send themselves
test 
messages.  So you need to be careful if you look for a To: and From:
that 
match.

>Received: from w0.xxxletter.com [208.202.133.101] by
email.catholicweb.com 
>with ESMTP
>   (SMTPD32-6.06) id AFB03E4600B8; Thu, 05 Sep 2002 15:33:52 -0500

This one failed the HELOBOGUS test because the remote mailserver
identified 
itself as w0.xxxletter.com, but that host doesn't exist (if you try
"ping 
w0.xxxletter.com", you'll see "Unknown host" or something similar).
   -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
[This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Helo Bogus Question

[Don Schreiner]

Hello fellow Decluder's,

I am seeing a lot of these (see header below) whereas the From address
is the same as the To address of one of our domains (is this spoofing
the domain?). I am catching them (barely in this case) based on weight
of other tests, but not sure I understand why these are not failing the
HELO BOGUS test too. I am seeing the HELO BOGUS fail on some of the
other Spam e-mails, however not always on those like the sample below. I
must not be fully understanding the HELO BOGUS test. Is it because the
Received domain and the IP match up - and only the From address is being
forged? When the From Address is being forged like this, what is my best
defense? I would prefer to just have these auto-deleted when this type
of forging occurs, as it seems to me - these would 100% of the time
always be Spam. Or is that incorrect thinking? Still not comfortable
enough to just delete on any specific test for forging like this. Thanks
in advance on feedback.

-Don S.


Received: from w0.xxxletter.com [208.202.133.101] by
email.catholicweb.com with ESMTP
  (SMTPD32-6.06) id AFB03E4600B8; Thu, 05 Sep 2002 15:33:52 -0500
Received: (from root@localhost)
by w0.xxxletter.com (8.11.4/8.11.4) id g85Kk8w17854
for [EMAIL PROTECTED]; Thu, 5 Sep 2002 16:46:08 -0400 (EDT)
Date: Thu, 5 Sep 2002 16:46:08 -0400 (EDT)
Message-Id: <[EMAIL PROTECTED]>
Mime-Version: 1.0
To: [EMAIL PROTECTED]
Subject: Acess the #1 xxx site with no credit card!
Content-type: text/html;
From: [EMAIL PROTECTED]
X-RBL-Warning: OSSRC: [1] hostitwithusa, see
http://spews.org/ask.cgi?S1886
X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA
208.202.133.101 with no reverse DNS entry.
X-Declude-Sender: [EMAIL PROTECTED] [208.202.133.101]
X-Declude-Spoolname: Dbfb00b8.SMD
X-Note: CompBiz.Net/CatholicWeb.Org scanned for spam with Declude
JunkMail.
X-Note: Failed Tests: OSSRC, SPAMCOP, REVDNS, WEIGHT20-29 [20].
X-Note: Total spam weight of this E-mail is 20.
X-Sender: Sender of E-mail: [EMAIL PROTECTED]
X-Note: RevDNS Remote Server [No Reverse DNS] ([208.202.133.101]).

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Spammer tools - why do these sites exist

[Don Schreiner]

Got to love this right off their site... 

In order to stay within federal laws so that you are bulk emailing and
not spamming you must;
1.) Use a Valid Return Address
2.) Offer and Honor a means of removal from your mailings.
3.) Make no attempts to forge or remove the headers from your emails.

Don S.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of decjunkmail
Sent: Monday, September 02, 2002 4:14 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Spammer tools - why do these sites exist

I just stumbled onto:

www.marketmenow.com

My question is, where are they being hosted and what ISP/internet
connection are they using that allows them to keep this site online
selling all kinds of obvious spammer tools without violating somebody's
AUP.

most intriguing -- a $150/month subscription that sends by email a list
of open relays three times a week.

Wondering why folks haven't surreptiously subscribed to this and then
posted the listed systems back into the DNSRBL lists (although who wants
to put $150 a month into these slimeballs pockets?)

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
[This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Address Book Only in Declude?

[Don Schreiner]

Tom et al,

I really like this approach on the rules.ima. Also been trying to spec
out a way to give the end user some control over some simple Spam
management. It would be great if a host administrator (and even the end
user) could determine which Declude Spam tests we make available from a
list they would like to use, as well as the ability to add/edit/delete
their own Declude Kill list addresses.  However, requires unique
global.cfg for each which is not currently possible and sure there are a
lot of issues involving same to to this. But it sure would be nice!

Don S.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Tom Baker |
Netsmith Inc
Sent: Thursday, August 29, 2002 12:36 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.JunkMail] Address Book Only in Declude?

The same obstacle I have not quite overcome as of yet. We use a size
restriction to keep mailbox's from filling up the entire mail server HD
(10MB per user). And to ensure their SPAM box does not stop incoming
mail if
the user is not erasing it we have this little disclaimer...

Note: All mailbox's have a 10 megabyte limit, and due to restrictions of
our
mail server we cannot automatically purge SPAM after a certain amount of
time, to ensure your SPAM folder does not fill up your mailbox, if your
SPAM
folder ever reaches 3 megabytes, it will automatically be completely
erased.

And to enforce it, I run a nightly search on the entire mail dir
D:\mail\*\spam.mbx (recursive serch)
Where size > 3084kb

And erase any spam.mbx's that I find
I'm working on a more creative solution.

-Original Message-
From: Charles Frolick [mailto:[EMAIL PROTECTED]] 
Sent: Thursday, August 29, 2002 11:22 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Address Book Only in Declude?


I do have one question, how do you manage the size of the spam folder
when
they use that option?  I would love to use the MAILBOX action, but have
no
way of cleaning out the spam folder without affecting the other folders,
including inbox, as well. We currently do not use aging as a restriction
for
those who use webmail exclusively, we opted for size limits instead.

Chuck Frolick
ArgoNet, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Tom Baker |
Netsmith
Inc
Sent: Thursday, August 29, 2002 11:09 AM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.JunkMail] Address Book Only in Declude?


Ok, I will stop posting on this thread after this.

For a working-example on how I have achieved this with imail and cold
fusion
I have setup a test account.

Login = [EMAIL PROTECTED]
Pass  = declude

Manager: http://users.bsc.net/
WebMail: http://mail.bsc.net/

>From the manager you can *import* an Outlook Express address book,
Or build your own, you can adjust the filter levels, and block
individual
users.

