[Declude.JunkMail] Help with HEADER message

[Greg Foulks]

My current HEADER action prints this to the top of the email body.

<### WARNING ### This email was scanned and could be SPAM! If you feel that 
this message is SPAM please forward the email
and all header information to [EMAIL PROTECTED] and request that the sender be 
blocked.> Error Messages = BADHEADERS, BADHEADERS2,
WEIGHT10   Begin Message:


How can I format this so I can get it to look like this...

#
#   WARNING #
#
#This email did not pass the#
#spam scanner and could be spam.#
#If you would like emails from  #
#address to be blocked, please  #
#forward this complete message  #
#to [EMAIL PROTECTED] #
#
#  Error Messages   #
#
#%ALLRECIPS%
#%HEADERS%
#%INOROUT%
#%TESTNAME%
#%TESTDOMAIN%
#%TESTSFAILD%
#%WARNING%

#Original Email Follows#
####



Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] DSBL

[Greg Foulks]

I'm new to Declude JunkMail these two lists that you mention. Should I add them to my 
GLOBAL.cfg file?

Where do I go to get updates for my GLOBAL.cfg file?

Also the section that says
#
# The following tests are commented out by default because they require a subscription,
# or are not commonly used.
#

Where do I go to subscribe? Does anyone know how much the subscription is?

Thanks,

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Wednesday, April 10, 2002 9:46 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] DSBL



>It appears that DSBL is now three lists ... the two confirmed ones
>are:
>
>list.dsbl.org for single-stage relays tested by trusted users, 
>multihop.dsbl.org

That is correct.  The multihop.dsbl.org was announced yesterday.

>I haven't noticed any hits on these with Declude ... are they working?

We've had occasional hits, but not many.  The DSBL zone only started 
working about a week ago (the first week or so of its existence it didn't 
have any hits)

>I'm using the format:
>
>
>DSBL   ip4r  list.dsbl.org   *  10 0
>DSBL   ip4r  multihop.dsbl.org   *   10 0

I do hope that you are going to have different names for those tests, such as:

 DSBL   ip4r  list.dsbl.org   *  10 0
 DSBLMULTI   ip4r  multihop.dsbl.org   *   10 0

 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] Need help with this one

[Greg Foulks]

I just received an email to my postmaster account and noticed that the email was not 
scanned by Declude JunkMail. I've been trying
to stop emails from this domain and can't figure out why they are still able to send 
to us.

Here is the header information (Notice that JunkMail didn't scan it)

Received: from wsv1.dis.daiei.co.jp ([202.25.168.1]) by webkeeper.nfti.com with 
Microsoft SMTPSVC(5.0.2195.3779);
 Wed, 10 Apr 2002 13:15:25 -0400
Received: from DCLWEB01 ([202.25.168.13]) by
  wsv1.dis.daiei.co.jp (Netscape Messaging Server 4.15 wsv1 Jun 21
  2001 23:53:48) with SMTP id GUD41A00.11Q for
  <[EMAIL PROTECTED]>; Thu, 11 Apr 2002 02:17:34 +0900
To: [EMAIL PROTECTED]
Message-ID: <[EMAIL PROTECTED]>
Date: Thu, 11 Apr 2002 02:00:02 +0900
From: [EMAIL PROTECTED]
Subject: =?ISO-2022-JP?B?GyRCJUAlJCUoITw4ZkVCPmxFOSQqJUglLyVhITwlayEhGyhC?=
 =?ISO-2022-JP?B?GyRCQmgbKEI2NxskQjlmISEbKEIyMDAyLzA0LzExGyRCR1s/LhsoQg==?=
MIME-Version: 1.0
X-Mail-Agent: BSMTP DLL  Jul 20 2000  by Tatsuo Baba
Content-Type: text/plain; charset=ISO-2022-JP
Return-Path: [EMAIL PROTECTED]
X-OriginalArrivalTime: 10 Apr 2002 17:15:25.0391 (UTC) FILETIME=[4DE81DF0:01C1E0B3]

Thanks,

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] Will this ever be possible?

[Greg Foulks]

It would be really cool if let's say a user gets a message and it's SPAM. They could 
forward the message to a IMAL mailbox and
declude would intercept the message scan the headers of the message and add it's self 
to the blacklist.

Greg

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Will this ever be possible?

[Greg Foulks]

A, but make the black list based on a per user environment. So that if 
[EMAIL PROTECTED] no longer want mail from yahoo.com

it won't bother anyone else on the mail server. If they want it changed then they will 
have come through the network admin. 

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Tuesday, April 23, 2002 9:53 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Will this ever be possible?



>Sounds like you want a program that is like SpamCop for your server, sounds
>cool actually. It could integrate with Imail's black lists or Declude's. You
>could use a program alias in Imail to dump to the parser.  Wish I had the
>time to write it.

Although, it would not work if you have malicious (or clueless) users.  For 
example, someone signs up for eBay, and starts getting marketing messages 
from them.  "Spam!" they say, and bam!  Nobody who uses eBay can use it 
anymore.  Of course, that assumes an ISP-type environment; a business would 
likely have fewer issues.

Then, there's the question of whether to blacklist based on the return 
address "makemoney$$$NOW$$$@yahoo.com", the domain "@yahoo.com", or the IP 
it comes from (likely the best option).
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Will this ever be possible?

[Greg Foulks]

Not everyone uses outlook and would rather that the filtering took place at the server 
level.

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of
[EMAIL PROTECTED]
Sent: Wednesday, April 24, 2002 4:03 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Will this ever be possible?


Using any recent version of Outlook / Outlook Express:

Right click on the message in the message list,
select 'Junk Email'
select 'Add to junk senders list'

Any new mail received from that send is routed according to the junk mail
rule. Usually deleted or sent to a junk mail file.

It's on a per user basis, each user can go in and maintain the junk senders
list in their own machine.

