[Declude.JunkMail] automated response

[Frederick Samarelli]

I am on vacation until Monday Aug 17th. I will be monitoring my emails.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] automated response

[Frederick Samarelli]

I will be out of the office until July 24th. I will be checking emails. If it 
is urgent please contact sh...@tcbinc.com or ted...@tcbinc.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] automated response

[Frederick Samarelli]

 will be out of email contact for most of the day.

If you need immediate attention contact [EMAIL PROTECTED] or [EMAIL PROTECTED]

Fred


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] From: <>

[Frederick Samarelli]

Is there a filer to block these.

From: <>

Fred




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Licensing problem after upgrade

[Frederick Samarelli]

The declude.exe is old (2005). Is this 
ok.
 
What file is used and for what. Declude.cfg and 
Global.cfg

  - Original Message - 
  From: 
  John T (Lists) 
  To: declude.junkmail@declude.com 
  
  Sent: Wednesday, October 11, 2006 1:23 
  AM
  Subject: RE: [Declude.JunkMail] Licensing 
  problem after upgrade
  
  
  The delivery app is 
  still declude.exe.
   
  Create a new text 
  file in you imail\declude director and call it declude.cfg.
   
  Add a line “CODE 
  -x-xx-xx-” replacing the xxx-xx with your 
  code.
   
  
  John 
  T
  eServices For 
  You
   
  "Seek, and ye shall 
  find!"
   
  
  -Original 
  Message-From: [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of 
  Frederick SamarelliSent: Tuesday, October 10, 
  2006 9:22 
  PMTo: 
  declude.junkmail@declude.comSubject: Re: [Declude.JunkMail] Licensing 
  problem after upgrade
   
  
   do not have a declude.cfg. 
  
   
  
  What should be in it and where 
  should it go.
  
   
  
  Do i just rename my global.cfg
  
   
  
  What about this.
  
   
  
  Also the IMAIL Delivery 
  Application is still set to Declude.exe is this 
  correct.
  
   
  
  Should it change to the 
  Decludeprocess.exe
  
   
  

- Original Message - 


From: Jeff Frantz 


To: declude.junkmail@declude.com 


Sent: 
Tuesday, October 10, 
2006 11:52 
PM

Subject: RE: 
[Declude.JunkMail] Licensing problem after upgrade

 
Fred,
 
Your license code 
should go in the declude.cfg file.
 
-Jeff
 




From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of 
Frederick SamarelliSent: Tuesday, October 
10, 2006 10:59 
PMTo: declude.junkmail@declude.comSubject: [Declude.JunkMail] Licensing 
problem after upgrade
 

I just upgraded from 3.x to the 
current version. Nothing will run.

 

All I see in the diags.txt is 
FATAL ERROR: Product license key not in configuration INVALID 
KEY

 

Where do I put the update 
Key?

 

 

 

Thanks.

 

Fred
---This E-mail came from the 
Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to 
[EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The 
archives can be foundat http://www.mail-archive.com. ---This 
E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just 
send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe 
Declude.JunkMail". The archives can be foundat 
http://www.mail-archive.com. 
  ---This E-mail came from 
  the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to 
  [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives 
  can be foundat http://www.mail-archive.com. ---This E-mail came 
  from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail 
  to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The 
  archives can be foundat http://www.mail-archive.com. 


---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.

Re: [Declude.JunkMail] Licensing problem after upgrade

[Frederick Samarelli]

 do not have a declude.cfg.
 
What should be in it and where should it 
go.
 
Do i just rename my global.cfg
 
What about this.
 
Also the IMAIL Delivery 
Application is still set to Declude.exe is this correct.
 
Should it change to the 
Decludeprocess.exe
 

  - Original Message - 
  From: 
  Jeff Frantz 
  To: declude.junkmail@declude.com 
  
  Sent: Tuesday, October 10, 2006 11:52 
  PM
  Subject: RE: [Declude.JunkMail] Licensing 
  problem after upgrade
  
  
  Fred,
   
  Your license code 
  should go in the declude.cfg file.
   
  -Jeff
   
  
  
  
  
  From: [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of 
  Frederick SamarelliSent: Tuesday, October 10, 2006 10:59 
  PMTo: declude.junkmail@declude.comSubject: [Declude.JunkMail] Licensing 
  problem after upgrade
   
  
  I just upgraded from 3.x to the 
  current version. Nothing will run.
  
   
  
  All I see in the diags.txt is 
  FATAL ERROR: Product license key not in configuration INVALID 
  KEY
  
   
  
  Where do I put the update 
  Key?
  
   
  
   
  
   
  
  Thanks.
  
   
  
  Fred---This 
  E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just 
  send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe 
  Declude.JunkMail". The archives can be foundat 
  http://www.mail-archive.com. ---This E-mail came from the 
  Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to 
  [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives 
  can be foundat http://www.mail-archive.com. 

---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.

[Declude.JunkMail] Licensing problem after upgrade

[Frederick Samarelli]

I just upgraded from 3.x to the current version. 
Nothing will run.
 
All I see in the diags.txt is FATAL ERROR: Product license key not in configuration 
INVALID KEY
 
Where do I put the update Key?
 
Also the IMAIL Delivery Application is still set to 
Declude.exe is this correct.
 
Thanks.
 
Fred

---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.

[Declude.JunkMail] automated response

[Frederick Samarelli]

I will be on Vacation until Tuesday 22 August. I will be checking my email 
frequently. If it is an emergency please contact [EMAIL PROTECTED] or [EMAIL 
PROTECTED]


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] automated response

[Frederick Samarelli]

I am out of town this week. Please contact Shawn [EMAIL PROTECTED] or Teddie 
[EMAIL PROTECTED] with any problems or questions.

I will be checking email often.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Looking for someone to provide services ColdFusion/SQL

[Frederick Samarelli]

Services Need.I need some one to help manage a web site for us. It 
is a ColdFusion and MS SQL 2000 System. It is a large custom site and they 
now what to make changes.Please contact off 
list.Thanks.Fred[EMAIL PROTECTED]

Re: [Declude.JunkMail] Bouncing emails

[Frederick Samarelli]

Title: Message



Is there not a way to set Exchange to accept them 
then trash.

  - Original Message - 
  From: 
  Dave Doherty 
  
  To: Declude.JunkMail@declude.com 
  
  Sent: Monday, February 27, 2006 12:44 
  PM
  Subject: Re: [Declude.JunkMail] Bouncing 
  emails
  
  You wouldn't. The gateway is not that 
  smart.
   
  We gave up on attempting to deliver 
  misspelled emails when we were the subject of a distributed 
  dictionary attack. No more than ten messages from any IP address, so nothing 
  could catch it. We got half a million messages a day for months. The Symantec 
  gateway software was useless in that situation. 
   
  Even setting the bounce period to one 
  day still had the gateway trying to send half a million bounces.
   
  -d
  
- Original Message - 
From: 
Kevin Bilbee 
To: Declude.JunkMail@declude.com 

Sent: Monday, February 27, 2006 12:41 
PM
Subject: RE: [Declude.JunkMail] 
Bouncing emails

In 
his setup Symantec would not see the message as a 
bounce.
 
Anyway how would you determine a bounce form a dictionary attack as 
opposed to someone who just typed the email address 
incorrectly.
 
 
Kevin Bilbee

  
  -Original Message-From: [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of Dave 
  DohertySent: Monday, February 27, 2006 9:12 AMTo: 
  Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] 
  Bouncing emails
  That is exactly why I stopped using 
  Symantec as a gateway. I tried to get them to add a "don't send bounces" 
  checkbox or at least a registry entry. but they refused, saying the 
  Internet RFC's made NDRs mandatory.
   
  -d
  
- Original Message - 
    From: 
    Frederick 
Samarelli 
To: Declude.JunkMail@declude.com 

Sent: Monday, February 27, 2006 
11:50 AM
Subject: [Declude.JunkMail] 
Bouncing emails

I am running a filter system listed 
below:
 
1. Front End. Symantec SMTP Gateway. (Scan 
Virus and a bit of spam and extensions). Removed 80% of my 
problems.
2. IMAIL 8.x and Declude 2.x scan and 
forward service.
3. Last Stop. MS Exchange
 
The problem is when we get a dictionary 
attack the exchange server sends a bounce. 550 user 
unknown.
 
The 550's works there way back through 
the system and now the SMTP Gateway server attempts to deliver the 
bounce for a day.
 
Anyone know a way of preventing the 
bounce.
 
Thanks.
 
Fred
 

[Declude.JunkMail] Bouncing emails

[Frederick Samarelli]

I am running a filter system listed 
below:
 
1. Front End. Symantec SMTP Gateway. (Scan Virus 
and a bit of spam and extensions). Removed 80% of my problems.
2. IMAIL 8.x and Declude 2.x scan and forward 
service.
3. Last Stop. MS Exchange
 
The problem is when we get a dictionary attack the 
exchange server sends a bounce. 550 user unknown.
 
The 550's works there way back through the 
system and now the SMTP Gateway server attempts to deliver the bounce for a 
day.
 
Anyone know a way of preventing the 
bounce.
 
Thanks.
 
Fred
 

[Declude.JunkMail] Looking for someone to provide services.

[Frederick Samarelli]

Services Need.

1. I need some one to help manage a web site for us. It is a ColdFusion and 
MS SQL 2000 System.


2. To Develop a few websites so end-users can customize using Microsoft 
FrontPage.


Please contact off list.

Thanks.

Fred
[EMAIL PROTECTED]






---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Spamcop catching Gmail

[Frederick Samarelli]

I noticed that Spamcop is catching email from GMAIL.COM

Is there another real-time black list to use that is as good Spamcop was.

Fred


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] AOL Now blocking Port 25

[Frederick Samarelli]

Has anyone else been told AOL is now enfosing this policy and how do we get 
around it.


a.. 554 IPT:OA
http://postmaster.info.aol.com/errors/554iptoa.html
EXPLANATION:

The message you received is generated from AOL when sending mail through a 
third party program and connecting through the default port 25.


America Online Inc. will no longer accept outgoing connections on port 25 
through third party mail programs.


SOLUTION:

If you are trying to access your America Online e-mail please visit Keyword: 
Open Mail Access


Send third party e-mail through port 587. This port requires you to 
authenticate and may require a change to your email client settings. Note, 
the server you are connecting to must support this configuration. If you are 
trying to get your AOL e-mail visit Keyword Open Mail Access, all others 
contact your server administrator for further support on this configuration.


For more information visit the port 25 FAQ.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] OT Imail Logs filter

[Frederick Samarelli]

I need a log filter program that will tell me what address sent and received 
emails and to whom.


Anyone have one.

Very Imported.

Thanks.

Fred


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] decludeproc did not install

[Frederick Samarelli]

It looks like Declude should have installed a Service called  decludeproc 
service.


It did not.

What next.

Fred 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Ver 3.0.5 What is the Proc Directory and why is all the mail going to it.

[Frederick Samarelli]

I just upgraded to the latest posted version of declude.

Now all my mail goes to a directory. \imail\spool\proc

Why.

Fred

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Something new with v 2.0.6

[Frederick Samarelli]

Title: Message



The Space was the issue. Added the "-" and all is 
well.

  - Original Message - 
  From: 
  Matt 
  To: Declude.JunkMail@declude.com 
  
  Sent: Wednesday, April 13, 2005 4:37 
  PM
  Subject: Re: [Declude.JunkMail] Something 
  new with v 2.0.6
  Fred,Those are all legit.  Andy has keen eyes and 
  I suspect that he may have identified the trigger, though it would be a bug in 
  Declude to behave in this way, but a minor one.The examples that you 
  gave all have no spaces prior to the first colon, and that is compliant.  
  The one that Andy gave was clearly not, and it is the one that is also causing 
  you problems.MattFrederick Samarelli wrote: 
  



Good Thought but I have these others without 
problem. Thanks.
 
XINHEADER   X-Note: Total spam weight 
of this E-mail is %WEIGHT%.XINHEADER   X-RBL-Warning: 
Total weight: %WEIGHT%XINHEADER  X-Note: This E-mail was 
scanned & filtered by TCB [%VERSION%] for SPAM & 
virus.XINHEADER  X-Note: Sent from: 
%MAILFROM%XINHEADER  X-Note: Sent from Reverse DNS:  
%REVDNS% ([%REMOTEIP%])XINHEADER  X-Note: Recipient(s):  
%REALRECIPS%- Original Message - 

  From: 
  Andy Schmidt 
  To: 
  Declude.JunkMail@declude.com 
  
  Sent: 
  Wednesday, April 13, 2005 4:02 PM
  Subject: 
  RE: [Declude.JunkMail] Something new with v 2.0.6
  
  Hi Frederick:
   
  I don't know if this has been asked/suggested already and I don't 
  have time to go back to the RFCs to see if embedded spaces are permitted 
  in the header name. But have you ever tried eliminating that 
  space:
   
  
  XINHEADER  X-Spam-Tests-Failed 
  Weight: %TESTSFAILEDWITHWEIGHTS%
   
      replace with:
   
  
  XINHEADER  X-Spam-Tests-Failed-Weight: 
  %TESTSFAILEDWITHWEIGHTS%
   
  May be the problem is that there is a CR/LF followed by a line that 
  contains no header name (due to the embedded space) following by 
  another CR/LF.  May be those two CR/LF without valid header 
  information inbetween are interpreted as "start of message body" by some 
  entities?
  Best RegardsAndy SchmidtPhone:  +1 201 934-3414 x20 
  (Business)Fax:    +1 201 934-9206 
  
-Original Message-From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED]] 
On Behalf Of Frederick SamarelliSent: Wednesday, April 
13, 2005 03:42 PMTo: Declude.JunkMail@declude.comSubject: 
Re: [Declude.JunkMail] Something new with v 2.0.6
Mike/Matt (thanks for your help) 
You should be able to duplicated by just forwarding an email to an 
outside account using the problem line at the 
bottom.
 
As not to confuse things I 
simplified the process.
 
Send an email from [EMAIL PROTECTED] =>>> [EMAIL PROTECTED] (forwarded to) 
=>>> [EMAIL PROTECTED]
 
This run through only one server on 
my network.
 
 
Header from My AOL 
account.
Return-Path: <[EMAIL PROTECTED]>Received: 
from  rly-xm04.mx.aol.com (rly-xm04.mail.aol.com [172.20.83.105]) 
by air-xm03.mail.aol.com (v105.26) with ESMTP id 
MAILINXM31-606425d743d132; Wed, 13 Apr 2005 15:34:25 -0400Received: 
from  bks.tcbinc.com (bks.tcbinc.com [64.124.117.196]) by 
rly-xm04.mx.aol.com (v105.26) with ESMTP id 
MAILRELAYINXM42-606425d743d132; Wed, 13 Apr 2005 15:34:21 
-0400Received: from SMTP32-FWD by bks.tcbinc.com  (SMTP32) 
id A741100040470EC67; Wed, 13 Apr 2005 15:33:42 Received: from 
web51806.mail.yahoo.com [206.190.38.237] by bks.tcbinc.com  
(SMTPD32-8.15) id A41140470; Wed, 13 Apr 2005 15:33:37 
-0400Received: (qmail 50369 invoked by uid 60001); 13 Apr 2005 
19:34:12 -Comment: DomainKeys? See http://antispam.yahoo.com/domainkeysDomainKey-Signature: 
a=rsa-sha1; q=dns; c=nofws;  s=s1024; d=yahoo.com;  
b=M12dWrk8x99pS4FhLTVJbfbgIc60YrjkjS/Vi2yiCoare5X2fk5F+zDzAA2XuOKAyAuKoj3EEGBHc6gPlwybZ/TMSShXoJtIypUpKUZZrm7SoU0rx30hedmPe9IecDArBynamRJFf8HjmCsGFKGIwJhKUjwV4wNnw1wLdarF7SE=  
;Message-ID: <[EMAIL PROTECTED]>Received: 
from [64.124.117.139] by web51806.mail.yahoo.com via HTTP; Wed, 13 Apr 
2005 12:34:12 PDTDate: Wed, 13 Apr 2005 12:34:12 -0700 
(PDT)From: Frederick Samarelli <[EMAIL PROTECTED]>Subject: 
test10To: [EMAIL PROTECTED]MIME-Version: 
1.0Content-Type: text/plain; charset=us-asciiX-RBL-Warning: 
SNIFFERZERO: Message failed SNIFFERZERO: 0.X-Declude-Sender: [EMAIL PROTECTED] 
[206.190.38.237]X-Declude-Spoolname: 
D741100040470EC67.SMDX-Note: Total spam weight of this E-mail is 
0.X-RBL-Warning: Total weight: 0X

Re: [Declude.JunkMail] Something new with v 2.0.6

[Frederick Samarelli]

Title: Message



Good Thought but I have these others without 
problem. Thanks.
 