These features just manage the rules.ima, which you can watch by going
to
the web-mail Interface and clicking "Change Processing Rules"

Anyone on this list is welcome to upload dummy address book's and play
with
this account I just wanted to demonstrate to others how I have
creatively
achieved this with IMAIL 6 / Cold Fusion.

* note: I built this interface before I became aware of the power of
WEIGHT,
changing the filter-definitions to work with weights instead of
individual
headers is on my to-do list, so if anyone actually does look at this
please
don't flame me on how I could improve that. I am already aware :)





-Original Message-
From: Tom Baker|Netsmith Inc [mailto:[EMAIL PROTECTED]]
Sent: Thursday, August 29, 2002 10:44 AM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.JunkMail] Address Book Only in Declude?


Excuse the typo everyone, I meant to put a "not (!)"  in that long
string

H!~THIS...

-Original Message-
From: Tom Baker|Netsmith Inc [mailto:[EMAIL PROTECTED]]
Sent: Thursday, August 29, 2002 10:41 AM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.JunkMail] Address Book Only in Declude?


Oh, for an "address book only"
You must also add one last entry at the bottom of rules.ima

H~THISWILLNEVERMATCHBECAUSEITSAREALLYLONGBOGUSSSTRING:NUL

That will force anything not matched in the above of rules.ima to be
deleted

Ex:
--rules.ima--
H~[EMAIL PROTECTED]:main
F~declude.com:main
F~[EMAIL PROTECTED]:main
H~THISWILLNEVERMATCHBECAUSEITSAREALLYLONGBOGUSSSTRING:NUL
--/rules.ima--

Anything that does not match the first 3 lines will be deleted



-Original Message-
From: Tom Baker|Netsmith Inc [mailto:[EMAIL PROTECTED]]
Sent: Thursday, August 29, 2002 10:38 AM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.JunkMail] Address Book Only in Declude?


Yes, this is how I already accomplished this for my users.
I have a cold fusion interface which verified login/password, then
manages
their rules.ima Anyone they want to "allow" it writes at the top of the
rules.ima...

F~[EMAIL PROTECTED]:MAIN

Any junk-mail they want to block it sends to SPAM folder

H~X-RBL

[Declude.JunkMail] Per User/Domain Global.cfg

[Don Schreiner]

Scott,

Like the junkmail file, can you also use per user/domain global.cfg
files with Pro version? I want to be able to define test weights and
more per domain/user vs. only actions with junkmail which I see covered
in the manual, but not for global.cfg

-Don S.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Filtering Outgoing E-mail based on 4 letter words

[Don Schreiner]

Is there a method in Declude or with IMail filter rules to scan outgoing
messages based on a list of 4 letter words in both the subject line and
e-mail body?  Have a customer who wants to scan outgoing e-mail for his
users for 4 letter words. Thanks.

-Don


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] DORKZTL:Permitting Mail by Word in Subject Line

[Don Schreiner]

I have a customer who has an automated e-mail form sent to him for price
quotes and the word "Quote" (without the quotation marks) is always in
the subject line. However, when the e-mail is sent from someone with a
Yahoo e-mail address it fails my Declude Junk Mail and ends up in the
Hold folder based on weight which I currently have set to 20 and based
on about 5 different tests. I do not want to increase my weight or
decrease the Junk Mail tests I use, because other than this scenario all
are confirmed junk mail and has been working good for me.

Is there a way with Declude I can configure to allow these automated
e-mail messages through using the Subject Line and the word "Quote" but
not change my weighting system? Thanks.

Don Schreiner
CompBiz, Inc.
www.compbiz.net
407-322-8654
800-408-3688 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] DORKZTL:DNS Report Down?

[Don Schreiner]

Can anyone bring up DNSReport.com and DNSStuff.com? Are they down?
Anyone experiencing regional connectivity errors?

-Don S.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

DORKZTL:RE: [Declude.JunkMail] Receipts

[Don Schreiner]

Hehe!

Whack with the return receipt sender clue-stick! Next...

As soon as I saw it - I thought of the wrath of Len!

-Don S.

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED]] On Behalf Of John Tolmachoff
> Sent: Tuesday, March 26, 2002 12:13 PM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] Receipts
> 
> OK, ready for the onslaught of comments.
> 
> Sorry.
> 
> John Tolmachoff
> IT Manager, Network Engineer
> 211 E. Imperial Hwy., Suite 106
> Fullerton, CA  92835
> 714-578-7999, ext. 104
> [EMAIL PROTECTED]
> www.reliancesoft.com
> 
> 
> 
> 
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> 
> ---
> 
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  You can E-mail
> [EMAIL PROTECTED] for assistance.  You can visit our web
> site at http://www.declude.com .
> --
> [This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

DORKZTL:RE: [Declude.JunkMail] ORBZ - More info

[Don Schreiner]

Anyone have a link or information on the most recent news about ORBZ and
Battle Creek? I see on some of the posts at the Battle Creek guest book
that apparently the charges may have been dropped. The most I have
enjoyed reading such a poorly written guest book application in ages.
Some of the posts are too funny...

http://216.117.150.42/battlecreekmichcom/cgi-bin/battlecreek/guestbook.c
gi#sign

Don S.

 

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED]] On Behalf Of Todd Holt
> Sent: Friday, March 22, 2002 10:19 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] ORBZ - More info
> 
> >I'm not sure either, however, Spam is like a virus and it takes away
from
> >other legitimate businesses that want to tell you about their
services
> >and/or
> >sales.  I have consulted with allot of my clients, most of them just
hit
> >delete
> >when they don't know where the e-mail came from.  So what's the point
of
> >these guys sending this mail if no one reads it?  That's why I say
it's
> like
> >a virus that spread under are skins and threatens our servers for no
good
> >reason.
> 
> The point is that a number of people DO read this stuff and want SPAM
sent
> to them as much as some people DO want to receive telemarketing phone
> calls
> which most of us don't answer or hang up on.  These are just lonely
people
> that feel needed when someone contacts them.
> 
> But the difference is who pays the cost! In telemarketing and junk
mail,
> the
> sender pays the cost.  In SPAM, the receiver (or more precisely, the
> receiver's mail host) pays the cost.  If business' are forced to
upgrade
> their systems to handle 20% more mail and 20% of their mail is
received,
> then discarded as SPAM, that company paid for an upgrade they didn't
need
> to
> handle their business.
> 
> Its like the junk mailers sending stuff COD that you can't refuse, or
the
> telemarketer calling collect and you can't refuse!
> 
> Todd
> 
> ---
> [This E-mail scanned for viruses by Declude Virus]
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> 
> ---
> 
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  You can E-mail
> [EMAIL PROTECTED] for assistance.  You can visit our web
> site at http://www.declude.com .
> --
> [This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] ORBZ - More info

[Don Schreiner]

> Another way to look at things would be to check out the court cases
where
> Corporations have sued their employees for misuse of e-mail.