[EMAIL PROTECTED]


> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Charles Frolick
> Sent: Tuesday, April 23, 2002 9:25 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Will this ever be possible?
>
>
> The problem is, neither Declude nor Imail supports per user black
> lists, but
> Imail filters can be set per user to send mail from a domain or email
> address to .  They don't need some fancy program to manage it
> though, they can always use the filter manager in Webmail.
>
> Chuck Frloick
>
> -Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Greg Foulks
> Sent: Tuesday, April 23, 2002 9:02 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Will this ever be possible?
>
>
> A, but make the black list based on a per user environment. So that if
> [EMAIL PROTECTED] no longer want mail from yahoo.com
>
> it won't bother anyone else on the mail server. If they want it
> changed then
> they will have come through the network admin.
>
> Greg Foulks, MCP
> NewFound Technologies, Inc.
> http://www.nfti.com
> Email: [EMAIL PROTECTED]
> Voice: 614.318.5036
> Fax: 614.318.5005
>
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
> Sent: Tuesday, April 23, 2002 9:53 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Will this ever be possible?
>
>
>
> >Sounds like you want a program that is like SpamCop for your
> server, sounds
> >cool actually. It could integrate with Imail's black lists or Declude's.
> You
> >could use a program alias in Imail to dump to the parser.  Wish I had the
> >time to write it.
>
> Although, it would not work if you have malicious (or clueless)
> users.  For
> example, someone signs up for eBay, and starts getting marketing messages
> from them.  "Spam!" they say, and bam!  Nobody who uses eBay can use it
> anymore.  Of course, that assumes an ISP-type environment; a
> business would
> likely have fewer issues.
>
> Then, there's the question of whether to blacklist based on the return
> address "makemoney$$$NOW$$$@yahoo.com", the domain "@yahoo.com", or the IP
> it comes from (likely the best option).
>  -Scott
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
>
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  You can E-mail
> [EMAIL PROTECTED] for assistance.  You can visit our web
> site at http://www.declude.com .
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
>
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  You can E-mail
> [EMAIL PROTECTED] for assistance.  You can visit our web
> site at http://www.declude.com .
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] File Extensions

[Greg Foulks]

Pg 232 in the Imail Users guide.

smd and smp - files being processed.
fwd and fwp - forwarded messages
lst- list messages
tmp- web messaging or mail to beeper/pager or mail to fax files
gse and gsp - error messages being returned to sender. Generated by the 
server(postmaster)

Files with ~ are locked files that are in process. These files also have an underscore 
as the first characters in the file name.

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Helpdesk
Sent: Monday, April 29, 2002 9:50 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] File Extensions


Scott,

Could you give a quick explanation of what the following file extensions
mean/indicate in the IMail spool directory?

.SMP
.SMD
.~MD
.GSE
.GSC
.VAP

Thanks,
Greg

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

Re: [Declude.JunkMail] Blacklist

[Greg Foulks]

You may already know this but you can also use the following..

[EMAIL PROTECTED] (Any mail from this address will be blocked)
a2.mediatrec.com (Any mail from this 3rd level domain will be blocked)
mediatrec.com (Any mail from this entire domain will be blocked)

If you never want to see another email from this domain again use the later.

Greg




- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, May 15, 2002 8:16 AM
Subject: Re: [Declude.JunkMail] Blacklist


>
> >When I create my own blacklist, which address in the message headers do I
> >blacklist?
>
> The blacklist uses the return address of the E-mail (the address that
> bounce messages go to, the "MAIL FROM" in the SMTP envelope).  It's the
> same address used by IMail's Kill List.  If you use the Declude JunkMail
> XSENDER option, or have a header with %MAILFROM% in it, you can use the
> header that Declude JunkMail adds.  However, you can not reliably use a
> header that was already in the E-mail (From: or Reply-To:).
>
> >For instance, give the message header below, do I blacklist
> >protege.myz.com (real origin) or a2.mediatrec.com (real from)?
>
> >X-Note: RDNS Real Origin: protege.myz.com. ([65.105.159.70])
> >X-Note: SMTP Real From: [EMAIL PROTECTED]
>
> In this case, I'm guessing you have a line "XINHEADER X-Note: SMTP Real
> From: %MAILFROM%" in the \IMail\Declude\global.cfg file.  If that is the
> case, then you would use [EMAIL PROTECTED]
> -Scott
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
>
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  You can E-mail
> [EMAIL PROTECTED] for assistance.  You can visit our web
> site at http://www.declude.com .
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Whitelist recipient address

[Greg Foulks]

I could use more WHITELIST space. I have many users who get email from AOL, YAHOO and 
MSN users. I do not want to WHITELIST the
entire domain because of the spam problems from these domains but I do want to 
WHITELIST specific users so the 200 limit gets used
up quickly.

Thanks,

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Friday, May 17, 2002 12:52 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Whitelist recipient address



>We do run JunkMail Pro, with version 1.53, so that's great!  Does is matter
>where we place the whitelist section in the global.cfg file, or can we just
>list them all at the bottom of the file?

They can go anywhere in the file.

>Why is there currently a hard limit of 200 whitelist entries?  I can't see
>where we will need more than 200 initially, but will this limit be increased
>in some future release?

We will likely increase the limit in the future.  Given the way it was
coded, a limit needed to be placed.  The WHITELIST was originally designed
for whitelisting E-mail from a few specific servers that fail a lot of spam
tests, so it wasn't envisioned that it would be used extensively.  However,
with the WHITELIST TO (and WHITELIST TODOMAIN), and people that like to
whitelist lots of domains (even at the risk of letting more spam through),
it looks like we need to allow unlimited whitelisting.
   -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Deleting spam based on test results

[Greg Foulks]

I wouldn't 
suggest it We also get legitimate email that fail the SPAMCOP and OSSRC 
tests. Try holding the mail then decide if it should be deleted or 
not.
 
Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: 
[EMAIL PROTECTED] Voice: 
614.318.5036 Fax: 614.318.5005 
-Original Message-From: 
[EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED]]On Behalf Of Glenn \ 
WCNetSent: Friday, May 17, 2002 1:29 PMTo: 
[EMAIL PROTECTED]Subject: [Declude.JunkMail] Deleting spam 
based on test results
How risky is it to out-right delete messages that 
fail the SPAMCOP or OSSRC tests?  Those sound pretty accurate for 
catching known spammers.
 