XINHEADER   X-Note: Total spam weight of 
this E-mail is %WEIGHT%.XINHEADER   X-RBL-Warning: Total 
weight: %WEIGHT%XINHEADER  X-Note: This E-mail was scanned & 
filtered by TCB [%VERSION%] for SPAM & 
virus.XINHEADER  X-Note: Sent from: 
%MAILFROM%XINHEADER  X-Note: Sent from Reverse DNS:  %REVDNS% 
([%REMOTEIP%])XINHEADER  X-Note: Recipient(s):  
%REALRECIPS%- Original Message - 

  From: 
  Andy Schmidt 
  To: Declude.JunkMail@declude.com 
  
  Sent: Wednesday, April 13, 2005 4:02 
  PM
  Subject: RE: [Declude.JunkMail] Something 
  new with v 2.0.6
  
  Hi 
  Frederick:
   
  I 
  don't know if this has been asked/suggested already and I don't have time to 
  go back to the RFCs to see if embedded spaces are permitted in the header 
  name. But have you ever tried eliminating that space:
   
  
  XINHEADER  X-Spam-Tests-Failed Weight: 
  %TESTSFAILEDWITHWEIGHTS%
   
      replace with:
   
  
  XINHEADER  X-Spam-Tests-Failed-Weight: 
  %TESTSFAILEDWITHWEIGHTS%
   
  May 
  be the problem is that there is a CR/LF followed by a line that contains no 
  header name (due to the embedded space) following by another CR/LF.  
  May be those two CR/LF without valid header information inbetween are 
  interpreted as "start of message body" by some 
  entities?
  Best 
  RegardsAndy SchmidtPhone:  +1 201 934-3414 x20 
  (Business)Fax:    +1 201 934-9206 
  

-Original Message-From: 
[EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Frederick 
SamarelliSent: Wednesday, April 13, 2005 03:42 PMTo: 
Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] 
Something new with v 2.0.6
Mike/Matt (thanks for your help) You 
should be able to duplicated by just forwarding an email to an outside 
account using the problem line at the bottom.
 
As not to confuse things I simplified 
the process.
 
Send an email from [EMAIL PROTECTED] =>>> [EMAIL PROTECTED] (forwarded to) 
=>>> [EMAIL PROTECTED]
 
This run through only one server on my 
network.
 
 
Header from My AOL 
account.
Return-Path: <[EMAIL PROTECTED]>Received: 
from  rly-xm04.mx.aol.com (rly-xm04.mail.aol.com [172.20.83.105]) by 
air-xm03.mail.aol.com (v105.26) with ESMTP id MAILINXM31-606425d743d132; 
Wed, 13 Apr 2005 15:34:25 -0400Received: from  bks.tcbinc.com 
(bks.tcbinc.com [64.124.117.196]) by rly-xm04.mx.aol.com (v105.26) with 
ESMTP id MAILRELAYINXM42-606425d743d132; Wed, 13 Apr 2005 15:34:21 
-0400Received: from SMTP32-FWD by bks.tcbinc.com  (SMTP32) id 
A741100040470EC67; Wed, 13 Apr 2005 15:33:42 Received: from 
web51806.mail.yahoo.com [206.190.38.237] by bks.tcbinc.com  
(SMTPD32-8.15) id A41140470; Wed, 13 Apr 2005 15:33:37 -0400Received: 
(qmail 50369 invoked by uid 60001); 13 Apr 2005 19:34:12 -Comment: 
DomainKeys? See http://antispam.yahoo.com/domainkeysDomainKey-Signature: 
a=rsa-sha1; q=dns; c=nofws;  s=s1024; d=yahoo.com;  
b=M12dWrk8x99pS4FhLTVJbfbgIc60YrjkjS/Vi2yiCoare5X2fk5F+zDzAA2XuOKAyAuKoj3EEGBHc6gPlwybZ/TMSShXoJtIypUpKUZZrm7SoU0rx30hedmPe9IecDArBynamRJFf8HjmCsGFKGIwJhKUjwV4wNnw1wLdarF7SE=  
;Message-ID: <[EMAIL PROTECTED]>Received: 
from [64.124.117.139] by web51806.mail.yahoo.com via HTTP; Wed, 13 Apr 2005 
12:34:12 PDTDate: Wed, 13 Apr 2005 12:34:12 -0700 (PDT)From: 
Frederick Samarelli <[EMAIL PROTECTED]>Subject: 
test10To: [EMAIL PROTECTED]MIME-Version: 
1.0Content-Type: text/plain; charset=us-asciiX-RBL-Warning: 
SNIFFERZERO: Message failed SNIFFERZERO: 0.X-Declude-Sender: [EMAIL PROTECTED] 
[206.190.38.237]X-Declude-Spoolname: D741100040470EC67.SMDX-Note: 
Total spam weight of this E-mail is 0.X-RBL-Warning: Total weight: 
0X-Note: This E-mail was scanned & filtered by TCB [2.0.6] for SPAM 
& virus.X-Spam-Tests-Failed: SNIFFERZERO
Message Body (should only be the word test10)
X-Spam-Tests-Failed Weight: SNIFFERZERO 
[0]X-Spam-Time:15:33:42X-Weight: 0X-Mailfrom: 
samarelli.yahoo.comX-Note: Sent from: [EMAIL PROTECTED]X-Note: 
Sent from Reverse DNS:  web51806.mail.yahoo.com 
([206.190.38.237])X-Hello: web51806.mail.yahoo.comX-Note: 
Recipient(s):  [EMAIL PROTECTED]X-Country-Chain: UNITED 
STATES->destinationX-AOL-IP: 
64.124.117.196X-AOL-SCOLL-SCORE:0:0:0:X-AOL-SCOLL-URL_COUNT:0test10
 
Culprit:
XINHEADER  X-Spam-Tests-Failed 
Weight: 
%TESTSFAILEDWITHWEIGHTS%

Re: [Declude.JunkMail] Something new with v 2.0.6

[Frederick Samarelli]

Mike/Matt (thanks for your help) You should 
be able to duplicated by just forwarding an email to an outside account using 
the problem line at the bottom.
 
As not to confuse things I simplified the 
process.
 
Send an email from [EMAIL PROTECTED] =>>> [EMAIL PROTECTED] (forwarded to) =>>> 
[EMAIL PROTECTED]
 
This run through only one server on my 
network.
 
 
Header from My AOL 
account.
Return-Path: <[EMAIL PROTECTED]>Received: 
from  rly-xm04.mx.aol.com (rly-xm04.mail.aol.com [172.20.83.105]) by 
air-xm03.mail.aol.com (v105.26) with ESMTP id MAILINXM31-606425d743d132; Wed, 13 
Apr 2005 15:34:25 -0400Received: from  bks.tcbinc.com (bks.tcbinc.com 
[64.124.117.196]) by rly-xm04.mx.aol.com (v105.26) with ESMTP id 
MAILRELAYINXM42-606425d743d132; Wed, 13 Apr 2005 15:34:21 -0400Received: 
from SMTP32-FWD by bks.tcbinc.com  (SMTP32) id A741100040470EC67; Wed, 
13 Apr 2005 15:33:42 Received: from web51806.mail.yahoo.com [206.190.38.237] 
by bks.tcbinc.com  (SMTPD32-8.15) id A41140470; Wed, 13 Apr 2005 
15:33:37 -0400Received: (qmail 50369 invoked by uid 60001); 13 Apr 2005 
19:34:12 -Comment: DomainKeys? See http://antispam.yahoo.com/domainkeysDomainKey-Signature: 
a=rsa-sha1; q=dns; c=nofws;  s=s1024; d=yahoo.com;  
b=M12dWrk8x99pS4FhLTVJbfbgIc60YrjkjS/Vi2yiCoare5X2fk5F+zDzAA2XuOKAyAuKoj3EEGBHc6gPlwybZ/TMSShXoJtIypUpKUZZrm7SoU0rx30hedmPe9IecDArBynamRJFf8HjmCsGFKGIwJhKUjwV4wNnw1wLdarF7SE=  
;Message-ID: <[EMAIL PROTECTED]>Received: 
from [64.124.117.139] by web51806.mail.yahoo.com via HTTP; Wed, 13 Apr 2005 
12:34:12 PDTDate: Wed, 13 Apr 2005 12:34:12 -0700 (PDT)From: Frederick 
Samarelli <[EMAIL PROTECTED]>Subject: 
test10To: [EMAIL PROTECTED]MIME-Version: 
1.0Content-Type: text/plain; charset=us-asciiX-RBL-Warning: SNIFFERZERO: 
Message failed SNIFFERZERO: 0.X-Declude-Sender: [EMAIL PROTECTED] 
[206.190.38.237]X-Declude-Spoolname: D741100040470EC67.SMDX-Note: Total 
spam weight of this E-mail is 0.X-RBL-Warning: Total weight: 0X-Note: 
This E-mail was scanned & filtered by TCB [2.0.6] for SPAM & 
virus.X-Spam-Tests-Failed: SNIFFERZERO
Message Body (should only be the word test10)
X-Spam-Tests-Failed Weight: SNIFFERZERO 
[0]X-Spam-Time:15:33:42X-Weight: 0X-Mailfrom: 
samarelli.yahoo.comX-Note: Sent from: [EMAIL PROTECTED]X-Note: Sent 
from Reverse DNS:  web51806.mail.yahoo.com ([206.190.38.237])X-Hello: 
web51806.mail.yahoo.comX-Note: Recipient(s):  
[EMAIL PROTECTED]X-Country-Chain: UNITED 
STATES->destinationX-AOL-IP: 
64.124.117.196X-AOL-SCOLL-SCORE:0:0:0:X-AOL-SCOLL-URL_COUNT:0test10
 
Culprit:
XINHEADER  X-Spam-Tests-Failed Weight: 
%TESTSFAILEDWITHWEIGHTS%

Re: [Declude.JunkMail] Something new with v 2.0.6

[Frederick Samarelli]

e going to have to see the 
  Global.CFG to figure out if there's a misconfiguration.  I 
  certainly looks like your entire XINHEADER config is 
  duplicated.
  Darin.
   
   
      - 
  Original Message - 
  From: 
  Frederick 
  Samarelli 
  To: Declude.JunkMail@declude.com 
  
  Sent: Wednesday, April 13, 2005 10:34 AM
  Subject: [Declude.JunkMail] Something new with v 
  2.0.6
  
  HEADER
   
  Received: from dns2.tcbinc.net 
  [64.124.116.30] by bks.tcbinc.com  (SMTPD32-8.15) id 
  A5E13540470; Wed, 13 Apr 2005 03:10:25 -0400Received: from 
  mail.tcbinc.net ([64.124.116.40]) by dns2.tcbinc.net (SMSSMTP 
  4.1.0.19) with SMTP id M2005041303105928414 for <[EMAIL PROTECTED]>; Wed, 13 Apr 
  2005 03:10:59 -0400Received: from SMTP32-FWD by 
  mail.tcbinc.net  (SMTP32) id AC601002507EA4CF6; Wed, 13 Apr 
  2005 03:10:59 -0400Received: from ADS [64.124.116.10] by 
  mail.tcbinc.net  (SMTPD32-8.15) id A6012507EA; Wed, 13 Apr 
  2005 03:10:57 -0400SUBJECT: Virus FoundMessage-Id: <[EMAIL PROTECTED]>X-RBL-Warning: 
  SNIFFERZERO: Message failed SNIFFERZERO: 0.X-RBL-Warning: 
  CMDSPACE: Space found in RCPT TO: command.X-RBL-Warning: SPFPASS: 
  SPF returned PASS for this E-mail.X-RBL-Warning: BADHEADERS: This 
  E-mail was sent from a broken mail client 
  [8c20].X-RBL-Warning: WEIGHT10: Total weight between 10 and 
  14.X-Declude-Sender: [EMAIL PROTECTED] 
  [64.124.116.10]X-Declude-Spoolname: 
  DC601002507EA4CF6.SMDX-RBL-Warning: SNIFFERZERO: Message failed 
  SNIFFERZERO: 0.X-RBL-Warning: SPFPASS: SPF returned PASS for this 
  E-mail.X-RBL-Warning: BADHEADERS: This E-mail was sent from a 
  broken mail client [8c20].X-RBL-Warning: HELOBOGUS: Domain ADS 
  has no MX or A records [0301].X-Declude-Sender: [EMAIL PROTECTED] 
  [64.124.116.10]X-Declude-Spoolname: 
  DC5E1035404704CAF.SMDX-Note: Total spam weight of this E-mail is 
  3.X-RBL-Warning: Total weight: 3X-Note: This E-mail was 
  scanned & filtered by TCB [2.0.6] for SPAM & 
  virus.X-Spam-Tests-Failed: SNIFFERZERO, SPFPASS, BADHEADERS, 
  HELOBOGUSX-Spam-Tests-Failed Weight: SNIFFERZERO [0], SPFPASS [0], 
  BADHEADERS [2], HELOBOGUS [1]X-Spam-Time:03:10:29X-Weight: 
  3X-Mailfrom: fred.tcbinc.netX-Note: Sent from: [EMAIL PROTECTED]X-Note: Sent from 
  Reverse DNS:  ads.tcbinc.net ([64.124.116.10])X-Hello: 
  ADSX-Note: Recipient(s):  [EMAIL PROTECTED]X-Country-Chain: 
  UNITED STATES->destinationFrom: [EMAIL PROTECTED]Date: Wed, 13 Apr 
  2005 03:10:29 -0400X-RCPT-TO: <[EMAIL PROTECTED]>Status: 
  UX-UIDL: 411698213
   
  BODY:
  X-Spam-Tests-Failed Weight: SNIFFERZERO 
  [0], CMDSPACE [8], SPFPASS [0], BADHEADERS [2], WEIGHT10 
  [10]X-Spam-Time:03:10:59X-Note: Total spam weight of this 
  E-mail is 10X-Note: This E-mail was scanned & filtered by 
  Declude [2.0.6] for SPAM & virusX-Spam-Tests-Failed: 
  SNIFFERZERO, CMDSPACE, SPFPASS, BADHEADERS, WEIGHT10X-Weight: 
  10X-Mailfrom: fred.tcbinc.netX-Note: Sent from: [EMAIL PROTECTED]X-Note: Sent from 
  Reverse DNS:  ads.tcbinc.net ([64.124.116.10])X-Hello: 
  ADSX-Note: Recipient(s):  [EMAIL PROTECTED]X-Country-Chain: 
  UNITED STATES->destinationDate: Wed, 13 Apr 2005 03:10:59 
  -0400
   
  Virus:[EMAIL PROTECTED]Alert: Virus 
  FoundComputer: DNS2Date: 04/13/2005Time: 03:10:54 
  AMSeverity: CriticalSource: Norton AntiVirus Corporate 
  Edition-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.JunkMail] Something new with v 2.0.6

[Frederick Samarelli]

Found the problem.
 
It was this line.
 
#XINHEADER  X-Spam-Tests-Failed Weight: 
%TESTSFAILEDWITHWEIGHTS%
 
I removed it and problem went away.
 
Any thoughts.
 

Re: [Declude.JunkMail] Something new with v 2.0.6

[Frederick Samarelli]

This is not the case.
 
I sent a test from my Yahoo account to my imail 
account.
 
If I look at it in Imail it is ok.
 
If I do the test again having a forward in on my 
imail account to an AOL account the header info get placed in the top of the 
BODY when I received it at my AOL account.
 
 
See below from the TEXT of the BODY.
 
X-Spam-Tests-Failed Weight: SNIFFERZERO 
[0]X-Spam-Time:12:53:55X-Note: Total spam weight of this E-mail is 
0X-Note: This E-mail was scanned & filtered by Declude [2.0.6] for SPAM 
& virusX-Spam-Tests-Failed: SNIFFERZEROX-Weight: 0X-Mailfrom: 
samarelli.yahoo.comX-Note: Sent from: [EMAIL PROTECTED]X-Note: Sent 
from Reverse DNS:  web51803.mail.yahoo.com ([206.190.38.234])X-Hello: 
web51803.mail.yahoo.comX-Note: Recipient(s):  
[EMAIL PROTECTED]X-Country-Chain: UNITED 
STATES->destinationX-AOL-IP: 
64.124.116.40X-AOL-SCOLL-SCORE:0:0:0:X-AOL-SCOLL-URL_COUNT:0

  - Original Message - 
  From: 
  Matt 
  To: Declude.JunkMail@declude.com 
  
  Sent: Wednesday, April 13, 2005 11:49 
  AM
  Subject: Re: [Declude.JunkMail] Something 
  new with v 2.0.6
  Fred,It looks like two full sets of Declude's 
  XINHEADER's, and something caused a double line break in it.  I am also 
  having a problem understanding the path that this E-mail took, and maybe that 
  will give you some clues.  There is something forwarding the message and 
  that might partially explain why it has two sets of headers, but the double 
  line break shouldn't appear there.Maybe you could explain the path 
  that this took:  64.124.116.10 (IMail) -> 
  SMTP32-FWD (Probably also IMail) -> 
  64.124.116.40 (SMSSMTP, Symantec???) -> 64.124.116.30 (IMail again).I am going to guess 
  that it is possible that Declude is getting confused based on the body being 
  in a format similar to a header where there is a word followed by a colon, and 
  in the process, it might be inserting the headers in the wrong location when 
  it is adding them the second time.  Total guess there of course.  I 
  suspect that the path is causing some form of double-processing, possibly the 
  Symantec SMSSMTP piece, and that if you could resolve that, the problem might 
  go away.  Also note that the headers show a 30 second difference between 
  the headers, so it's going somewhere.So to summarize, it looks like 
  it's being double-processed due to some mechanism involving SMSSMTP, and 
  Declude is maybe parsing the message incorrectly for where to insert the 
  second set of headers, and if you could get it to only process it once (remove 
  forwarding/looping possible issue), the symptom might go away.  If so, 
  Declude might also want to look at the parsing code for where to insert the 
  headers and account for the condition in future releases as I'm sure that 
  isn't intentional.MattFrederick Samarelli wrote: 
  



See attached config.
 