Do you know where there are any of these cases that I can review online?


If not, thanks anyway. I will try and free up some time to perform some
research and will share my findings if I come across anything. I hate
all this legal stuff and would rather devote the time to new
technologies, working projects, etc., but legalities an unnecessary evil
in my position. 

This "Joe the Lawyer" guy has got my blood boiling a little bit along
with the Battle Creek ORBZ action. I don't know who "Joe the Lawyer" is
and give him the benefit of doubt having our best intentions in mind
from a legal standpoint. Where is his reply supplying us legal
references to the legalities of filtering or blocking Junk Mail? He
apparently does not agree with filtering e-mail for Spam. Does he agree
that it is right for un-solicited Porn to be received by children or
anyone for that matter? If he does agree, then how is this different
from un-solicited e-mail for Time-Share travel, Life Insurance, and the
next get rich quick scam?

As a business owner, I am all about Free Enterprise.  But I do not
hi-jack other folks servers or conduct dictionary attacks to e-mail
servers that I do not own to solicit my goods/services. I think we all
agree if an e-mail address is published on a public site it is fair
game, otherwise leave me alone unless I ask.

I know this may perhaps be hedging OT, but what happened to ORBZ this
week could happen to any of using a Kill file, Processing Rules, or
Declude as "Joe the Lawyer" points out. Even if we feel he and Battle
Creek are wrong, we can be forced in fear to shut down just like ORBZ
did and defending lawsuits that are frivolous and without foundation.
Can Ian Gulliver at ORBZ afford to defend himself alone? Can any of us
alone?  

I guess the whole thing just pisses me off. I know that "morally" it is
wrong for individuals and entities to send most of the unsolicited and
trickery Spam that is being blocked by reputable firms.  However,
"legally" I am not so sure until such time I can reference a federal or
international ruling/law. I feel I need something to back me up and in
our usage agreement and defend our customer policies.

Sorry to be so verbose, but it just ticks me off what I am seeing
happening and those who are responsible sending Spam and then actually
believing they should have the given right to do so.

Don S.


> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED]] On Behalf Of Tom
> Sent: Thursday, March 21, 2002 7:59 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] ORBZ - More info
> 
> 
> > Ahh... my 2 cents anyway. I just feel no one has the right to send
me
> > crap I did not ask for, especially PORN solicitations into my
children's
> > e-mail box. Perhaps I am wrong legally as it relates to free rights
and
> > e-mail solicitations, but the PORN solicitation alone is enough to
keep
> > me fighting for my rights to block SPAM.
> 
> Another way to look at things would be to check out the court cases
where
> Corporations have sued their employees for misuse of e-mail.
> 
> In any case if it is your system you can do whatever you want with it.
> If the customers don't like it, too bad!  You own it, you paid for it,
> and you maintain it.  It's that simple!
> 
> What does this mean?  If you write an e-mail to a friend your BOSS,
the
> or ISP (owner of the equipment) has the right to view it.  Just like
the
> FBI and CIA.  This is why we stress the use of PGP!
> 
> Anyway, just my 2 cents!
> 
> PS: Don't reply to me if you want to argue, I just wanted to give
>   another view point.
> 
> Regards,
> Tom
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> 
> ---
> 
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  You can E-mail
> [EMAIL PROTECTED] for assistance.  You can visit our web
> site at http://www.declude.com .
> --
> [This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] ORBZ - More info

[Don Schreiner]

I am posting the following reply here to an active thread in the regular
IMail Discussion list (Scott I hope you don't mind), because for
whatever reason my posts there do not get distributed?? (I have finally
asked IPSwitch to investigate because I cannot post nor do I ever
receive original posts there).



This is what gets me on this entire blocking issue and the "Joe the
Lawyer" positions...

We support and maintain several online "family-oriented" and religious
oriented portal communities and their companion e-mail services.  We
have all the appropriate legal Usage Agreements, Policies, etc. They
basically state if something goes wrong it is not our fault, usage of
services is "AS-IS", and if you don't like, then don't use our services,
or if we don't like you - we will terminate your usage with us
exercising our right to do so.  So I am pretty sure our lawyers have us
well covered regarding a law suit that we block SPAM?

But what really gets to me from the "Joe the Lawyer" guys, is that a
significant number of the Spam's we block are from PORN outfits targeted
to our innocent and very often young community members. I say the hell
to the free speech Spammer guys that are wanting to send my customers,
clients, and community members PORN solicitations. I would rather defend
myself to the Judge trying to protect the proliferation of PORN to
children, than defend myself from blocking somebody's supposed right to
send unsolicited e-mail.

Ahh... my 2 cents anyway. I just feel no one has the right to send me
crap I did not ask for, especially PORN solicitations into my children's
e-mail box. Perhaps I am wrong legally as it relates to free rights and
e-mail solicitations, but the PORN solicitation alone is enough to keep
me fighting for my rights to block SPAM.

Anyone know of a good legal resource on this issue and where I can
reference for comparison some Usage Agreements and online Policies that
have held up against these morons out there? I would like to have our
lawyer's double check our usage agreements and policies on Spam
filtering. Thanks.

Don S.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Thursday, March 21, 2002 4:50 PM
To: [EMAIL PROTECTED]
Subject: Re: [IMail Forum] ORBZ shut down


>That should be a major wake up call for any of you blocking messages!

Another interesting point where "Joe the lawyer"'s argument backfires:

Blacklisting could actually help PREVENT a similar lawsuit!  Anyone who
is 
adding the town of Battle Creek, Michigan (and other buggy mail servers)
to 
their blacklists will minimize mail to these mail servers, which will in

turn minimize the chances that they will get sent to jail for sending
mail 
to those servers.

-Scott
---
Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for 
IMail.  http://www.declude.com

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]


Please visit http://www.ipswitch.com/support/mailing-lists.html 
to be removed from this list.