Are any of the many tests on the "DNS-based Spam 
Databases" worth putting into effect to get more accuracy out of 
Junk-Mail?
 
Glenn Z.
 

Re: [Declude.JunkMail] any advice?

[Greg Foulks]

Maybe blacklist [EMAIL PROTECTED]

??
Greg


- Original Message -
From: "Helpdesk" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, June 07, 2002 12:03 PM
Subject: [Declude.JunkMail] any advice?


> Some spammer is sending mail to our domains and addressing the "to" and
the
> "from" like the example below.
>
> From: [EMAIL PROTECTED]
> To: [EMAIL PROTECTED]
> Subject: Make Money in Real Estate
> Date: Fri, Jun 7, 2002, 4:00 AM
>
> The Declude logs show messages like this having a spam weight of 25+ (we
> consider 13+ to be spam) but I'm whitelisting the acsworld.net domain so
the
> messages are getting delivered.
>
> I know I could remove the whitelist for acsworld.net but I was wondering
if
> there is another way to stop these messages from being delivered?
>
> Quick note, the acsworld.net mail server is not running IMail but it is
> forwarding messages for some acsworld.net addresses to some subscribers
new
> acsworld.com address (acsworld.com is using an IMail server with Declude).
>
> Would whitelisting the IP address of the ".net" server instead of the
> acsworld.net domain fix the problem?
>
> Thanks,
>
> Greg
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
>
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  You can E-mail
> [EMAIL PROTECTED] for assistance.  You can visit our web
> site at http://www.declude.com .
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] FW: Win $5,000.00 a Week for Life from Publishers Clearing House

[Greg Foulks]

How did this email get through my scanner? Notice the header does not have any of the 
declude headers.

greg
--
Received: from gz-5.com [66.197.94.198] by mail.nfti.com
  (SMTPD32-6.06) id A27C7E025A; Wed, 26 Jun 2002 10:41:00 -0400
Received: (from root@localhost)by gz-5.com (8.10.2/8.10.2) id g1FEqFq01889;26 
Jun 2001 10:40:38 -0500
Date: 26 Jun 2001 10:40:38 -0500
Message-Id: <[EMAIL PROTECTED]>
Content-Type: text/html
From: Weekly PayChecks <[EMAIL PROTECTED]>
Subject: Win $5,000.00 a Week for Life from Publishers Clearing House
To: [EMAIL PROTECTED]
X-Message-ID1: CRKNWGLNEPRPSXVUQHJNJJBJECIRUSULAHEGMOSJBCQWAGVFQE:1115432:2389
X-RCPT-TO: <[EMAIL PROTECTED]>
X-UIDL: 318925016
Status: U

-Original Message-
From: Weekly PayChecks [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, June 26, 2001 11:41 AM
To: [EMAIL PROTECTED]
Subject: Win $5,000.00 a Week for Life from Publishers Clearing House




The payment schedule below will be established in your name, if you're selected the 
winner. Just click on one of the special links
in this Bulletin to continue the entry process. The weekly paychecks will be made out 
and delivered to you, should you win.



$ 5,000.00 A WEEK FOR LIFE
YEAR 1: $ 260,000.00
YEAR 2: $ 260,000.00
YEAR 3: $ 260,000.00
YEAR 4: $ 260,000.00
YEAR 5: $ 260,000.00
YEAR 6: $ 260,000.00

YEAR 7: $ 260,000.00
YEAR 8: $ 260,000.00
YEAR 9: $ 260,000.00
YEAR 10:$ 260,000.00



As the chart at right indicates, the winner of the $ 5,000.00 weekly paycheck prize 
will have an annual income that ranks among the
top 1% of all households in the United States! That amount of money would give the 
winner tremendous financial independence without
having to work another day in his or her life!

Even if you love your job, wouldn't you love to add $ 260,000.00 a year to your income?

Buy that summer home, boat, luxury car! You could have it all and more if you click 
now and complete your $ 5,000.00 Weekly
Paychecks for Life Entry Form now and have it selected the winner.

Completing this form will allow us to begin distribution of $ 5,000.00 weekly checks 
for the rest of your life should you be the
winner!

To claim this thrilling entry opportunity simply click here. Follow the directions and 
we'll make sure you receive $ 5,000.00 every
single week if you win!

So I urge you to take just a moment to respond. This is a truly exciting prize, and we 
don't want you to miss out on it!




Weekly Compensation: $ 5,000.00
Yearly Compensation: $ 260,000,000 †
» Winner guaranteed weekly paychecks for life.

» The entrant address on winning entry
 form will be paycheck mailing address.

† $ 5,000.00 X 52 Weeks = $ 260,000.00










This is a post-only message, please do not reply.
If you have any question regarding Publishers Clearing House
or other pch.com sweepstakes, please visit the pch.com
Info Center by clicking here.
Privacy Policy
Publishers Clearing House, pch.com, and their agencies are not responsible for any 
incorrect or inaccurate information or
formatting, whether caused by internet users or by any of the equipment, programming 
or software associated with or utilized in
connection with the Sweepstakes.
© 2002 Publishers Clearing House





Click here to remove yourself from any further mailings from GZ Media.

http://www.gz-5.com/sending/unsubscribe.php

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] FW: Win $5,000.00 a Week for Life from Publishers Clearing House

[Greg Foulks]

Well here is what the log says

06/26/2002 10:41:03 Qd27c25a Triggered fromfile on @gz-5.com.
06/26/2002 10:41:47 Qd27c25a WARNING: Could not unlock file due to 2 error.

Greg

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Wednesday, June 26, 2002 10:49 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] FW: Win $5,000.00 a Week for Life from
Publishers Clearing House



>How did this email get through my scanner? Notice the header does not have 
>any of the declude headers.