The problem only started after the update from 
2.0.5 to 2.0.6

  - 
  Original Message - 
  From: 
  Darin Cox 

  To: 
  Declude.JunkMail@declude.com 
  
  Sent: 
  Wednesday, April 13, 2005 10:39 AM
  Subject: 
  Re: [Declude.JunkMail] Something new with v 2.0.6
  
  I think we're going to have to see the 
  Global.CFG to figure out if there's a misconfiguration.  I certainly 
  looks like your entire XINHEADER config is duplicated.
  Darin.
   
   
  - 
  Original Message - 
  From: 
  Frederick 
  Samarelli 
  To: Declude.JunkMail@declude.com 
  
  Sent: Wednesday, April 13, 2005 10:34 AM
  Subject: [Declude.JunkMail] Something new with v 
  2.0.6
  
  HEADER
   
  Received: from dns2.tcbinc.net 
  [64.124.116.30] by bks.tcbinc.com  (SMTPD32-8.15) id A5E13540470; 
  Wed, 13 Apr 2005 03:10:25 -0400Received: from mail.tcbinc.net 
  ([64.124.116.40]) by dns2.tcbinc.net (SMSSMTP 4.1.0.19) with SMTP 
  id M2005041303105928414 for <[EMAIL PROTECTED]>; Wed, 13 Apr 2005 
  03:10:59 -0400Received: from SMTP32-FWD by mail.tcbinc.net  
  (SMTP32) id AC601002507EA4CF6; Wed, 13 Apr 2005 03:10:59 
  -0400Received: from ADS [64.124.116.10] by mail.tcbinc.net  
  (SMTPD32-8.15) id A6012507EA; Wed, 13 Apr 2005 03:10:57 -0400SUBJECT: 
  Virus FoundMessage-Id: <[EMAIL PROTECTED]>X-RBL-Warning: 
  SNIFFERZERO: Message failed SNIFFERZERO: 0.X-RBL-Warning: CMDSPACE: 
  Space found in RCPT TO: command.X-RBL-Warning: SPFPASS: SPF returned 
  PASS for this E-mail.X-RBL-Warning: BADHEADERS: This E-mail was sent 
  from a broken mail client [8c20].X-RBL-Warning: WEIGHT10: Total 
  weight between 10 and 14.X-Declude-Sender: [EMAIL PROTECTED] 
  [64.124.116.10]X-Declude-Spoolname: 
  DC601002507EA4CF6.SMDX-RBL-Warning: SNIFFERZERO: Message failed 
  SNIFFERZERO: 0.X-RBL-Warning: SPFPASS: SPF re

Re: [Declude.JunkMail] Something new with v 2.0.6

[Frederick Samarelli]

See attached config.
 
The problem only started after the update from 
2.0.5 to 2.0.6

  - Original Message - 
  From: 
  Darin Cox 
  To: Declude.JunkMail@declude.com 
  
  Sent: Wednesday, April 13, 2005 10:39 
  AM
  Subject: Re: [Declude.JunkMail] Something 
  new with v 2.0.6
  
  I think we're going to have to see the Global.CFG 
  to figure out if there's a misconfiguration.  I certainly looks like your 
  entire XINHEADER config is duplicated.
  Darin.
   
   
  - Original Message - 
  From: Frederick Samarelli 
  
  To: Declude.JunkMail@declude.com 
  
  Sent: Wednesday, April 13, 2005 10:34 AM
  Subject: [Declude.JunkMail] Something new with v 2.0.6
  
  HEADER
   
  Received: from dns2.tcbinc.net [64.124.116.30] by 
  bks.tcbinc.com  (SMTPD32-8.15) id A5E13540470; Wed, 13 Apr 2005 
  03:10:25 -0400Received: from mail.tcbinc.net ([64.124.116.40]) by 
  dns2.tcbinc.net (SMSSMTP 4.1.0.19) with SMTP id 
  M2005041303105928414 for <[EMAIL PROTECTED]>; Wed, 13 Apr 2005 
  03:10:59 -0400Received: from SMTP32-FWD by mail.tcbinc.net  
  (SMTP32) id AC601002507EA4CF6; Wed, 13 Apr 2005 03:10:59 -0400Received: 
  from ADS [64.124.116.10] by mail.tcbinc.net  (SMTPD32-8.15) id 
  A6012507EA; Wed, 13 Apr 2005 03:10:57 -0400SUBJECT: Virus 
  FoundMessage-Id: <[EMAIL PROTECTED]>X-RBL-Warning: 
  SNIFFERZERO: Message failed SNIFFERZERO: 0.X-RBL-Warning: CMDSPACE: Space 
  found in RCPT TO: command.X-RBL-Warning: SPFPASS: SPF returned PASS for 
  this E-mail.X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken 
  mail client [8c20].X-RBL-Warning: WEIGHT10: Total weight between 10 
  and 14.X-Declude-Sender: [EMAIL PROTECTED] 
  [64.124.116.10]X-Declude-Spoolname: 
  DC601002507EA4CF6.SMDX-RBL-Warning: SNIFFERZERO: Message failed 
  SNIFFERZERO: 0.X-RBL-Warning: SPFPASS: SPF returned PASS for this 
  E-mail.X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail 
  client [8c20].X-RBL-Warning: HELOBOGUS: Domain ADS has no MX or A 
  records [0301].X-Declude-Sender: [EMAIL PROTECTED] 
  [64.124.116.10]X-Declude-Spoolname: DC5E1035404704CAF.SMDX-Note: Total 
  spam weight of this E-mail is 3.X-RBL-Warning: Total weight: 3X-Note: 
  This E-mail was scanned & filtered by TCB [2.0.6] for SPAM & 
  virus.X-Spam-Tests-Failed: SNIFFERZERO, SPFPASS, BADHEADERS, 
  HELOBOGUSX-Spam-Tests-Failed Weight: SNIFFERZERO [0], SPFPASS [0], 
  BADHEADERS [2], HELOBOGUS [1]X-Spam-Time:03:10:29X-Weight: 
  3X-Mailfrom: fred.tcbinc.netX-Note: Sent from: [EMAIL PROTECTED]X-Note: Sent from Reverse 
  DNS:  ads.tcbinc.net ([64.124.116.10])X-Hello: ADSX-Note: 
  Recipient(s):  [EMAIL PROTECTED]X-Country-Chain: 
  UNITED STATES->destinationFrom: [EMAIL PROTECTED]Date: Wed, 13 Apr 2005 
  03:10:29 -0400X-RCPT-TO: <[EMAIL PROTECTED]>Status: UX-UIDL: 
  411698213
   
  BODY:
  X-Spam-Tests-Failed Weight: SNIFFERZERO [0], 
  CMDSPACE [8], SPFPASS [0], BADHEADERS [2], WEIGHT10 
  [10]X-Spam-Time:03:10:59X-Note: Total spam weight of this E-mail is 
  10X-Note: This E-mail was scanned & filtered by Declude [2.0.6] for 
  SPAM & virusX-Spam-Tests-Failed: SNIFFERZERO, CMDSPACE, SPFPASS, 
  BADHEADERS, WEIGHT10X-Weight: 10X-Mailfrom: fred.tcbinc.netX-Note: 
  Sent from: [EMAIL PROTECTED]X-Note: 
  Sent from Reverse DNS:  ads.tcbinc.net ([64.124.116.10])X-Hello: 
  ADSX-Note: Recipient(s):  [EMAIL PROTECTED]X-Country-Chain: 
  UNITED STATES->destinationDate: Wed, 13 Apr 2005 03:10:59 
  -0400
   
  Virus:[EMAIL PROTECTED]Alert: Virus 
  FoundComputer: DNS2Date: 04/13/2005Time: 03:10:54 AMSeverity: 
  CriticalSource: Norton AntiVirus Corporate 
Edition


GLOBAL.CFG
Description: Binary data

[Declude.JunkMail] Something new with v 2.0.6

[Frederick Samarelli]

HEADER
 
Received: from dns2.tcbinc.net [64.124.116.30] by 
bks.tcbinc.com  (SMTPD32-8.15) id A5E13540470; Wed, 13 Apr 2005 
03:10:25 -0400Received: from mail.tcbinc.net ([64.124.116.40]) by 
dns2.tcbinc.net (SMSSMTP 4.1.0.19) with SMTP id 
M2005041303105928414 for <[EMAIL PROTECTED]>; Wed, 13 Apr 2005 03:10:59 
-0400Received: from SMTP32-FWD by mail.tcbinc.net  (SMTP32) id 
AC601002507EA4CF6; Wed, 13 Apr 2005 03:10:59 -0400Received: from ADS 
[64.124.116.10] by mail.tcbinc.net  (SMTPD32-8.15) id A6012507EA; Wed, 
13 Apr 2005 03:10:57 -0400SUBJECT: Virus FoundMessage-Id: <[EMAIL PROTECTED]>X-RBL-Warning: 
SNIFFERZERO: Message failed SNIFFERZERO: 0.X-RBL-Warning: CMDSPACE: Space 
found in RCPT TO: command.X-RBL-Warning: SPFPASS: SPF returned PASS for this 
E-mail.X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail 
client [8c20].X-RBL-Warning: WEIGHT10: Total weight between 10 and 
14.X-Declude-Sender: [EMAIL PROTECTED] 
[64.124.116.10]X-Declude-Spoolname: DC601002507EA4CF6.SMDX-RBL-Warning: 
SNIFFERZERO: Message failed SNIFFERZERO: 0.X-RBL-Warning: SPFPASS: SPF 
returned PASS for this E-mail.X-RBL-Warning: BADHEADERS: This E-mail was 
sent from a broken mail client [8c20].X-RBL-Warning: HELOBOGUS: Domain 
ADS has no MX or A records [0301].X-Declude-Sender: [EMAIL PROTECTED] 
[64.124.116.10]X-Declude-Spoolname: DC5E1035404704CAF.SMDX-Note: Total 
spam weight of this E-mail is 3.X-RBL-Warning: Total weight: 3X-Note: 
This E-mail was scanned & filtered by TCB [2.0.6] for SPAM & 
virus.X-Spam-Tests-Failed: SNIFFERZERO, SPFPASS, BADHEADERS, 
HELOBOGUSX-Spam-Tests-Failed Weight: SNIFFERZERO [0], SPFPASS [0], 
BADHEADERS [2], HELOBOGUS [1]X-Spam-Time:03:10:29X-Weight: 
3X-Mailfrom: fred.tcbinc.netX-Note: Sent from: [EMAIL PROTECTED]X-Note: Sent from Reverse 
DNS:  ads.tcbinc.net ([64.124.116.10])X-Hello: ADSX-Note: 
Recipient(s):  [EMAIL PROTECTED]X-Country-Chain: 
UNITED STATES->destinationFrom: [EMAIL PROTECTED]Date: Wed, 13 Apr 2005 
03:10:29 -0400X-RCPT-TO: <[EMAIL PROTECTED]>Status: UX-UIDL: 
411698213
 
BODY:
X-Spam-Tests-Failed Weight: SNIFFERZERO [0], 
CMDSPACE [8], SPFPASS [0], BADHEADERS [2], WEIGHT10 
[10]X-Spam-Time:03:10:59X-Note: Total spam weight of this E-mail is 
10X-Note: This E-mail was scanned & filtered by Declude [2.0.6] for SPAM 
& virusX-Spam-Tests-Failed: SNIFFERZERO, CMDSPACE, SPFPASS, BADHEADERS, 
WEIGHT10X-Weight: 10X-Mailfrom: fred.tcbinc.netX-Note: Sent from: [EMAIL PROTECTED]X-Note: Sent from Reverse 
DNS:  ads.tcbinc.net ([64.124.116.10])X-Hello: ADSX-Note: 
Recipient(s):  [EMAIL PROTECTED]X-Country-Chain: 
UNITED STATES->destinationDate: Wed, 13 Apr 2005 03:10:59 
-0400
 
Virus:[EMAIL PROTECTED]Alert: Virus 
FoundComputer: DNS2Date: 04/13/2005Time: 03:10:54 AMSeverity: 
CriticalSource: Norton AntiVirus Corporate 
Edition

Re: [Declude.JunkMail] Something new with v 2.0.6

[Frederick Samarelli]

Title: Message



They are all a problem.
 
They show up in the body of the email after it is 
forwarded.
 
If I pull the email directly from the server it is 
fine. Noting shows in the body.
 
If I have that email account setup to forward to 
another address the email shows with all these lines at the top of the body of 
the message.
 
The lines represent all my XINHEADER 
references.

  - Original Message - 
  From: 
  Andy Schmidt 
  To: Declude.JunkMail@declude.com 
  
  Sent: Wednesday, April 13, 2005 10:02 
  AM
  Subject: RE: [Declude.JunkMail] Something 
  new with v 2.0.6
  
  Hi 
  Frederick:
   
  May 
  be you should also post the relevant lines from the Globa.cfg so that one can 
  see what lines you requested to be inserted.
   
  Also, which of these lines specifically are 
  incorrect?
  Best 
  RegardsAndy SchmidtPhone:  +1 201 934-3414 x20 
  (Business)Fax:    +1 201 934-9206 
  

-Original Message-From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Frederick 
SamarelliSent: Wednesday, April 13, 2005 01:08 AMTo: 
Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Something 
new with v 2.0.6
Since I upgraded to v 
2.0.6 from 2.0.5 I am getting the below header info included in the body of 
emails that are being forwarded.
 
Any ideas.
 
X-Spam-Tests-Failed Weight: SNIFFERZERO [0], FILTER-MAILFROM 
[5]X-Spam-Time:00:00:12X-Note: Total spam weight of this E-mail is 
5X-Note: This E-mail was scanned & filtered by Declude [2.0.6] for 
SPAM & virusX-Spam-Tests-Failed: SNIFFERZERO, 
FILTER-MAILFROMX-Weight: 5X-Mailfrom: <>X-Note: Sent from: 
<>X-Note: Sent from Reverse DNS:  (Private IP) 
([127.0.0.1])X-Hello: X-Note: Recipient(s):  [EMAIL PROTECTED]X-Country-Chain: 

[Declude.JunkMail] Something new with v 2.0.6

[Frederick Samarelli]

Since I upgraded to v 2.0.6 
from 2.0.5 I am getting the below header info included in the body of emails 
that are being forwarded.
 
Any ideas.
 
X-Spam-Tests-Failed Weight: SNIFFERZERO [0], FILTER-MAILFROM 
[5]X-Spam-Time:00:00:12X-Note: Total spam weight of this E-mail is 
5X-Note: This E-mail was scanned & filtered by Declude [2.0.6] for SPAM 
& virusX-Spam-Tests-Failed: SNIFFERZERO, FILTER-MAILFROMX-Weight: 
5X-Mailfrom: <>X-Note: Sent from: <>X-Note: Sent from 
Reverse DNS:  (Private IP) ([127.0.0.1])X-Hello: X-Note: 
Recipient(s):  [EMAIL PROTECTED]X-Country-Chain: 

[Declude.JunkMail] bounce unwanted email - should be interesting....

[Frederick Samarelli]

Spamming spammers?Report: 
IBM to offer service to bounce unwanted e-mail back to the computers that sent 
them.March 22, 2005: 7:00 AM EST

 
NEW YORK (CNN/Money) - IBM is set to unveil a service Tuesday 
that will send unwanted e-mail back to the spammers who send them, according to 
a published report Tuesday.
 
http://money.cnn.com/2005/03/22/technology/ibm_spam/index.htm?cnn=yes
 
 

Re: [Declude.JunkMail] Off Topic.

[Frederick Samarelli]

That would be nice but since we have IMAIL on another server I am not sure 
that is possible.

Fred
PS. As always this is the best list around.
- Original Message - 
From: "Dan Geiser" <[EMAIL PROTECTED]>
To: 
Sent: Friday, March 18, 2005 12:13 PM
Subject: Re: [Declude.JunkMail] Off Topic.


Fred,
Are you looking for a Control Panel which allows customers to manage both
web sites and e-mail sites?
Dan
- Original Message - 
From: "Frederick Samarelli" <[EMAIL PROTECTED]>
To: 
Sent: Friday, March 18, 2005 11:24 AM
Subject: [Declude.JunkMail] Off Topic.


I am looking for recommendations of software that allows users to manage
there own web domain. We host websites for many people and we are looking
to
give them more control. Some sort of Portal/Control Panel. We are a
windows
shop.
Thanks.
Fred Samarelli
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan)


---
E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan)
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Off Topic.

[Frederick Samarelli]

I am looking for recommendations of software that allows users to manage 
there own web domain. We host websites for many people and we are looking to 
give them more control. Some sort of Portal/Control Panel. We are a windows 
shop.

Thanks.
Fred Samarelli
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Yahoo Problem

[Frederick Samarelli]

Has anyone seen a problem with Yahoo Email?
It looks like email from our network is not getting to Yahoo accounts.
Our IP's fail SPAMBAG and SPEWS (this is because they list our IP provider). 
They are clean on all other tests.

Anyone know how to contact Yahoo or have seen this problem?
Fred 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Subject problem

[Frederick Samarelli]

Scott. Any response to this.
Fred
It shows this way in Spam Review and the Subject Line test also catches 
this.

It was fixed in the 2.03b but after I installed the production 2.0 released 
by Barry it is now broken again.

Fred
- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: 
Sent: Thursday, February 03, 2005 2:04 PM
Subject: Re: [Declude.JunkMail] Subject problem



I am running the latest version (newly released 2.0) and the subject is 
showing =?iso-8859?
The subject shouldn't appear that way in the E-mail itself.  For Declude 
JunkMail usage, it may appear that way with the "Subject starting with a 
colon" issue, which has been fixed in the latest 2.0.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in 
mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Subject problem

[Frederick Samarelli]

I shows this way in Spam Review and the Subject Line test also catches this.
It was fixed in the 2.03b but after I installed the production 2.0 released 
by Barry it is now broken again.