An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/

Please visit the Knowledge Base for answers to frequently asked
questions:  http://www.ipswitch.com/support/IMail/
--
[This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of
[EMAIL PROTECTED]
Sent: Thursday, March 21, 2002 4:02 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] ORBZ - More info

I told Kellogg's I wouldn't buy their cereal anymore:
http://www.kelloggs.com/contact/index.html

I called Kellogg's too, to complain: 1-800-962-1413
(8 AM to 8 PM ET Weekdays)

Battle Creek, a town of 54,000 best known as the headquarters of the
Kellogg's cereal company

[EMAIL PROTECTED]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
--
[This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] ORBZ - More info

[Don Schreiner]

I followed suit and also sent a copy of my post on their guestbook to
him, as well as, the city commissioners over there. They probably don't
even understand what the hell is going on.  Anyway, their e-mails can
all be found at
http://ci.battle-creek.mi.us/Government/High/Biographies.htm#Squires. I
think it is a matter of educating them the errors of their ways. The
Hale storm person who apparently reported to the police department
appears to HAVE NOT educated anyone regarding what and why their server
crashed and what ORBZ does and that they should be considered the good
guys!

[EMAIL PROTECTED],[EMAIL PROTECTED],
[EMAIL PROTECTED],[EMAIL PROTECTED],[EMAIL PROTECTED],santana@
vivaward3.com,[EMAIL PROTECTED], [EMAIL PROTECTED]

Don S.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Matt Robertson
Sent: Thursday, March 21, 2002 5:26 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] ORBZ - More info

I sent this email to the CIO of Battle Creek (found him thru a Wired
link):



Mr. Lee, 

As you are no doubt aware the news was broken today that actions taken
by your department are responsible for the demise of the ORBZ anti-spam
notification system.   

This strikes me as a dereliction of your server administrator's
responsibility and nothing else.  Any competent individual responsible
for web-based systems is well aware that security and update patches
must be maintained or dire consequences can result. 

Lotus released a security patch that would have cured the subject
problem on its Domino product in September 2001.  That was seven months
ago. 

Rather than prosecuting a good citizen providing a beneficent service to
a grateful world (who now think of you and the competence of your
department in much less than flattering terms), you should look to your
own systems to see what else hasn't been kept updated. 

As a systems administrator myself, I do not appreciate the penalty I and
legions of other internet users are now paying for such ignorance,
neglect and misplaced blame. 

Sincerely, 

--- 
Matt Robertson[EMAIL PROTECTED] 
MSB Designs, Inc., www.mysecretbase.com 
---

 
 
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
--
[This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] ORBZ gone

[Don Schreiner]

Wow! Sure would like to try and help the guy out.  I am not familiar
with the Lotus Domino issue? Is there anything as a group we can do to
help?

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Tech
Sent: Wednesday, March 20, 2002 11:15 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] ORBZ gone



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Wednesday, March 20, 2002 10:41 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] ORBZ gone



>Verified in a discussion on SPAM-L list.

Verified by who?

When ORBS died, there were tons of rumors, many so widespread that most
people just assumed they were true, but few actual facts.  Since the
ORBZ
site is no longer reachable, there isn't an easy source of reliable
information.

I know that there is discussion on the SPAM-L list about it, but has
anyone
on that list actually verified that it is true?  I just didn't claim it
to
be a fact because of the ORBS incident, which took a couple weeks before
it
could be proven that ORBS was really gone.  I just don't want to see
another "A friend of a friend of my brother's wife's sister in law's
favorite bartender told me that..." (which often gets written in an
E-mail
as "It is a fact that...").
 -Scott

FWIW, I received this moments ago.

- Forwarded message from ORBZ <[EMAIL PROTECTED]> -

Date: Wed, 20 Mar 2002 03:15:49 +
From: ORBZ <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Shutdown

Here's the email that those of you with forward sight
have been fearing since the inception of ORBZ.

As of this moment, ORBZ is shutting down.  DNS zones
are going to stop resolving, the website will disappear
and mail will stop working (so furthur discussion on
this list probably won't work -- use NANAE).

I don't want to disappear in silence like ORBS, so I'll
try for as much description as possible without
compromising my own position.

I received an official court notice this afternoon to
turn over all information relation to ORBZ accounts.
This came from the 10th Judicial District court of the
State of Michigan.  It appears that ORBZ may be facing
criminal charges for denial of service relating to the
Lotus Domino issue.

I was happy to try to weather any civil issues that may
have come up, and I was committed to seeing it through.
However, the threat of jail time is too much; I don't
believe in this fight quite that much.

Thank you all for all your support.  I sincerely hope
that someone with the goal of carrying on the mission
of ORBZ pops up in another country with a less
foreboding legal system.  Anyone who has copies of the
current zones may do with them what they wish.

For those of you stuck without good spam filtering,
please consider ORDB and SpamCop; they both provide
excellent free solutions.

Ian Gulliver
ORBZ

--
This message was sent to the opt-in ORBZ list.
If you do not want to receive ORBZ messages,
please send mail to [EMAIL PROTECTED]





Denny Jodeit
Flare Net, Inc.
[EMAIL PROTECTED]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
--
[This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Delog update

[Don Schreiner]

Hey Tom,

Good job! I set CPU to med3 on the same machine I referenced previous
and now down from 99% to average 45% CPU usage. Process took about 3
minutes vs. 1-2 minutes on 1349 message count. For the larger volume
guys (I know we are small fry), if you inserted the total time to
process in the report, this might help them determine what setting to
use in sacrifice of time vs. CPU setting.

On another mail server we manage with a lot more horsepower (I think we
have 800mhz on that machine?), full throttle it only used about 45% CPU.
Set to med3 it dropped to 15% CPU and again only took a few minutes to
process a 1727 message count.

Will let you know how the 11:59 scheduler option goes. Of course the
best option would be the ability to specify the time. But 11:59pm is
probably good for admins similar to us. Hey - how about turning on the
mailer option for us demo guys. Guess I wouldn't need a license then ;0)

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Tom
Sent: Wednesday, February 20, 2002 10:37 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Delog update


For those of you using Delog with Declude for Imail,
you can now get the updated beta version 1.04b from 
the web site.  This version allows you to enable an
internal timer and set maximum cpu cycles Delog is
allowed to take.  If anyone encounters any problems
please feel free to contact us.
 
http://www.imagefxonline.net/apps/delog/delog.zip

Please refer to the web site for additional help.
http://www.imagefxonline.net/apps/delog


Thanks,
Tom
Image`fx
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
--
[This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Delog update

[Don Schreiner]

Love having the statistics on the failed Spam tests. Great idea and very
helpful!