Have you checked the Declude JunkMail log file to see what it says for this 
E-mail (you would need to check the IMail SMTP log file to get the spool 
file name to cross-reference it with the Declude log file)?
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] FW: Win $5,000.00 a Week for Life from Publishers Clearing House

[Greg Foulks]

Would doing a "send all" from the message queue cause this? Because during this time I 
did do a "send all" so I could clear out my
queue.

Greg

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Wednesday, June 26, 2002 11:13 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] FW: Win $5,000.00 a Week for Life from
Publishers Clearing House



>Well here is what the log says
>
>06/26/2002 10:41:03 Qd27c25a Triggered fromfile on @gz-5.com.
>06/26/2002 10:41:47 Qd27c25a WARNING: Could not unlock file due to 2 error.

The "2 error" means that the E-mail file no longer exists.  It sounds like
IMail delivered the E-mail while Declude was still scanning it (which it
should not have done), or the file was renamed for some other reason.  Very
unusual.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] FW: Win $5,000.00 a Week for Life from Publishers Clearing House

[Greg Foulks]

Okay-- So what I gather is... Don't use the Send buttons unless I absolutely need to. 
;-)

I just wanted to make sure those spammers hadn't found a way around declude scanner!

thanks,
greg
(a continued happy customer!)

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Wednesday, June 26, 2002 2:02 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] FW: Win $5,000.00 a Week for Life from
Publishers Clearing House



>Would doing a "send all" from the message queue cause this? Because during 
>this time I did do a "send all" so I could clear out my
>queue.

Actually, we have just confirmed that a "Send One" or "Send All" from the 
IMail Administrator's "View Queue" will immediately unlock files that 
Declude is processing, and attempt to deliver them.  It appears that it 
only affects the specific file that you highlight (so a "Send All" or queue 
run would not harm the locked files), so if you make sure not to try to 
send E-mail that is locked (the _1234567.~MD filename format), you should 
be fine.

I do not know what the consequences are of doing a "Send One" on an E-mail 
that IMail is trying to deliver (IE whether or not it might send multiple 
copies of it).
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] OT- View queue

[Greg Foulks]

Does anyone know of a tool that will allow me to view the queue in real-time? Without 
having to use the View Queue.. button on
Imail.

Thanks,
Greg

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] I was spammed by myself

[Greg Foulks]

I get this email that say that it was sent from myself to myself. However I see some 
other interesting things in the header. What
can I use in this header to keep this from happening again?

Received: from $domain [80.16.228.101] by mail.nfti.com
  (SMTPD32-6.06) id AB048501B4; Thu, 27 Jun 2002 12:19:16 -0400
From: [EMAIL PROTECTED]
Received: from nfti.com by 687RSR1MQ.nfti.com with SMTP for [EMAIL PROTECTED]; Thu, 
27 Jun 2002 12:20:34 -0500
Message-Id: <[EMAIL PROTECTED]>
Content-Type: multipart/alternative; boundary="=_NextPart_958_86848855000616454165"
Date: Thu, 27 Jun 2002 12:20:34 -0500
Reply-To: [EMAIL PROTECTED]
X-Encoding: MIME
To: [EMAIL PROTECTED]
Subject: Mortgage Rates Have Never Been Lower
MIME-Version: 1.0
Content-Transfer-Encoding: Quoted-Printable
X-Declude-Sender: [EMAIL PROTECTED] [80.16.228.101]
X-Declude-Spoolname: D3b041b4.SMD
X-Note: This E-mail was scanned by NFTISERV's Declude JunkMail for spam.
X-Spam-Tests-Failed: None
X-Note: This E-mail was sent from host101-228.pool22816.interbusiness.it. 
([80.16.228.101]).
X-RCPT-TO: <[EMAIL PROTECTED]>
X-UIDL: 318925206
Status: U

Thanks,
Greg

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] I was spammed by myself

[Greg Foulks]

What is the HELOBOGUS test? I've not seen that one. You say that the spam headers 
would detect... why didn't it? In fact it did not
fail one test.

greg

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Thursday, June 27, 2002 1:13 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] I was spammed by myself



>I get this email that say that it was sent from myself to myself. However
>I see some other interesting things in the header. What
>can I use in this header to keep this from happening again?
>
>Received: from $domain [80.16.228.101] by mail.nfti.com
>   (SMTPD32-6.06) id AB048501B4; Thu, 27 Jun 2002 12:19:16 -0400

Here's the first key that it is spam:  $domain.  The HELOBOGUS and
SPAMHEADERS tests will detect that; a custom filter could be used too with
the latest beta.

What else do you see in the headers that is interesting?

There is a good chance that we will add a test that will look for the same
To/From addresses, which is becoming more and more popular (even though it
is common to see in legitimate mail, too).
   -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] I was spammed by myself

[Greg Foulks]

Thanks Scott 

When will this beta release move to production code?

Greg

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Thursday, June 27, 2002 2:01 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] I was spammed by myself



>What is the HELOBOGUS test? I've not seen that one.

That's in the latest beta version, and detects bogus HELO/EHLO data (for 
example, if a server sends "HELO $domain" or "EHLO i.am.a.spammer").

>You say that the spam headers would detect... why didn't it?

Because I forgot to mention that only the latest beta version would detect 
it with the SPAMHEADERS test.
   -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] I was spammed by myself

[Greg Foulks]

No but I do WHITELIST my domain.. 
greg

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of David Stavert
Sent: Thursday, June 27, 2002 2:08 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] I was spammed by myself


Do you have WHITELISTTO postmaster?

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Greg Foulks
Sent: Thursday, June 27, 2002 12:50 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] I was spammed by myself


What is the HELOBOGUS test? I've not seen that one. You say that the spam
headers would detect... why didn't it? In fact it did not
fail one test.

greg

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Thursday, June 27, 2002 1:13 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] I was spammed by myself



>I get this email that say that it was sent from myself to myself. However
>I see some other interesting things in the header. What
>can I use in this header to keep this from happening again?
>
>Received: from $domain [80.16.228.101] by mail.nfti.com
>   (SMTPD32-6.06) id AB048501B4; Thu, 27 Jun 2002 12:19:16 -0400

Here's the first key that it is spam:  $domain.  The HELOBOGUS and
SPAMHEADERS tests will detect that; a custom filter could be used too with
the latest beta.