Fred
- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: 
Sent: Thursday, February 03, 2005 2:04 PM
Subject: Re: [Declude.JunkMail] Subject problem



I am running the latest version (newly released 2.0) and the subject is 
showing =?iso-8859?
The subject shouldn't appear that way in the E-mail itself.  For Declude 
JunkMail usage, it may appear that way with the "Subject starting with a 
colon" issue, which has been fixed in the latest 2.0.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Subject problem

[Frederick Samarelli]

I am running the latest version (newly released 2.0) and the subject is 
showing =?iso-8859?

Fred 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] test.dat

[Frederick Samarelli]

I have noticed a file in the spool directory "test.dat"
It gets updated frequently.
I am running 2.0.3b
Any thoughts

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] URI Blacklist External Program Beta Now Posted For Download

[Frederick Samarelli]

Since I only implemented it last evening on our 
test server we are looking at about 500 emails.

  - Original Message - 
  From: 
  Markus Gufler 
  
  To: Declude.JunkMail@declude.com 
  
  Sent: Tuesday, December 28, 2004 10:14 
  AM
  Subject: RE: [Declude.JunkMail] URI 
  Blacklist External Program Beta Now Posted For Download
  
  based on 10, 100 or 1000 messages?
   
  Markus
  


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Frederick 
SamarelliSent: Tuesday, December 28, 2004 4:03 PMTo: 
Declude.JunkMail@declude.comSubject: 
Re: [Declude.JunkMail] URI Blacklist External Program Beta Now Posted For 
Download

It looks like it may be a redundant test to 
sniffer.
 
Everything INV-URIBL catches so does 
SNIFFER.
 
Fred

  - Original Message - 
  From: 
  Darrell 
  ([EMAIL PROTECTED]) 
  To: Declude.JunkMail@declude.com 
  
  Sent: Monday, December 27, 2004 10:32 
  PM
  Subject: [Declude.JunkMail] URI 
  Blacklist External Program Beta Now Posted For Download
  
  We have released a public beta of our 
  URI lookup tool at http://www.invariantsystems.com/invuribl/default.htm.  In 
  addition, we have posted some stats on how effective the tool is on 
  our system at http://www.invariantsystems.com/invuribl/stats.htm.
   
  For a more detailed description on the tool 
  please see the below message or send me a note with any 
  questions.
  Darrell
  
- Original Message - 
From: 
Darrell 
([EMAIL PROTECTED]) 
To: Declude.JunkMail@declude.com 

Sent: Wednesday, December 22, 2004 
11:13 PM
Subject: URI Blacklist External 
Program

We have wrote an external application that 
extracts URI's from a message and checks them against a URI 
Blacklist. For those not familar 
with URI blacklists here is how the folks at surbl.org describe 
it.
 
"Surbl blacklists differ from most other RBLs in that 
they're used to detect spam based on message body URIs (usually web 
sites). Unlike most other RBLs, SURBLs are not used to block spam 
senders. Instead they allow you to block messages that have 
spam domains which occur in message bodies. "
 
We have been running this application in 
production for the last week against multi.surbl.org.  We have 
also tested the application against several of the other SURBL lists 
with the same level of sucess.
 
If you are interested in testing or running 
the software please join the following list [EMAIL PROTECTED].  
During the beta period this is where we will be communicating about the 
application.  For some of the applications basic features and 
implementation requirements please see http://www.invariantsystems.com/invuribl/default.htm.  
We expect to release a beta version within the next couple 
days.
 
If you would like any additional 
information prior to joining the list please let me know,
Darrell
 
---Check out 
http://www.invariantsystems.com for utilities for Declude And Imail.  IMail/Declude 
Overflow Queue Monitoring, MRTG Integration, and Log 
Parsers.

Re: [Declude.JunkMail] URI Blacklist External Program Beta Now Posted For Download

[Frederick Samarelli]

It looks like it may be a redundant test to 
sniffer.
 
Everything INV-URIBL catches so does 
SNIFFER.
 
Fred

  - Original Message - 
  From: 
  Darrell 
  ([EMAIL PROTECTED]) 
  To: Declude.JunkMail@declude.com 
  
  Sent: Monday, December 27, 2004 10:32 
  PM
  Subject: [Declude.JunkMail] URI Blacklist 
  External Program Beta Now Posted For Download
  
  We have released a public beta of our 
  URI lookup tool at http://www.invariantsystems.com/invuribl/default.htm.  In 
  addition, we have posted some stats on how effective the tool is on our 
  system at http://www.invariantsystems.com/invuribl/stats.htm.
   
  For a more detailed description on the tool 
  please see the below message or send me a note with any 
questions.
  Darrell
  
- Original Message - 
From: 
Darrell 
([EMAIL PROTECTED]) 
To: Declude.JunkMail@declude.com 

Sent: Wednesday, December 22, 2004 
11:13 PM
Subject: URI Blacklist External 
Program

We have wrote an external application that 
extracts URI's from a message and checks them against a URI 
Blacklist. For those not familar with 
URI blacklists here is how the folks at surbl.org describe it.
 
"Surbl blacklists differ from most other RBLs in that 
they're used to detect spam based on message body URIs (usually web sites). 
Unlike most other RBLs, SURBLs are not used to block spam 
senders. Instead they allow you to block messages that have 
spam domains which occur in message bodies. "
 
We have been running this application in 
production for the last week against multi.surbl.org.  We have 
also tested the application against several of the other SURBL lists with 
the same level of sucess.
 
If you are interested in testing or running the 
software please join the following list [EMAIL PROTECTED].  
During the beta period this is where we will be communicating about the 
application.  For some of the applications basic features and 
implementation requirements please see http://www.invariantsystems.com/invuribl/default.htm.  
We expect to release a beta version within the next couple 
days.
 
If you would like any additional information 
prior to joining the list please let me know,
Darrell
 
---Check out http://www.invariantsystems.com 
for utilities for Declude And Imail.  IMail/Declude Overflow Queue 
Monitoring, MRTG Integration, and Log 
Parsers.

Re: [Declude.JunkMail] Trouble with 2.0b installation...

[Frederick Samarelli]

I had the same problem.
All I did was stop mail delivery to the server, make sure no DELUDE.EXE 
processes we running and reinstall the 2.0b.

Worked fine.
- Original Message - 
From: "S.J.Stanaitis" <[EMAIL PROTECTED]>
To: 
Sent: Wednesday, December 22, 2004 10:45 AM
Subject: [Declude.JunkMail] Trouble with 2.0b installation...


Just ran through the 2.0b installation, get an error almost at completion 
"Unable to copy file to target directory."  After clicking OK a dozen or 
so times, it completes.  I then dropped to a DOS prompt and ran declude to 
confirm the version, and got this:

Declude v1.79 has already been installed; IMail will call it when 
necessary.
You can ignore any warnings that appear after this.

It backed up 1.80 and installed 1.79?  Also, the creation date on the file 
is 8/18/2004...

Ideas?
Thanks,
Sam
--
S.J.Stanaitis
Network Administrator, Decorative Product Source
http://www.dpsource.com/
[EMAIL PROTECTED]
(877)-650-8054 x160
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Fw: [Declude.JunkMail] Declude incorrectly detecting subject.

[Frederick Samarelli]

Any thought on this.
I upgraded to 2.0b and now get Failed to get temporary file name: 267 in the 
log file.

- Original Message - 
From: "Frederick Samarelli" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, December 21, 2004 5:55 PM
Subject: Re: [Declude.JunkMail] Declude incorrectly detecting subject.


I upgraded to 2.0b and now get Failed to get temporary file name: 267 in 
the log file.

- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, December 21, 2004 5:30 PM
Subject: Re: [Declude.JunkMail] Declude incorrectly detecting subject.



I am noticing some emails with this in the header. The problem is Declude 
is analyzing it as the subject when is should be using the one later in 
the email. See below. Any thoughts.
This is fixed in v2.0b.  :)
   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in 
mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.


This outgoing message is guaranteed to be authentic by Message Level 
users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Declude incorrectly detecting subject.

[Frederick Samarelli]

I upgraded to 2.0b and now get Failed to get temporary file name: 267 in the 
log file.

- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, December 21, 2004 5:30 PM
Subject: Re: [Declude.JunkMail] Declude incorrectly detecting subject.



I am noticing some emails with this in the header. The problem is Declude 
is analyzing it as the subject when is should be using the one later in 
the email. See below. Any thoughts.
This is fixed in v2.0b.  :)
   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.


This outgoing message is guaranteed to be authentic by Message Level 
users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Declude incorrectly detecting subject.

[Frederick Samarelli]

Where do I download the version.
- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, December 21, 2004 5:30 PM
Subject: Re: [Declude.JunkMail] Declude incorrectly detecting subject.



I am noticing some emails with this in the header. The problem is Declude 
is analyzing it as the subject when is should be using the one later in 
the email. See below. Any thoughts.
This is fixed in v2.0b.  :)
   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.


This outgoing message is guaranteed to be authentic by Message Level 
users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Declude incorrectly detecting subject.

[Frederick Samarelli]

I am noticing some emails with this in the header. The problem is Declude is 
analyzing it as the subject when is should be using the one later in the 
email. See below. Any thoughts.

"DomainKey-Signature: a=rsa-sha1; q=dns; c=simple;
 s=test1; d=earthlink.net;
 
h=Message-ID:From:To:References:Subject:Date:MIME-Version:Content-Type:Content-Transfer-Encoding:X-Priority:X-MSMail-Priority:X-Mailer:Disposition-Notification-To:X-MimeOLE;
 b=H9fY2Cru32tHwdaPFHrSFBzeyUyQqtUytw+BMgWWUP1/ysmDK1csSmzr9OiVFC3B;"
"Subject:Re: [infogurumarketing] Credit Card Processing" 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] IP listed in MTLDB

[Frederick Samarelli]

I have this line in my config.
MTLDB  ip4rmtldb.declude.com*   8   0
One of my IP numbers is failing this test.
How can I find out why.
Fred
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] DNS Servers on W2K box

[Frederick Samarelli]

I have seen the same problem. Just switched to Simple DNS.
- Original Message - 
From: "Bennie" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, October 03, 2004 10:08 AM
Subject: Re: [Declude.JunkMail] DNS Servers on W2K box


the problems we were having is that the dns server would quit doing 
lookups. All our mail would get returned.  I contacted IMail and we 
checked it out. They found it was the DNS lookups.  The only way around 
the problem was to reboot the DNS server about every 4-6 hours.  So I 
reloaded the DNS server but was not able to do look ups.  Kept getting 
Non-existent domain.  Finally I put a pointer in the reverse dns with the 
name of the DNS server and everything seems to be working now.  Not sure 
what was going on...

Bennie
- Original Message - 
From: "Darin Cox" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, October 03, 2004 9:53 AM
Subject: Re: [Declude.JunkMail] DNS Servers on W2K box


MS DNS works fine.  We've been using it for years with no problems.
What does the event log say?
Darin.
- Original Message - 
From: "Bennie" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, October 03, 2004 9:36 AM
Subject: [Declude.JunkMail] DNS Servers on W2K box

Hey Guys,
What is the best DNS server to run on a W2K box.  I was using the 
Microsoft
DNS server but have been running into some problems.  I reloaded it now 
it
will not do lookups.  My upstream provider will not let me point my Mail
server to their DNS servers because of the amount of lookup from Declude.
Any help would be apreciated.

Bennie
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]


---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Copy All Email

[Frederick Samarelli]

I have a server setup to store and forward (Imail and Declude).
One of my customers need to shut there in-house mail server down for a few 
days.

I plan on send there mail on to another server that will spool them until 
there server comes back on-line.

Question.
Can I copy all there mail when it is sent to the spool server and send it to 
one of my Imail servers so they can get there mail.

Thanks.
Fred
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] ColdFusion

[Frederick Samarelli]

Anyone familiar with Coldfusion that can answer a question.

Please email me off list.

Sorry to bother the remainder of the list.

Fred
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Experts Race to Fix Serious Internet Flaw

[Frederick Samarelli]

This is off topic but I think some of the smartest people on the net are on
this list.

Any thoughts.

http://www.washingtonpost.com/wp-dyn/articles/A27890-2004Apr20.html
Experts Race to Fix Serious Internet Flaw

By Brian Krebs
washingtonpost.com Staff Writer
Tuesday, April 20, 2004; 4:40 PM


Computer security experts in the United States and Britain today confirmed
that a new method has been identified that could make it easy for hackers to
disrupt Internet communications worldwide, prompting a months-long, quiet
effort to convince Internet service providers and other operators of the
global telecommunications system to upgrade their systems.

The U.S. Department of Homeland Security issued an alert Tuesday afternoon
warning that the vulnerability could be used to "affect a large segment of
the Internet community."

The exploit, identified by 36-year-old Milwaukee security researcher Paul
Watson, could give hackers the ability to crash Internet routers -- the
complex machines that direct most of the world's Web traffic.

The method that Watson identified takes advantage of an inherent design flaw
in transmission control protocol (TCP) -- the language that all computers
use to communicate on the Internet -- that could place ordinary computers at
greater risk of attack.

Watson, who is scheduled to present his findings at a security conference in
Canada later this week, could not be immediately reached for comment. A
notice on the conference's Web site and Watson's own site,
www.terrorist.net, indicates that he still plans to share the full details
of his research.

Specific details about the vulnerability were published for the first time
today by British security officials who said a successful attack using the
flaw could significantly disrupt online communications.

"The exploitation of this vulnerability could have affected the glue that
holds the Internet together," said Roger Cumming, director of the National
Infrastructure Security and Coordination Center in the United Kingdom.
"Fixing it is a small but significant step to aid the overall stability of
the Internet."

The NISCC and its peers in the United States, Canada and Australia have been
working with Cisco Systems Inc., Juniper Networks Inc., and all of the major
Internet router manufacturers to address the problem, NISCC officials said.

Rob Sturgeon, vice president of customer service for Juniper Networks, said
the company began working with the NISCC in December and released a patch
several weeks ago to protect its customers. Juniper is not aware of anyone
exploiting the flaw, he said.

A Cisco spokesman declined to comment on the situation. Spokespeople for two
major Internet backbone operators, AT&T and MCI's UUNet division, also
declined to comment.

Amit Yoran, director of the cybersecurity division for the U.S. Department
of Homeland Security, conceded the seriousness of the problem but said most
of the world's major Internet service providers had already taken steps to
prevent the attack.

"It's important to note that this is a significant discovery, but it's also
important to provide a fair degree of assurance that the sky is not
falling," Yoran said.

Security experts disagreed over how easily hackers could take advantage of
the vulnerability. The problem might be much worse, they said, if Watson
follows through on his plans to publish explicit instructions on how to
exploit the flaw in his research.

Security experts have known for years about the basic vulnerability that
Watson identified, which theoretically could allow attackers to shut down
Internet routers remotely by tricking them into resetting themselves. The
challenge has always been that attackers must successfully guess several
specific sets of information about the intended targets, a process that many
thought would take even powerful computers several years to complete.

According to Marcus Sachs, director of the SANS Internet Storm Center and a
former top White House security official, Watson appears to have discovered
a way to dramatically shorten the time it takes to guess that information to
just a few minutes.

But Michael Sutton, director of Reston, Va.-based security company iDefense
Labs, said such an attack still would be very difficult to execute, even
employing tools based on Watson's research.

"This guy has certainly lessened the difficulty, but it looks like this
would still be pretty tough to do," Sutton said. "What's he done is take
this from a theoretical problem to one that's practical but difficult."

Sachs said the concern generated by the vulnerability is reminiscent of what
happened two years ago in the wake of the discovery of a serious security
flaw in the ubiquitous "simple network management protocol," a low-level
communications language used by all machines that connect to the Internet.

At the time, the problem was thought to be so serious that the nation's top
computer security officials were called in to the White House to brief
President 

Re: [Declude.JunkMail] Spamreview

[Frederick Samarelli]

Has anyone responded to this.

It is a great program... I wish I had a VB program to do the work.

Fred
- Original Message - 
From: "Tom Schwarz" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Saturday, April 10, 2004 9:45 AM
Subject: [Declude.JunkMail] Spamreview


> Scott,
>
> We have switched email systems and will no longer be supporting
SpamReview.
> It is written in VB6.0.  You have any suggestions of someone that we can
> turn it over to?
>
> Have a Great Day, Tom
> --
> Where Online Shopping Is Fun
> http://www.shopping-headquarters.com
> --
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] weird random .htm attachments

[Frederick Samarelli]

So you use something like like.