Couple of comments:

1. Definitely CPU intensive. Had our server (600mhz Intel) pegged 99%
while running. Our server usually idles around 2-3%. My typical log file
scanned contains 1300+ messages each, and my declude log setting is at
medium on those scanned. Took about 1.0 - 1.5 minutes to complete the
scan. So the CPU was not pegged for very long anyway.

2. Feature to combine report stats weekly / monthly would be very useful
vs. combining all declude logs and then running a report based on the
amount of resources required and length of time.

3.  I like the interactive feature to pick and choose a log.  I guess an
option to pick multiple logs vs. a single log file would be useful too,
but again probably not for the faint hearted server.

4. I know you state to use the Windows task scheduler. Integrated would
be good for those not familiar with Task Scheduler.

Great work and look forward to using!

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Tom
Sent: Monday, February 18, 2002 9:42 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Delog update

> Could I solve the multi-day problem by concatenating the logs 
> together, then running Delog?

I don't see any reason why you couldn't.
Let me know how it works out.


Here is a sample batch file to combine the Declude log files into one:
--
@echo off
C:
CD\IMAIL\SPOOL
copy DEC*.LOG TOTAL.LOG
EXIT
--

Run Delog on the total log file, it may take a while.
What I can do is add a feature to the configuration file
to tell Delog to look for a specific weekly log file.
This would override the default daily log.


Regards,
Tom
Image`fx
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
--
[This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] which .eml file to use?

[Don Schreiner]

Whoops, sorry I figured it out and just did not synch with me the first
time I read it in the manual.

The answer: TESTNAMEbounce.eml (replacing TESTNAME with the name of the
test you want the bounce

Sorry for the lame question.

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Don Schreiner
Sent: Sunday, February 17, 2002 6:41 AM
To: Declude List
Subject: [Declude.JunkMail] which .eml file to use?

If you use the BOUNCE action based on a weight, then how does Declude
know which corresponding .eml bounce message to use? For example, I have
set-up an .eml named BADHEADERSbounce.eml as suggested based on weight
30. However, I also have another .eml named WEIGHT20bounce.eml should my
weight 20 fail. Where do you define which action will use the correct
.eml?

-Don



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
--
[This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] which .eml file to use?

[Don Schreiner]

If you use the BOUNCE action based on a weight, then how does Declude
know which corresponding .eml bounce message to use? For example, I have
set-up an .eml named BADHEADERSbounce.eml as suggested based on weight
30. However, I also have another .eml named WEIGHT20bounce.eml should my
weight 20 fail. Where do you define which action will use the correct
.eml?

-Don



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] Postmaster Account, Virus, and Logs Help

[Don Schreiner]

1. I picked up the following in my syslog. Does anyone know what is
happening?

LIST 1
RETR 1
DELE 1
LIST 2
RETR 2
DELE 2
LIST 3
RETR 3
DELE 3

...it continues up through number 80 plus.

2. I am currently investigating why the postmaster account, for one of
the domains we host, sent an e-mail with a virus attached to itself at
the same Postmaster account? Declude virus appears to have caught the
W32/NewApt.worm.gen@MM virus that was attached during pre-scan within
the html body of the message. The header is below...

Received: from mail.thedomain.com [216.201.29.172] by Thedomain.com
  (SMTPD32-6.06) id A2F8C25012A; Tue, 12 Feb 2002 16:11:04 -0600
From: <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Thedomain VIRUS WARNING: YOU APPEAR TO HAVE A VIRUS!
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="=_NextPart_000_0007_01AF0E92.A4E9CDO0"
Message-Id: <[EMAIL PROTECTED]>
X-Declude-Sender: [EMAIL PROTECTED] []
X-Declude-Spoolname: D92f812a.SMD
X-Note: CompBiz.Net scanned e-mail for spam with Declude JunkMail.
X-Note: Failed Tests .
X-Sender: Mail From: [EMAIL PROTECTED]
X-Note: This E-mail was sent from  ([216.201.29.172]).
X-Note: Total spam weight of this E-mail is 0.

3. I am looking through the syslog and other logs trying to ID what and
where exactly happened and difficult to figure out??

4. This is what I pick up in the log searching for the Spool file
name...

02:12 16:13 SMTPD(0C25012A) [216.201.29.172] f:\imail\spool\D92f812a.SMD
97962

5. This is what I find when searching for 0C25012A...

LIST 10
RETR 10
02:12 16:11 SMTPD(0C25012A) [216.30.105.167] connect 216.201.29.172 port
2055
DELE 10
LIST 11
02:12 16:11 SMTPD(0C25012A) [216.201.29.172] HELO mail.thedomain.com
RETR 11
DELE 11
LIST 12
02:12 16:11 SMTPD(0C25012A) [216.201.29.172] MAIL FROM:
<[EMAIL PROTECTED]>
RETR 12
DELE 12
02:12 16:11 SMTPD(0C25012A) [216.201.29.172] RCPT TO:
[EMAIL PROTECTED]
LIST 13
RETR 13
DELE 13

Thanks.

-Don

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Problems with SpamReview Software

[Don Schreiner]

I am not sure that is related to the issue I was having? Your issue
might be as simple as setting the file size in the Settings to read
first 5000 bytes when previewing. Otherwise very large e-mails take a
while to process before displaying for preview. This is included in the
latest release of SPAM review which can be downloaded from his site.  I
got my issue worked out that was related to a bug with the fromfile test
in declude.  Scott is already working on a fix.