What else do you see in the headers that is interesting?

There is a good chance that we will add a test that will look for the same
To/From addresses, which is becoming more and more popular (even though it
is common to see in legitimate mail, too).
   -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] I was spammed by myself

[Greg Foulks]

I guess what I am asking is... 

Is the beta stable enough now to take care of this $domain issue... I've been getting 
way too many of these.

or

Should I wait until the release is gold?

What do you think?

Greg

BTW- If I move to the newer (beta) version. What becomes of my current configuration?



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Thursday, June 27, 2002 2:14 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] I was spammed by myself



>When will this beta release move to production code?

I don't know.

It could be within the next few weeks, or it could take a month or so 
(mostly depending on what new features we may decide to add).  My guess is 
closer to the few weeks side, as the new filtering ability has been 
requested quite often.
   -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Is there a feature list for the JunkMail beta? Fw: [Declude.JunkMail] New filter test

[Greg Foulks]

Okay..

I just installed the new beta and was trying to test the wordfilter.

Now I noticed that my emails from hotmail are not getting through. I can't figure out 
why. The declude log says that match the
BlackHoleSender list but the address I am sending from is not in the BlackHole.

06/27/2002 16:10:54 Q712a24a Msg failed BlackHole-Senders ().
06/27/2002 16:10:54 Q712a24a Msg failed WEIGHT20 (Weight of 30 reaches or exceeds the 
limit of 20.).
06/27/2002 16:10:54 Q712a24a Msg failed WEIGHT30 (Weight of 30 reaches or exceeds the 
limit of 30.).

Any ideas what I should look at?

Greg

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Thursday, June 27, 2002 4:13 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Is there a feature list for the JunkMail
beta? Fw: [Declude.JunkMail] New filter test



>The main problem we're seeing is false positives on SPAMHEADERS, BADHEADERS...

Just a reminder here --

Although the SPAMHEADERS test will have quite a few false positives (mainly
from poorly designed websites, but the false positives go down a lot by
using the new LOOSENSPAMHEADERS ON setting in the latest beta), the
BADHEADERS test will never catch any legitimate mail unless it is sent from
a broken mail client.  So the BADHEADERS test is usually good to use either
on its own or in a weighting system.

>BTW, any interest in adding email categorization (based on content) or
>summarization algorithm?

Now that would be an interesting idea.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Is there a feature list for the JunkMail beta? Fw: [Declude.JunkMail] New filter test

[Greg Foulks]

damn your good!

I just added a list of new domains and addresses to block from a posting on this list. 
I found it deep in the middle a domain was
being blocked "mail.com" I added a "@" so it now reads "@mail.com"

Works fine now. Let this be a lesson to us all. Use the block lists at your own risks!

Greg

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Thursday, June 27, 2002 4:31 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Is there a feature list for the JunkMail
beta? Fw: [Declude.JunkMail] New filter test



>Now I noticed that my emails from hotmail are not getting through. I can't
>figure out why. The declude log says that match the
>BlackHoleSender list but the address I am sending from is not in the
>BlackHole.

Let me guess, you've told Declude to look for any return address with
"mail.com" in it?  That would catch any @hotmail.com address.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] How did this one get through

[Greg Foulks]

I have this email address blocked

[EMAIL PROTECTED] 

Yet it is still getting passed my Declude Scanner. Can anyone help with this?


Received: from postoffice.inreach.com [209.142.2.45] by mail.nfti.com with ESMTP
  (SMTPD32-6.06) id A3B91450046; Sun, 11 Aug 2002 02:27:05 -0400
Received: from Dqnf ([65.66.218.213]) by postoffice.inreach.com
  (Post.Office MTA v3.5.3 release 223 ID# 0-68376U62000L6200S0V35)
  with SMTP id com for <[EMAIL PROTECTED]>;
  Sat, 10 Aug 2002 23:26:54 -0700
From: manxminx <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: A special  good tool
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=CT3W66032BOb391463O59Y1rHfN0qG8
Message-Id: <[EMAIL PROTECTED]>
X-Declude-Sender: [EMAIL PROTECTED] [209.142.2.45]
X-Declude-Spoolname: D03b9046.SMD
X-Note: This E-mail was scanned by NFTISERV's Declude JunkMail for spam.
X-Spam-Tests-Failed: None
X-Weight: 0
X-Note: This E-mail was sent from  ([209.142.2.45]).

Thanks,
Greg
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] How did this one get through

[Greg Foulks]

It's in the sender blacklist... and it's is not in my whitelist.

greg

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Monday, August 12, 2002 10:04 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] How did this one get through



>I have this email address blocked
>
>[EMAIL PROTECTED]
>
>Yet it is still getting passed my Declude Scanner. Can anyone help with this?

Where is it blocked?  In a sender blacklist ("fromfile")?  Are other 
blocked E-mail addresses getting blocked?

Do you have any whitelists that would allow the E-mail through (which would 
override any blacklists)?
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] FW: WARNING: YOU WERE SENT A VIRUS

[Greg Foulks]

I don't know how it is... But I still keep getting emails that pass through Declude 
when they have been black listed.

???

Greg

-Original Message-
From: Nicki Bloch [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, August 20, 2002 8:43 AM
To: Greg
Subject: FW: WARNING: YOU WERE SENT A VIRUS




-Original Message-
From: Postmaster [mailto:[EMAIL PROTECTED]]
Sent: Monday, August 19, 2002 6:14 PM
To: [EMAIL PROTECTED]
Subject: WARNING: YOU WERE SENT A VIRUS


The Declude Virus Scanner software on mail.nfti.com has reported that you
were
sent an E-mail from [EMAIL PROTECTED], containing the Unknown Virus
virus in the
Unknown File attachment.  The subject of the E-mail was "W32.Elkern  removal
tools".
The E-mail containing the virus has been quarantined to prevent further
damage.

Headers Follow:
Received: from postoffice.inreach.com [209.142.2.45] by mail.nfti.com with
ESMTP
  (SMTPD32-6.06) id ADA9C7100FA; Mon, 19 Aug 2002 18:14:01 -0400
Received: from Ljz ([65.68.74.215]) by postoffice.inreach.com
  (Post.Office MTA v3.5.3 release 223 ID# 0-68376U62000L6200S0V35)
  with SMTP id com for <[EMAIL PROTECTED]>;
  Mon, 19 Aug 2002 15:13:51 -0700
From: bcal <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: W32.Elkern  removal tools
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=JhzwE3Is17sYkT0a8
Message-Id: <[EMAIL PROTECTED]>


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] FW: WARNING: YOU WERE SENT A VIRUS

[Greg Foulks]

Now that make sense. then I should but this sender in the Imail kill file? This would 
stop them from getting past the email server
right?


Greg

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff
Sent: Thursday, August 29, 2002 1:39 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] FW: WARNING: YOU WERE SENT A VIRUS


If they are blacklisted in JunkMail, JunkMail is processed after Virus.

John Tolmachoff
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Strange problem

[Greg Foulks]

I had a user today come to me and say that none of the emails they sent today where 
delivered even though they left the users
outbox. After a general look over I found that every email they were sending it was 
being blocked and deleted as spam by declude
global.cfg

Not sure what the problem was and none of my other users are having this problem. I 
added this user to the white list even though
the mail server is already on the white list and now they are able to send email and 
have them get past declude.

Has anyone else seen this problem?

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Strange problem

[Greg Foulks]

I found the problem. 

I have a block on the word cum in my wordfilter list and the users name is acummings.

How can I block the word cum without affecting this user?


Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of R. Scott Perry
Sent: Tuesday, October 22, 2002 2:34 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Strange problem



>I had a user today come to me and say that none of the emails they sent 
>today where delivered even though they left the users
>outbox. After a general look over I found that every email they were 
>sending it was being blocked and deleted as spam by declude
>global.cfg
>
>Not sure what the problem was ...

Have you checked the Declude JunkMail log file to see which test(s) the 
E-mail failed?  Have you checked your \IMail\Declude\global.cfg file to see 
what tests are set to "DELETE"?

>and none of my other users are having this problem. I added this user to 
>the white list even though
>the mail server is already on the white list and now they are able to send 
>email and have them get past declude.
>
>Has anyone else seen this problem?

It's not a problem -- it is the standard operation of Declude JunkMail.  If 
you scan outgoing E-mail and have it deleted when it fails certain tests, 
well, it will get deleted if it fails those tests.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Strange problem

[Greg Foulks]

I found the problem.

I have a block on the word c u m (take out the spaces) in my wordfilter list and the 
users name is ac u mmings (take out the
spaces).

How can I block the word c u m(take out the spaces) without affecting this user?


Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of R. Scott Perry
Sent: Tuesday, October 22, 2002 2:34 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Strange problem



>I had a user today come to me and say that none of the emails they sent
>today where delivered even though they left the users
>outbox. After a general look over I found that every email they were
>sending it was being blocked and deleted as spam by declude
>global.cfg
>
>Not sure what the problem was ...

Have you checked the Declude JunkMail log file to see which test(s) the
E-mail failed?  Have you checked your \IMail\Declude\global.cfg file to see
what tests are set to "DELETE"?

>and none of my other users are having this problem. I added this user to
>the white list even though
>the mail server is already on the white list and now they are able to send
>email and have them get past declude.
>
>Has anyone else seen this problem?

It's not a problem -- it is the standard operation of Declude JunkMail.  If
you scan outgoing E-mail and have it deleted when it fails certain tests,
well, it will get deleted if it fails those tests.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Strange problem

[Greg Foulks]

I use the delete action. How can I find the email in the archives?

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of R. Scott Perry
Sent: Tuesday, October 22, 2002 3:08 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Strange problem



>How can I block the word c u m(take out the spaces) without affecting this 
>user?

If the E-mail I sent to the list was blocked on your server, you'll need to 
go through your hold directory to find it.  If you use the DELETE action, 
well, you'll need to search the archives.  :)
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Strange problem

[Greg Foulks]

okay send it again

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of R. Scott Perry
Sent: Tuesday, October 22, 2002 3:35 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Strange problem



>I use the delete action. How can I find the email in the archives?

If you can turn off that test temporarily, I can re-send it for you.  Or, 
you can look at the link below to find the URL to the archives.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Strange problem

[Greg Foulks]

Scott,
It did not come through. Could you send the email to [EMAIL PROTECTED] or maybe 
point to where I might find info about this in
the documentation?

Thanks,

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of R. Scott Perry
Sent: Tuesday, October 22, 2002 3:35 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Strange problem



>I use the delete action. How can I find the email in the archives?

If you can turn off that test temporarily, I can re-send it for you.  Or,
you can look at the link below to find the URL to the archives.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Delog

[Greg Foulks]

It's a cool tool but I don't understand the interface. Can anyone help with a couple 
of questions?

1) The meter-Does this show how much spam is sent to the domain as a percentage of the 
total amount of email sent to the domain?

2) Interactive mode doesn't seem to work that well

3) Failed counter- failed what?

Thanks for any help!

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Email blocked by word filter

[Greg Foulks]

I had an email fail the word filter search but I can't seem to find which word 
triggered the block. Any suggestions on how I can
find the word that triggered the block?

Thanks,

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Email blocked by word filter

[Greg Foulks]

Thanks Scott-

Couple more questions...

1) How do I find out which version I am running?

2) I don't use WARN and if I'm not using 1.65 do you have any other way of finding 
what line of the test it failed?

Thanks,

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Monday, December 23, 2002 10:49 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Email blocked by word filter



>I had an email fail the word filter search but I can't seem to find which 
>word triggered the block. Any suggestions on how I can
>find the word that triggered the block?

If you are running the latest release (1.65), and use LOGLEVEL HIGH, 
Declude JunkMail will record the line number in the filter file that 
triggered the test.  It will also appear in the headers if you use the WARN 
action.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Email blocked by word filter

[Greg Foulks]

John,
Looking at the declog I see this as the error for the email that failed.

12/23/2002 11:05:47 Q33ef3e4 Msg failed MYFILTER (Message failed MYFILTER test (21)).


Are you saying that the (21) is the line that the message failed at?

Thanks,

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff
Sent: Monday, December 23, 2002 10:53 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Email blocked by word filter


> I had an email fail the word filter search but I can't seem to find which
word
> triggered the block. Any suggestions on how I can
> find the word that triggered the block?

If you have set to WARN action, then there will be a number in () after the
test name in the headers that indicate the last line number of the filter
that failed.

John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com




---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Email blocked by word filter

[Greg Foulks]

Found it. I had a filter in the body defined for xxx this triggered the test and the 
email was blocked.

Funny but I didn't have a single reference in the body of the email "xxx" but I did 
have a couple of attachment and when looking at
the raw ext of the email with the attachments I found the "xxx" reference.

Very Strange

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Monday, December 23, 2002 12:34 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Email blocked by word filter



>1) How do I find out which version I am running?

You can type "\IMail\Declude -diag" (exactly like that, from a command
prompt) to find out.

 > 12/23/2002 11:05:47 Q33ef3e4 Msg failed MYFILTER (Message failed
MYFILTER test (21)).

This indicates that the E-mail triggered the filter on line 21.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Found an email that was not scanned by Declude JunkMail

[Greg Foulks]

I'm going through some emails 
that I've saved up that I've received and am in the process of adding them to my 
black list. I found an email that was not scanned by Declude. I say this because 
it doesn't have any of the Declude tags added to the header.
 
Here is what the header looks 
like.
 
Received: from 
emx02.exitrequest.com [198.77.63.35] by mail.nfti.com with ESMTP  
(SMTPD32-6.06) id A2B050176; Fri, 10 Jan 2003 17:01:20 -0500Received: (from 
tppn@localhost) by 
emx02.exitrequest.com (8.11.6/8.11.6) id h0AM42R13226 for [EMAIL PROTECTED]; Fri, 10 Jan 2003 
17:04:02 -0500Date: Fri, 10 Jan 2003 17:04:02 -0500Message-Id: <[EMAIL PROTECTED]>From: 
Perfect Skin <[EMAIL PROTECTED]>To: 
[EMAIL PROTECTED]Subject: 
Finally, perfect Skin at any age...At No ChargeContent-type: 
text/htmlX-RCPT-TO: <[EMAIL PROTECTED]>X-UIDL: 
318944106Status: U
 
 
Normally our headers look like 
this...
 
Received: from 
rev1.listadps248.com [64.70.45.26] by mail.nfti.com with ESMTP  
(SMTPD32-6.06) id AC0FEB0390; Fri, 10 Jan 2003 16:33:03 -0500Received: from 
[10.0.1.15] by rev1.listadps248.com (10.0.1.33) with QMQP; 10 Jan 2003 
17:33:24 +Message-Id: <1soljn$[EMAIL PROTECTED]>To: 
[EMAIL PROTECTED]Date: Fri, 10 
Jan 2003 10:02:00 -0800Reply-To: [EMAIL PROTECTED]From: 
new year giveaway <[EMAIL PROTECTED]>Subject: 
Two Complimentary Airline TicketsMIME-Version: 1.0X-Mailer-Version: v 
11130388Content-type: text/htmlX-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?64.70.45.26X-Declude-Sender: 
[EMAIL PROTECTED] 
[64.70.45.26]X-Declude-Spoolname: D3c0f390.SMDX-Note: This E-mail was 
scanned by NFTISERV's Declude JunkMail for spam.X-Spam-Tests-Failed: 
SPAMCOP, SPAMCOP2, WEIGHT10X-Weight: 18X-Note: This E-mail was sent from 
rev1.listadps248.com. ([64.70.45.26]).X-RCPT-TO: <[EMAIL PROTECTED]>X-UIDL: 
318944083Status: U
Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: 
[EMAIL PROTECTED] Voice: 
614.318.5036 Fax: 614.318.5005 
 

RE: [Declude.JunkMail] Found an email that was not scanned by Declude JunkMail

[Greg Foulks]

John,
I do have those turned on. Here is what my INHeader looks like

CONSOLE OFF
XINHEADER   X-Note: This E-mail was scanned by NFTISERV's Declude JunkMail for 
spam.
XINHEADER   X-Spam-Tests-Failed: %TESTSFAILED%
XINHEADER   X-Weight: %WEIGHT%
#IPBYPASS   127.0.0.1
XSENDER ON
XSPOOLNAME  ON
XINHEADER   X-Note: This E-mail was sent from %REVDNS% ([%REMOTEIP%]).

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff
Sent: Wednesday, January 15, 2003 1:37 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Found an email that was not scanned by
Declude JunkMail


I will add that it is very useful to have in the Global.cfg file:

XSENDER ON
XSPOOLNAME ON
XINHEADER   X-Tests-Failed: %TESTSFAILED%

Those three lines go a long way to helping to quickly know what is going on.

John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Found an email that was not scanned by Declude JunkMail

[Greg Foulks]

Scott,
No they do not.

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Wednesday, January 15, 2003 1:16 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Found an email that was not scanned by
Declude JunkMail



>I'm going through some emails that I've saved up that I've received and am 
>in the process of adding them to my black list. I found an email that was 
>not scanned by Declude. I say this because it doesn't have any of the 
>Declude tags added to the header.

Do your Declude JunkMail log file show any entries for this E-mail?
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Found an email that was not scanned by Dec lude JunkMail

[Greg Foulks]

Thanks Andrew! I'll just watch to see if this happens again before I get too worried 
about it.



Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Colbeck, Andrew
Sent: Wednesday, January 15, 2003 1:57 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.JunkMail] Found an email that was not scanned by
Dec lude JunkMail


I've had this happen several times, too, Greg.  If you are inclined to
search the archives from two or three weeks ago, you will find a reply from
Scott regarding a terse error message the Declude log file; the upshot was
that if you look in your IMail and Declude logs, you will find this error
message and that the Q*.smd file was locked or missing when Declude went to
do it's part.

When I looked into it, I found that my IMail had logged that it tried to
deliver the same message twice, deleting the Q*.SMD file and orphaning the
D*.smd file.  Since it has happened so few times, I haven't bothered to take
up the issue with Ipswitch.

Andrew 8)

-----Original Message-
From: Greg Foulks [mailto:[EMAIL PROTECTED]] 
Sent: Wednesday, January 15, 2003 10:45 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Found an email that was not scanned by
Declude JunkMail

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Found an email that was not scanned by Declude JunkMail

[Greg Foulks]

Hey Scott- I do have gp1 and gp2 files. Should I send them to [EMAIL PROTECTED]?

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Wednesday, January 15, 2003 3:04 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Found an email that was not scanned by
Declude JunkMail



>No they do not.

If there is nothing in the log files, most likely Declude didn't see the 
E-mail at all.  This should rarely ever happen, but could if for example 
you were upgrading IMail at the time (if IMail overwrote the Declude 
registry entry, and the E-mail arrived before Declude was back in place).

Another possibility is that something went wrong internally within 
Declude.  If this was the case, there should be C:\Declude.gp1 and 
C:\Declude.gp2 files, which you can send to me and I can check to see what 
happened.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Exclude Local Users from the Wordfilter test

[Greg Foulks]

Is it possible to exclude local 
users from the Wordfilter test. I have some users that are trying to send out 
group messages but some of the content is being caught in the wordfilter and 
they have a legitimate reason to use some of these words.
 
Thanks,
Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: 
[EMAIL PROTECTED] Voice: 
614.318.5036 Fax: 614.318.5005 
 

RE: [Declude.JunkMail] Exclude Local Users from the Wordfilter test

[Greg Foulks]

John,
Good point. Questions though about the order that test are run. If adding a fromfile 
test how would that effect spam that is sent to
in to our mail server with an internal user as the return address?

Thanks,

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff
Sent: Thursday, January 16, 2003 10:50 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Exclude Local Users from the Wordfilter
test


Here is an idea for you.

The word filter tests are in one file as one test.

Create a new test as a fromfile and list the from addresses of your uses and
use a negative fail weight equal to or more than the wordfilter test.

Example:

WORDFILTER1 filter  C:\imail\declude\wordfilter1.txt
x   20  0
LOCALUSER   fromfile
C:\imail\declude\localuser.txt  x   -20 0

John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Exclude Local Users from the Wordfilter test

[Greg Foulks]

Just like what Scott said. What if I create this fromfile and add a negative weight of 
20 and a Spam message comes in with a From or
Return address that matches one of the address in the fromfile. Won't it then take 20 
points away from the weight of the message?

I guess the other part of the question was

What is the order of tests that are executed?

is it...

-Global
-Blacklist
-wordfilter
-fromfile
-ipfilter

or some other order? I ask this because it will determine how I assign the values of 
the weights.

Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff
Sent: Thursday, January 16, 2003 11:44 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Exclude Local Users from the Wordfilter
test


> Good point. Questions though about the order that test are run. If adding
a fromfile
> test how would that effect spam that is sent to
> in to our mail server with an internal user as the return address?

Greg, do you mean an e-mail sent to your local users which has the return or
from address the same as the to address?

John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] how much is junk?

[Greg Foulks]

How did you configure delog to scan more than 1 file?

Greg 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Helpdesk
Sent: Thursday, February 13, 2003 2:46 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] how much is junk?


on 2/13/03 2:36 PM, paul wrote:

> Ok guys, what do you see in ratio of junk vs good mail per day?

Spam messages account for over 75% of our incoming messages (we're an ISP).

Later,
Greg

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Fwd: Declude Virus caught a virus

[Greg Foulks]

Were getting a increase in emails with that contain viruses. I want to 
block the sender but the sender address is being forged. I have the remote 
IP/domain where the email's are coming from. Can I just include the domain 
in my blacklist even though it's not the sender?

Thanks,
Greg

Date: Tue,  3 Jun 2003 14:07:45 -0400
From: "Postmaster" <[EMAIL PROTECTED]>
Reply-To: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: Declude Virus caught a virus
X-Mailer: 
Declude Virus v1.55i caught the Unknown Virus virus in Unknown File
from [EMAIL PROTECTED] to:  [EMAIL PROTECTED]
Date:   06/03/2003 14:07:44
Subject:Re: Movie
Spool File: De3ea290.SMD
Remote IP:  140.254.46.146
Headers:
Received: from STATION16 [140.254.46.146] by mail.nfti.com with ESMTP
  (SMTPD32-6.06) id A3EA50F0290; Tue, 03 Jun 2003 14:07:38 -0400
From: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: Re: Movie
Date: Tue, 3 Jun 2003 14:10:50 --0400
Importance: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.
X-MSMail-Priority: Normal
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="CSmtpMsgPart123X456_000_008C6F80"
Message-Id: <[EMAIL PROTECTED]>
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Fwd: Declude Virus caught a virus

[Greg Foulks]

Thanks Scott -- I'll give that a go.

Greg

At 02:27 PM 6/3/2003 -0400, you wrote:

Were getting a increase in emails with that contain viruses. I want to 
block the sender but the sender address is being forged. I have the 
remote IP/domain where the email's are coming from. Can I just include 
the domain in my blacklist even though it's not the sender?
You could use an IP blacklist (not a sender blacklist), but Declude Virus 
takes priority, so Declude JunkMail won't see it.

In this case, you can use the IMail Control Access file to block the IP.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.