BODY   10CONTAINS+ String.fromCharCode(


- Original Message - 
From: "Glenn Brooks" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, March 30, 2004 9:20 AM
Subject: Re: [Declude.JunkMail] weird random .htm attachments


> so you do a body filter?
>
> At 09:00 AM 3/30/2004 -0500, you wrote:
> >I filter on this "+ String.fromCharCode("
> >
> >This is common in all of them. Combined with other tests it catches most.
> >
> >Mike
> >
> >
> >
> >- Original Message -
> >From: "Glenn Brooks" <[EMAIL PROTECTED]>
> >To: <[EMAIL PROTECTED]>
> >Sent: Monday, March 29, 2004 20:02
> >Subject: RE: [Declude.JunkMail] weird random .htm attachments
> >
> >
> > > Has anyone set up a filter to catch thesewe get a lot of them...
> > >
> > > gb
> > >
> > >
> > > At 04:41 PM 3/29/2004 -0800, you wrote:
> > > >Yes, I have been seeing them too. They are java scripts that run.
> >Definitly
> > > >spam.
> > > >
> > > >John Tolmachoff
> > > >Engineer/Consultant/Owner
> > > >eServices For You
> > > >
> > > > > -Original Message-
> > > > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> > > > > [EMAIL PROTECTED] On Behalf Of Kevin
> > > > > Sent: Monday, March 29, 2004 4:37 PM
> > > > > To: [EMAIL PROTECTED]
> > > > > Subject: [Declude.JunkMail] weird random .htm attachments
> > > > >
> > > > > Hi,
> > > > >
> > > > > Tried searching mail-archive.com for these but didn't turn up
> >anything.
> > > > >
> > > > > Subject: pass on the fun [random subjects]
> > > > > Body: This message has attach [random too]
> > > > > [random attachments but always ends in .htm]
> > > > >
> > > > > I didn't open it with IE but with a text editor.
> > > > >
> > > > > Starts with contractions = new
> >Array(162,
> > > > > [whole bunch of numbers]
> > > > >
> > > > > ends with
> > > > >
> > > > > charters = 907;
> > > > > beetle = 243;
> > > > > var equal = "";
> > > > > for(bowl = 0; bowl < charters; bowl++)
> > > > >equal = equal + String.fromCharCode(contractions[bowl] ^
> > > > > preferential[bowl % beetle]);
> > > > > document.write(equal);
> > > > > 
> > > > >
> > > > > Sniffer catches these under rule 62 (Experimental) but it's not
enough
> >to
> > > > > hold these.
> > > > >
> > > > > Any ideas? What does one see when they view this under IE?
> > > > >
> > > > >
> > > > > ---
> > > > > [This E-mail was scanned for viruses by Declude Virus
> > > >(http://www.declude.com)]
> > > > >
> > > > > ---
> > > > > This E-mail came from the Declude.JunkMail mailing list.  To
> > > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > > > type "unsubscribe Declude.JunkMail".  The archives can be found
> > > > > at http://www.mail-archive.com.
> > > >
> > > >---
> > > >[This E-mail was scanned for viruses by Declude Virus
> > > >(http://www.declude.com)]
> > > >
> > > >---
> > > >This E-mail came from the Declude.JunkMail mailing list.  To
> > > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > >type "unsubscribe Declude.JunkMail".  The archives can be found
> > > >at http://www.mail-archive.com.
> > >
> > > Glenn Brooks
> > > WebWize, Inc.
> > > 713-688-4382
> > > http://www.webwize.com
> > >
> > >
> > > ---
> > > [This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list.  To
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > type "unsubscribe Declude.JunkMail".  The archives can be found
> > > at http://www.mail-archive.com.
> > >
> > >
> >
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list.  To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >type "unsubscribe Declude.JunkMail".  The archives can be found
> >at http://www.mail-archive.com.
>
> Glenn Brooks
> WebWize, Inc.
> 713-688-4382
> http://www.webwize.com
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Raid Controller

[Frederick Samarelli]

Nicely written.

I use the LSI Logic Megaraid (Formally AMI) Elite SCSI Boards.

I configure it as a Raid1 set for the C: and another Raid1 set for the D:

This allows me to temporarily Fail a drive when I am performing
update/upgrade.

If the update/upgrade goes bad I have complete snapshot of the drives prior
to the work.

Backup and running in minutes.

Just my thoughts.

- Original Message - 
From: "Keith Anderson" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, March 25, 2004 10:07 AM
Subject: RE: [Declude.JunkMail] Raid Controller



My SCSI RAID10 rack has a dedicated "channel" (if you are referring to
the physical cable connecting the drive to the adapter card) for each
drive in the rack.  They don't share cables in high-end systems, either,
especially with SCSI/640.  Long before you run into bottlenecks at the
drive cables, you will run into a bottleneck at the interface between
your adapter card and the motherboard.  The only advantage to multiple
channels comes from a very efficient write-back cache right on the RAID
card.

Tom is comparing drives that you can buy at a place like CompUSA, isn't
he?  Budget ATA vs. budget SCSI (The Cheetah).  Aside from the hot-swap
advantage and a bit more throughput, SCSI just wasn't meant for the
CompUSA market.  It was intended and best suited for high-end
applications.  SCSI is also quickly being replaced by fiber channel in
the very high-end systems, because fiber channel handles 2Gig
throughput.  You don't pay a dollar-per-gigabyte to get 2 gigs of
throughput.  And YES, the drives are much different.  These drives are
much bigger, much faster, many more platters and heads, and very
reliable, and VERY expensive.  They go through weeks of intensive
testing before they are released for use.

If you look at the Seagate models in the low-end consumer market and
compare ATA and SCSI in the same lines, you'll find that the hardware
behind the PCB is identical.  I won't disagree that they overprice the
SCSI version of that drive, but there really is a lot more "smarts" in a
SCSI drive than ATA.  A SCSI device isn't just hard drives, but entire
arrays can be interfaced with SCSI, and other device types like
scanners, printers, etc. are supported.  The main advantage to SCSI is
that all SCSI devices must be able to function completely independent of
any other device.  For example, the SCSI command structure allows you to
copy data directly from one drive to another without data going through
the adapter.  A SCSI device can be disconnected and reconnected at will
from its host, and as long as the host wasn't in need of something at
that moment, nothing is interrupted.  Error handling is just as complex,
with the drive itself able to mark bad sectors and relocate data to
spare sectors, all without causing any transaction delays.

In contrast, ATA is watered down to be simple, cheap and mass
reproducable.  Very dependent on a host to tell it what to do at any
given moment, and if you disconnect it, it's lost from the system until
reboot (and possibly damaged).  When errors occur on an ATA drive, it
has very little smarts to handle it.  A failing ATA will drag a system
to its knees.

Yes, SCSI is an old standard, but many standards are just as old and
they are still the best choice today.  Look at Ethernet!



> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Matt
> Sent: Wednesday, March 24, 2004 11:07 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] Raid Controller
>
> That's the company that I was told about before.  I think you
> might be selling serial ATA short though.
>
> First, these cards have a separate bus for each drive, so a 4
> port serial ATA RAID card can handle much more than any
> single drive can push.  No issue there.
>
> Secondly, I've been reading reviews for over a year now on
> Tom's hardware that show IDE drives out performing 15K
> Cheetahs.  This wasn't always the case but it appears that
> there has been a lot of effort in the IDE realm and very
> little in the SCSI realm.  The SCSI protocol is at least a
> decade old as well and I see no reason why you should just
> simply keep doubling the bus with that technology when you
> can pump more data over a simple firewire or USB cable (along
> with power).
>
> The real question though is how well are these drives made in
> comparison to the SCSI ones.  SCSI is of course just the
> interface and has no effect on the reliability of the drive.
> It used to be that they just simply engineered the SCSI
> drives better, but I don't know that this is entirely the
> case now, or at least if there enough of a difference for it
> to really matter.  The current SATA drives are generally
> suggested to be better than IDE, but I wouldn't expect for
> one to be as reliable as a drive that costs 4 times as much
> if not more.  The incremental boost to reliability may also
> be moot depending on the application.  I plan on having two
>

Re: [Declude.JunkMail] Raid Controller

[Frederick Samarelli]

LSI Megaraid is great.

- Original Message - 
From: "Kevin Bilbee" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, March 24, 2004 8:34 PM
Subject: [Declude.JunkMail] Raid Controller


> Reccomendations
>
> I have the oppertunity to add some spindles to our mail server and want to
> know what people are using and reccomend I have been looking at LSI and my
> boss wants me to look at Adaptec.
>
>
> Kevin Bilbee
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: Re: [Declude.JunkMail] BlackIce

[Frederick Samarelli]

Have one.
PIX.

Problem is we had port 4000 open thought is was harmless.



- Original Message - 
From: "Todd Hunter" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, March 22, 2004 5:13 AM
Subject: OT: Re: [Declude.JunkMail] BlackIce


> If you have 16 servers then you need to invest in a real firewall.  You
can
> get a good hardware firewall for $900 - $3000.
>
> Look at:
>
> www.sonicwall.com
> www.servgate.com
>
> The ServGate Edgeforce is a nice unit and can be upgraded to do virus
> scanning.   The also won PC Mag Editors choice award this month.
>
> Good luck.
>
> Todd
>
>
> At 10:43 AM 3/22/2004 -0500, you wrote:
> >We lost 16 Servers.
> >
> >
> >- Original Message -
> >From: "Jason" <[EMAIL PROTECTED]>
> >To: <[EMAIL PROTECTED]>
> >Sent: Sunday, March 21, 2004 9:50 PM
> >Subject: RE: [Declude.JunkMail] BlackIce
> >
> >
> >We had a single Colo'd server fall ill to this vulnerability on Friday
> >night.  It wasn't a pretty sight to say the least.
> >
> >Jason
> >
> >
> >-Original Message-
> >From: [EMAIL PROTECTED]
> >[mailto:[EMAIL PROTECTED] On Behalf Of Mike Wiegers
> >Sent: Sunday, March 21, 2004 6:51 PM
> >To: [EMAIL PROTECTED]
> >Subject: RE: [Declude.JunkMail] BlackIce
> >
> >
> >Thanks for the heads up on this. Unless you have updated your BlackICE
> >in the last week you are at risk.
> >
> >http://xforce.iss.net/xforce/alerts/id/166
> >
> >http://www.eeye.com/html/Research/Advisories/AD20040318.html
> >
> >
> >-Original Message-
> >From: [EMAIL PROTECTED]
> >[mailto:[EMAIL PROTECTED] On Behalf Of Frederick
> >Samarelli
> >Sent: Sunday, March 21, 2004 5:17 PM
> >To: [EMAIL PROTECTED]
> >Subject: [Declude.JunkMail] BlackIce
> >
> >Warning for anyone using BlackIce.
> >
> >We were hit by a destructive worm.
> >http://www.washingtonpost.com/wp-dyn/articles/A11310-2004Mar20.html
> >
> >Destroyed most of our servers.
> >
> >We are in the process of recovering from backups.
> >
> >Fred
> >---
> >[This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list.  To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> >"unsubscribe Declude.JunkMail".  The archives can be found at
> >http://www.mail-archive.com.
> >
> >
> >[AUTOMATED NOTE: Your mail server [209.184.248.29] is missing a reverse
> >DNS entry. All Internet hosts are required to have a reverse DNS entry.
> >The missing reverse DNS entry will cause your mail to be treated as spam
> >on some servers, such as AOL.]
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list.  To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> >"unsubscribe Declude.JunkMail".  The archives can be found at
> >http://www.mail-archive.com.
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list.  To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >type "unsubscribe Declude.JunkMail".  The archives can be found
> >at http://www.mail-archive.com.
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list.  To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >type "unsubscribe Declude.JunkMail".  The archives can be found
> >at http://www.mail-archive.com.
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] BlackIce

[Frederick Samarelli]

We lost 16 Servers.


- Original Message - 
From: "Jason" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, March 21, 2004 9:50 PM
Subject: RE: [Declude.JunkMail] BlackIce


We had a single Colo'd server fall ill to this vulnerability on Friday
night.  It wasn't a pretty sight to say the least.

Jason


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Mike Wiegers
Sent: Sunday, March 21, 2004 6:51 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] BlackIce


Thanks for the heads up on this. Unless you have updated your BlackICE
in the last week you are at risk.

http://xforce.iss.net/xforce/alerts/id/166

http://www.eeye.com/html/Research/Advisories/AD20040318.html


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Frederick
Samarelli
Sent: Sunday, March 21, 2004 5:17 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] BlackIce

Warning for anyone using BlackIce.

We were hit by a destructive worm.
http://www.washingtonpost.com/wp-dyn/articles/A11310-2004Mar20.html

Destroyed most of our servers.

We are in the process of recovering from backups.

Fred
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.


[AUTOMATED NOTE: Your mail server [209.184.248.29] is missing a reverse
DNS entry. All Internet hosts are required to have a reverse DNS entry.
The missing reverse DNS entry will cause your mail to be treated as spam
on some servers, such as AOL.]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] BlackIce

[Frederick Samarelli]

Warning for anyone using BlackIce.

We were hit by a destructive worm.
http://www.washingtonpost.com/wp-dyn/articles/A11310-2004Mar20.html

Destroyed most of our servers.

We are in the process of recovering from backups.

Fred
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPFPASS (Junk)

[Frederick Samarelli]

This is the offending header.

Received: from mail13.americanfamilydeals.com ([69.56.11.46])
 by DNS2.tcbinc.net (SAVSMTP 3.1.3.37) with SMTP id M2004031909522726515
 for <[EMAIL PROTECTED]>; Fri, 19 Mar 2004 09:52:29 -0500
Message-ID:
<[EMAIL PROTECTED]>
Date: Fri, 19 Mar 2004 08:52:30 -0600 (CST)
From: "Point.com"
<[EMAIL PROTECTED]>
Reply-To: American Family Deals
<[EMAIL PROTECTED]>
To: Nancy Gladwell <[EMAIL PROTECTED]>
Subject: [~23]Cell Phone, Accessories & Shipping at NO Cost
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="=_Part_1277094_8887513.1079707950959"
X-nb: zspttavsabivfviftpfnfnnn maifvvbmwpmfifmpa pmfwstssn
X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail
detected. [2-3-1800]
X-RBL-Warning: SNIFFER: Message failed SNIFFER: 63. [2-6-3000]
X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. [2-17-8800]
X-RBL-Warning: MAILPOLICE-BULK: This E-mail came from
mxllvniqnx.americanfamilydeals.com, a potential spam source listed in
MAILPOLICE-BULK. [2-26-d000]
X-RBL-Warning: SBL-XBL:
"http://www.spamhaus.org/SBL/sbl.lasso?query=SBL9613"; [2-33-10800]
X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 426, weight 3)
[2-57-1c800]
X-Declude-Sender: [EMAIL PROTECTED]
[69.56.11.46]
X-Declude-Spoolname: D09300e8a005e2c5b.SMD
X-RBL-Warning: Total weight: 23
X-Note: Sent from: [EMAIL PROTECTED]
X-Note: Sent from Reverse DNS:  mail13.americanfamilydeals.com
([69.56.11.46]).
X-Note: This E-mail was scanned by TCB [1.78i21] for virus.

--=_Part_1277094_8887513.1079707950959
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

This message contains an HTML formatted message but your email client does =
not support the display of HTML. Please view this message in a different ma=
il client or forward this email to a web-based mail system.

--=_Part_1277094_8887513.1079707950959
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, March 19, 2004 11:46 AM
Subject: Re: [Declude.JunkMail] SPFPASS (Junk)


>
> >What do we do when we find Junkmail passing the SPF Test.
> >
> >Is there a place to report it.
>
> It should be treated the same way as regular spam that you would report,
> but there is a big exception here:  you can almost certainly find someone
> responsible that allowed the spam through.
>
> If you have the headers, feel free to post them here.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] SPFPASS (Junk)

[Frederick Samarelli]

What do we do when we find Junkmail passing the SPF Test.

Is there a place to report it.

Fred
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Port 25

[Frederick Samarelli]

Can IMAIL be configured to both port 25 and 
another.
 
If not can my Cisco Router be configured to do 
this.
 
Fred
 
 

  - Original Message - 
  From: 
  Dave Doherty 
  
  To: [EMAIL PROTECTED] 
  
  Sent: Wednesday, March 17, 2004 12:08 
  AM
  Subject: Re: [Declude.JunkMail] Comcast 
  Update
  
  Hi Matt-
   
  click... click... click...
   
  So here we go again. The old broken record. 
   
  If Comcast and RoadRunner blocked port 25, they 
  would be down many millions of messages per day.
   
  If you really feel the need to provide outbound mail service 
  for your clients, why not do it on a different port and instruct them to use 
  that port? It's exceedingly easy to do, even in Outlook Express.
   
  Not trying to pick an argument here, but ya gotta admit that 
  stopping millions of messages a day is worth a little effort.
   
  -Dave
   
   
   
  
- Original Message - 
From: 
Matt 

To: [EMAIL PROTECTED] 

Sent: Tuesday, March 16, 2004 11:08 
PM
Subject: Re: [Declude.JunkMail] Comcast 
Update
If my memory serves me right, there was a little more than 
14,000 mail hosts identified in SenderBase for comcast.net exactly one month 
ago.  Guess what...    http://www.senderbase.org/search?searchString=comcast.netI 
believe that says 26,217, over a 90% increase in the last 
month.That's not really all that fair because of the virus storm and 
propagation can set off SenderBase.  They still though have many, many 
customers recording rates suggestive of up to 1 million messages a 
day.Road Runner (rr.com) is actually up about 130% in the same 
period, but I think that just goes to show you that they were working harder 
to begin with and RR customers are just as foolish as Comcast customers are 
when it comes to executing viruses.MattColbeck, Andrew 
wrote:
So far, it's bull.  After 1 week, my logs show no reduction in junk traffic
from ComCast reverse DNS addresses.

Andrew 8)

-Original Message-
From: Matt [mailto:[EMAIL PROTECTED]] 
Sent: Wednesday, March 10, 2004 7:02 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Comcast Update


Bull dookie, sounds like lip-service to me :)

Matt



Dan Patnode wrote:

  
  Seems they're actually aware of the problem:

http://maccentral.macworld.com/news/2004/03/10/comcast/index.php?redirect=1
0
  
  78943859000

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
  
  ---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


 


  -- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

[Declude.JunkMail] BONDEDSENDER

[Frederick Samarelli]

Does anyone have any recent thoughts (Pros and Cons) toward BONDEDSENDER.

Fred
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Redhat

[Frederick Samarelli]

Is there anyone that can give me a quick hand with a few question about
Redat Linux

Off Line please

Fred


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Email Address Error

[Frederick Samarelli]

No that is not black listed.

Is the ".@" against any standard.

- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, March 03, 2004 8:20 PM
Subject: Re: [Declude.JunkMail] Email Address Error


>
> >Does anyone know why we would get this error from our exchange server
after
> >delude processed the email and forwarded it.
> >
> >"xxx" replaced the real email address.
> >
> >All I think of it has a ".@"
> >
> >03:03 03:59 SMTP-(04989AD1) >MAIL FROM:<[EMAIL PROTECTED]>
> >03:03 03:59 SMTP-(04989AD1) 501 Invalid Address
> >03:03 03:59 SMTP-(04989AD1) ERR undeliverable 501 Invalid Address
> >03:03 03:59 SMTP-(04989AD1) SMTP_DELIV_FAILED
>
> It is possible that the Exchange server has E-mail from @verizon.net
> blacklisted for some reason?
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Email Address Error

[Frederick Samarelli]

Does anyone know why we would get this error from our exchange server after
delude processed the email and forwarded it.

"xxx" replaced the real email address.

All I think of it has a ".@"

03:03 03:59 SMTP-(04989AD1) >MAIL FROM:<[EMAIL PROTECTED]>
03:03 03:59 SMTP-(04989AD1) 501 Invalid Address
03:03 03:59 SMTP-(04989AD1) ERR undeliverable 501 Invalid Address
03:03 03:59 SMTP-(04989AD1) SMTP_DELIV_FAILED


Fred

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] winmail.dat

[Frederick Samarelli]

Where do I put this in the virus.cfg OKCODE 5
- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, March 02, 2004 10:52 AM
Subject: Re: [Declude.JunkMail] winmail.dat


>
> >I am using F-Prot with Delude as a virus scanner.
> >I am getting the below and it is trapping all emails with the
"winmail.dat"
> >attachment (Outlook).
> >Any thoughts on how to fix.
>
> That's a bug with the latest version of F-Prot.  You can either ignore it
> (adding a line "OKCODE 5" to the \IMail\Declude\virus.cfg file will ensure
> that it gets delivered), or go back to the previous version of F-Prot that
> does not have that bug.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] winmail.dat

[Frederick Samarelli]

I am using F-Prot with Delude as a virus scanner.
I am getting the below and it is trapping all emails with the "winmail.dat"
attachment (Outlook).
Any thoughts on how to fix.

Fred

03/02/2004 10:33:46 Qa94f098502a29485 Error 5 in virus scanner 1.
03/02/2004 10:33:46 Qa94f098502a29485 Scanned: Error in virus scanner.
[MIME: 2 5091]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] DNS timeout and DNS configuration - does it get logged?

[Frederick Samarelli]

What is the syntax to tell Declude to use a DNS server in the Global.cfg

Fred
- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, February 26, 2004 6:24 PM
Subject: Re: [Declude.JunkMail] DNS timeout and DNS configuration - does it
get logged?


>
> >In diagnosing why some messages are slipping through, I manually analyzed
> >the headers using spamcop and noticed that spamcop reported a blacklist
> >that wasn't getting scored by declude.
> >
> >I'm assuming the problem is a DNS timeout when declude is trying to
> >perform the lookup test.
>
> Either that, or a dropped packet.  It's also possible that the IP was
added
> after Declude JunkMail performed the lookup, but before you looked it up
> manually.
>
> >I'm changing the DNS servers used by declude but wondering:
> >
> >1. Is there a way to confirm which DNS server declude is using? I know it
> >either inherits the imail server or used the "DNS..." config line, but is
> >there a status that shows what it actually is using?
>
> With the latest beta, typing "\IMail\Declude -diag" from a command prompt
> will display the DNS server that is being used.
>
> >2. What is the algorithm?  does declude use primary DNS and then
secondary
> >DNS also?  When a DNS lookup fails, does it retry the same server, switch
> >to the secondary DNS server, or simply move on to the next test?
>
> Given the IMail architecture, Declude JunkMail always uses the first DNS
> server listed in the IMail SMTP settings (unless you override this with a
> DNS line in the \IMail\Declude\global.cfg file).  Note that it is
> recommended (with or without Declude) that you only use 1 DNS server in
the
> IMail SMTP settings.
>
> >3. How does DNS caching affect declude?  Should we install a
"caching-only
> >DNS server and configure it as declude's primary lookup server? Will
> >caching actually cause problems with stale data or help performance?
>
> The DNS caching is automatic -- you don't need to worry about it, the DNS
> server will automatically cache the DNS entries, no matter how you have it
> set up (unless you either have a very odd DNS server, or tweak it in a way
> that it shouldn't be tweaked).
>
> The reason that you don't need to worry about it is that the spam
databases
> decide how long the entries should be cached.
>
> >4. Any general advice on monitoring DNS lookups?  Obviously, if DNS is
> >failing it will make declude work poorly.
>
> DNS is nice, as it rarely ever fails.  As a comparison, we have a custom
> programmed web server (not using IIS) that hangs at about every 100,000
> hits.  We have a custom programmed DNS server that has handled many
> millions of hits without hanging even once.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] new dow and hour tests

[Frederick Samarelli]

How would you add weight to these testes.


- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, February 18, 2004 6:22 PM
Subject: Re: [Declude.JunkMail] new dow and hour tests


>
> >Can someone explain these new tests?
>
>  From the release notes:
>
> New tests "dow" and "hour", to allow hour and day-of-week detection. IE
> "HOUR hour 9 16 0 0" for local 9AM->4:59PM. DOW dow 1 5 0 0 for Monday
> through Friday.
>
> So if you add the following lines to your \IMail\Declude\global.cfg file:
>
> HOURhour9   16  0   0
> DOW dow 1   5   0   0
>
> it will create two new tests, HOUR and DOW.  The HOUR test will be
> triggered if the E-mail was received between 9AM and 4:59PM (16:59); the
> DOW test will be triggered if the E-mail was received between Monday and
> Friday.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] JunkMail User Friendly Interface

[Frederick Samarelli]

Has anyone developed an interface like 
this that works in a Scan and Forward situation.
 
Fred

  - Original Message - 
  From: 
  Steve :-) 
  To: [EMAIL PROTECTED] 
  
  Sent: Monday, February 09, 2004 9:56 
  AM
  Subject: Re: [Declude.JunkMail] JunkMail 
  User Friendly Interface
  Hi all2 cents worth.   Sandy built a page for us, 
  and our customers love it! Very KISS ( keep it simple stupid) it has 3 choices 
  high med low. And the choice to delete or send to spam folder. 
  That's it. We like it because it takes the load off of us and puts it 
  in the customers hands.  The way it should be.SteveSanford 
  Whiteman wrote:
  
Someone  with  some  skills could probably come up with a user front
end  of  some  kind  (biggest  problem that comes to my mind is that
there's  no  real  web  server  on an Imail box. I don't know if you
could use the Ipswitch features or not.)

We've  built  several user self-configuration interfaces using IMail's
built-in  web  server,  thus preserving single sign-on, look-and-feel,
and simplicity.

Each  project  like  this  is  unique,  so  there's no one prepackaged
interface. Feel free to contact me off-list for further discussion.

--Sandy



Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]

SpamAssassin plugs into Declude!
http://www.mailmage.com/download/software/freeutils/SPAMC32/Release/

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses as a service to Keeling Inc. Customers]



  

[Declude.JunkMail] Logtool

[Frederick Samarelli]

Warning for anyone thinking of purchasing Logtool. (See Below).

Scott you may want to remove them from your Tools list.

Fred
- Original Message - 
From: "Jason Wolfe" <[EMAIL PROTECTED]>
To: "Frederick Samarelli" <[EMAIL PROTECTED]>
Sent: Saturday, January 17, 2004 11:15 PM
Subject: Re: Version 2.2 Now Available for Download


> At this time, it seems unlikely that there will be any additional versions
of LogTool, as I no longer work for Netcomm in a full time position.
>
> Jason Wolfe
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Blocking the attached message

[Frederick Samarelli]

Title: Message



What about
 
BODY 45 CONTAINS .listrc.comBODY 45 CONTAINS 
.madedcd.com

  - Original Message - 
  From: 
  Sharyn 
  Schmidt 
  To: 'Declude Junkmail List' 
  Sent: Tuesday, February 03, 2004 9:01 
  AM
  Subject: [Declude.JunkMail] Blocking the 
  attached message
  
  Sorry, folks, to attach spam to an email but this is driving me 
  NUTS.
   
  No 
  matter what I do, I can't seem to block this!
   
  Is 
  anyone else successfully blocking this one?
   
  Thanks,
  
  ~Sharyn~ 

Re: [Declude.JunkMail] Imail and Spyware Protection

[Frederick Samarelli]

PestPatrol works great for us.
http://www.pestpatrol.com

Fred
- Original Message - 
From: "marc catuogno" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, January 26, 2004 11:06 AM
Subject: RE: [Declude.JunkMail] Imail and Spyware Protection


I would suggest ADAWARE or Spybot Search and destroy for the desktops. They
are both free and work well in conjunction.  Spybot also has some blocking
features which I suppose could offer some protection if someone sent a link
through an e-mail to a common spyware download. I sent a broadcast to all my
users a few months ago urging them to install one or both of these apps on
their PCs, of course they didn't listen, but what can you do?

Marc

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Bridges, Samantha
Sent: Monday, January 26, 2004 10:13 AM
To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Imail and Spyware Protection

Recently, I read an article about spyware.  Does Declude or Imail
address this issue with their product(s)?  A quote from an article
states:  "Network Associates will become the latest security software
maker to address the growing problem of stealth surveillance software
known as spyware."

How do you know if spyware is on a PC?  Does Declude or Imail identify
and remove sneakly applications such as these?

Here is the full article:

MCAFEE ADDS SPYWARE PROTECTION
Software will identify and remove sneaky applications.
http://www.pcworld.com/news/article/0,aid,114421,tk,dn012304X,00.asp

Thanks and I look forward to any responses.


Samantha Bridges
Communications Technician
Macomb Intermediate School District
44001 Garfield Road
Clinton Township  MI  48038-1100
(586) 228-3300

[EMAIL PROTECTED]
http://www.misd.net


CONFIDENTIALITY NOTICE: This email message, including any attachments,
is for the sole use of the intended recipient(s) and may contain
confidential and privileged information. Any unauthorized review, use,
disclosure or distribution is prohibited. If you are not the intended
recipient, please contact the sender by reply email and destroy all
copies of the original message.


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]




---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] BONDEDSENDER, spam hit on Virtumundo

[Frederick Samarelli]

I received some of these Papal scams from a Bondedsender.

Should I forward the email to [EMAIL PROTECTED]

Fred


- Original Message - 
From: "Cyan Callihan" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, January 18, 2004 4:19 PM
Subject: Re: [Declude.JunkMail] BONDEDSENDER, spam hit on Virtumundo


Please send all of your complaints about virtumundo to
[EMAIL PROTECTED]

I will investigate.

Cyan

 -Original Message-
From: Matt [mailto:[EMAIL PROTECTED]
Sent: Sun Jan 18 10:49:12 2004
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] BONDEDSENDER, spam hit on Virtumundo

Orin,

I found a total of 8 bonded messages from Virtumundo in my capture accounts
in the last 5 days (all to the same user).  It's likely that some others
were passed, or even deleted considering, so the total was probably 12-16
messages from this one source to this one user in all (passed entries were
missed for two days).  Those IP's are as follows:


vl208-45.vmlocal.com [216.21.208.45] - Turn the email on your screen into a
fax in their hand.
vl208-44.vmlocal.com [216.21.208.44] - Make your windows as pretty as the
view.
vl208-52.vmlocal.com [216.21.208.52] - Too many shoes? Never heard of such a
thing.
vl208-54.vmlocal.com [216.21.208.54] - Get help, and get out of debt.
vl208-67.vmlocal.com [216.21.208.67] - Answer all questions with a DNA test.
vl208-75.vmlocal.com [216.21.208.75] - When it comes to refinancing, there
really is no time like the present.
vm208-78.adknow-net.com [216.21.208.78] - Low interest credit cards to get
you back on your feet.
vm208-66.adknow-net.com [216.21.208.66] - Need student loan consolidation?

There's two things to note here; 1) the first 6 were held because I have a
filter from Kami that tracked the REVDNS entry, but not the last two, 2)
these are posted in order of being received, and they clearly were moving up
their list of IP's in order to avoid detection, and then they changed their
reverse DNS name as well (which worked in totality when bonded on my
system).

My point really is that if Bonded Sender really cared about "guaranteed
legitimate E-mail", they would have done 10 minutes of due diligence and
figured out what Virtumundo really was before ever listing them in the first
place.  The Bonded Sender site in fact reads like a brochure for
bulk-mailers talking about how many systems they are whitelisted on, but
they then turn around and protect companies like Virtumundo, either by
design, or by a lack of quality control.  Either way, they need to seriously
rethink their business strategy because if they keep slipping up like this,
they won't be able to claim any value to their paying customers.

Personally, I feel like I was scammed.  No big deal, it was easy enough to
fix.  I might suggest that some consideration be made to Declude's default
inclusion and/or weighting of this test (scored at -20 currently).

Matt



Orin Wells wrote:


Forgive me if this has been addressed before, but I would like to hear

from Cyan what the policy and procedures are for de-listing a Bonded

Sender when it is apparent they have disseminated spam. If I were running

the show I would not only de-list them immediately, but I would bar the

company from ever re-gaining certification under any name.



Of course it has to be investigated to make sure the origin had not been

spoofed to protect the innocent from false spamming charges.

---

[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]



---

This E-mail came from the Declude.JunkMail mailing list.  To

unsubscribe, just send an E-mail to [EMAIL PROTECTED], and

type "unsubscribe Declude.JunkMail".  The archives can be found

at http://www.mail-archive.com.








-- 

=

MailPure custom filters for Declude JunkMail Pro.

http://www.mailpure.com/software/

=

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Imail Processor Overload

[Frederick Samarelli]

Has anyone looked for a DNS problem...

- Original Message - 
From: "Dave Doherty" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, January 16, 2004 3:50 PM
Subject: Re: [Declude.JunkMail] Imail Processor Overload


> You might be seeing the effects of file fragmentation.
>
> -Dave
>
>
> - Original Message - 
> From: "Chris Butler" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Friday, January 16, 2004 11:26 AM
> Subject: [Declude.JunkMail] Imail Processor Overload
>
>
> > Has anyone else seen a problem with server processor being overloaded
over
> > time?  I have a reoccuring problem where over time my processor
> utilization
> > increases steadily.  The only fix that I have found so far is to remove
> the
> > old Spool folder and replace it with an empty one, and then the useage
> > decrease back to normal again.  Any ideas?  Thanks
> >
> > Chris Butler
> > Internal Systems Engineer
> > Region VI ESC
> > phone 936.435.8276
> > fax 936.295.1447
> > [EMAIL PROTECTED]
> >
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] 1.77i15 Bug

[Frederick Samarelli]

Same problem.
01/13/2004 13:53:21 Q3ea002ea02623b93 ERROR: nTests corrupted (1):
961824839-200
01/13/2004 13:53:22 Q3ea002ea02623b93 (Error 5 at 42351c v1.77i17)
01/13/2004 13:53:22 Q3ea002ea02623b93 (log part 2 saved as C:\declude.gp2)
01/13/2004 13:53:22 Q3ea002ea02623b93 (log part 1 saved as C:\declude.gp1)


- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, January 13, 2004 1:09 PM
Subject: Re: [Declude.JunkMail] 1.77i15 Bug


>
> >It now shows 1.77i16 but still the same error.
> >
> >1/13/2004 12:44:03 Q2e6302780262ca7c (Error 5 at 4127f8 v1.77i16)
> >01/13/2004 12:44:03 Q2e6302780262ca7c (log part 2 saved as
C:\declude.gp2)
> >01/13/2004 12:44:03 Q2e6302780262ca7c (log part 1 saved as
C:\declude.gp1)
>
> There is a v1.77i17 that has been placed online to deal with
> this.  However, given the mystery caching problem, you may or may not be
> able to get 1.77i17 (we're still getting i15 when we try to download from
> here, even though i17 is online).
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask about our free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] whitelisted

[Frederick Samarelli]

I got that this morning as well.

I commented out the HABEAS test.
- Original Message - 
From: "andyb" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, January 13, 2004 1:13 PM
Subject: [Declude.JunkMail] whitelisted


> HI,
>
> I'm getting spam, and it is being whitelisted because of HABEAS...  Here
are
> the headers.
>
> These emails are definately spam.  Looks like HABEAS has been compromised?
>
> Comments Please.
>
> thanks, Andy
>
> Received: from cs78191007.pp.htv.fi [62.78.191.7] by thumpernet.com
>   (SMTPD32-6.06) id A0E113013E; Tue, 13 Jan 2004 12:54:41 -0500
> Received: from 240.80.76.18 by 81.218.114.4; Tue, 13 Jan 2004
03:42:04 -0200
> Message-ID: <[EMAIL PROTECTED]>
> X-Habeas-SWE-1: winter into spring
> X-Habeas-SWE-2: brightly anticipated
> X-Habeas-SWE-3: like Habeas SWE (tm)
> X-Habeas-SWE-4: Copyright 2002 Habeas (tm)
> X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this
> X-Habeas-SWE-6: email in exchange for a license for this Habeas
> X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant
> X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this
> X-Habeas-SWE-9: mark in spam to .
> From: "Blaine Shaffer" <[EMAIL PROTECTED]>
> Reply-To: "Blaine Shaffer" <[EMAIL PROTECTED]>
> To: [EMAIL PROTECTED]
> Cc: [EMAIL PROTECTED], [EMAIL PROTECTED],
[EMAIL PROTECTED],
> [EMAIL PROTECTED]
> Subject: GOT Valï(u)m, Viagr@, X(a)[EMAIL PROTECTED], Som@ Di3t Pills Many M3ds Y5iov
> Date: Tue, 13 Jan 2004 04:49:04 -0100
> X-Mailer: NetJunction (NetJunction 5.0-p1)/MIME
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
>  boundary="--891940459175399"
> X-Priority: 5
> X-Declude-Sender: [EMAIL PROTECTED] [62.78.191.7]
> X-RBL-Warning: Total weight: 0
> X-Note: Total spam weight of this E-mail is 0.
> X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
> spam.
> X-Spam-Tests-Failed: Whitelisted [0]
> X-RCPT-TO: <[EMAIL PROTECTED]>
> X-UIDL: 370486507
> Status: U
>
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] messagescreen.com

[Frederick Samarelli]

But how does it work? Good --- bad
- Original Message - 
From: "Rick Klinge" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, January 13, 2004 1:02 PM
Subject: RE: [Declude.JunkMail] messagescreen.com


> MessageScreen is a sophisticated anti-spam, anti-virus, and content
> filtering solution that is tightly integrated with Novell GroupWise,
> Microsoft Exchange, and Lotus Domino email platforms. MessageScreen's
> gateway-level filtering technology stops over 97% of spam and produces
> virtually no false positives.
>
> http://www.messagescreen.com/Products/MessageScreen/index.htm
>
> > -Original Message-
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED] On Behalf Of
> > Frederick Samarelli
> > Sent: Tuesday, January 13, 2004 11:30 AM
> > To: [EMAIL PROTECTED]
> > Subject: [Declude.JunkMail] messagescreen.com
> >
> >
> > Does anyone have any info on this service.
> >
> >  messagescreen.com
> >
>
> ___
> Virus Scanned and Filtered by http://www.FamHost.com E-Mail System.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] 1.77i15 Bug

[Frederick Samarelli]

declude.gp1 file.

(Error 5 at 4127f8 v1.77i16)
(attempt to read at 73c098)
(004127F8 0012C700 (00470AB4 0012FF68) C:\IMail\Declude.exe)
(004101C5 0012C868 ( ) C:\IMail\Declude.exe)
(0040D3B6 0012FF80 (0002 00620B80) C:\IMail\Declude.exe)
(004322E0 0012FFC0 ( ) C:\IMail\Declude.exe)
(7C5987E7 0012FFF0 (0043222C ) C:\WINNT\system32\KERNEL32.dll)
- Original Message - 
From: "Frederick Samarelli" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, January 13, 2004 12:47 PM
Subject: Re: [Declude.JunkMail] 1.77i15 Bug


> It now shows 1.77i16 but still the same error.
>
> 1/13/2004 12:44:03 Q2e6302780262ca7c (Error 5 at 4127f8 v1.77i16)
> 01/13/2004 12:44:03 Q2e6302780262ca7c (log part 2 saved as C:\declude.gp2)
> 01/13/2004 12:44:03 Q2e6302780262ca7c (log part 1 saved as C:\declude.gp1)
>
>
> - Original Message - 
> From: "R. Scott Perry" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Tuesday, January 13, 2004 12:12 PM
> Subject: Re: [Declude.JunkMail] 1.77i15 Bug
>
>
> >
> > >Ok. When I download the latest version.
> > >http://www.declude.com/interim
> > >
> > >It shows as 1.77i15
> >
> > This is very strange.  Our log files show that 1.77i16 was uploaded
twice,
> > yet downloading it shows 1.77i15.  Even after deleting the file from the
> > web server, it can still be downloaded -- but as 1.77i15.  The HTTP
> headers
> > don't show any caching program interfering -- but there definitely is
> > one.  I'm going to have to look into this to see why it is happening.
> >
> > -Scott
> > ---
> > Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
> > Declude Virus: Catches known viruses and is the leader in mailserver
> > vulnerability detection.
> > Find out what you've been missing: Ask about our free 30-day evaluation.
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> >
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] 1.77i15 Bug

[Frederick Samarelli]

It now shows 1.77i16 but still the same error.

1/13/2004 12:44:03 Q2e6302780262ca7c (Error 5 at 4127f8 v1.77i16)
01/13/2004 12:44:03 Q2e6302780262ca7c (log part 2 saved as C:\declude.gp2)
01/13/2004 12:44:03 Q2e6302780262ca7c (log part 1 saved as C:\declude.gp1)


- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, January 13, 2004 12:12 PM
Subject: Re: [Declude.JunkMail] 1.77i15 Bug


>
> >Ok. When I download the latest version.
> >http://www.declude.com/interim
> >
> >It shows as 1.77i15
>
> This is very strange.  Our log files show that 1.77i16 was uploaded twice,
> yet downloading it shows 1.77i15.  Even after deleting the file from the
> web server, it can still be downloaded -- but as 1.77i15.  The HTTP
headers
> don't show any caching program interfering -- but there definitely is
> one.  I'm going to have to look into this to see why it is happening.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask about our free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] messagescreen.com

[Frederick Samarelli]

Does anyone have any info on this service.
 
 messagescreen.com

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] 1.77i15 Bug

[Frederick Samarelli]

Ok. When I download the latest version.
http://www.declude.com/interim

It shows as 1.77i15
- Original Message - 
From: "Bill Landry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, January 13, 2004 11:32 AM
Subject: Re: [Declude.JunkMail] 1.77i15 Bug


> - Original Message - 
> From: "Frederick Samarelli" <[EMAIL PROTECTED]>
>
> > Has anyone else see this.
> > After upgrading from 1.77i12 to 1.77i15 I get this I revert back to
> 1.77i12
> > and I am fine.
> >
> > 01/12/2004 18:39:34 Q303603930282ebed ERROR: nTests corrupted (1)
> > 01/12/2004 18:39:35 Q303603930282ebed (Error 5 at 4234ac v1.77i15)
> > 01/12/2004 18:39:35 Q303603930282ebed (log part 2 saved as
C:\declude.gp2)
> > 01/12/2004 18:39:35 Q303603930282ebed (log part 1 saved as
C:\declude.gp1)
> > 01/12/2004 18:40:00 Q304f0288029c4e8f ERROR: nTests corrupted (1)
> > 01/12/2004 18:40:00 Q303803930282f265 ERROR: nTests corrupted (1
>
> I think this may be one of the log issues Scott was talking about in a
> earlier post that is fixed in 1.77i16.
>
> Bill
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] 1.77i15 Bug

[Frederick Samarelli]

Has anyone else see this.
After upgrading from 1.77i12 to 1.77i15 I get this I revert back to 1.77i12
and I am fine.

01/12/2004 18:39:34 Q303603930282ebed ERROR: nTests corrupted (1)
01/12/2004 18:39:35 Q303603930282ebed (Error 5 at 4234ac v1.77i15)
01/12/2004 18:39:35 Q303603930282ebed (log part 2 saved as C:\declude.gp2)
01/12/2004 18:39:35 Q303603930282ebed (log part 1 saved as C:\declude.gp1)
01/12/2004 18:40:00 Q304f0288029c4e8f ERROR: nTests corrupted (1)
01/12/2004 18:40:00 Q303803930282f265 ERROR: nTests corrupted (1

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] 1.77i12 Bug: Aliases Counted in BYPASSMULTIRECP

[Frederick Samarelli]

After upgrading from 1.77i12 to 1.77i17 I get this.
01/12/2004 18:39:34 Q303603930282ebed ERROR: nTests corrupted (1)
01/12/2004 18:39:35 Q303603930282ebed (Error 5 at 4234ac v1.77i15)
01/12/2004 18:39:35 Q303603930282ebed (log part 2 saved as C:\declude.gp2)
01/12/2004 18:39:35 Q303603930282ebed (log part 1 saved as C:\declude.gp1)
01/12/2004 18:40:00 Q304f0288029c4e8f ERROR: nTests corrupted (1)
01/12/2004 18:40:00 Q303803930282f265 ERROR: nTests corrupted (1

- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, January 12, 2004 5:28 PM
Subject: RE: [Declude.JunkMail] 1.77i12 Bug: Aliases Counted in
BYPASSMULTIRECP


>
> >any news on this matter?
>
> The issue with 1.77i12 and the bypasswhitelist option has been fixed in
> v1.77i15 at http://www.declude.com/interim .  So if a user sends an E-mail
> with one recipient that is an alias that expands to 5 addresses, the
> bypasswhitelist option will only count it as one recipient.
>
> 1.77i15 also changes the new LOGLEVEL LOW "one-line summary" log file
entry
> to include the weight, and start with "Tests failed [weight=WEIGHT]: ".
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask about our free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] New CMDSPACE test in latest interim release

[Frederick Samarelli]

Woops on the Delude thing
- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, January 06, 2004 6:53 PM
Subject: [Declude.JunkMail] New CMDSPACE test in latest interim release


> We've just added a new test to the latest interim release, called
> CMDSPACE.  This one looks for spaces in SMTP commands where there
shouldn't
> be any.
>
> It is catching about 75% of the spam to the spamtraps here, and since we
> started using it, only 1 of the approximately 500 legitimate E-mails that
> came in was caught.  It looks like this could be a good test until
spammers
> change their spamware.
>
> To use it, you need the latest interim release (from
> http://www.delude.com/interim ), and need to use the following line in
your
> \IMail\Declude\global.cfg file to define the test:
>
> CMDSPACEcmdspacex   x   8   0
>
> (where "8" is the weight you want to assign to the test).
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask about our free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Maximum Processes

[Frederick Samarelli]

Where are you setting "Maximum Processes"
- Original Message - 
From: "Kris McElroy" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, December 22, 2003 5:47 PM
Subject: [Declude.JunkMail] Maximum Processes


> I just brought my new Gateway server online today.  Single 2.8GHz Xeon,
36Gb
> 15k Scsi, 1Gb ram.  I have watched the que all day and it has just
increased
> up to 8,700.  I adjusted the Maximum Processes to 75, helped some, then I
> adjusted it to 100 and BAM and the que started decreasing steadily.
Within
> 15 to 20 minutes it decreased to 7627, and the processor is not maxing out
> it is holding ground.  I have been having issues with my previous mail
> gateway that mail would pile up and take anywhere from 4 to 6 hours to get
> to my inbox.  Does this make sense to anyone, running at 100 Maximum
> Processes is this ok or is there any thing that I should worry about?
>
>
>
>
> Thanks,
>
>
> Kris McElroy
> [EMAIL PROTECTED]
>
> Chief Technology Officer
> Duracom, INC.
> www.duracom.net
>
> "I am always doing that which I can not do, in order that I may learn how
to
> do it."
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Overflow

[Frederick Samarelli]

I just loaded a copy of Metaip DNS software.

http://www.metainfo.com/

Removed the MS DNS.

Will keep you informed.



- Original Message - 
From: "Charles Frolick" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, December 22, 2003 3:19 PM
Subject: RE: [Declude.JunkMail] Overflow


> You might try another DNS server software. I use SimpleDNS Plus
> (http://www.jhsoft.com/), and run all my customer domains (350), 250K+
> messages per day with Declude and Imail using it, and 2000 dial
> customers, with no issues.
> I have never heard MS DNS to be stable under high load conditions. It
> used to do strange things with more than 20 domains under very low load
> back in NT4, and I heard it had a memory leak under 2k with an earlier
> service pack.
>
> Thanks,
> Chuck Frolick
> ArgoLink.net
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
> Sent: Monday, December 22, 2003 1:30 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] Overflow
>
>
>  >> That means that your DNS server is dying.  It sounds like this may
> be a  >> common problem with Microsoft DNS, where it starts choking if
> it has too  >> much in its cache.  Switching to the latest version of
> BIND may be the best  >> option.
>
> >Not sure what you are suggesting.
> >
> >Latest version of Bind?
>
> Correct.
>
> >Is there a newer version of MS DNS or are you suggesting a different
> >product.
>
> I don't know -- I've never actually used MS DNS.  But it sounds like
> there
> is a serious problem with MS DNS that a number of our customers have
> been
> seeing lately, where it slows down tremendously, that requires either a
> clearing of the cache or reboot to fix.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask about our free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> "unsubscribe Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Overflow

[Frederick Samarelli]

Not sure what you are suggesting.

Latest version of Bind?

Is there a newer version of MS DNS or are you suggesting a different
product.

Fred
- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, December 22, 2003 2:02 PM
Subject: Re: [Declude.JunkMail] Overflow


>
> >It just happened again.
> >
> >I cleared the Cache and the backup cleared.
> >
> >What does the mean.
>
> That means that your DNS server is dying.  It sounds like this may be a
> common problem with Microsoft DNS, where it starts choking if it has too
> much in its cache.  Switching to the latest version of BIND may be the
best
> option.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask about our free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Overflow

[Frederick Samarelli]

OK.

It just happened again.

I cleared the Cache and the backup cleared.

What does the mean.

Fred
- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, December 22, 2003 12:23 PM
Subject: Re: [Declude.JunkMail] Overflow


>
> >I have not tried to clear the MS DNS Cache.
> >
> >But the problem goes away after a while.
> >
> >It is fine at the moment but it will come back soon.
>
> When it comes back, I would recommend checking the DNS server.  First,
> check to see the IP of the DNS server Declude JunkMail will be using (the
> first one listed in the IMail SMTP settings).  Then, go to a command
> prompt, and type:
>
>  nslookup
>  server 192.0.2.53   [replacing that IP with the IP of
> the DNS server that Declude JunkMail will be using]
>  2.0.0.127.bl.spamcop.net
>  2.0.0.127.bl.spamcop.net
>  2.0.0.127.bl.spamcop.net
>  2.0.0.127.bl.spamcop.net
>
> What you are looking for is to see how quickly [1] you get the initial
> response (which could be delayed due to a problem with the DNS servers at
> spamcop.net), and [2] once you get the first response, how quickly cached
> responses come back.
>
> Once you get the first response back, subsequent (cached) responses should
> come back very quickly (you should not be able to detect any delay).  If
> you can detect a delay, there is a problem with the DNS server or your
> connection to it.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask about our free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Overflow

[Frederick Samarelli]

John,

I have not tried to clear the MS DNS Cache.

But the problem goes away after a while.

It is fine at the moment but it will come back soon.

Fred
- Original Message - 
From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, December 22, 2003 11:43 AM
Subject: RE: [Declude.JunkMail] Overflow


Fredrick, please answer my question.

You said you are using the MS DNS service on the server to help with the
problem.

Does it still reoccur, and if so, have you tried clearing the MS DNS service
cache and does that allow mail to flow until it reoccurs?

John Tolmachoff
Engineer/Consultant/Owner
eServices For You


> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Frederick Samarelli
> Sent: Monday, December 22, 2003 8:36 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] Overflow
>
> I am 100% sure it is not DNS.
>
> I have Sniffer  and Spamchk as external test but I have commented them out
> and still a problem.
>
> The problem goes way after a while then comes back.
>
> These are my external DNS test.
>
> BLITZEDALL ip4r opm.blitzed.org   *  3 0
> CBL  ip4r cbl.abuseat.org   127.0.0.2 10 0
> EASYNET-DNSBL ip4r sbl.spamhaus.org  127.0.0.2 16 0
> IPWHOIS  ip4r ipwhois.rfc-ignorant.org *  5 0
> SORBS-HTTP ip4rdnsbl.sorbs.net  127.0.0.2 10 0
> SORBS-SOCKS ip4rdnsbl.sorbs.net  127.0.0.3 10 0
> SORBS-MISC ip4rdnsbl.sorbs.net  127.0.0.4 7 0
> SORBS-SMTP ip4rdnsbl.sorbs.net  127.0.0.5 7 0
> SORBS-WEB ip4rdnsbl.sorbs.net  127.0.0.7 7 0
> FIVETEN-SPAMSUP ip4r blackholes.five-ten-sg.com 127.0.0.7 5 0
> FIVETEN-MISC ip4r blackholes.five-ten-sg.com 127.0.0.9 10 0
> FIVETEN-FREE ip4r blackholes.five-ten-sg.com 127.0.0.12 10 0
> SECURITYSAGE   rhsbl   blackhole.securitysage.com  *  2  0
> MAILPOLICE-BULK rhsbl   bulk.rhs.mailpolice.com  127.0.0.2100
> MAILPOLICE-PORN rhsbl   porn.rhs.mailpolice.com 127.0.0.2100
> ORDB  ip4r relays.ordb.org   *  5 0
> SPAMCOP  ip4r bl.spamcop.net   127.0.0.2 17 0
> SBBL  ip4r sbbl.they.com   *  3 0
> NJABL  ip4r dnsbl.njabl.org   127.0.0.2 8 0
> DSBL  ip4r list.dsbl.org   *  6 0
> DSN  rhsbl dsn.rfc-ignorant.org  127.0.0.2 3 0
> - Original Message -
> From: "R. Scott Perry" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Monday, December 22, 2003 11:00 AM
> Subject: Re: [Declude.JunkMail] Overflow
>
>
> >
> > >The Declude process looks like it take 10 - 60 seconds per email.
> > >
> > >It is almost like it is in a wait state looking for something.
> >
> > There is about a 99% chance this *is* a DNS issue.
> >
> > If you are positive that your DNS server is working well (answering
> cached
> > queries very quickly, with no noticeable delay), the next thing to do is
> > make sure that you are not running dead DNS-based spam tests (such as
> > MONKEYS*, OS*, EASYNET*).  Depending on how well those tests died, they
> may
> > timeout, causing the behavior you are experiencing.
> >
> > -Scott
> > ---
> > Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
> > Declude Virus: Catches known viruses and is the leader in mailserver
> > vulnerability detection.
> > Find out what you've been missing: Ask about our free 30-day evaluation.
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> >
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Overflow

[Frederick Samarelli]

I am 100% sure it is not DNS.

I have Sniffer  and Spamchk as external test but I have commented them out
and still a problem.

The problem goes way after a while then comes back.

These are my external DNS test.

BLITZEDALL ip4r opm.blitzed.org   *  3 0
CBL  ip4r cbl.abuseat.org   127.0.0.2 10 0
EASYNET-DNSBL ip4r sbl.spamhaus.org  127.0.0.2 16 0
IPWHOIS  ip4r ipwhois.rfc-ignorant.org *  5 0
SORBS-HTTP ip4rdnsbl.sorbs.net  127.0.0.2 10 0
SORBS-SOCKS ip4rdnsbl.sorbs.net  127.0.0.3 10 0
SORBS-MISC ip4rdnsbl.sorbs.net  127.0.0.4 7 0
SORBS-SMTP ip4rdnsbl.sorbs.net  127.0.0.5 7 0
SORBS-WEB ip4rdnsbl.sorbs.net  127.0.0.7 7 0
FIVETEN-SPAMSUP ip4r blackholes.five-ten-sg.com 127.0.0.7 5 0
FIVETEN-MISC ip4r blackholes.five-ten-sg.com 127.0.0.9 10 0
FIVETEN-FREE ip4r blackholes.five-ten-sg.com 127.0.0.12 10 0
SECURITYSAGE   rhsbl   blackhole.securitysage.com  *  2  0
MAILPOLICE-BULK rhsbl   bulk.rhs.mailpolice.com  127.0.0.2100
MAILPOLICE-PORN rhsbl   porn.rhs.mailpolice.com 127.0.0.2100
ORDB  ip4r relays.ordb.org   *  5 0
SPAMCOP  ip4r bl.spamcop.net   127.0.0.2 17 0
SBBL  ip4r sbbl.they.com   *  3 0
NJABL  ip4r dnsbl.njabl.org   127.0.0.2 8 0
DSBL  ip4r list.dsbl.org   *  6 0
DSN  rhsbl dsn.rfc-ignorant.org  127.0.0.2 3 0
- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, December 22, 2003 11:00 AM
Subject: Re: [Declude.JunkMail] Overflow


>
> >The Declude process looks like it take 10 - 60 seconds per email.
> >
> >It is almost like it is in a wait state looking for something.
>
> There is about a 99% chance this *is* a DNS issue.
>
> If you are positive that your DNS server is working well (answering cached
> queries very quickly, with no noticeable delay), the next thing to do is
> make sure that you are not running dead DNS-based spam tests (such as
> MONKEYS*, OS*, EASYNET*).  Depending on how well those tests died, they
may
> timeout, causing the behavior you are experiencing.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask about our free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Overflow

[Frederick Samarelli]

I get that same problem at different times of the day.

Like now.

I have lots of power and my dns server is working perfectly.

I monitor the system using Remote Task Manager.

The Declude process looks like it take 10 - 60 seconds per email.

It is almost like it is in a wait state looking for something.

I loaded DNS on the mail server to eliminate it as the problem.

Fred





- Original Message - 
From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, December 22, 2003 10:34 AM
Subject: [Declude.JunkMail] Overflow


If any one is experiencing the overflow folder filling up and it is not
attributable to server load, please contact me. I am having this problem and
am narrowing it down.

John Tolmachoff
Engineer/Consultant/Owner
eServices For You


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPF broken with v1.77i4?

[Frederick Samarelli]

Any fix on this.

Fred
- Original Message - 
From: "Bill Landry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, December 19, 2003 7:21 PM
Subject: [Declude.JunkMail] SPF broken with v1.77i4?


> Scott, I updated to v1.77i4 for the added logging, however, now SPF
appears
> not to be working at all.  Logging shows up in spf.none, but no logging
> shows up in spf.log any longer.  I sent a test message through that failed
> SPF on v1.77i3, but passed right through without notice with v1.77i4.
>
> Bill
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] messagescreen.com

[Frederick Samarelli]

Does anyone have any info on this service.
 
 messagescreen.com
 
Fred
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Virginia Indicts Two Men On Spam Charges

[Frederick Samarelli]

http://www.washingtonpost.com/wp-dyn/articles/A56209-2003Dec11.html

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Declude Virus List

[Frederick Samarelli]

How can I get on the Declude Virus scan list
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] BODY STARTSWITH

[Frederick Samarelli]

MINWEIGHT

How does that work?

- Original Message - 
From: "Bill Landry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, December 02, 2003 5:12 PM
Subject: Re: [Declude.JunkMail] BODY STARTSWITH


> Thanks Matt, I was able to accomplish what I wanted using MINWEIGHT.
>
> Bill
> - Original Message - 
> From: "Matthew Bramble" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Tuesday, December 02, 2003 1:59 PM
> Subject: Re: [Declude.JunkMail] BODY STARTSWITH
>
>
> > Bill,
> >
> > I haven't seen an absolute confirmation that this functionality works
> > yet as I haven't yet integrated this filter into my system using the new
> > code.  The END functionality though is something that Scott said he
> > would include along with MAXWEIGHT, MINWEIGHT, SKIPIFWEIGHT, and some
> > logging options for weighting, and he described how it works in his
> > response to my question for added functionality in his message on
> > 11/14.  I'll explain it further if that message doesn't do it for you.
> >
> > Matt
> >
> >
> >
> > Bill Landry wrote:
> >
> > >Matt, I was noticing that you are using "END" in this file.  How is
that
> > >feature enabled?  When I add "END" to any of my files, it seems that
> > >JunkMail just skips the entire files.  Is there something that you need
> to
> > >add to the global.cfg to enable this filter feature?
> > >
> > >Bill
> > >- Original Message - 
> > >From: "Matthew Bramble" <[EMAIL PROTECTED]>
> > >To: <[EMAIL PROTECTED]>
> > >Sent: Tuesday, November 25, 2003 4:12 PM
> > >Subject: Re: [Declude.JunkMail] BODY STARTSWITH
> > >
> > >
> > >
> > >
> > >>Munged twice so far, so I am resending this time without the zip file
> > >>attachment in the event that there is some sort of restriction on
this.
> > >>The referenced file can be downloaded from the following link:
> > >>
> > >>
> > >>
> > >>
> >
>
>http://www.mailpure.com/software/decludefilters/gibberish/Gibberish_v2-0-0.
> txt
> > >
> > >
> > >>Matt
> > >>
> > >> Original Message 
> > >>Subject: Re: [Declude.JunkMail] BODY STARTSWITH
> > >>Date: Tue, 25 Nov 2003 18:39:22 -0500
> > >>From: Matthew Bramble <[EMAIL PROTECTED]>
> > >>To: [EMAIL PROTECTED]
> > >>
> > >>
> > >>Scott,
> > >>
> > >>I've attached a new copy of the GIBBERISH filter that makes use of the
> > >>END and MAXPOINTS functionality that was discussed previously.  Am I
> > >>correct that these can also be used now with Declude JunkMail Pro
> > >>v1.76i27?  And if so, did I follow the implemented methodology?
> > >>
> > >>Essentially, I'm using the functionality to simplify into one file and
> > >>save on processing.  I tried to order things within the file so that
the
> > >>most common END statements would be hit first, and I scored the Main
> > >>Filter hits at 1000 so that it would be easy for an administrator to
> > >>modify the scoring by just adjusting the MAXPOINTS entry.  The
MAXPOINTS
> > >>entry should keep the filter from adding points incrementally, and it
> > >>should end the test after one hit, producing no more score than the
> > >>MAXPOINTS entry allows.  Scoring isn't applied to the filter in the
> > >>Global.cfg file since it is all handled internal to the filter.
> > >>
> > >>Note to fellow admins:  This file also hasn't been tested because I am
> > >>not yet using the proper release.  I'm really just putting it out
there
> > >>to see if Scott can tell me if I got the idea right.  I must stress
that
> > >>this is not intended to be used for any versions of Declude JunkMail
Pro
> > >>prior to v1.76i27 because it could result in assessing 1000 or more
> > >>points without proper software support, and it may have other issues.
> > >>Please do not put this into a production environment unless you
> > >>understand what you are doing and are going to monitor it closely.
> > >>
> > >>Matt
> > >>
> > >>
> > >>
> >
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> >
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT

[Frederick Samarelli]

So if I want to perform an action at 100 should I change these to:

SKIPIFWEIGHT 101
MAXWEIGHT101
- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, December 01, 2003 10:30 AM
Subject: Re: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT


>
> >I have my system setup as listed below.
> >
> >Why would the system ingnore the WEIGHT100 DELETE
>
> Note that the SKIPIFWEIGHT and MAXWEIGHT options in the latest interim
> release only apply to the filters that they are listed in.
>
> >it is performing WEIGHT40 ROUTETO [EMAIL PROTECTED]
> >
> >(In the top of my Filters)
> >SKIPIFWEIGHT 100
> >MAXWEIGHT100
>
> Here, the maximum weight that this specific filter can add is 100 (and the
> test will not be run if the weight is calculated at 100 or higher when the
> test is run).
>
> >$default$.junkmail
> >WEIGHT100 DELETE
> >
> >Global.cfg
> >WEIGHT100 weight  x x 100 0
>
> In this case, if the total weight for the E-mail is 100 or higher, it
> should be deleted.
>
> Note that the WEIGHT100 DELETE would be ignored if there are per-user or
> per-domain settings (which would override it), or if the E-mail is
outgoing
> (in which case the \IMail\Declude\global.cfg file would be used).
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask about our free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT

[Frederick Samarelli]

Once again I found my own problem.

Thanks.
- Original Message - 
From: "Frederick Samarelli" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, December 01, 2003 10:16 AM
Subject: Re: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT


> I have my system setup as listed below.
>
> Why would the system ingnore the WEIGHT100 DELETE
>
> it is performing WEIGHT40 ROUTETO [EMAIL PROTECTED]
>
> (In the top of my Filters)
> SKIPIFWEIGHT 100
> MAXWEIGHT100
>
> $default$.junkmail
> WEIGHT100 DELETE
>
> Global.cfg
> WEIGHT100 weight  x x 100 0
>
>
>
>
> - Original Message - 
> From: "Kami Razvan" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Saturday, November 29, 2003 5:34 AM
> Subject: RE: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT
>
>
> > Hi Frederick:
> >
> > Here is what we do:
> >
> > # Version>= 1.27i28: Skip the test if weight is reached
> > SKIPIFWEIGHT 70
> > # Version>= 1.27i28: Exit the test if weight is reached
> > MAXWEIGHT60
> > REMOTEIP  0STARTSWITH 157.151.5
> > REMOTEIP  0STARTSWITH 193.216.245.227
> > REMOTEIP  0STARTSWITH 194.143.183.53
> >
> >
> > You have to be using Declude 1.27i27 or 28 (I don't remember) or
higher..
> >
> > Simply add them to the top of your filter files and it will do what they
> say
> > they do..
> >
> > Upon start of the filter if the total weight prior to entering the
filter
> is
> > 70 then the filter will not run and if during the run of the filter the
> > weight associated with the filter reaches 60 then the filter exits.
> >
> > So if you have a weight of 50 going into the filter you can exit the
> filter
> > with no more than 110 as weight.
> >
> > OR
> >
> > If you are running the filter and you are already at a weight of 70 then
> the
> > filter will never run and you will exit with 70.
> >
> > Recommendation:
> >
> > Make sure you put all your weights that have negative weight prior to
the
> > ones with positive weight.  That is what we do - all of our negative
> weights
> > are on top of the global.cfg and we have structured our filters such
that
> > the bigger filters are the last to execute so hopefully if the weight is
> > large enough prior to getting to them they will not run.
> >
> > Looking at our log files it is incredible how many of the filters are
not
> > even running anymore but they are there just in case...
> >
> > Hope that answers your question..
> >
> > Regards,
> > Kami
> >
> > -Original Message-
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED] On Behalf Of Frederick
> Samarelli
> > Sent: Friday, November 28, 2003 11:20 PM
> > To: [EMAIL PROTECTED]
> > Subject: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT
> >
> > Does any one have more information on these SKIPIFWEIGHT and MAXWEIGHT
> >
> >
> > Thanks.
> >
> > Fred
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> >
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT

[Frederick Samarelli]

I have my system setup as listed below.

Why would the system ingnore the WEIGHT100 DELETE

it is performing WEIGHT40 ROUTETO [EMAIL PROTECTED]

(In the top of my Filters)
SKIPIFWEIGHT 100
MAXWEIGHT100

$default$.junkmail
WEIGHT100 DELETE

Global.cfg
WEIGHT100 weight  x x 100 0




- Original Message - 
From: "Kami Razvan" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Saturday, November 29, 2003 5:34 AM
Subject: RE: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT


> Hi Frederick:
>
> Here is what we do:
>
> # Version>= 1.27i28: Skip the test if weight is reached
> SKIPIFWEIGHT 70
> # Version>= 1.27i28: Exit the test if weight is reached
> MAXWEIGHT60
> REMOTEIP  0STARTSWITH 157.151.5
> REMOTEIP  0STARTSWITH 193.216.245.227
> REMOTEIP  0STARTSWITH 194.143.183.53
>
>
> You have to be using Declude 1.27i27 or 28 (I don't remember) or higher..
>
> Simply add them to the top of your filter files and it will do what they
say
> they do..
>
> Upon start of the filter if the total weight prior to entering the filter
is
> 70 then the filter will not run and if during the run of the filter the
> weight associated with the filter reaches 60 then the filter exits.
>
> So if you have a weight of 50 going into the filter you can exit the
filter
> with no more than 110 as weight.
>
> OR
>
> If you are running the filter and you are already at a weight of 70 then
the
> filter will never run and you will exit with 70.
>
> Recommendation:
>
> Make sure you put all your weights that have negative weight prior to the
> ones with positive weight.  That is what we do - all of our negative
weights
> are on top of the global.cfg and we have structured our filters such that
> the bigger filters are the last to execute so hopefully if the weight is
> large enough prior to getting to them they will not run.
>
> Looking at our log files it is incredible how many of the filters are not
> even running anymore but they are there just in case...
>
> Hope that answers your question..
>
> Regards,
> Kami
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Frederick
Samarelli
> Sent: Friday, November 28, 2003 11:20 PM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT
>
> Does any one have more information on these SKIPIFWEIGHT and MAXWEIGHT
>
>
> Thanks.
>
> Fred
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] CATCHALLMAILS

[Frederick Samarelli]

Does anyone know why  I am getting this in the Declude log file.

11/30/2003 23:27:44  Warning: misconfiguration in following line in
configuration file (catchallmails is not an ACTION). May be a duplicate test
definition?
11/30/2003 23:27:44   catchallmails x x 0 0

Fred

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] CATCHALLMAILS

[Frederick Samarelli]

Belay my last.

I had a duplicate entry.

Thanks.

Fred
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT

[Frederick Samarelli]

Does any one have more information on these SKIPIFWEIGHT and MAXWEIGHT


Thanks.

Fred
- Original Message - 
From: "Nick Hayer" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, November 26, 2003 10:37 AM
Subject: Re: [Declude.JunkMail] improved performance using ramdrive?


> Frederick -
>
> I suggest you try the new feature in the latest intrim release
> that has these commands avail:
> SKIPIFWEIGHT and MAXWEIGHT
>
> Place your compensatory filters [ones that reduce scoring] in the
> global config ahead of the other filter files.
>
> For me frankly most of my filters do not even now run - the dns tests
> take care of the load so cpu use is way down
>
> -Nick
>
>
>
> From:   "Frederick Samarelli" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Subject:Re: [Declude.JunkMail] improved performance using
ramdrive?
> Date sent:  Wed, 26 Nov 2003 09:44:37 -0500
> Send reply to:  [EMAIL PROTECTED]
>
> > I have some big filters and see very little disk access.
> >
> > I don't think it would help.
> >
> > What Delcude uses is CPU CPU CPU CPU ...
> >
> >
> > - Original Message - 
> > From: "Gufler Markus" <[EMAIL PROTECTED]>
> > To: <[EMAIL PROTECTED]>
> > Sent: Wednesday, November 26, 2003 9:21 AM
> > Subject: [Declude.JunkMail] improved performance using ramdrive?
> >
> >
> > > Hi all,
> > >
> > > Anyone has experiences using a ramdrive for all declude exe, config
> > > and
> > filter files?
> > >
> > > Markus
> > >
> > >
> > > ---
> > > [This E-mail was scanned for viruses by Declude Virus
> > (http://www.declude.com)]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list.  To
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > type "unsubscribe Declude.JunkMail".  The archives can be found at
> > > http://www.mail-archive.com.
> > >
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> > (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> >
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.