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Madscientist
Sent: Friday, February 08, 2002 8:02 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Problems with SpamReview Software

I've had some similar problems so I quit using it.
The problem seems to be related to the amount of content in the folder.
I
have a lot of captured spam.
_M

| -Original Message-
| From: [EMAIL PROTECTED]
| [mailto:[EMAIL PROTECTED]]On Behalf Of Don Schreiner
| Sent: Thursday, February 07, 2002 8:51 PM
| To: Declude List
| Subject: [Declude.JunkMail] Problems with SpamReview Software
|
|
| Is anyone having problems with Tom's newly released Spam Review
| software? It was working fantastic until yesterday when it started to
| hang up on launch and spikes the CPU 99%. I have to kill it with my
Task
| Manager. I have the latest version installed, checked all the
settings,
| only set to read 4000 bytes, and I even performed a re-install and
| cannot get it to launch correctly when there are more than 3-4 e-mails
| in the hold folder.
|
| If I clear my SPAM Hold folder it launches and works just fine, until
it
| starts filling up again.  I have SPAm Review running on 2 separate
| machines, 2 separate locations (all Win2k Dells w/ all the bells and
| whistles), and then today suddenly on our other e-mail server, the
same
| thing is happening there now.  Totally puzzled?  Tom said he was going
| to be out of town for a few days and not sure if he is back. Anyone
have
| a clue what could be causing it to hang like this?
|
| -Don
|
| ---
| [This E-mail was scanned for viruses by Declude Virus
| (http://www.declude.com)]
|
| ---
|
| This E-mail came from the Declude.JunkMail mailing list.  To
| unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
| type "unsubscribe Declude.JunkMail".  You can E-mail
| [EMAIL PROTECTED] for assistance.  You can visit our web
| site at http://www.declude.com .
|
|

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
--
[This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Declude Info in Body of E-mail?

[Don Schreiner]

Got it and commented it out for now.  Also figured out that what was
causing the Spam Review app to hang. Thanks.

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Thursday, February 07, 2002 9:51 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Declude Info in Body of E-mail?


>I am getting Declude Info in the message body (at the very top of the
>message body as seen below) within e-mail replies, and only occurring
>from what appears to be e-mails sent to legitimate AOL, HOTMAIL,
etc

We've discovered a glitch with the "fromfile" test type that can cause
this 
in the headers.  A new version should be out tomorrow morning that takes

care of this.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
--
[This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Problems with SpamReview Software

[Don Schreiner]

It is the add-on third party software called Spam Review written by Tom
Schwarz. 

I figured it out! My FREEMAIL test had something to do with it and was
causing it to hang 99% CPU anytime it was reviewing any of the FREEMAIL
domains (i.e. AOL, HOTMAIL, etc.) that I had defined in my FREEMAIL.lst
file.  It did not like it at all!  As soon as I commented out everything
in my Global.cfg and JunkMail and also cleared out any e-mails that had
been already processed in my Hold folder - all back to normal!  ;0)

Was driving me nuts. I just saw Scott posted they are already working on
a problem with FROMFILE test type that was causing my FREEMAIL
definition to fail.

Thanks for trying to help out.

-Don
 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Tom
Sent: Thursday, February 07, 2002 9:24 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Problems with SpamReview Software

> Is anyone having problems with Tom's newly released Spam Review
> software? It was working fantastic until yesterday when it started to
> hang up on launch and spikes the CPU 99%. I have to kill it with my
Task
> Manager. I have the latest version installed, checked all the
settings,
> only set to read 4000 bytes, and I even performed a re-install and
> cannot get it to launch correctly when there are more than 3-4 e-mails
> in the hold folder.


What software are you referring to, Declude?
or are you referring to Delog?

Regards,
Tom
Image`fx
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
--
[This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] Declude Info in Body of E-mail?

[Don Schreiner]

I am getting Declude Info in the message body (at the very top of the
message body as seen below) within e-mail replies, and only occurring
from what appears to be e-mails sent to legitimate AOL, HOTMAIL, etc.
addresses, and then upon reply receipt to the original e-mail sent, is
where the Declude info is seen in the body of the message. (Hope that
made sense.)  Yesterday, I set-up FREEMAIL weights in my Global.cfg like
the example posted. I have double checked my settings, but cannot
identify why this is happening. Any idea what is causing this?

X-RBL-Warning: Weight of 10 exceeds the limit of 10.
X-Declude-Sender: [EMAIL PROTECTED] [64.12.136.4]
X-Declude-Spoolname: Da4080a0.SMD
X-Note: CompBiz.Net scanned e-mail for spam with Declude JunkMail.
X-Note: Failed Tests: NOPOSTMASTER, FREEMAIL, WEIGHT10.
X-Sender: Mail From: [EMAIL PROTECTED]
X-Note: This E-mail was sent from imo-m01.mx.aol.com. ([64.12.136.4]).
X-Note: Total spam weight of this E-mail is 10.

My FREEMAIL is set to WARN with a weight of 5 in my Global.cfg
definition as follows:

FREEMAIL   fromfileE:\IMail\Declude\freemail.lst   x  50

My FREEMAIL.lst is as follows:

@hotmail.com Suspect Free Mail Domain
@aol.com Suspect Free Mail Domain


Thanks,

-Don

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] Problems with SpamReview Software

[Don Schreiner]

Is anyone having problems with Tom's newly released Spam Review
software? It was working fantastic until yesterday when it started to
hang up on launch and spikes the CPU 99%. I have to kill it with my Task
Manager. I have the latest version installed, checked all the settings,
only set to read 4000 bytes, and I even performed a re-install and
cannot get it to launch correctly when there are more than 3-4 e-mails
in the hold folder.

If I clear my SPAM Hold folder it launches and works just fine, until it
starts filling up again.  I have SPAm Review running on 2 separate
machines, 2 separate locations (all Win2k Dells w/ all the bells and
whistles), and then today suddenly on our other e-mail server, the same
thing is happening there now.  Totally puzzled?  Tom said he was going
to be out of town for a few days and not sure if he is back. Anyone have
a clue what could be causing it to hang like this?

-Don

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] OT: Link to Govt SPAM list

[Don Schreiner]

Does anyone have the link to the Article about reporting SPAM to the
government?

-Don 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] MISSING_REVERSE_DNS:FREEMAIL test

[Don Schreiner]

I must have missed this in the documentation? Where can I learn more
about the FREEMAIL test and freemail.lst?

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of John Shacklett
Sent: Wednesday, February 06, 2002 4:23 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] MISSING_REVERSE_DNS:FREEMAIL test

Scott helped me sort out what was exactly the same problem with my YAHOO
test in my global.cfg last week.

This isn't exactly a "me too" though; since fixing the glitch, all of my
previously reported WEIGHT inconsistencies seems to be gone as well.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Wednesday, February 06, 2002 4:11 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] MISSING_REVERSE_DNS:FREEMAIL test



>My FREEMAIL test doesn't seem to work.
>
>I want to add 5 points to any emails form designated "Free Email"
systems
>(because they shouldn't show up as broken mail clients, black-holed,
etc.
>and I want to bounce them if they do).
>
>I have C:\IMail\Declude\FreeMail.lst which contains one line:
>@hotmail.com

So far so good.

>In my Global.cfg file I have:
>FREEMAILfromfileC:\IMail\Declude\freemail.lst   x
x
>  5   0

Note that this should be:

 FREEMAILfromfileC:\IMail\Declude\freemail.lst
x
  5   0

Otherwise, you're giving it a weight of "x" (which is invalid), and
giving
ALL E-mail from non-Hotmail accounts a weight of 5.

To find out exactly what is happening, you can use the debug mode.  To
use
the debug mode, you can change the "LOGLEVEL LOW" line in
\IMail\Declude\global.cfg to "LOGLEVEL DEBUG".  Then, when an E-mail has
arrived from a Hotmail account, you can switch back to "LOGLEVEL LOW"
(the
debug mode adds huge amounts of information to the log file).  You can
then
E-mail me the \IMail\Declude\dec.log file (as an attachment), and I
can
take a look at it to see what is happening.
  -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
--
[This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Spam Review Update v1.0.7

[Don Schreiner]

I agree the sort feature would be a big help.  BTW, love the add to
kill.lst feature. Used properly it is a big time saver.

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Todd Holt
Sent: Monday, February 04, 2002 10:41 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Spam Review Update v1.0.7

I second this!!

Todd

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Bennie
Sent: Sunday, February 03, 2002 3:21 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Spam Review Update v1.0.7


Hey Tom,

I have a suggestion... :)

On your spam review software.. can you have a button so we can sort by
sent
address... then we can select all of those and delete a block at a
time...

I have noticed when I am cleaning it out.. i have a number of spams
which
have the same return email address... once I look at one of these.. I
know
all the rest are spam... so it would be easier to do a Shift-click and
select them all.. if they were sorted by return email address...

Have I stated this with out confusing anyone...

Bennie

- Original Message -
From: "Tom Schwarz" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Saturday, February 02, 2002 11:18 AM
Subject: [Declude.JunkMail] Spam Review Update v1.0.7


> Power is back and life is getting back to normal so I thought I would
post
> an update.  The last update I posted the first person that downloaded
it
> found a major problem.  I hope that is not the case this time.
>
> If you are currently using SpamReview all you should need is
spamreview.exe.
>
> I know the Add to Kill feature will not make everybody happy but I
received
> a mix bag of requests and this was already in testing so that is what
you
> get for now.  I will add other similar features later.  I have some
code
to
> restart the smtp service on a 2000 computer but don't know if it will
work
> on NT.  If you are a vb programmer and have code that you know will
restart
> a service on NT and/or 2000 and are willing to share it please email
it to
> me.  I am thinking of allowing you to restart the smtp service from
> SpamReview.
>
> http://www.slsoft.com/spamreview.htm
>
>
> v1.0.7 New Features
> Add to Kill - You can now add a From email to the IMail kill.lst
> file. The SMTP service must be restarted for the changes to kill.lst
to
take
> effect. (note: future versions may allow you to add to other exclusion
> lists).
> Virus EMail can now be reviewed. You must specify the path to the
> virus hold folder. It's the same path specified in your virus.cfg file
as
> "VIRDIR D:\IMail1\spool\virus". You cannot view Virus EMail as HTML
and
you
> can not Return the email to the Que. The Deleted and Hold folders for
the
> Virus feature are located under your Virus folder.
> A new "Settings" feature allows you to truncate the message to a
> given number of bytes. This will speed up your processing when the
email
> includes a large attachment. This setting is "Truncate Message Size
To?"
and
> is specified in Bytes. Zero bytes retrieves the entire message.
> Clear Spam Deleted Folder and Clear Virus Deleted Folder features
> allow you to clear out the Deleted folders. This process cannot be
reversed.
>
>
>


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---
[This E-mail scanned for viruses by Declude Virus]


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
--
[This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] Comparing Weight Configurations

[Don Schreiner]

Anyone want to compare/share some of their successful weighting
configurations? For the last few months we have been successful catching
1000's of confirmed SPAM daily with only a few (2-5) false
positives/day.  I changed SPAMCOP this morning from HOLD to WARN because
I am seeing an increase in false positives (about 20+/day over the past
week). Now I am concerned that by taking off the HOLD on SPAMCOP that we
are going to start seeing a significant increase of confirmed SPAM get
through. I hope to set-up the weighting better to try and make up the
difference.  I am thinking about also adding the sniffer filter and
currently studying the docs now. This is what we currently have set-up
below. Scott told me one time this is more of an Art than a Science.
Thanks to anyone that can help out!

Don
CompBiz, Inc.
www.compbiz.net


GLOBAL.CFG & Weights

ORBZIN  5
ORBZOUT 5
ORDB5
OSDUL   5
OSFORM  5
OSLIST  5
OSRELAY 5
OSSMART 5
OSSOFT  5
OSSRC   5
SPAMCOP 10
DSN 5
NOABUSE 5
NOPOSTMASTER5
BADHEADERS  8   
MAILFROM12
PERCENT 10
REVDNS  5
ROUTING 5
SPAMHEADERS 5

WEIGHT10weight  x   x   10  0
WEIGHT20weight  x   x   20  0


$default$.junkmail

ORBZIN  WARN
ORBZOUT WARN
ORDBHOLD
OSDUL   HOLD
OSFORM  WARN
OSLIST  WARN
OSRELAY WARN
OSSMART WARN
OSSOFT  HOLD
OSSRC   HOLD
SPAMCOP WARN
DSN WARN
NOABUSE WARN
NOPOSTMASTERWARN
BADHEADERS  WARN
MAILFROMHOLD
PERCENT HOLD
REVDNS  WARN
ROUTING WARN
SPAMHEADERS WARN
#SNIFFERWARN

WEIGHT10WARN
WEIGHT20HOLD

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] Spam did not get blocked after failing several tests?

[Don Schreiner]

I am trying to figure out why this SPAM (see below) and just this
morning several similar SPAM's got through our Declude JunkMail???
Failed every test in the book it seems. We have a weight of 10 to warn
and a weight of 20 to Hold. Below is the header from one of the SPAM's
which is representative of the others coming though, and our $JunkMail$
configuration below that. Anyone have an idea what is happening and why?
Thanks.

-Don
CompBiz, Inc.


Here is the e-mail...

Received: from SMTP32-FWD by CompBiz.net
  (SMTP32) id A0694; Fri,  1 Feb 2002 07:09:14 -0500
Received: from iisweb.iissys.com [12.47.76.58] by SNEEZY.XEROCOM.NET
with ESMTP
  (SMTPD32-6.00) id A3B3625000A6; Thu, 31 Jan 2002 19:39:15 -0500
Received: from aaddn.com ([4.4.48.73]) by iisweb.iissys.com with
Microsoft SMTPSVC(5.0.2195.2966);
 Thu, 31 Jan 2002 19:38:41 -0500
Message-Id: <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Priority: 3 (Normal)
MIME-Version: 1.0
X-Encoding: MIME
Content-Type: multipart/alternative;
boundary="=_NextPart_22458882"
Importance: Normal
Reply-To: [EMAIL PROTECTED]
Date: Thu, 31 Jan 2002 19:33:25 -0500
X-MSMail-Priority: Normal
Subject: Email Marketing
From: [EMAIL PROTECTED]
Return-Path: [EMAIL PROTECTED]
X-OriginalArrivalTime: 01 Feb 2002 00:38:43.0396 (UTC)
FILETIME=[CD0CD840:01C1AAB8]
X-RBL-Warning: Open relay. Please see http://orbz.org/?12.47.76.58
X-RBL-Warning: Open relay.  Please see http://orbz.org/?12.47.76.58
X-RBL-Warning: Weight of 25 exceeds the limit of 10.
X-Declude-Sender: [EMAIL PROTECTED] [12.47.76.58]
X-Declude-Spoolname: De3b30a6.SMD
X-Note: CompBiz.Net scanned e-mail for spam with Declude JunkMail.
X-Note: Failed Tests: ORBZIN, ORBZOUT, ORDB, SPAMCOP, WEIGHT10, WEIGHT20
X-Sender: Mail From: [EMAIL PROTECTED]
X-Note: This E-mail was sent from 58.76.47.12.in-addr.arpa.
([12.47.76.58]).
X-UIDL: 307438799
Status: U

Here are our settings...

ORBZIN  WARN
ORBZOUT WARN
ORDBHOLD
OSDUL   HOLD
OSFORM  WARN
OSLIST  WARN
OSRELAY WARN
OSSMART WARN
OSSOFT  HOLD
OSSRC   HOLD
SPAMCOP HOLD
DSN WARN
NOABUSE WARN
NOPOSTMASTERWARN
BADHEADERS  WARN
MAILFROMHOLD
PERCENT HOLD
REVDNS  WARN
ROUTING WARN
SPAMHEADERS WARN
#SNIFFERWARN
WEIGHT10WARN
WEIGHT20HOLD

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Spam Review and Kill File

[Don Schreiner]

Tom,


I would want 2 separate button options.


1. Button to the delete & Kill list.
2. Button to the Delete folder only.


Not 100% for sure but a warning in the documentation about having the
%MAILFROM% variable in your header as Scott was stating in a previous
post. Does this address the issue of identifying the "real" from address
that we would want to add to the Kill list? 


I like the idea of the Kill list vs. Declude Blacklist if it saves on
the CPU.  However, I would want to be more certain it was a "real" from
address and not a bogus one.  Like the earlier post... most of those
from addresses are bogus.


-Don 


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Tom Schwarz
Sent: Wednesday, January 30, 2002 7:15 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Spam Review and Kill File


Let's talk about the IMail "kill.lst" file for just a minute.


Some of you suggested that you wanted to add "from" email addresses to
the
"kill.lst" file from SpamReview.  I like this idea and am working on it.


My question is...


How do you want it to work?


Do you want a button to do it?


Do you want an option in Settings for adding it whenever you click on
"Move
To Deleted"?


Other?


Tom


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]


---


This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
--
[This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Spam Review Question

[Don Schreiner]

I second this requested feature about adding to the Kill List.  Great
Idea!

Also, I like the idea of sending to Spam Cop vs. the sender because will
surely have a lot of bounces.

Also, I think this is great you wrote the app and will not mind sending
a donation to you.  Keep up the great job.  Love the app so far.

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath
Sent: Wednesday, January 30, 2002 10:47 AM
To: Tom Schwarz
Subject: Re: [Declude.JunkMail] Spam Review Question

Reply to: Tom Schwarz
  Re: [Declude.JunkMail] Spam Review Question on Wednesday 9:38:23
AM

Actually, the next most useful feature for me would
be to take the real sender and add-to-kill.lst function.
Then if you consistently see an abuser, you just add his
address to Imails kill file... This also ultimately reduces
server load as well, as mail is simply rejected rather than
processed...

This line gives me the 'real' sender and I'd love to kill.lst
some of these if they are clearly doing only spamming...:

XINHEADER   X-Note: SMTP Real-From: %MAILFROM%

I do not see an immediate need to notify senders of bad mail.

--
Roger Heath

- Copy of Original Message(s): -

T> On some of the email I review I would like to click a button and send
an
T> email back to the sender, based on a template, letting them know that
they
T> have a problem.  It could include all the warnings.  Is this a
feature that
T> others would use if it was available?

T> Tom

T> ---
T> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

T> ---

T> This E-mail came from the Declude.JunkMail mailing list.  To
T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
T> type "unsubscribe Declude.JunkMail".  You can E-mail
T> [EMAIL PROTECTED] for assistance.  You can visit our web
T> site at http://www.declude.com .
T> --
T> ActivatorMail(tm) ver.012602 Scanned for all viruses by 
T> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.012602 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
--
[This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Spamreview Update v1.0.4

[Don Schreiner]

Is Spam Review updated since last night when I downloaded??

-Don

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Tom Schwarz
Sent: Wednesday, January 30, 2002 9:18 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Spamreview Update v1.0.4

Hold on just a minute.  I forgot to do something.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Tom Schwarz
Sent: Wednesday, January 30, 2002 7:58 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Spamreview Update v1.0.4


Several New features and fixes.

If you have previously installed all you need is the exe.

http://www.slsoft.com/spamreview.htm

(We are getting rain and ice so if you cannot get to the site the power
lines may be down.)

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
--
[This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .