[Declude.JunkMail] Ip blacklist file

[Jeff Maze]

Hello,
I have a question.  I have a test that when a spam message comes
through the filters and not caught, I add the whole /24 IP address range to
a file so that if a message arrives from the IP range again, it's
automatically set to a weight that gets the message forwarded to an e-mail
account for review.
Anyway, I would like to add the IP addresses of hotmail, etc. so
that if a message comes through from the hotmail servers, I don't
inadvertently block it.
Can I just add a '#' before the IP address to 'rem' it out and
Declude won't block it?
Thanks..


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] E-Mail to download v1.8

[Jeff Maze]

Really?  I don't see it..  I see the manual and automatic downloads for it,
and the other links take me other places..
 
What am I missing?  Think it may just be a blonde moment..

  _  

From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson
Sent: Tuesday, September 28, 2004 9:45 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] E-Mail to download v1.8


Jeff,
I was able to get it via my account login at www.declude.com.  
 
Keith

-Original Message- 
From: [EMAIL PROTECTED] on behalf of Jeff Maze 
Sent: Tue 9/28/2004 10:33 AM 
To: [EMAIL PROTECTED] 
Cc: 
Subject: [Declude.JunkMail] E-Mail to download v1.8



Hello,
Just wanted to know if there's a place to download the latest .cfg
files to handle the v1.8 additions.  Or even an updated declude manual?

Thanks..


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


<>

[Declude.JunkMail] E-Mail to download v1.8

[Jeff Maze]

Hello,
Just wanted to know if there's a place to download the latest .cfg
files to handle the v1.8 additions.  Or even an updated declude manual?

Thanks..


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] [OT] Nice - Stupid People

[Jeff Maze]

Got this in the hostmaster account today.  Just thought y'all would like
this.

The guy receives a spam mail and instead of investigating it further or
blocking it, he e-mails everyone in the government saying we are committing
"Fraud Copyright".  Yeah, we're in NE Ohio and going to fly to Germany to
send out something like this.  Gee, they won't catch us now.  Dang, this guy
did and now we're in trouble.  Give me a break..  Heck even the
[EMAIL PROTECTED] account isn't created so if he replied to that, it would
have bounced on him..

_
The people he sent the e-mail to:
From:  Security: Arends Communications LLC
[EMAIL PROTECTED]
To:  [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED];
[EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED];
[EMAIL PROTECTED]; [EMAIL PROTECTED]


The e-mail:
__


fraud copyright
 

Whois spoofed IP: 
Registrant:
Crescent Digital (AURORAPR-DOM)
   23400 Mercantile Rd.
   Suites 4 & 5
   Beachwood, OH 44118
   US
 
   Domain Name: AURORAPR.COM
 
   Administrative Contact, Technical Contact:
  Master, Host  (GJRPAEGMHI)
[EMAIL PROTECTED]
  Crescent Digital
  23400 Mercantile Rd.
  Suite 4 & 5
  Beachwood, OH 44024
  US
  216-378-0360 fax: 216-378-0372
 
   Record expires on 15-Aug-2005.
   Record created on 16-Aug-1995.
   Database last updated on 21-Sep-2004 22:46:06 EDT.
 
   Domain servers in listed order:
 
   NS1.CRESCENTDIGITAL.COM  67.17.218.3
   NS2.CRESCENTDIGITAL.COM  67.17.218.4
 
 
Return-Path: <[EMAIL PROTECTED]>
Received: from pD951102D.dip.t-dialin.net (pD951102D.dip.t-dialin.net
[217.81.16.45])
   by arendscommunications.com
(8.12.11/8.12.6) with SMTP id i8M1kj8n008799
   for
<[EMAIL PROTECTED]>; Wed, 22 Sep 2004 01:47:02 GMT
   (envelope-from [EMAIL PROTECTED])
Message-ID: <[EMAIL PROTECTED]>
From: "Vanessa J. Smith" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Popular soft - bottom prices
Date: Wed, 22 Sep 2004 01:31:20 +
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="=_NextPart_000__2937039B.75E30923"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.
X-ClamAV: clean
Status:   
 
 
Kev
Server Time Zone: GMT
 
 
-Original Message-
From: Vanessa J. Smith [mailto:[EMAIL PROTECTED] 
Sent: Wednesday, September 22, 2004 1:31 AM
To: [EMAIL PROTECTED]
Subject: Popular soft - bottom prices

Access all the popular software possible for bottom prices!
Our software is 2-10 times cheaper than sold by our competitors.

A few examples:

$80 Windows XP Professional
$120 Microsoft Office 2003 Professional
$100 Adobe Photoshop 8.0/CS
$50 Norton Internet Security Pro 2004 Professional (Including: AntiVirus +
AntiSpam + Firewall)
$180 Macromedia Studio MX 2004 (Including: Dreamweaver MX + Flash MX +
Fireworks MX)
$150 Adobe Acrobat 6.0 Professional
$20 Red Hat Linux 7.3

Categories: Business, Internet, Antivirus, Security, etc.
And lots more... Enter here:

Mirror 1: http://www.softsale.ws
Mirror 2: http://www.decasoft.org

Best regards,
Vanessa J. Smith
_ 
To change your mail preferences, go: http://www.softsale.ws/uns.htm
_ 
 


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Blacklisted again

[Jeff Maze]

Hook the server up to a hub and then hook another computer 
to the hub..  Next, get a network sniffer (Linux machine and ethereal works 
great) and sniff to see what information is being passed..  Run it for 
about 30 seconds and you should have enough information to begin working 
with..
 


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Richard 
FarrisSent: Wednesday, September 15, 2004 10:16 PMTo: 
[EMAIL PROTECTED]Subject: [Declude.JunkMail] Blacklisted 
again

I just got 
blacklisted again with Spamcop...I have taken out every IP address from my mail 
server except for my 1 dial up pool...Everyone else must authenticateMy 
server is still at almost 100% most of the time...I am still sending out spam 
but how do I tell where it is coming from...
Richard FarrisEthixs 
Online1.270.247. Office1.800.548.3877 Tech Support"Crossroads to 
a Cleaner Internet"
    

RE: [Declude.JunkMail] JS/IFromot.A Notifications

[Jeff Maze]

Ooops.. Dang.. Wrong list.. Hahah Sorry..
 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Thursday, September 09, 2004 10:37 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] JS/IFromot.A Notifications

1. You would ask on the Declude.Virus list.
2. You would add a FORGINGVIRUS entry.

John Tolmachoff
Engineer/Consultant/Owner
eServices For You

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- 
> [EMAIL PROTECTED] On Behalf Of Jeff Maze
> Sent: Thursday, September 09, 2004 7:18 AM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] JS/IFromot.A Notifications
> 
> Hello,
>   What would we add so that these notifications aren't being sent out?
> Should we just add 'IFromot' to the SPOOFINGVIRUS entry within Virus.cfg?
> 
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] JS/IFromot.A Notifications

[Jeff Maze]

Hello,
What would we add so that these notifications aren't being sent out?
Should we just add 'IFromot' to the SPOOFINGVIRUS entry within Virus.cfg?


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] [OT] Student needs money for school..

[Jeff Maze]

Looking at the headers of spam that came into our spam account, I noticed
this header:

Received: from 67.17.218.5 [218.69.212.203] by mail.crescentdigital.com
  (SMTPD32-6.06) id A39D801DE; Tue, 10 Aug 2004 19:00:45 -0400
Received: from 18.142.129.10 by 218.69.212.203; Tue, 10 Aug 2004 21:54:09
-0100

I did a whois on the 218.69.212.203 ip and it's traced back to networks in
China, but the Received line below that I found interesting.  The
18.142.129.10 IP is traced back to MIT.  Looks like someone at MIT has
hacked into the China server and is using that server to send out spam; and
probably getting paid for it too.  Kinda Funny..

linux:~ # whois 218.69.212.203
inetnum:  218.67.128.0 - 218.69.255.255
netname:  CNCGROUP-TJ
country:  CN
descr:CNCGROUP Tianjin province network
address:  No.156,Fu-Xing-Men-Nei Street,
address:  Beijing,100031,P.R.China

linux:~ # whois 18.142.129.10
OrgName:Massachusetts Institute of Technology
OrgID:  MIT-2
Address:Room W92-190
Address:77 Massachusetts Avenue
City:   Cambridge
StateProv:  MA
PostalCode: 02139-4307
Country:US
NetRange:   18.0.0.0 - 18.255.255.255
CIDR:   18.0.0.0/8
NetName:MIT


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] [OT] Sendmail secondary server checks DB for users

[Jeff Maze]

Hello,
I don't remember if it was on this list, but I remember reading
somewhere that someone setup a sendmail/postfix server running as a
secondary mail server and to help curb the amount of dictionary attack
e-mails (TO: [EMAIL PROTECTED], [EMAIL PROTECTED], ... [EMAIL PROTECTED], etc.),
they had the sec server look up valid e-mail address in a database (I
believe via MySQL).  If it was valid, then it forwarded it onto the primary
server; if not, it dumped it.
We're getting a lot of dictionary attack e-mails through our sec
server and would like to implement something like this (if possible).  Thank
you for your time and attention.. -Jeff


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Spam tests

[Jeff Maze]

Looks like SpamAssassin to me.. 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Scott MacLean
Sent: Wednesday, August 04, 2004 1:44 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Spam tests

I received a forwarded email with these headers today. Don't know which spam
filter product generated them, but they look like some neat tests:

*  0.3 NO_REAL_NAME From: does not include a real name
*  0.9 FROM_ENDS_IN_NUMS From: ends in numbers
*  0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
*  0.0 CONGRATULATIONS BODY: Congratulations - you've been scammed?
*  0.1 LINES_OF_YELLING_2 BODY: 2 WHOLE LINES OF YELLING DETECTED
*  0.0 LINES_OF_YELLING BODY: A WHOLE LINE OF YELLING DETECTED
*  0.6 SUBJ_ALL_CAPS Subject is all capitals
*  2.2 FROM_HAS_ULINE_NUMS From: contains an underline and
numbers/letters
*  1.6 NIGERIAN_BODY1 Message body looks like a Nigerian spam message 1+

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] [OT] Good iMail syslog viewer

[Jeff Maze]

Hello,
    Was wondering if anyone knows of a good iMail syslog 
viewer.  Would like to see the IP addresses of messages arriving to try and 
block the [EMAIL PROTECTED], [EMAIL PROTECTED], etc. type of mass 
mailers..
    Thanks..
 

[Declude.JunkMail] [OT] Microsoft to enforce Sender ID checks

[Jeff Maze]

http://www.infoworld.com/article/04/07/22/HNmicrosoftid_1.html


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities

[Jeff Maze]

Hmmm.. Have a link for Kiwi? 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jeff Kratka
Sent: Friday, July 16, 2004 2:16 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities

 I'm still running v6.06 (mostly due to cost). One thing I found was moving
the spool directory to a completely different location and using Kiwi for my
syslog it helped alot.


Jeff Kratka

TymeWyse Internet
P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417
tel/fax: (541) 839-6027  -  [EMAIL PROTECTED]



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Jose Gosende
Sent: Friday, July 16, 2004 6:57 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities


Does anyone know of any vulnerabilities in iMail 6.06?
Within a minute after turning on iMail's SMTP service my server becomes
completely unresponsive and eventually goes down. I've also installed all of
the 6.06 related patches from Ipswitch's site.

Jose
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.721 / Virus Database: 477 - Release Date: 7/16/2004

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities

[Jeff Maze]

We're running 6.06 and haven't had that problem yet (knocks on wood).  But I
do know there are certain MS patches that will mess up the display of the
admin page (2000 SP4 for example).

Is it possible you just ran an MS update and one of those messed the system
up?  iMail is an old version and these updates might mess something up.  I
hate trying to run a system on outdate hardware and software.  If only the
bosses would listen.  hahaha

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jose Gosende
Sent: Friday, July 16, 2004 9:57 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities

Does anyone know of any vulnerabilities in iMail 6.06?
Within a minute after turning on iMail's SMTP service my server becomes
completely unresponsive and eventually goes down. I've also installed all of
the 6.06 related patches from Ipswitch's site.

Jose
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.721 / Virus Database: 477 - Release Date: 7/16/2004

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] New Phishing attempt

[Jeff Maze]

Just FYI for y'all..  I just go this in one of our mail accounts:
___
Dear Wells Fargo account holder, 
We regret to inform you, that we had to block your Wells Fargo account
because we have been notified that your account may have been compromised by
outside parties.

Our terms and conditions you agreed to state that your account must always
be under your control or those you designate at all times. We have noticed
some activity related to your account that indicates that other parties may
have access and or control of your information in your account.

These parties have in the past been involved with money laundering, illegal
drugs, terrorism and various Federal Title 18 violations. In order that you
may access your account we must verify your identity by clicking on the link
below.

Please be aware that until we can verify your identity 
no further access to your account will be allowed and we will have no other
liability for your account
or any transactions that may have occurred as a result of your failure to
reactivate your account as
instructed below.

Thank you for your time and consideration in this matter.

Please follow the link below and renew your account information

https://online.wellsfargo.com/cgi-bin/signon.cgi

Before you reactivate your account, 
all payments have been frozen, and you will not be able to use your account
in any way
until we have verified your identity.

___
Clicking on the above link takes you here:
http://online_wellsfargo_com_account.rndsystems.co.kr:7308/wells.htm

___
Internet headers of message:
Received: from sunshim [211.238.153.250] by mail.crescentdigital.com
  (SMTPD32-6.06) id AC3F1C70038; Sat, 10 Jul 2004 13:49:51 -0400
From: "Wells Fargo National Association" <[EMAIL PROTECTED]>
To: "Hostmaster" <[EMAIL PROTECTED]>
Subject: Your account at Wells Fargo has been suspended
Date: Sun, 11 Jul 2004 02:46:38 +0900
Reply-To: "Wells Fargo National Association" <[EMAIL PROTECTED]>
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
X-Priority: 3 (Normal)
Importance: Normal
X-Mailer: EM: 4.52.0.790
Content-Type: multipart/alternative;  boundary="_PartID_397661559923674"
X-RBL-Warning: HELOBOGUS: Domain sunshim returns a server failure for MX or
A records.
X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 211.238.153.250
with no reverse DNS entry.
X-Declude-Sender: [EMAIL PROTECTED] [211.238.153.250]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: HELOBOGUS, REVDNS [9]
X-Note: This E-mail was sent from [No Reverse DNS] ([211.238.153.250]).
X-RCPT-TO: <[EMAIL PROTECTED]>
X-UIDL: 381729393
Status: U


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Whitelist.txt within domain folders

[Jeff Maze]

Ok.. Thanks..

I guess the client will have to live with it..  Hahahah  I put the e-mail
addresses for the domain in the whitelist file but with the spammers out
there and other mailers out there, they're putting the domain e-mail
addresses in the x-sender field and the spam is getting whitelisted and
through..

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Wednesday, July 07, 2004 1:26 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Whitelist.txt within domain folders


>Was just wondering if we can put IP addresses within the whitelist.txt 
>file that is in the domain folders.

No -- only E-mail addresses or domains are allowed there.

>If not, is it a future feature possibility?

It is something that we are considering.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Whitelist.txt within domain folders

[Jeff Maze]

Was just wondering if we can put IP addresses within the whitelist.txt file
that is in the domain folders.

If not, is it a future feature possibility?


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] [Declude.Virus] OT- Anyone know about this latest "attack" reported by CNN?

[Jeff Maze]

Oh darn.. The page didn't open in Opera 7.51 and Norton Antivirus 2004
caught the download.ject worm..  :)

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
Sent: Friday, June 25, 2004 2:37 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.JunkMail] [Declude.Virus] OT- Anyone know about this
latest "attack" reported by CNN?

Your webservers, sure.  That's the easy part, the patch was available in
early April.

Your desktops, no, not if your users use Internet Explorer.  There is no
patch yet, and it's been exploited for at least 2 months.

For a whitehat demonstration, use your fully patched IE to go to:

http://62.131.86.111/security/idiots/repro/installer.htm

Note that in an actual infection, the URL wouldn't be *quite* so obvious.

We're also seeing routine infections of zip files with viruses in them, and
they're too new for our vendor to keep up.

Andrew 8)

-Original Message-
From: Sharyn Schmidt [mailto:[EMAIL PROTECTED]
Sent: Friday, June 25, 2004 7:39 AM
To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] [Declude.Virus] OT- Anyone know about this
latest "attack" reported by CNN?


Thanks!

We are patched.

Sharyn


We are the worldwide producer and marketer of the award winning Cruzan
Single Barrel Rum, judged "Best in the World" at the annual
San Francisco Wine and Spirits Championships. For
more information, please click (go to) http://www.cruzanrums.com";>www.cruzanrums.com
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: Possible Spam: RE: [Declude.JunkMail] NDR's

[Jeff Maze]

Great.. Thanks.. 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Rich
Sent: Friday, June 11, 2004 10:50 AM
To: [EMAIL PROTECTED]
Subject: Re: Possible Spam: RE: [Declude.JunkMail] NDR's

I'm working on creating one, a version of what we have, it's started at
http://www.kendra.com/Support/PerUser_Gateway/index.htm, I'm trying to
finish it today.

Rich


- Original Message -----
From: "Jeff Maze" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, June 11, 2004 8:42 AM
Subject: RE: Possible Spam: RE: [Declude.JunkMail] NDR's


> Was there a HOWTO you found online to do this?  Wouldn't mind attempting
> this when I get a chance..
>
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Rich
> Sent: Friday, June 11, 2004 10:33 AM
> To: [EMAIL PROTECTED]
> Subject: Re: Possible Spam: RE: [Declude.JunkMail] NDR's
>
> We've been getting upwards of 30k messages a day which are NDR's with our
> domain name, but with a randomly generated username.  We found that
although
> our mail server is more then capable of handling the volume, it was
creating
> a lot of lag with POP3 accounts when the server was being hammered with
the
> dang things.  Seems this is getting to be the latest craze, spamming with
> legit domain names attached to a random username.
>
> So what we did was to set up two BSD/Postfix boxes that filter based on a
> list of our valid users which we update as needed.  The incoming NDR's are
> then trashed at the BSD/Postfix level and Imail and Declude don't have to
> deal with them.  This is kind of like Len Conrads Imgate, but it only
checks
> for a valid username before relaying the email into the Imail box.
>
> Rich
>
>
> - Original Message -
> From: "declude" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Friday, June 11, 2004 4:05 AM
> Subject: Possible Spam: RE: [Declude.JunkMail] NDR's
>
>
> > Markus
> >
> > We are seeing 1 in 10 email's which are NDR's and are nothing to do with
> the german-politic spam messages.
> >
> > Look's like we have a new problem, which is growing quickly.
> >
> > Scott I hope you can help on this one or anyone else...
> >
> > Kevin
> >
> >
> > -- Original Message --
> > From: "Markus Gufler" <[EMAIL PROTECTED]>
> > Reply-To: [EMAIL PROTECTED]
> > Date:  Fri, 11 Jun 2004 12:49:55 +0200
> >
> > >
> > >> We are seeing a lot of NDR's coming from ligit servers, with
> > >> a spoofed user name, but a correct domain name.
> > >>
> > >> What would be the best way to deal with this ever growing problem.
> > >
> > >Yipiieee  :-)
> > >I'm not the only one having this problem.
> > >
> > >As I can see this are NDR's from current spam messages having forged
but
> > >real existing mailfrom addresses and a lot of random recipient names in
> > >combination with valid domains. (german-politic spam messages send from
> > >sober.g zombies)
> > >
> > >Markus
> > >
> > >
> > >---
> > >[This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> > >
> > >---
> > >This E-mail came from the Declude.JunkMail mailing list.  To
> > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > >type "unsubscribe Declude.JunkMail".  The archives can be found
> > >at http://www.mail-archive.com.
> > >
> > >
> > >[ PS. This email has been securely processed by Sorting Office ]
> > >
> > >
> > >
> > __
> > This email has been Processed using Sorting Office Email Services
> > This email and any attachments are confidential to the intended
> > recipient and may also be privileged. If you are not the intended
> > recipient please delete it from your system and notify the sender.
> > You should not copy it or use it for any purpose nor disclose or
> > distribute its contents to any other person.
> >
> >Sorting Office Email Filter Solution
> > Anti-Virus | Anti-Spam
> > For kad.co.uk
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubsc

RE: Possible Spam: RE: [Declude.JunkMail] NDR's

[Jeff Maze]

Was there a HOWTO you found online to do this?  Wouldn't mind attempting
this when I get a chance..
 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Rich
Sent: Friday, June 11, 2004 10:33 AM
To: [EMAIL PROTECTED]
Subject: Re: Possible Spam: RE: [Declude.JunkMail] NDR's

We've been getting upwards of 30k messages a day which are NDR's with our
domain name, but with a randomly generated username.  We found that although
our mail server is more then capable of handling the volume, it was creating
a lot of lag with POP3 accounts when the server was being hammered with the
dang things.  Seems this is getting to be the latest craze, spamming with
legit domain names attached to a random username.

So what we did was to set up two BSD/Postfix boxes that filter based on a
list of our valid users which we update as needed.  The incoming NDR's are
then trashed at the BSD/Postfix level and Imail and Declude don't have to
deal with them.  This is kind of like Len Conrads Imgate, but it only checks
for a valid username before relaying the email into the Imail box.

Rich


- Original Message -
From: "declude" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, June 11, 2004 4:05 AM
Subject: Possible Spam: RE: [Declude.JunkMail] NDR's


> Markus
>
> We are seeing 1 in 10 email's which are NDR's and are nothing to do with
the german-politic spam messages.
>
> Look's like we have a new problem, which is growing quickly.
>
> Scott I hope you can help on this one or anyone else...
>
> Kevin
>
>
> -- Original Message --
> From: "Markus Gufler" <[EMAIL PROTECTED]>
> Reply-To: [EMAIL PROTECTED]
> Date:  Fri, 11 Jun 2004 12:49:55 +0200
>
> >
> >> We are seeing a lot of NDR's coming from ligit servers, with
> >> a spoofed user name, but a correct domain name.
> >>
> >> What would be the best way to deal with this ever growing problem.
> >
> >Yipiieee  :-)
> >I'm not the only one having this problem.
> >
> >As I can see this are NDR's from current spam messages having forged but
> >real existing mailfrom addresses and a lot of random recipient names in
> >combination with valid domains. (german-politic spam messages send from
> >sober.g zombies)
> >
> >Markus
> >
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list.  To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >type "unsubscribe Declude.JunkMail".  The archives can be found
> >at http://www.mail-archive.com.
> >
> >
> >[ PS. This email has been securely processed by Sorting Office ]
> >
> >
> >
> __
> This email has been Processed using Sorting Office Email Services
> This email and any attachments are confidential to the intended
> recipient and may also be privileged. If you are not the intended
> recipient please delete it from your system and notify the sender.
> You should not copy it or use it for any purpose nor disclose or
> distribute its contents to any other person.
>
>Sorting Office Email Filter Solution
> Anti-Virus | Anti-Spam
> For kad.co.uk
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Can you do WHITELISTING in the $default$.JunkMail.txt file?

[Jeff Maze]

Do the per-domain setup..

1.  Create a folder for each domain or domains that you want this per-domain
whitelisting for, within the X:\iMail\Declude folder.  E.g.  example.com (I
did all of our domains that we host just because the default
$default$.junkmail file was getting huge with all the whitelisted e-mail
addresses).

2.  Copy $default$.junkmail and the *.eml files to this directory.

3.  Edit the $default$.junkmail file and add the following line (I put mine
after the SPAMDOMAINS test):
WHITELISTFILE   %location of whitelist text file%
e.g. WHITELISTFILE   X:\imail\declude\example.com\%ftp access
folder%\whitelist.txt
I wouldn't give them full access to all the *.eml files as well as
the $default$.junkmail file, so this is why I added the %ftp access folder%
listing.

4.  Also, you can edit the $default$.junkmail file if you want certain
things to happen with messages that fail certain tests.  E.g.  If this
example.com boss only wants messages routed, deleted, etc. for messages that
fail the WEIGHT10 test, then you can.  This $default$.junkmail file
overrides the default $default$.junkmail file within the X:\imail\Declude
folder.

5.  Create the whitelist.txt file and add e-mail addresses that you wish to
have whitelisted for certain domains.
whitelist.txt
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
@example.com
.morebeforethisdomain.com

Hope this helps you out..

> _ 
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]  On Behalf Of Brent Brashear
> Sent: Thursday, May 27, 2004 9:53 AM
> To:   Declude
> Subject:  [Declude.JunkMail] Can you do WHITELISTING in the
> $default$.JunkMail.txt file?
> 
> I'm wanting to give AntiSpam customers the ability to 'tweek' their spam
> settings by giving them FTP access to the $default$.JunkMail.txt file.
> 
> I'm hoping they'll also be able to manage their WHITELISTING (because not
> everyone wants the same WHITELIST)
> 
> How could this be done?
> 
> -Brent
> 
<>

RE: [Declude.JunkMail] Per-Domain Whitelist

[Jeff Maze]

Great.. Thanks.. 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Wednesday, May 26, 2004 11:15 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Per-Domain Whitelist


> I'm running a per-domain whitelist of e-mail addresses, etc.  
>I can't seem to get a couple domains configured correctly for one 
>particular client.
> They receive e-mails from lehman.com, but it's a weird sender 
>address - [EMAIL PROTECTED]  I added
"lehman.com"
>to the whitelist file thinking this would allow anything from the 
>lehman.com domain.  Well, it didn't.  Should I have put ".lehman.com"
instead?

The lines in the per-domain whitelist files should contain either one E-mail
address ("[EMAIL PROTECTED]") or domain ("@example.com") or subdomain
(".example.com") per line.  Just "lehman.com" won't match anything.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Per-Domain Whitelist

[Jeff Maze]

Hello,
I'm running a per-domain whitelist of e-mail addresses, etc.  I
can't seem to get a couple domains configured correctly for one particular
client.
They receive e-mails from lehman.com, but it's a weird sender
address - [EMAIL PROTECTED]  I added "lehman.com"
to the whitelist file thinking this would allow anything from the lehman.com
domain.  Well, it didn't.  Should I have put ".lehman.com" instead?
Thank you for your time and attention..


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Hotmail not accept inbound mail?

[Jeff Maze]

Is this an option in later version of iMail?  We're 
running 6.06 and I don't recall this anywhere..


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of 
MattSent: Friday, May 21, 2004 12:58 PMTo: 
[EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] Hotmail 
not accept inbound mail?
I turned off IMail's internal DNS caching in order to avoid 
situations like this.  I don't host that many local accounts, but I haven't 
seen any build-ups in my spool either time that Hotmail has had issues.  My 
thought is that maybe you cached records in IMail that corespond to the servers 
that aren't functioning properly?  This is one of the reasons why I turned 
this off at least.MattRobert Shubert wrote:
Incidentally, Hotmail - as of a few day ago - does acknowledge the
problem and said they are working on it. I had to tell my server to
retry for a day before I could start sending to hotmail again.

R

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Colbeck, Andrew
Sent: Tuesday, May 18, 2004 12:40 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.JunkMail] Hotmail not accept inbound mail?

I'm seeing 2 things:

My default Imail queuing numbers gave too much emphasis on retry threads
and
frequency.  I've lowered them.

The same 1/4 of the Hotmail MX hosts are still down this week.  I
stuffed
the responsive ones into my cacheing DNS server in a hotmail.com zone
and
that alleviated the queue.  The next day I checked my Imail log, because
I
wanted to get rid of that hotmail.com workaround before it bit me, and I
found that the remaining 3/4 of the servers still regularly told my
server
to come back later, refused connection, or dropped the connection.

Andrew 8)

-Original Message-
From: David Lewis-Waller [mailto:[EMAIL PROTECTED]] 
Sent: Tuesday, May 18, 2004 2:52 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Hotmail not accept inbound mail?


This looks like it's an ongoing, long term issue. DNReports MX
connection
problems.

http://www.dnsreport.com/tools/dnsreport.ch?domain=hotmail.com


  
  -Original Message-
From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED]] On Behalf Of Rick Davidson
Sent: 11 May 2004 20:29
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Hotmail not accept inbound mail?

Yep hotmail is not accepting from us either, I am seeing 
connection resets from them

Rick Davidson
National Systems Manager
North American Title Group
-
- Original Message -
From: "Colbeck, Andrew" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, May 11, 2004 2:44 PM
Subject: [Declude.JunkMail] Hotmail not accept inbound mail?


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  -- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

RE: [Declude.JunkMail] Are these Forged?

[Jeff Maze]

Was wondering what the attachment names have been?

I received on earlier (I think) and the name of the zip file was support.zip
(had a PIF file within). 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Mike Wiegers
Sent: Thursday, May 20, 2004 2:34 PM
To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Are these Forged?

Started getting these lately and needed to find out if they are forged and
if Declude  site is setup to handle them as forged.

Exploit-ObjectData trojan
Downloader-IU!zip trojan

Thanks,
Mike

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Hotmail not accept inbound mail?

[Jeff Maze]

You know what's weird.. If I put just backup.dnsreport.com 
in the address bar, it comes up to DNSstuff.com..  
Whoa..


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Steve 
:-)Sent: Tuesday, May 18, 2004 11:41 AMTo: 
[EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] Hotmail 
not accept inbound mail?
You may want to use this link instead I can't seem to get the 
main server to come up.http://backup.dnsreport.com/tools/dnsreport.ch?domain=hotmail.comSteveDavid 
Lewis-Waller wrote:
This looks like it's an ongoing, long term issue. DNReports MX connection
problems.

http://www.dnsreport.com/tools/dnsreport.ch?domain=hotmail.com


  
  -Original Message-
From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED]] On Behalf Of Rick Davidson
Sent: 11 May 2004 20:29
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Hotmail not accept inbound mail?

Yep hotmail is not accepting from us either, I am seeing 
connection resets from them

Rick Davidson
National Systems Manager
North American Title Group
-
- Original Message -
From: "Colbeck, Andrew" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, May 11, 2004 2:44 PM
Subject: [Declude.JunkMail] Hotmail not accept inbound mail?


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses as a service to Keeling Inc. Customers]



  

RE: [Declude.JunkMail] Hotmail not accept inbound mail?

[Jeff Maze]

Hmmm.. Still didn't work..  There's always http://www.checkdns.net

This is what checkdns says about dnsreport.com:
http://www.checkdns.net/quickcheck.aspx?domain=www.dnsreport.com&detailed=1 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Don Brown
Sent: Tuesday, May 18, 2004 10:56 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Hotmail not accept inbound mail?

substitute 'backup' for the 'www' in the url.


Tuesday, May 18, 2004, 8:14:36 AM, Jeff Maze <[EMAIL PROTECTED]>
wrote:
JM> When clicking the link below, I get a "unable to connect to server" 
JM> (using Opera 7.5)..

JM> -Original Message-
JM> From: [EMAIL PROTECTED]
JM> [mailto:[EMAIL PROTECTED] On Behalf Of Robert
JM> Sent: Tuesday, May 18, 2004 9:05 AM
JM> To: [EMAIL PROTECTED]
JM> Subject: Re: [Declude.JunkMail] Hotmail not accept inbound mail?

JM> dnsreprots.com hasn't worked for two day for me.
JM> the link doesn't work either?

JM> I keep getting different pages that want to see me free web space.

JM> Is it just me?

JM> Robert

JM> - Original Message -
JM> From: David Lewis-Waller <[EMAIL PROTECTED]>
JM> To: <[EMAIL PROTECTED]>
JM> Sent: Tuesday, May 18, 2004 5:52 AM
JM> Subject: RE: [Declude.JunkMail] Hotmail not accept inbound mail?


>> This looks like it's an ongoing, long term issue. DNReports MX 
>> connection problems.
>>
>> http://www.dnsreport.com/tools/dnsreport.ch?domain=hotmail.com
>>
>>
>> > -Original Message-
>> > From: [EMAIL PROTECTED]
>> > [mailto:[EMAIL PROTECTED] On Behalf Of Rick 
>> > Davidson
>> > Sent: 11 May 2004 20:29
>> > To: [EMAIL PROTECTED]
>> > Subject: Re: [Declude.JunkMail] Hotmail not accept inbound mail?
>> >
>> > Yep hotmail is not accepting from us either, I am seeing connection 
>> > resets from them
>> >
>> > Rick Davidson
>> > National Systems Manager
>> > North American Title Group
>> > -
>> > - Original Message -
>> > From: "Colbeck, Andrew" <[EMAIL PROTECTED]>
>> > To: <[EMAIL PROTECTED]>
>> > Sent: Tuesday, May 11, 2004 2:44 PM
>> > Subject: [Declude.JunkMail] Hotmail not accept inbound mail?
>> >
>>
>> ---
>> [This E-mail was scanned for viruses by Declude Virus
JM> (http://www.declude.com)]
>>
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To 
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
>> "unsubscribe Declude.JunkMail".  The archives can be found at 
>> http://www.mail-archive.com.
>>

JM> ---
JM> [This E-mail was scanned for viruses by Declude Virus 
JM> (http://www.declude.com)]

JM> ---
JM> This E-mail came from the Declude.JunkMail mailing list.  To 
JM> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
JM> "unsubscribe Declude.JunkMail".  The archives can be found at 
JM> http://www.mail-archive.com.

JM> ---
JM> [This E-mail was scanned for viruses by Declude Virus 
JM> (http://www.declude.com)]

JM> ---
JM> This E-mail came from the Declude.JunkMail mailing list.  To 
JM> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
JM> "unsubscribe Declude.JunkMail".  The archives can be found at 
JM> http://www.mail-archive.com.




Don Brown - Dallas, Texas USA Internet Concepts, Inc.
[EMAIL PROTECTED]   http://www.inetconcepts.net
(972) 788-2364Fax: (972) 788-5049


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Hotmail not accept inbound mail?

[Jeff Maze]

When clicking the link below, I get a "unable to connect to server" (using
Opera 7.5).. 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Robert
Sent: Tuesday, May 18, 2004 9:05 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Hotmail not accept inbound mail?

dnsreprots.com hasn't worked for two day for me.
the link doesn't work either?

I keep getting different pages that want to see me free web space.

Is it just me?

Robert

- Original Message -
From: David Lewis-Waller <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, May 18, 2004 5:52 AM
Subject: RE: [Declude.JunkMail] Hotmail not accept inbound mail?


> This looks like it's an ongoing, long term issue. DNReports MX 
> connection problems.
>
> http://www.dnsreport.com/tools/dnsreport.ch?domain=hotmail.com
>
>
> > -Original Message-
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED] On Behalf Of Rick 
> > Davidson
> > Sent: 11 May 2004 20:29
> > To: [EMAIL PROTECTED]
> > Subject: Re: [Declude.JunkMail] Hotmail not accept inbound mail?
> >
> > Yep hotmail is not accepting from us either, I am seeing connection 
> > resets from them
> >
> > Rick Davidson
> > National Systems Manager
> > North American Title Group
> > -
> > - Original Message -
> > From: "Colbeck, Andrew" <[EMAIL PROTECTED]>
> > To: <[EMAIL PROTECTED]>
> > Sent: Tuesday, May 11, 2004 2:44 PM
> > Subject: [Declude.JunkMail] Hotmail not accept inbound mail?
> >
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] [OT] Declude Web Site - is it down?

[Jeff Maze]

Was just wondering if anyone else can bring up the Declude website.  I'm
updating my favorites (gonna giving FireFox a run) and the Declude site
isn't coming up for me.

Anyone else having that same problem?

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] f-prot

[Jeff Maze]

Title: Message



Just was curious, did you happen to notice how much extra 
overhead was added to the CPU when another virus scanner was added to the 
system.  With only 8000-1 message a day for our server, it's not the 
newest nor fastest thing out there.


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Kami 
RazvanSent: Saturday, May 15, 2004 1:31 PMTo: 
[EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] 
f-prot

Larry:
We have used it for years and are very happy with it.
 
Of course since it is cheap I suggest you use the savings and add another 
scanner to your arsenal.  2 is always better than 1.
 
We use AVG and FProt together.
 
Regards,
Kami


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Larry 
CraddockSent: Saturday, May 15, 2004 1:26 PMTo: 
[EMAIL PROTECTED]Subject: [Declude.JunkMail] 
f-prot

Can anyone tell me how f-prot compares to 
mcafee or symantec when it comes to keeping their database up with new viruses? 
That just seems pretty cheap but hey that's exactly what I'm looking for as long 
as it works well :)
 
thanks,
 
Larry 
Craddock

RE: [Declude.JunkMail] Injunction against SpamCop

[Jeff Maze]

Anyone have a list of IP addresses that OptInRealBig.com uses to send out
their mailings?  Declude Blacklist.. >:)

The web site's IP is 69.6.21.239 which is assigned to JAYS WEB SERVICE
JAYSWEBSERV-01 (NET-69-6-21-0-1) 69.6.21.0 - 69.6.21.255.  There are some
interesting hostname when I did a scan of this IP bank, but nothing really
worth while.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Wednesday, May 12, 2004 11:20 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Injunction against SpamCop

Maybe if Scott Ricter of OptinRealBig can get himself an injunction against
SpamCop, then maybe AOL, RR and every other damn ISP that they're listing
can do the same :-/

http://zdnet.com.com/2100-1104_2-5210518.html?tag=sas.email

But seriously, we all have Congress to thank for this glorious piece of
leglislation that they call CAN-SPAM.

Matt

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Country Code for Palestine?

[Jeff Maze]

Hello,
I was wondering if there was a way to "decode" the Mime encoding of
a message so that I could build filters to catch the "Vi*agra" portion of
the subject line.  I'm included both what the subject line looks like in an
e-mail client and what the internet headers of the message looks like.
Thanks..


Subject:  Overnight Delivery of L\evitra, Vi*agra, Phentermine


Subject:
=?iso-8859-1?B?T3Zlcm5pZ2h0IERlbGl2ZXJ5IG9mIExcZXZpdHJhLCBWaSphZ3JhLCBQaGVud
GVybWluZQ==?=


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Junkmail Test

[Jeff Maze]

This is only a test


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Messages for list showing up in spam account

[Jeff Maze]

After doing a little digging, I figured it out..  Something with the way I
have Declude configured.. DOH!  Sorry about that..  Thanks for the
response.. 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Friday, May 07, 2004 9:17 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Messages for list showing up in spam account


>Was just wondering why these messages, that should be delivered to our 
>maillist account, is being delivered to our spam account.

It's hard to say without more information, but what I can say is that:

>X-Spam-Tests-Failed: ROUTING [-6]

The E-mail only failed the ROUTING test, and scored less than 0, so it
should not have been caught.  I'm guessing an IMail rule did this.  What do
your IMail SMTP and Declude JunkMail log file entries show for this E-mail?

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Messages for list showing up in spam account

[Jeff Maze]

Was just wondering why these messages, that should be delivered to our
maillist account, is being delivered to our spam account.


Received: from declude.com [24.107.232.14] by mail.crescentdigital.com with
ESMTP
  (SMTPD32-6.06) id A5834E600F4; Fri, 07 May 2004 07:39:47 -0400
Received: from mail.zcom.it [217.199.0.33] by declude.com with ESMTP
  (SMTPD32-8.05) id A4F643CF021E; Fri, 07 May 2004 07:37:26 -0400
Received: from nb2 [82.50.47.52] by mail.zcom.it with ESMTP
  (SMTPD32-7.15) id A4ED71600C2; Fri, 07 May 2004 13:37:17 +0200
From: "Markus Gufler" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: RE: [Declude.Virus] Unknown Viruses?
Date: Fri, 7 May 2004 13:39:08 +0200
MIME-Version: 1.0
Content-Type: multipart/mixed;
  boundary="=_NextPart_000_0099_01C43438.AC7FDC10"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
In-Reply-To: <[EMAIL PROTECTED]>
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Thread-Index: AcQ0JC1/ximC/W9xTbuArlawpitVYwAAlxuw
Message-Id: <[EMAIL PROTECTED]>
X-RBL-Warning: FIVETEN-SRC: 52.47.50.82.blackholes.five-ten-sg.com.
X-RBL-Warning: IPWHOIS: "$ has inaccurate or missing WHOIS data at the RIR"
X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam
[420e].
X-RBL-Warning: HOUR: Hour was between 7:00 and 21:59.
X-RBL-Warning: SPFFAIL: SPF returned FAIL for this E-mail.
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: -255.
X-RBL-Warning: BLKLST-COUNTRY-EU: Message failed BLKLST-COUNTRY-EU test
(line 15, weight -5)
X-RBL-Warning: ISDATE-EN: Message failed ISDATE-EN test (line 17, weight
-10)
X-Declude-Sender: [EMAIL PROTECTED] [82.50.47.52]
X-Spam-Tests-Failed: FIVETEN-SRC, IPWHOIS, SPAMHEADERS, HOUR, SPFFAIL,
SPAMCHK, BLKLST-COUNTRY-EU, ISDATE-EN [-250]
X-Country-Chain: ITALY->destination
X-Note: Sent from [EMAIL PROTECTED] - host52-47.pool8250.interbusiness.it
([82.50.47.52]) outgoing.
X-Note: Sent to [EMAIL PROTECTED]
X-RBL-Warning: FIVETENSRC: 52.47.50.82.blackholes.five-ten-sg.com.
X-RBL-Warning: IPWHOIS: "$ has inaccurate or missing WHOIS data at the RIR"
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: -6.
X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent
with spam [210f].
X-Note: This E-mail was scanned for viruses by Declude Virus
(www.declude.com)
X-NRecips: 1
X-Reverse-IP: ns1.zcom.it
X-Weight: 9 (FIVETENSRC, IPWHOIS, SPFFAIL, HEUR2, SPAMCHK, ROUTING)
X-Country-Chain: [IANA Reserved]->ITALY->destination.
X-Declude-Sender: [EMAIL PROTECTED] [217.199.0.33]
X-Declude-Spoolname: D74f643cf021e71c6.SMD
Precedence: bulk
Sender: [EMAIL PROTECTED]
Reply-To: [EMAIL PROTECTED]
X-Declude-Sender: [EMAIL PROTECTED] [24.107.232.14]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: ROUTING [-6]
X-Note: This E-mail was sent from cpe-24-107-232-14.ma.charter.com
([24.107.232.14]).
X-RCPT-TO: <[EMAIL PROTECTED]>
X-UIDL: 383931744
Status: R 
X-Status: N
X-KMail-EncryptionState:  
X-KMail-SignatureState:  


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] [OT] Bind DNS

[Jeff Maze]

Hello,
Scott was talking about using Bind for the DNS purposes of the mail
servers.  I have a question about that.
I'm in the process of testing and then rebuilding our secondary mail
server (currently running RedHat 8 with Sendmail; going to upgrade it to
White Box Enterprise Linux 3 running Sendmail and Bind).  We were having a
problem with DNS timeouts when checking messages.  When these time outs
would happen, the spam message were allowed to be delivered.
Anyway, should I setup Bind on the secondary mail server to just be
a caching server?  Since I hope to only have the primary mail server setup
to use this DNS server, there shouldn't be any major problems with setting
it up as such, correct?
Thank you for your comments, suggestions, etc.. -Jeff



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Per-Domain Virus.CFG?

[Jeff Maze - Hostmaster]

Good point.. Thanks.. I'll forward that inform onto him..

Well, you can never tell with some of these people..  He probably uses
Internet Explorer to first find the location of the file and then send it as
a link..  Probably one of those types that knows enough about computers that
could cause damage, but not know how to fix that damage..  

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Thursday, April 29, 2004 10:31 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Per-Domain Virus.CFG?

Let me get this straight. You have a client that is distributing security
updates in a non-security minded way, correct? Tell him to wise up and put
the link in the body, not as an attachment.

John Tolmachoff
Engineer/Consultant/Owner
eServices For You

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- 
> [EMAIL PROTECTED] On Behalf Of Jeff Maze - Hostmaster
> Sent: Thursday, April 29, 2004 7:02 AM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] Per-Domain Virus.CFG?
> 
> Hello,
>   Was wondering if there was a way to have a per-domain virus.cfg.
> The reason I ask is that I have "BANEXT lnk" in the virus.cfg (which I 
> recently added).  Today a client responded saying he distributes 
> McAfee Enterprise anti-virus updates via email using a shortcut 
> (*.lnk) as the attachment.  The link points to a file on our their network
server.
>   Is it possible to have only his domain allow this extension so he
can 
> distribute the file or the only way to change this is to make it 
> globally allowable.
>   Thanks..
> 
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Per-Domain Virus.CFG?

[Jeff Maze - Hostmaster]

Hello,
Was wondering if there was a way to have a per-domain virus.cfg.
The reason I ask is that I have "BANEXT lnk" in the virus.cfg (which I
recently added).  Today a client responded saying he distributes McAfee
Enterprise anti-virus updates via email using a shortcut (*.lnk) as the
attachment.  The link points to a file on our their network server.
Is it possible to have only his domain allow this extension so he
can distribute the file or the only way to change this is to make it
globally allowable.
Thanks..


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] SPAMDOMAINS Failure

[Jeff Maze - Hostmaster]

Hello,
Had a client forward me an e-mail that failed the SPAMDOMAIN test
(along with a couple others).
Below are the internet headers of the SPAMDOMAINs failure (I can
post the full inet headers if desired):

X-RBL-Warning: SPAMDOMAINS: Spamdomain 'att.net' found: Address of
[EMAIL PROTECTED] sent from invalid emhmta02.cdpd.airdata.com.
X-Declude-Sender: [EMAIL PROTECTED] [199.88.234.47]

I have an entry of: att.net  in our spamdomains.txt file.  Now to
add this entry to the spamdomains.txt file, I would make the following
entry, correct?

att.net .airdata.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Whitelist.txt file

[Jeff Maze - Hostmaster]

Ooops.. Sorry about that.. I meant to say $default$.junkmail file..

Just trying to get a domain configured correct in a per-domain config with
the whitelist.txt file (having problems and hearing about it from the
client).

So, if there is a whiltelistip entry in the $default$.junkmail file and the
message originates from that IP, it's whitelisted (as it normally and should
do).

And if an e-mail comes from [EMAIL PROTECTED], that e-mail is first checked for
the WHITELIST FROM in the GLOBAL.CFG file, if it's not there then it's
checked again the WHITELIST.TXT file within the per-domain configuration.

Is this correct?

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Wednesday, April 28, 2004 1:59 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Whitelist.txt file


>And to just re-verify something, if the whitelist.txt file is in the 
>domain folder (per-domain config), the GLOBAL.CFG is skipped and the 
>whitelist.txt file is used instead for whitelisting e-mail addresses.  
>Or are they used in conjunction with each other?

That's handled the same regardless of whether whitelistfiles are used or
not.

If there is per-user config file, it will be used.  Otherwise, if a
per-domain config file, that will be used.  If neither are present, the
\IMail\Declude\$default$.JunkMail file will be used if the E-mail is
incoming, or the \IMail\Declude\global.cfg file will be used if the E-mail
is outgoing.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Whitelist.txt file

[Jeff Maze - Hostmaster]

Ok thanks..

And to just re-verify something, if the whitelist.txt file is in the domain
folder (per-domain config), the GLOBAL.CFG is skipped and the whitelist.txt
file is used instead for whitelisting e-mail addresses.  Or are they used in
conjunction with each other?

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Wednesday, April 28, 2004 12:20 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Whitelist.txt file


> Can IP addresses in conjunction with e-mail addresses (or 
>domain
>names) be added to a Whitelists.txt file within a per-domain configuration?

No, currently the whitelistfiles can only use domains or E-mail addresses.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Whitelist.txt file

[Jeff Maze - Hostmaster]

Hello,
Can IP addresses in conjunction with e-mail addresses (or domain
names) be added to a Whitelists.txt file within a per-domain configuration?
Thanks.. -Jeff


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] WHITELISTFILE for per-domain

[Jeff Maze - Hostmaster]

Thanks.. That works..

One quick question.. If that entry is in for the per-domain
$default$.junkmail file, I assume it will not use the main
$default$.junkmail file within the main declude sub-folder for whitelists,
correct?  Or do they work in tandum.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Friday, April 23, 2004 3:30 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] WHITELISTFILE for per-domain


> Just a quick question about this option.  In the domain that 
>has a separate configuration file, I would edit the $default$.junkmail 
>file and add the following line, correct?
>
>WHITELISTFILE   c:\imail\declude\domain.com\whitelist.txt
>
> And then put in the e-mail addresses or domains I wish to have 
>whitelisted for that domain in the whitelist.txt file.

Correct.  :)

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] WHITELISTFILE for per-domain

[Jeff Maze - Hostmaster]

Hello,
Just a quick question about this option.  In the domain that has a
separate configuration file, I would edit the $default$.junkmail file and
add the following line, correct?

WHITELISTFILE   c:\imail\declude\domain.com\whitelist.txt

And then put in the e-mail addresses or domains I wish to have
whitelisted for that domain in the whitelist.txt file.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] CMDSPACE Test

[Jeff Maze - Hostmaster]

Hello,
I was wondering what exactly the CMDSPACE test is.  I wasn't able to
find anything about it in the Junkmail manual..
Thanks.. -Jeff


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Comcast.net Spam

[Jeff Maze - Hostmaster]

Hello,
Yeah, I too have notice A LOT of spam originating from ComCast
networks lately.
You could implement SPAMDOMAINS that would check the "from" and
where the message came from to add weight to the message.  Seems to work
well when you don't get DNS timeouts (which I have been having problems with
lately).

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Paul Fuhrmeister
Sent: Thursday, April 22, 2004 10:12 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Comcast.net Spam

An email is "from" [EMAIL PROTECTED] [24.5.121.88] AND was received
from cib.co.za (c-24-5-121-88.client.comcast.net [24.5.121.88]

Is there a way to add weight when
- received from client.comcast.net BUT sender is not "@comcast.net"


Here are example headers:

Received: from cib.co.za (c-24-5-121-88.client.comcast.net [24.5.121.88])
by mail17.**.com (Postfix) with SMTP id 858D630F4B;
Wed, 21 Apr 2004 21:25:31 -0500 (CDT)
(envelope-from [EMAIL PROTECTED])
Message-ID: <[EMAIL PROTECTED]>
From: "Tim Salazar" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED], [EMAIL PROTECTED]
Subject: Pain Pills V.icodin Hy.drocodone Lortab Lorcet Norco
Date: Thu, 22 Apr 2004 01:00:15 +
MIME-Version: 1.0
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: 8bit
X-RBL-Warning: DSBL: "http://dsbl.org/listing?ip=24.5.121.88";
X-RBL-Warning: BLOCKTEXT: Message failed BLOCKTEXT test (line 394, weight 7)
X-Declude-Sender: [EMAIL PROTECTED] [24.5.121.88]
X-Declude-Spoolname: D2d2c2f4000be40bf.SMD
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 1049636097


Paul Fuhrmeister
[EMAIL PROTECTED]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] This too got through.. No spamdomains?

[Jeff Maze - Hostmaster]

Ok.. Thanks.. I'll have to look into this more..

Sorry to be a pain, but most of the messages that got through (14 of them
between 12am and 5am) last night were caused by this problem.  Thanks
again..

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Thursday, April 22, 2004 8:27 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] This too got through.. No spamdomains?


>Hmmm.. Ok..  And this timeout is because of our DNS servers, correct?

The timeout could be caused by a number of factors -- it could be your DNS
server, theirs, or it is possible that the DNS packet was dropped somewhere
along the way.

>But, didn't it already do a lookup in order to get this line:
>
>Received: from c-67-169-68-81.client.comcast.net 
>(c-67-169-68-81.client.comcast.net [67.169.68.81])

No.  That line was added by the mailserver that handled the E-mail before
IMail.  Either it was able to get the reverse DNS entry (if it is a
legitimate mailserver), or it didn't try (if that is a forged header, or it
was sent via spamware).

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] This too got through.. No spamdomains?

[Jeff Maze - Hostmaster]

Hmmm.. Ok..  And this timeout is because of our DNS servers, correct?

But, didn't it already do a lookup in order to get this line:

Received: from c-67-169-68-81.client.comcast.net
(c-67-169-68-81.client.comcast.net [67.169.68.81])

X-Note: This E-mail was sent from (timeout) ([67.169.68.81]).


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Thursday, April 22, 2004 8:14 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] This too got through.. No spamdomains?


> I got this message in one of my main accounts.  It first came 
>through our sec mail server, but then nothing appears to have been 
>flagged by Declude.  Weird thing is, I'm running SPAMDOMAINS.  So 
>shouldn't this message have failed at least SPAMDOMAINS?

This is why:

>X-Note: This E-mail was sent from (timeout) ([67.169.68.81]).

The reverse DNS lookup timed out.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] This too got through.. No spamdomains?

[Jeff Maze - Hostmaster]

Hello,
I got this message in one of my main accounts.  It first came
through our sec mail server, but then nothing appears to have been flagged
by Declude.  Weird thing is, I'm running SPAMDOMAINS.  So shouldn't this
message have failed at least SPAMDOMAINS?
I have IPBYPASS 67.17.218.70 within the GLOBAL.CFG file and running
Declude v.1.79.

SPAMDOMAIN.TXT Entries:

comcast.net
msn.com hotmail.com

Internet Headers:

Received: from secmail.crescentdigital.com [67.17.218.70] by
mail.crescentdigital.com with ESMTP (SMTPD32-6.06) id A9E6D4010A; Wed, 21
Apr 2004 19:55:18 -0400
Received: from c-67-169-68-81.client.comcast.net
(c-67-169-68-81.client.comcast.net [67.169.68.81])
by secmail.crescentdigital.com (8.12.8/8.12.8) with SMTP id
i3LNvYoi026730;
Wed, 21 Apr 2004 19:57:37 -0400
Received: from 133.226.240.152 by 67.169.68.81; Thu, 22 Apr 2004 02:46:47
+0200
Message-ID: <[EMAIL PROTECTED]>
From: "Rose Acevedo" <[EMAIL PROTECTED]>
Reply-To: "Rose Acevedo" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED], [EMAIL PROTECTED],
   [EMAIL PROTECTED]
Subject: Re: Cc:Lôw Côst Term Life ins. - Free Quôtes
Date: Wed, 21 Apr 2004 20:45:47 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--25203145111901053"
X-Originating-IP: 67.17.218.70
X-Declude-Sender: [EMAIL PROTECTED] [67.169.68.81]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: None [0]
X-Note: This E-mail was sent from (timeout) ([67.169.68.81]).
X-RCPT-TO: <[EMAIL PROTECTED]>
X-UIDL: 382031063
Status: U


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] This got through.. -Question-

[Jeff Maze - Hostmaster]

Just a question..  The message below (internet headers listed only) got
through and only failed on the CMDSPACE test..  But one of the X-Notes
states the there was a timeout looking up the IP address (it's
24-51-32-177.kntnny.adelphia.net)..

Anyway, I was wondering if there was a test could be added that would add a
low-weight (say 2 or 3) for timeouts during DNS lookups?  Only bad thing, if
your DNS server fails, so will a majority of your messages..  Any thoughts?

__
Received: from emailaddresses.com [24.51.32.177] by mail.crescentdigital.com
  (SMTPD32-6.06) id ABBD117012A; Wed, 21 Apr 2004 01:50:53 -0400
Message-ID: <[EMAIL PROTECTED]>
From: "Cheapest Only Shop" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Your Doctor say no? We will say yes! 82928
Date: Wed, 21 Apr 2004 00:50:40 -0500
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_NextPart_600_2990_759E2990.759E2990"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command .
X-Declude-Sender: [EMAIL PROTECTED] [24.51.32.177]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: CMDSPACE [8]
X-Note: This E-mail was sent from (timeout) ([24.51.32.177]).
X-RCPT-TO: <[EMAIL PROTECTED]>
X-UIDL: 382030971
Status: U


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] US Treasury cannot do it right?

[Jeff Maze - Hostmaster]

Yeah, I got sick of modifying my setups for others mistakes..  I've just
ended up forwarding them the message with the internet headers telling them
what the problem is, how to fix it, and that messages from them will be
blocked/reviewed until the problems are fixed..  Haven't gotten any
respsonses though..  Goes with the normal IT mentality..  "It's not our
problem, its yours..  Your setup is wrong..  Ours is perfect.."  UGH!  I
hate hearing that..  Right there I know they don't even want to look at
their logs, etc to try and resolve the problem..

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
Sent: Tuesday, April 20, 2004 11:30 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] US Treasury cannot do it right?

My personal oppioion is that ISP's, government agencies, Technology
companies should be held to a higher standard than the average business. If
they are not following standards then they should be held for review. They
can be comprimized by zombies just like everyone else.

After reviwing the held messages then notify the admin of the problem. 

I think part of the problem with false positives are the people finding the
misconfigurations are modifying their rule sets to accomidate the failure of
other mail admins to configure their systems correctly. When they should be
notifying them of their problems so they can fix them.


Kevin Bilbee

> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Goran 
> Jovanovic
> Sent: Tuesday, April 20, 2004 8:11 PM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] US Treasury cannot do it right?
> 
> 
> OK if I am right the US Treasury Department needs help!
> 
> They identified themselves as 10.0.7.238 instead of a host.domain !!?? 
> This is very bad.
> 
> There is a REVDNS for the sending IP
> 66.77.65.238 PTR record: lists.qai.irs.gov
> 
> What am I asking here? Perhaps it is just amazement that the e-mail 
> got out like this. I suppose there is nothing that we can do from this 
> end except build enough room in our tests to prevent legit stuff from 
> getting caught.
> 
> The more I look into this SPAM stuff the scarier it gets.
> 
> -
> 
> Received: from 10.0.7.238 [66.77.65.238] by tlsonline.com
>   (SMTPD32-8.10 ) id A63E11DB00DA; Tue, 20 Apr 2004 12:56:30 -0400
> Date: Tue, 20 Apr 2004 12:55:42 -0400 (EDT)
> Message-Id: 
> <[EMAIL PROTECTED]
> ts.treas.g
> ov>
> From: US Treasury Release: News <[EMAIL PROTECTED]>
> To: "US Treasury Release: News" <[EMAIL PROTECTED]>
> Subject: [US Treasury] Treasury and IRS Address Foreign Tax Credit, 
> Partnership Transactions
> List-Unsubscribe: 
> List-Subscribe: 
> Reply-To: US Treasury Release: News <[EMAIL PROTECTED]>
> X-Message-Id: <[EMAIL PROTECTED]>
> Sender: [EMAIL PROTECTED]
> X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]"
> X-RBL-Warning: HELOBOGUS: Domain 10.0.7.238 has no MX or A records 
> [0301].
> X-RBL-Warning: IPNOTINMX: 
> X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail 
> detected.
> X-Declude-Sender: [EMAIL PROTECTED]
> [66.77.65.238]
> X-Declude-Spoolname: D563e11db00dae005.SMD
> X-Note: This E-mail was sent from lists.qai.irs.gov ([66.77.65.238]).
> X-Spam-Tests-Failed: NOABUSE, HELOBOGUS, IPNOTINMX, NOLEGITCONTENT, 
> HELOISIP, HELOISIPX [7]
> X-Note: This E-mail was scanned by Declude JunkMail
> (www.declude.com) for spam.
> X-Note: Total spam weight of this E-mail is 7.
> X-Country-Chain: 
> Organization: The LAN Shoppe
> 
> 
>  
>  Goran Jovanovic
>  The LAN Shoppe
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus 
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
> 

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Hotmail and MSN help needed.

[Jeff Maze - Hostmaster]

Yeah, I noticed that too.. The message that I saw came from their 65.54 
network..  I did a scan on the /24 subnet of it's network and nothing as far 
as hostname was resolved for anything within that range..

On Tuesday 20 April 2004 03:51 pm, you wrote:
> About a week ago Hotmail and MSN had certain mail servers that did not have
> reverse DNS entries.  Is anyone else seeing this?  This is causing a lot of
> false positives.  I sent an email to Microsoft but that is probably a total
> waste of time.
>
> Anybody know what is up with this.
>
> Chuck Schick
> Warp 8, Inc.
> 303-421-5140
> www.warp8.com
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SPAMDOMAINS - Netscape.com

[Jeff Maze - Hostmaster]

Ok.. Makes sense..  Thanks..
 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
Sent: Monday, April 19, 2004 2:29 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.JunkMail] SPAMDOMAINS - Netscape.com

Jeff, the main problem with figuring out spamdomains entries is that you
really have to receive valid mail from the domain to really know.

If they have an SPF record, that's the easiest way to research them, but you
can also try the website at http://www.SenderBase.org to see what they've
noticed.  They've noticed one more host: dust.netscape.com

The problem with checking the MX record is that it is only for recording
inbound mail to Netscape.com, it doesn't necessarily say anything about
outbound mail from them, which is what you're after.

I suspect that your suggestion will work fine, as I think that they keep
their corporate domain for netscape.com separate from the customer business
as netscape.net ... 

Andrew 8)

-----Original Message-
From: Jeff Maze - Hostmaster [mailto:[EMAIL PROTECTED]
Sent: Monday, April 19, 2004 11:07 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] SPAMDOMAINS - Netscape.com


Hello,
I got a message that was "from"  [EMAIL PROTECTED] but came from
RoadRunners networks.  There isn't a netscape entry in my SPAMDOMAINS.TXT
file.  I was just wondering what I would enter to make it so.

I did a NSLOOKUP on netscape.com and the MX record points to
mail.nescape.everyone.net.  So the entry I would enter would be:

netscape.comnetscape.everyone.net

Is this correct?  Just want to make sure if there are more later.  I
want to understand this so I don't keep asking.  Thanks.. -Jeff



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] SPAMDOMAINS - Netscape.com

[Jeff Maze - Hostmaster]

Hello,
I got a message that was "from"  [EMAIL PROTECTED] but came from
RoadRunners networks.  There isn't a netscape entry in my SPAMDOMAINS.TXT
file.  I was just wondering what I would enter to make it so.

I did a NSLOOKUP on netscape.com and the MX record points to
mail.nescape.everyone.net.  So the entry I would enter would be:

netscape.comnetscape.everyone.net

Is this correct?  Just want to make sure if there are more later.  I
want to understand this so I don't keep asking.  Thanks.. -Jeff



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Spamdomains.txt file

[Jeff Maze - Hostmaster]

Here's the spamdomains.txt file I received off-list (for our setup, I left
out the outblaze domains)..  Don't forget to add the needed entries to the
Global.cfg file and the $default$.junkmail files (see below)..

Global.cfg
_
SPAMDOMAINS spamdomains C:\IMail\Declude\spamdomains.txtx
15  0


$default$.junkmail
_
SPAMDOMAINS WARN


spamdomains.txt
_
@paypal.com .paypal.
citibank.com.ssmb.com
fleet.com   .bkb.com
wellsfargo.com  .norwest.com
.ebay.com  .emailebay.com
@ebay.com  .ebay.com
amazon.com
att.net
attbi.com
bellatlantic.netverizon.net
bellsouth.net
charter.net
china.com
comcast.net
compuserve.com
concentric..cnchost.com
cox.net
earthlink.
excite.com  excitenetwork.com
gte.net verizon.net
hotmail.com msn.com
juno.com
untd.com
@lycos.co.uklycos.
@lycos.com
mac.com apple.com
mailcity.comlycos.com
mindspring. earthlink.
msn.com hotmail.com
netscape.netaol.com
netzero.com untd.com
prodigy.net
qwest.net
.rr.com
sympatico.cabellnexxia.net
usa.net mx.net
wanadoo.fr
yahoo.
rocketmail.com  yahoo.com
zzn.com mailcentro.com
shaw.ca shawcable.net
icq.com
google.com

@2die4.com  outblaze.com
@accountant.com outblaze.com
@adexec.com outblaze.com
@africamail.com outblaze.com
@allergist.com  outblaze.com
@alumnidirector.com outblaze.com
@archaeologist.com  outblaze.com
@arcticmail.com outblaze.com
@artlover.com   outblaze.com
@asia.com   outblaze.com
@australiamail.com  outblaze.com
@berlin.com outblaze.com
@bikerider.com  outblaze.com
@catlover.com   outblaze.com
@cheerful.com   outblaze.com
@chemist.comoutblaze.com
@clerk.com  outblaze.com
@cliffhanger.comoutblaze.com
@columnist.com  outblaze.com
@comic.com  outblaze.com
@consultant.com outblaze.com
@counsellor.com outblaze.com
@cutey.com  outblaze.com
@deliveryman.comoutblaze.com
@diplomats.com  outblaze.com
@doctor.com outblaze.com
@doglover.com   outblaze.com
@dr.com outblaze.com
@dublin.com outblaze.com
@earthling.net  outblaze.com
@email.com  outblaze.com
@engineer.com   outblaze.com
@europe.com outblaze.com
@execs.com  outblaze.com
@financier.com  outblaze.com
@gardener.com   outblaze.com
@geologist.com  outblaze.com
@graphic-designer.com   outblaze.com
@hairdresser.netoutblaze.com
@hot-shot.com   outblaze.com
@iname.com  outblaze.com
@inorbit.comoutblaze.com
@insurer.comoutblaze.com
@japan.com  outblaze.com
@journalist.com outblaze.com
@lawyer.com outblaze.com
@legislator.com outblaze.com
@lobbyist.com   outblaze.com
@london.com outblaze.com
@loveable.com   outblaze.com
@mad.scientist.com  outblaze.com
@madrid.com outblaze.com
@mail.com   outblaze.com
@mindless.com   outblaze.com
@minister.com   outblaze.com
@moscowmail.com outblaze.com
@munich.com outblaze.com
@musician.org   outblaze.com
@myself.com outblaze.com
@nycmail.comoutblaze.com
@optician.com   outblaze.com
@paris.com  outblaze.com
@pediatrician.com   outblaze.com
@playful.comoutblaze.com
@poetic.com outblaze.com
@popstar.comoutblaze.com
@post.com   outblaze.com
@presidency.com outblaze.com
@priest.com outblaze.com
@programmer.net outblaze.com
@publicist.com  outblaze.com
@realtyagent.comoutblaze.com
@registerednurses.com   outblaze.com
@repairman.com  outblaze.com
@representative.com outblaze.com
@rescueteam.com outblaze.com
@rome.com   outblaze.com
@saintly.comoutblaze.com
@samerica.com   outblaze.com
@sanfranmail.comoutblaze.com
@scientist.com  outblaze.com
@seductive.com  outblaze.com
@singapore.com  outblaze.com
@sociologist.comoutblaze.com
@soon.com   outblaze.com
@teacher.comoutblaze.com
@techie.com outblaze.com
@tokyo.com  outblaze.com
@umpire.com outblaze.com
@usa.comoutblaze.com
@whoever.comoutblaze.com
@winning.comoutblaze.com
@witty.com  outblaze.com
@writeme.comoutblaze.com
@yours.com  outblaze.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Spamdomains.txt file

[Jeff Maze - Hostmaster]

I'd post the one I received off list, but am not sure if the original person
who sent it to me would like if I did..  I'll contact them and see if it
would be ok..  Just don't want to make anyone angry..  I'm sure they won't
care, but it would stink to post it and then have them come back bitchin'
that I did.. 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Monday, April 19, 2004 10:09 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Spamdomains.txt file

Me three. ;)

John Tolmachoff
Engineer/Consultant/Owner
eServices For You

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- 
> [EMAIL PROTECTED] On Behalf Of Rick Hogue
> Sent: Monday, April 19, 2004 6:56 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Spamdomains.txt file
> 
> Me too.
> 
> 
> Rick Hogue
> www.intent.net Web Hosting 1-800-866-2983 www.prosperity.com Featured 
> web site
> 
> 
> 
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Doug McKee
> Sent: Monday, April 19, 2004 8:55 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Spamdomains.txt file
> 
> Me too,
> Thanks,
> Doug
> 
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Goran 
> Jovanovic
> Sent: Monday, April 19, 2004 7:38 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Spamdomains.txt file
> 
> 
> Todd,
> 
> Would you mind sending me a copy of the spamdomain.txt file as well? I
would
> like to see what you have as a starting point.
> 
> Thanx
> 
> 
> 
>  Goran Jovanovic
>  The LAN Shoppe
> 
> 
> 
> > -Original Message-
> > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- 
> > [EMAIL PROTECTED] On Behalf Of Todd
> > Sent: Monday, April 19, 2004 2:19 AM
> > To: [EMAIL PROTECTED]
> > Subject: Re: [Declude.JunkMail] Spamdomains.txt file
> >
> > Jeff,
> >
> > I see no one has answered you on this.  Spamdomains is a very
> useful
> > test and I think you will like the results.  We get an average of 
> > 14% weekdays and 26% on weekends of our email fail Spamdomains and 
> > there
> are
> > not
> > a lot of FPs.
> >
> > I will send you a spamdomains file tomorrow.
> >
> > Todd Hunter
> > Smart Mail
> >
> >
> > - Original Message -
> > From: "Jeff Maze - Hostmaster" <[EMAIL PROTECTED]>
> > To: <[EMAIL PROTECTED]>
> > Sent: Friday, April 16, 2004 11:15 AM
> > Subject: RE: [Declude.JunkMail] Spamdomains.txt file
> >
> >
> > > Anyone?
> > >
> > > -Original Message-
> > > From: [EMAIL PROTECTED]
> > > [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze 
> > > - Hostmaster
> > > Sent: Friday, April 16, 2004 8:26 AM
> > > To: [EMAIL PROTECTED]
> > > Subject: [Declude.JunkMail] Spamdomains.txt file
> > >
> > > Hello,
> > > I think I'm going to implement the spam domains tests.  Anyone 
> > > have a file they would like to share that works well for them?
> > >
> > >
> > > ---
> > > [This E-mail was scanned for viruses by Declude Virus 
> > > (http://www.declude.com)]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe,
> > > just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe 
> > > Declude.JunkMail".  The archives can be found at 
> > > http://www.mail-archive.com.
> > >
> > >
> > >
> > > ---
> > > [This E-mail was scanned for viruses by Declude Virus
> > (http://www.declude.com)]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list.  To 
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> > > "unsubscribe Declude.JunkMail".  The archives can be found at 
> > > http://www.mail-archive.com.
> > >
> >
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus 
> > (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To 
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> > "unsubscribe Declude.JunkMail".  The archives can be found at 
> > http://www.mail-archive.com.
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus

[Declude.JunkMail] Global.CFG file for separate domains

[Jeff Maze - Hostmaster]

Hello,
I was wondering if it's possible with the standard version to create
a Global.cfg file or that type of file (whitelist and other configs) for
separate domains (like the $default$.junkmail file)..  Thanks..


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Spamdomains.txt file

[Jeff Maze - Hostmaster]

Thanks.. I've received a couple so far, so if you don't wish to send it,
it's ok..

But I do have another question for the list..  Pretty much the entries for
Global.CFG and the junkmail config for the spamdomains tests..  Which weight
seems to work best, etc.  This weekend, I've seen A LOT of spam that wasn't
caught that would if SPAMDOMAINS was being run (messages from Argentina but
listing Yahoo as the e-mail account)..

Thanks... -Jeff   

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Todd
Sent: Monday, April 19, 2004 2:19 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Spamdomains.txt file

Jeff,

I see no one has answered you on this.  Spamdomains is a very useful
test and I think you will like the results.  We get an average of 14%
weekdays and 26% on weekends of our email fail Spamdomains and there are not
a lot of FPs.

I will send you a spamdomains file tomorrow.

Todd Hunter
Smart Mail


- Original Message -
From: "Jeff Maze - Hostmaster" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, April 16, 2004 11:15 AM
Subject: RE: [Declude.JunkMail] Spamdomains.txt file


> Anyone?
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze -
> Hostmaster
> Sent: Friday, April 16, 2004 8:26 AM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] Spamdomains.txt file
>
> Hello,
> I think I'm going to implement the spam domains tests.  Anyone have
> a file they would like to share that works well for them?
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
>
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Ipfile.txt

[Jeff Maze - Hostmaster]

One other thing.. If there are changes made to the ipfile.txt file, does the
SMTP server need to be restarted for Declude to see and use these changes? 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Thursday, April 15, 2004 1:22 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Ipfile.txt


> In the global.cfg file I would enter the following entry:
>
>IPTEST  ipfile C:\IMail\Declude\ipfile.txt x 10 0
>
> And then in the $default$.junkmail file, I would enter the 
>following
>entry:
>
>IPTEST  ROUTETO [EMAIL PROTECTED]   (or whatever I want)
>
> This appear as being correct, right?

That looks good to me.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Spamdomains.txt file

[Jeff Maze - Hostmaster]

Anyone? 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze -
Hostmaster
Sent: Friday, April 16, 2004 8:26 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Spamdomains.txt file

Hello,
I think I'm going to implement the spam domains tests.  Anyone have
a file they would like to share that works well for them?


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Spamdomains.txt file

[Jeff Maze - Hostmaster]

Hello,
I think I'm going to implement the spam domains tests.  Anyone have
a file they would like to share that works well for them?


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Updating Global.CFG

[Jeff Maze - Hostmaster]

We're running iMail v6.06 and I've been running the SMTP AUTH for about 2
years (only way to remove our server from open-relay lists; started the job
to find this out)..

This is a very nice feature since I've had a number of people saying
messages they they've sent from home being seen as SPAM and not being
delivered.. 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Mike Hyslip
Sent: Thursday, April 15, 2004 4:25 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Updating Global.CFG

There's a checkbox under the properties of the SMTP service, something about
disabling the AUTH function.  This was on 7.x I am pretty sure, probably
supported for quite some time.

The introduction into declude I believe has been much more recent.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick
Sent: Thursday, April 15, 2004 4:18 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Updating Global.CFG

Doesn't that only work with Imail 8.x and not the earlier versions.  I got
the impression somewhere, sometime.

Chuck Schick
Warp 8, Inc.
303-421-5140
www.warp8.com


> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Mike Hyslip
> Sent: Thursday, April 15, 2004 8:22 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Updating Global.CFG
>
>
> It is for user SMTP authentication.  To bypass relay settings and show 
> you're really a user of the server when sending an email (so you can 
> relay while off the local network) - since you're an authenticated 
> user, you can choose to whitelist any emails from that particular session.
>
> Mike
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze - 
> Hostmaster
> Sent: Thursday, April 15, 2004 10:15 AM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] Updating Global.CFG
>
> Hello,
>   I'm also updating my Global.CFG file and noticed something new.
> What is WHITELIST AUTH?  I checked the online manual, but there's 
> nothing listed for it.  There's an entry for WHITELIST HABEAS, but not
AUTH.
>   Thanks..
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus 
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Ipfile.txt

[Jeff Maze - Hostmaster]

Hello,
I accidentally overwrote my ipfile.txt test when I upgraded my
Declude config files (global.cfg & $default$.junkmail).  Just wanted to make
sure I get this right (would like to add this as well even though the
latest-greatest global.cfg file is catching A LOT of spam).
In the global.cfg file I would enter the following entry:

IPTEST  ipfile C:\IMail\Declude\ipfile.txt x 10 0

And then in the $default$.junkmail file, I would enter the following
entry:

IPTEST  ROUTETO [EMAIL PROTECTED]   (or whatever I want)

This appear as being correct, right?
Thanks.. -Jeff


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Updating Global.CFG

[Jeff Maze - Hostmaster]

Hello,
I'm also updating my Global.CFG file and noticed something new.
What is WHITELIST AUTH?  I checked the online manual, but there's nothing
listed for it.  There's an entry for WHITELIST HABEAS, but not AUTH.
Thanks..


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] all_list.date

[Jeff Maze - Hostmaster]

Great, thanks!


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher
Sent: Thursday, April 15, 2004 9:59 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] all_list.date

all_list.dat uses the IP address to calculate the country code. Used with
the COUNTRY and COUNTRIES tests.

Scott Fisher
Director of IT
Farm Progress Companies

>>> [EMAIL PROTECTED] 04/15/04 08:47AM >>>
Hello,
Was just wondering what this file was?  I missed a few days and didn't
see anything in the archives..  Thanks..


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)] 

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] all_list.date

[Jeff Maze - Hostmaster]

Hello,
Was just wondering what this file was?  I missed a few days and didn't
see anything in the archives..  Thanks..


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Test

[Jeff Maze - Hostmaster]

Ok.. Got it back..  I guess just not a lot going on..

But have noticed an INFLUX of spam messages lately..  A lot not being caught
by the filters but also a lot being caught.. 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze -
Hostmaster
Sent: Sunday, April 11, 2004 10:32 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Test

Haven't received messages from here nor Declude.Virus since Friday.. Just
doing a test..


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Test

[Jeff Maze - Hostmaster]

Haven't received messages from here nor Declude.Virus since Friday.. Just
doing a test..


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Subject Line FIlter

[Jeff Maze - Hostmaster]

And this only works in the Pro version, correct? 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Wednesday, March 24, 2004 2:26 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Subject Line FIlter


>Scott... Am I correct that case is also a factor??

No.

>Such as
>CONTAINSHello World
>will not catch
>hello world

CONTAINSHello World

*will* catch "hello world".


-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] How do they do it?

[Jeff Maze - Hostmaster]

One problem we've recently had is that a mail server we were trying to send
messages to would die intermittently..  Came to discover there were filters
on their router that when a certain "incident" happened, it blocked
everything from that computer IP for 4 hours..  Maybe this is something
you'd like to look into..

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler
Sent: Friday, February 06, 2004 7:10 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] How do they do it? 



I have no practical solution but you would need something that parses your
SMTP logfile in realtime (like unixtool's tail or the new baretail) and
track occurences of "invalid user" messages. If there are more then X
connection attempts from one single IP in Y minutes causing an invalid user
log entry this IP (or at least port 25 from this IP) should be blocked
immediatly for Z minutes.

Blocking the IP in Imail is problematic because you have to restart the
service every time the IP-list is updated.

I don't know if some SW firewalls like BlackIce or ZoneAlarm allow external
updates for IP-filter tables. Maybe there is also some HW appliance that can
do this.

Filtering by IP in declude junkmail is too late because this will not block
the connection attempts. 

Are you sure this joe jobs are the real reason why the amount of spam seems
to increase after you transfer the domain to your own server? What registrar
do you use? There was an intersting argument on this list some days ago
about certain registrars that seems to be here specially for spammers. Or
are you inserting your clients email adress in the whois information after
during transfer?

Markus




> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Joe Wolf
> Sent: Saturday, February 07, 2004 12:39 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] How do they do it? 
> 
> I called the Black Ice tech support people today and
> discussed this issue.
> They told me that Black Ice will not stop a dictionary attack 
> that is in progress, but it would shut the spammer down for a 
> second attempt.
> 
> He also had major concerns about backup mail spoolers.  He
> said that you have to whitelist your backup spoolers and that 
> will still allow the spammer to run their dictionary attacks.
> 
> He didn't think Black Ice was a good product for such use.
> He seemed like he knew what he was talking about.
> 
> -Joe
> 
> - Original Message -
> From: "Jeff Kratka" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Friday, February 06, 2004 5:17 PM
> Subject: RE: [Declude.JunkMail] How do they do it?
> 
> 
> > Are there others suggestion for firewall software for the
> server. Does
> > Zonealarm have a server version and if so does it work as
> well as Black
> Ice.
> >
> >
> > Jeff Kratka
> >
> > *
> > TymeWyse Internet
> > P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417
> > tel/fax: (541) 839-6027  -  [EMAIL PROTECTED]
> > *
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To 
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> > "unsubscribe Declude.JunkMail".  The archives can be found at 
> > http://www.mail-archive.com.
> >
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
> 

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] [OT] A lot of messages from <> in queue

[Jeff Maze - Hostmaster]

Hello,
Anyone know what lately (the last week or so) we've been getting a
lot of message building up in queue with <> as the from address (according
to the queue) and a to address listed as domains and other listings
different that what we host.
Any clues or iMail configuration (6.06) changes that I can change so
it automatically dumps these messages and not hold them in queue.
Thanks..


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Whitelisted

[Jeff Maze - Hostmaster]

Hello,
One of our clients has been forwarding e-mails that have made it
through the cracks and found something interesting.
I have our network whitelisted, and have the secdns entry so that it
checks the ip of the originating server when it comes through the sec mail
server.  But today, I noticed something (I don't have the original message
or headers; but printed out the message).
The IP of our secondary mail server is 67.17.218.70.  I received a
message that had its IP put in as the hostname.  So Declude saw this IP and
whitelisted.  I'll type a couple lines of the headers:

Received: from secmail.crescentdigital.com [67.17.218.70] by
mail.crescentdigital.com with ESMTP (SMTPD32-6.06) id ADFD3B007E; Fri, 14
Nov 2003 08:51:57 -0500
Received: from 67.17.218.70 ([211.219.196.240])
 by secmail.crescentdigital.com (8.12.8/8.12.5) with SMTP id hAEEpdwo012904;

 Fri, 14 Nov 2003 09:51:41 -0500
Received: from [135.4.188.96] by 67.17.218.70 SMTP id 1fYH8RwA83HJQ7; Wed,
19 Nov 2003 19:45:46 -0700
X-Mailer: AOL 7.0 for Windows US sub 118
X-Spam-Tests-Failed: Whitelisted

I have Declude Standard (one of the latest version, but not the
latest).  Is there anyway to fix this?  The 211.219 IP is a Korean IP and
the 135.4 is Lucent (?).
Thanks.. Jeff


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Spammer wanting servers?

[Jeff Maze - Hostmaster]

Yeah, really..  2,000 IP's, dedicated network for one $2,000 a month..  Uh,
yeah right..  And the providers profit on that?  hahahaha

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jonathan
Sent: Wednesday, November 12, 2003 6:36 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Spammer wanting servers?


He wants 2,000 IPs? Sure, no problem .. in fact, I'll give him a whole class
B.

10.123.x.x :)

Jonathan

At 05:22 PM 11/12/2003, you wrote:
>Hi Scott-
>
>Where on the tools page is this nifty test located?
>
>:)
>
>-Original Message-
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
>Sent: Wednesday, November 12, 2003 2:47 PM
>To: [EMAIL PROTECTED]
>Subject: RE: [Declude.JunkMail] Spammer wanting servers?
>
>
>
> > > offer me such service please call me at: 1617-901-4129, Leave me a 
> > > message
>
> >Number is a Sprint PCS cell phone in Boston.
>
>... or an AT&T wireless phone in Boston, per 
>http://www.dnsstuff.com/tools/dophone.ch?name=1617-901-4129 .
>
> -Scott
>---
>Declude JunkMail: The advanced anti-spam solution for IMail 
>mailservers. Declude Virus: Catches known viruses and is the leader in 
>mailserver vulnerability detection. Find out what you've been missing: 
>Ask about our free 30-day evaluation.
>
>---
>[This E-mail was scanned for viruses by Declude Virus 
>(http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To 
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
>"unsubscribe Declude.JunkMail".  The archives can be found at 
>http://www.mail-archive.com.
>
>---
>[This E-mail was scanned for viruses by Declude Virus
>(http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To 
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
>"unsubscribe Declude.JunkMail".  The archives can be found at 
>http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Outbound failing IPNOTINMX

[Jeff Maze - Hostmaster]

Hello,
I have a client that is concerned because every message he sends
out, Deculde states that it's failing the IPNOTINMX test.  He's used
dnsreport on his domain and replied to me with this line:

"Messages I send out are failing IPNOTINMX spam test. This is report from
DNSreport.com you can run again since this seems to have formatting that
email doesn't like. I found this on Declude's web site."

I don't understand exactly what he means or what he wants me to do
with this, but is there something I can tell him to try and have him not
worry about it?  The IPNOTINMX test is still set to the default weight, so
none of his messages should be bounced, etc.  Is this test failing because
he is sending the messages from home and Declude is running the tests on
this IP address?

Just was wondering.. Thanks..


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] [OT] WEIRD Problem!

[Jeff Maze - Hostmaster]

Thanks for the suggestions all..  I had already changed the password when
the first time it happened..  But I've since turned off the Norton Anti-Spam
and will see if anything else happens..  Thanks again..

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Stanley Lyzak
Sent: Tuesday, October 21, 2003 10:23 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] [OT] WEIRD Problem!


One other thing you can try (I actually think Scott is on the right track if
your laptop firewall is showing outbound Outlook access).

Try not to save your email password in your outlook. Have it prompt you.

Much easier to stop these things when they cannot authenticate.


Stan Lyzak, BSEE, CISSP, MCSE², CCNA, Security+, A+
Network Security Engineer
ASysTech, Inc.




-Original Message-
From: Jeff Maze - Hostmaster [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, October 21, 2003 9:44 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] [OT] WEIRD Problem!


Hello,
I've recently discovered something interesting happening with my
laptop.  Just a little FYI about it.  I have all spam messages that fail the
Declude Tests forwarded to a [EMAIL PROTECTED] account, which I
download and review on my computer.  I have NIS 2004 running on my laptop as
well.  I'm also running NIS Anti-virus 2004 and it's updated with Virus defs
dated 10/15/2003 and a full system scan was just completed (attempted
liveupdate this morning, but it's just sitting there).
Anyway, the other day I received 3 Undeliverable Mail messages in
this spam account and upon reviewing the message, saw that it was coming
from the WAN IP address of my laptop (cable providers IP address when at
home (2), and the firewall WAN IP when at work (1)).  So I setup NIS to
inform me whenever Outlook 2002 tried to send out messages; NIS is also
configured to only allow Outlook to connect to our mail server to send and
receive messages.
Well, it happened again this morning; I knew because NIS popped up a
window stating such.  I've included the Undeliverable Mail message as well
as the iMail log entry.  I attempted to lookup the D*.SMD and Q*.SMD (to see
what the message contained), but iMail has already deleted them and even
though I have Outlook setup to store all sent messages in the sent items
folder, there is nothing there as well.  I got the alert while receiving
messages from the spam account.
Anyone every hear of anything like this before?
Thank you for your time and attention.. -Jeff


undeliverable to [EMAIL PROTECTED]

Original message follows.

Received: from %computername% [67.17.218.x] by crescentdigital.com with
ESMTP
  (SMTPD32-6.06) id A30560E0134; Tue, 21 Oct 2003 08:13:57 -0400
From: "DO NOT REPLY TO THIS ACCOUNT - Please reply to original sender"
<[EMAIL PROTECTED]>
To: "'Catalina'" <[EMAIL PROTECTED]>
Date: Tue, 21 Oct 2003 08:13:40 -0400
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: application/ms-tnef;
name="winmail.dat"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="winmail.dat"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.4510
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-MS-TNEF-Correlator: A762BD7065A7A046BC679108E78E7F89447F2800
Subject: Not read: This is not loan  j
X-Declude-Sender: [EMAIL PROTECTED] [67.17.218.x]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.

eJ8+Ii4MAQaQCAAEAAABAAEAAQeQBgAI5AQAAADoAAEIgAcAFwAAAFJFUE9S
eJ8+VC5J
UE0uTm90ZS5JUE5OUk4AtwYBDYAEAAICAAIAAQqAAQAhQTA2MEZEM0Q4MzEwQUI0MjhB
MjYwNDEyREVBMkYwNjQAEQcBA5AGAIQDAAAaCwAjAAALACkAAEAAMgDgQjiyzJfD
AR4ASQABJgAAAFtOb3J0b24gQW50aVNwYW1dIFRoaXMgaXMgbm90IGxvYW4gIGoCAUwA
AQAAADUAgSsfpL6jEBmdbgDdAQ9UAgAAAQBBbGx5c3NhAFNNVFAAY3B5dXNAeWFob28u
Y29tAEAATgAAvK6jApjDAUAAVQCAuMGTv5fDAR4AcAABJgAAAFtOb3J0b24gQW50aVNw
YW1dIFRoaXMgaXMgbm90IGxvYW4gIGoCAXEAAQAAABYBw5fMsjhj1+r3oAhAD5a+slvd
v2KaAAAeAHIAAQEAHgBzAAEBAB4AdAABDgAAAFN1YnNjcmli
ZXIgMzcLAAgMAAIBHQwBHgAAAFNNVFA6U1BBTUBDUkVTQ0VOVERJR0lUQUwuQ09N
CwABDgEDABQOAB4AKA4BOwAAADAwMDAwMDA1AXNwYW1AY3Jlc2NlbnRkaWdp
dGFsLmNvbQFzcGFtQGNyZXNjZW50ZGlnaXRhbC5jb20AAB4AKQ4BOwAAADAwMDAwMDA1AXNw
YW1AY3Jlc2NlbnRkaWdpdGFsLmNvbQFzcGFtQGNyZXNjZW50ZGlnaXRhbC5jb20AAB4AARAB
GQAAAE1lc3NhZ2Ugd2FzIG5vdCByZWFkIGJ5OgACAfgPAQAAABCnYr1wZaegRrxnkQjn
jn+JAgH6DwEQp2K9cGWnoEa8Z5EI545/iQIB+w8BkgA4obsQBeUQ
jn+GqG7

[message truncated]


iMail Log Entry:

10:21 08:13 SMTPD(060E0134) [67.17.218.5] connect 67.17.218.x port 1371 

10:21 08:13 SMTPD(060E0134) [67.17.218.x] EHLO %computername% 

10:21 08:13 SMTPD(03E0) Authenticated [EMAIL PROTECTED], session
treated as local. 

10

RE: [Declude.JunkMail] [OT] WEIRD Problem!

[Jeff Maze - Hostmaster]

I have outlook setup so that any messages received from the separate e-mail
accounts (6 work e-mail accounts I look into), get automatically moved to
folders other than my Inbox.  So the host master account gets forwarded to
the host master folder, spam to the spam folder, etc.  Also, I have two
rules setup so that if certain people e-mail me, their messages are moved to
a separate folder as well.  There aren't any rules that are setup to
automatically forward messages.

Yes, Norton Anti-Spam is installed (came with NIS 2004; installs
automatically) and running on the system.  Should I turn this off and see if
the problem disappears?  

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Tuesday, October 21, 2003 10:08 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] [OT] WEIRD Problem!



> Anyone every hear of anything like this before?

Do you have any rules in Outlook to try to bounce E-mails?  Are you running 
any anti-spam software on the laptop?

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] [OT] WEIRD Problem!

[Jeff Maze - Hostmaster]

Hello,
I've recently discovered something interesting happening with my
laptop.  Just a little FYI about it.  I have all spam messages that fail the
Declude Tests forwarded to a [EMAIL PROTECTED] account, which I
download and review on my computer.  I have NIS 2004 running on my laptop as
well.  I'm also running NIS Anti-virus 2004 and it's updated with Virus defs
dated 10/15/2003 and a full system scan was just completed (attempted
liveupdate this morning, but it's just sitting there).
Anyway, the other day I received 3 Undeliverable Mail messages in
this spam account and upon reviewing the message, saw that it was coming
from the WAN IP address of my laptop (cable providers IP address when at
home (2), and the firewall WAN IP when at work (1)).  So I setup NIS to
inform me whenever Outlook 2002 tried to send out messages; NIS is also
configured to only allow Outlook to connect to our mail server to send and
receive messages.
Well, it happened again this morning; I knew because NIS popped up a
window stating such.  I've included the Undeliverable Mail message as well
as the iMail log entry.  I attempted to lookup the D*.SMD and Q*.SMD (to see
what the message contained), but iMail has already deleted them and even
though I have Outlook setup to store all sent messages in the sent items
folder, there is nothing there as well.  I got the alert while receiving
messages from the spam account.
Anyone every hear of anything like this before?
Thank you for your time and attention.. -Jeff


undeliverable to [EMAIL PROTECTED]

Original message follows.

Received: from %computername% [67.17.218.x] by crescentdigital.com with
ESMTP
  (SMTPD32-6.06) id A30560E0134; Tue, 21 Oct 2003 08:13:57 -0400
From: "DO NOT REPLY TO THIS ACCOUNT - Please reply to original sender"
<[EMAIL PROTECTED]>
To: "'Catalina'" <[EMAIL PROTECTED]>
Date: Tue, 21 Oct 2003 08:13:40 -0400
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: application/ms-tnef;
name="winmail.dat"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="winmail.dat"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.4510
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-MS-TNEF-Correlator: A762BD7065A7A046BC679108E78E7F89447F2800
Subject: Not read: This is not loan  j
X-Declude-Sender: [EMAIL PROTECTED] [67.17.218.x]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.

eJ8+Ii4MAQaQCAAEAAABAAEAAQeQBgAI5AQAAADoAAEIgAcAFwAAAFJFUE9S
eJ8+VC5J
UE0uTm90ZS5JUE5OUk4AtwYBDYAEAAICAAIAAQqAAQAhQTA2MEZEM0Q4MzEwQUI0MjhB
MjYwNDEyREVBMkYwNjQAEQcBA5AGAIQDAAAaCwAjAAALACkAAEAAMgDgQjiyzJfD
AR4ASQABJgAAAFtOb3J0b24gQW50aVNwYW1dIFRoaXMgaXMgbm90IGxvYW4gIGoCAUwA
AQAAADUAgSsfpL6jEBmdbgDdAQ9UAgAAAQBBbGx5c3NhAFNNVFAAY3B5dXNAeWFob28u
Y29tAEAATgAAvK6jApjDAUAAVQCAuMGTv5fDAR4AcAABJgAAAFtOb3J0b24gQW50aVNw
YW1dIFRoaXMgaXMgbm90IGxvYW4gIGoCAXEAAQAAABYBw5fMsjhj1+r3oAhAD5a+slvd
v2KaAAAeAHIAAQEAHgBzAAEBAB4AdAABDgAAAFN1YnNjcmli
ZXIgMzcLAAgMAAIBHQwBHgAAAFNNVFA6U1BBTUBDUkVTQ0VOVERJR0lUQUwuQ09N
CwABDgEDABQOAB4AKA4BOwAAADAwMDAwMDA1AXNwYW1AY3Jlc2NlbnRkaWdp
dGFsLmNvbQFzcGFtQGNyZXNjZW50ZGlnaXRhbC5jb20AAB4AKQ4BOwAAADAwMDAwMDA1AXNw
YW1AY3Jlc2NlbnRkaWdpdGFsLmNvbQFzcGFtQGNyZXNjZW50ZGlnaXRhbC5jb20AAB4AARAB
GQAAAE1lc3NhZ2Ugd2FzIG5vdCByZWFkIGJ5OgACAfgPAQAAABCnYr1wZaegRrxnkQjn
jn+JAgH6DwEQp2K9cGWnoEa8Z5EI545/iQIB+w8BkgA4obsQBeUQ
jn+GqG7

[message truncated]


iMail Log Entry:

10:21 08:13 SMTPD(060E0134) [67.17.218.5] connect 67.17.218.x port 1371 

10:21 08:13 SMTPD(060E0134) [67.17.218.x] EHLO %computername% 

10:21 08:13 SMTPD(03E0) Authenticated [EMAIL PROTECTED], session
treated as local. 

10:21 08:13 SMTPD(060E0134) [67.17.218.x] MAIL FROM:
<[EMAIL PROTECTED]>

10:21 08:13 SMTPD(060E0134) [67.17.218.x] RCPT TO: <[EMAIL PROTECTED]> 

10:21 08:13 SMTPD(060E0134) [67.17.218.x] MAIL FROM:
<[EMAIL PROTECTED]>

10:21 08:13 SMTPD(060E0134) [67.17.218.x] RCPT TO: <[EMAIL PROTECTED]> 

10:21 08:13 SMTPD(060E0134) [67.17.218.x] C:\IMAIL\spool\D2305134.SMD 2267 

10:21 08:13 SMTP-(0878) processing C:\IMAIL\spool\Q2305134.SMD 

10:21 08:13 SMTP-(0878) Trying yahoo.com (0) 

10:21 08:13 SMTP-(0878) Connect yahoo.com [64.157.4.78:25] (1) 

10:21 08:13 SMTP-(0878) 220 YSmtp mta109.mail.sc5.yahoo.com ESMTP
service ready

10:21 08:13 SMTP-(0878) >EHLO crescentdigital.com 

10:21 08:13 SMTP-(0878) 250-mta109.mail.sc5.yahoo.com 

10:21 08:13 SMTP-(0878) 250-8BITMIME 

10:21 08:13 SMTP-(0878) 250-SIZE 10485760 

10:21 08:13 SMTP-(0878) 250 PIPELINING 

10:21 08:13 SMTP-(0878) >MAIL FROM:<[EMAIL PROTECTED]> 

10:21 08:13 SMTP-(0878) 250 sender <[EMAIL PROTECTED]> ok 

10:21 08:13 SMTP-(0878) >RCPT To:<[EMAIL PROTECTED]> 

10:21 08:13 SMTP-(000

RE: [Declude.JunkMail] Imail/Web mail

[Jeff Maze - Hostmaster]

Where do you get Kill Web Mail?  Does it come with iMail 8?


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli
Sent: Thursday, October 16, 2003 3:01 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Imail/Web mail


I use Killer Web Mail but how do you show and sort by TO: Address.

- Original Message - 
From: "Matthew Bramble" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, October 16, 2003 3:36 PM
Subject: Re: [Declude.JunkMail] Imail/Web mail


> I do pretty much the same thing, though I use Killer Web Mail for this 
> purpose.
>
> I think you are talking about the list of messages, in which case you 
> might have to re-code your Web Mail templates to get that to work.  
> You can though do things like add the weight to the subject and 
> probably even the To address using the SUBJECT functionality in your 
> Default.$Junkmail$ file.  I append the weight to the messages with 
> SUBJECT [%WEIGHT%] for a redundant fail weight test, and then sort by 
> subject since I never see FP's above a certain score.  This comes in 
> real handy for testing new filters.  The only drawback of course is 
> that all BCC data is lost when you block with Declude.
>
> Matt
>
>
> Frederick Samarelli wrote:
>
> >Does anyone know of a way you can display the sender in the Web Mail 
> >for IMAIL.
> >
> >I am Routing email to a Web account and would like to display both 
> >the
TO:
> >and FROM:
> >
> >Thanks.
> >
> >Fred
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list.  To 
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> >"unsubscribe Declude.JunkMail".  The archives can be found at 
> >http://www.mail-archive.com.
> >
> >
> >
> >
>
> --
> ===
> Matthew S. Bramble
> President and Technical Coordinator
> iGaia Incorporated, Operator of NYcars.com
> ---
> Office Phone: (518) 862-9042
> Cellular: (518) 229-3375
> Fax: (518) 862-9044
> E-mail: [EMAIL PROTECTED] or [EMAIL PROTECTED]
> ===
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] [OT] Signed Spam..

[Jeff Maze - Hostmaster]

http://news.com.com/2100-7344_3-5089977.html?tag=nefd_top


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] [OT] iMail 6.06 behind firewall

[Jeff Maze - Hostmaster]

I know this is off-topic, but I've attempted numerous times to put our
server behind a firewall, but upon doing so, the queue grows to an enormous
proportion and the only way to clear it is to remove it from behind the
firewall.

Besides the normal ports 25, 110 and 80 (for web mail), do I also have to
keep 1024-65525 open as well for iMail to work properly?  Seems stupid to do
since normal standardized e-mail should only use the above mentioned three
ports (sendmail does).

I've contacted Ipswitch about this, and get the same ol' line about
upgrading to the latest version and getting full support.  But since my boss
is cheap and won't upgrade, it makes my life not too pleasant.

Thanks for any help you may offer..  -Jeff


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Backup MX / Spam

[Jeff Maze - Hostmaster]

Use the IPBYPASS %sec mx ip% feature within the GLOBAL.CFG file.  It will
skip the ip address of your secondary mx record and run the check on the ip
address of the originating server.

IPBYPASSxxx.xxx.xxx.xxx


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Robert Grosshandler
Sent: Thursday, October 02, 2003 11:34 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Backup MX / Spam


Hi

Some large percentage of the spam we get comes to the backup MX and then is
relayed to the primary MX.  

Using Declude JM Standard, is there some test I can use to add additional
weight to any mail routed through my backup MX?

Thanks,

Rob


==
Robert N. Grosshandler
www.iGive.com
Turn shopping into Philanthropy

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] [OT] - Subject: URGENT URGENT URGENT

[Jeff Maze - Hostmaster]

Title: Message



Anyone else getting messages such as this?  I'm 
getting them delivered into a number or different e-mail accounts.  Could 
this be the next thing thanks to SoBig?
 

-Original Message-From: Aron 
[mailto:[EMAIL PROTECTED] Sent: Thursday, September 11, 2003 
8:45 AMSubject: URGENT URGENT URGENT Importance: 
High
"GOT YOU"If you were dumb enough to open this 
email then you will find a WORM has executed itself through your 
mailbox and by the time you read this into your hard-drive. This is 
PAYBACK for the Virus you disguised in the email you sent to us 
recently which destroyed our hard-drive and back-up system. This costs us 
thousands of dollars and we lost a lot of irreplaceable files on our system.  Now it's your turn to have your computer infected. 
This WORM it is 
undetectable by AntiVirus software 
and it will  drive your computer crazy because it's 
always hiding and causing havoc in your system. Using your computer recovery 
disks will not remove the problem cause it still stays on your computers Motherboard. This will proabably cost you a new computer and 
I sincerely hope this teaches you a lesson not to send people nasty viruses 
again.Evocash Administration Inc.Phone: +1 767 4499922Fax: +1 767 4499922
^+Start^=Auto^Execute+^WORM^-^+Start^=Auto^Execute+^WORM^-^+Start^=Auto^Execute+^WORM^-^+Start^=Auto^Execute+^WORM^-^+Start^=Auto^Execute+^WORM^-
  

RE: [Declude.JunkMail] How do I get removed

[Jeff Maze - Hostmaster]

Yeah, I ran the test and we're also on the BLARSBL.  Looked up the secondary
mail server and that too is on the list.  Looks like he just blocked our
whole IP range.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Wednesday, September 10, 2003 10:10 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] How do I get removed



>How do I get off this spam list. URBL  Im not even sure how I got on.
>
>http://www.dnsstuff.com/tools/ip4r.ch?ip=64.118.70.2

If you read the description, you'll see why you are appropriately 
listed.  We usually get several E-mails every day from people asking us.  :(

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Using Declude to block Sobig Virus

[Jeff Maze - Hostmaster]

Title: Message



    The one thing I've been doing since the "invasion" 
began was use our secondary mail server to block the IP's of infected 
machines.  Most of the infected messages seem to come through this machine 
first.  We're running Sendmail (with webmin interface; a lot easier to 
admin a linux box) and just editing /etc/mail/access file and adding the 
ip's seems to have cut back significantly.
 
    I've added the ip's of blocked computers just to show 
how bad it's gotten for us.
 
68.198.54.158 REJECT68.21.239.190 REJECT66.121.151.50 REJECT12.24.245.12 REJECT65.16.62.133 REJECT68.21.234.46 REJECT24.159.60.200 REJECT206.241.2.71 REJECT64.147.6.241 REJECT67.81.61.57 REJECT64.30.194.34 REJECT68.36.190.124 REJECT68.52.195.199 REJECT63.164.145.33 REJECT64.238.101.148 REJECT68.156.224.121 REJECT24.170.148.211 REJECT131.123.194.222 REJECT65.106.147.178 REJECT64.42.16.202 REJECT24.211.10.41 REJECT200.71.130.17 REJECT167.206.206.195 REJECT66.127.198.198 REJECT162.40.222.119 REJECT208.40.28.196 REJECT24.208.129.78 REJECT207.225.67.82 REJECT159.247.3.210 REJECT62.203.100.247 REJECT67.121.153.139 REJECT61.171.135.186 REJECT166.102.18.250 REJECT208.191.162.43 REJECT66.207.240.194 REJECT67.22.187.165 REJECT66.0.236.20 REJECT67.124.159.88 REJECT172.195.161.72 REJECT218.74.215.84 REJECT218.4.189.195 REJECT67.123.8.79 REJECT24.192.246.239 REJECT67.35.8.41 REJECT67.124.156.242 REJECT218.154.254.90 REJECT68.211.150.190 REJECT216.78.60.164 REJECT24.56.47.175 REJECT209.145.206.61 REJECT68.154.104.93 REJECT24.51.83.89 REJECT61.11.73.184 REJECT68.158.221.166 REJECT209.114.230.52 REJECT207.233.213.6 REJECT143.111.23.145 REJECT68.42.36.205 REJECT12.224.192.252 REJECT68.211.189.49 REJECT192.216.156.19 REJECT24.228.47.53 REJECT68.36.3.18 REJECT209.42.33.176 REJECT67.124.41.187 REJECT61.77.77.26 REJECT62.56.134.108 REJECT68.211.254.102 REJECT67.34.231.144 REJECT68.154.105.182 REJECT68.75.177.204 REJECT199.8.235.219 REJECT64.204.5.34 REJECT24.51.80.32 REJECT68.74.150.211 REJECT218.148.9.3 REJECT68.42.56.220 REJECT208.61.30.204 REJECT12.248.55.60 REJECT202.69.84.212 REJECT61.171.70.153 REJECT24.53.88.127 REJECT64.223.33.234 REJECT66.68.84.60 REJECT67.34.240.3 REJECT68.158.34.212 REJECT68.158.98.7 REJECT162.40.32.115 REJECT66.228.145.47 REJECT209.90.85.25 REJECT213.136.106.126 REJECT217.164.73.133 REJECT61.189.204.100 REJECT200.67.179.81 REJECT61.189.203.191 REJECT217.164.72.55 REJECT61.189.203.246 REJECT217.164.72.29 REJECT68.211.224.163 REJECT200.67.179.50 REJECT68.80.143.188 REJECT209.142.243.81 REJECT204.117.50.140 REJECT68.154.64.14 REJECT162.83.176.132 REJECT65.73.95.99 REJECT196.21.128.1 REJECT67.80.139.111 REJECT68.154.70.39 REJECT139.55.233.177 REJECT162.40.37.192 REJECT62.80.224.31 REJECT203.129.202.18 REJECT162.40.38.232 REJECT162.40.35.90 REJECT217.23.38.139 REJECT68.211.233.11 REJECT67.64.6.246 REJECT208.180.60.231 REJECT68.159.166.134 REJECT67.86.70.25 REJECT24.99.10.242 REJECT209.53.213.216 REJECT138.88.207.116 REJECT66.76.141.52 REJECT208.57.145.28 REJECT66.123.232.6 REJECT66.13.214.118 REJECT68.43.11.199 REJECT207.232.103.155 REJECT208.57.105.248 REJECT68.153.69.21 REJECT66.190.154.21 REJECT4.41.189.36 REJECT24.218.40.135 REJECT216.170.5.59 REJECT68.113.10.240 REJECT24.199.82.174 REJECT68.58.112.228 REJECT172.128.42.74 REJECT206.230.185.42 REJECT65.57.29.48 REJECT156.110.31.162 REJECT172.175.113.206 REJECT24.126.130.151 REJECT208.255.242.58 REJECT66.76.135.192 REJECT65.64.25.225 REJECT67.34.236.66 REJECT162.40.37.6 REJECT

[Declude.JunkMail] [OT] Weird e-mails..

[Jeff Maze - Hostmaster]

Anyone else seeing e-mails such as these:I've received a number of these
and they're being caught by Declude as spam..  They also appear to be coming
from more than one place, including rr.com..

__
Subject: How you been?

Why hello ;)

Whats been happening on your side of the woods?

We haven't been doing much at all really!

Anyways seeya tommorow.

__
Received: from 12-217-117-164.client.mchsi.com [12.217.117.164]
Subject: Hello

Hey,

How have you been?  What have you been doing lately?

Ive just been at home doing nothing :( bored at uni etc.

Anyway's lets catch up soon,

Luv,
You know who ;)


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] FW: Attention mail server administrators

[Jeff Maze - Hostmaster]

Yeah, I've had a number of people calling saying they can receive messages
from our server, but get server time-outs when trying to send messages.
Trying to talk to these non-IT type people is a pain.

Trying to explain to them that it's not our server, but their internet
provider and to call them for a solution (the classic question: "But aren't
you our internet provider?"; "Uh, we just host your e-mail and web site";
"But isn't that the same?").  As you stated, most of the time just changing
their SMTP server settings to the provider usually fixes the problem.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble
Sent: Thursday, August 28, 2003 10:59 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] FW: Attention mail server administrators


My father was just blocked by Cox from reaching my SMTP server the other 
day.  They did it without any warning/notice.  Their resolution was to 
use their own mail server for SMTP, but he could still reach my server 
by way of POP3.

It does introduce another potential point of failure into the mix that 
then becomes more problematic to troubleshoot for E-mail providers, but 
it's not terrible to have to do.

I did ask the customer service rep at Cox why they blocked everyone 
instead of just the spammers, and he of course didn't have a good 
answer.  Seems these guys don't want to police their network.  Naturally 
the way around this is to set up SMTP on a port other than 25, however 
IMail I think only has one setting for the entire server.

Matt



Markus Gufler wrote:

>Your opinions?
>
>Markus
>
>
>--
>From: No-IP Alerts [mailto:[EMAIL PROTECTED]
>To: xxx
>Subject: Attention mail server administrators
>
>
>Hello ,
>
>NOTICE:  Mail you send from your dynamic IP may not be reaching your 
>customers.
>
>Many ISP's including AOL,Road Runner have started rejecting mail sent 
>from residential dynamic IP address blocks in attempt to reduce the 
>amount of unsolicited email that travels through their networks. 
>No-IP.com has been working around the clock to provide a solution, 
>Alternate-Port SMTP.
>
>Altnerate-Port SMTP solves a couple of problems our users encounter 
>when trying to send mail from a residential service such as blocked 
>outbound port 25, AOL and other ISPs rejecting mail based on ip, and 
>inability to send mail from email addresses @yourdomain.com
>
>For detailed information about this service please visit: 
>http://www.no-ip.com/svc/mail/smtp
>
>Some providers that restrict outbound port 25 include
>- NetZero
>- Mindspring
>- MSN
>- Earthlink
>- Flashnet 
>- MediaOne
>- AT&T
>- Verizon
>- Bell Canada
>- Cox
>
>Note that Alternate-Port SMTP is for outbound mail only.  Should your 
>ISP block inbound port 25 you will need our Mail Reflector service 
>(http://www.no-ip.com/svc/mail/reflector).
>
>If you are unsure what service you need or have questions please open a 
>support ticket at http://www.no-ip.com/ticket/
>
>Regards,
>No-IP.com Alerts
>  
>


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] OSRELAY Replacement..

[Jeff Maze - Hostmaster]

So what are y'all beginning to use instead of the OSRELAY tests?

I was using this and one of the other OS tests.  Even though I still had 350
messages in my spam account this morning, I would like another test to
replace these.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Increased SPAM not being blocked.

[Jeff Maze - Hostmaster]

Maybe start using the BLACKLIST option.  I've been doing that for a little
while, and it seems to cut back on a lot of spam.  I have them setup with a
20 weight and a ROUTETO my spam account so I can review and see if they're
legit or not..


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] A good SD.TXT File?

[Jeff Maze - Hostmaster]

Anyone have one handy that might assist me?  Hahaha

Thanks.. Jeff


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: Imail v6 and Windows Update

[Jeff Maze - Hostmaster]

Title: Message



Thanks Denny.. Removal went well and everything is back to normal.. Good 
to know that at least someone had gone through the same thing.. 
hahaha

  
  -Original Message-From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of Denny JodeitSent: Thursday, July 17, 2003 10:17 
  AMTo: [EMAIL PROTECTED]Subject: Re: 
  [Declude.JunkMail] OT: Imail v6 and Windows Update
  Yes, the tech installed the whole boat-everything 
  Microsoft had to offer, then I uninstalled Q328310 only and the problem was 
  gone.
  I had also had the problem in Dec 2002 when 
  Q328310 was first released, so I knew where to look.
  
- Original Message - 
From: 
Scott 
MacLean 
To: [EMAIL PROTECTED] 

Sent: Thursday, July 17, 2003 10:56 
AM
Subject: Re: [Declude.JunkMail] OT: 
Imail v6 and Windows Update
Did you install Q328310, then install SP4, then 
uninstall Q328310 and it fixed it?At 10:33 AM 7/17/2003, Denny 
Jodeit wrote:
I did not uninstall SP4, just 
  Critical Update Q328310 and it fixed theproblem.- 
  Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]>To: 
  <[EMAIL PROTECTED]>Sent: 
  Thursday, July 17, 2003 10:23 AMSubject: Re: [Declude.JunkMail] OT: 
  Imail v6 and Windows Update>> 
  > Was wondering if 
  anyone knew what the Microsoft update it wasthat> >caused 
  the display of the IMail manager to be shifted and un-readable.> 
  > Dang new people 
  installed it and now I can't edit any of the> >entries, 
  etc.>> It's probably the Windows 2000 SP4 that was 
  installed.  It includes the> update that caused the IMail 
  Administrator screen to be> shifted.  Unfortunately, the only 
  ways to fix it seem to be either to not> install SP4, or to upgrade 
  IMail.>> 
  -Scott> ---> Declude JunkMail: The advanced anti-spam 
  solution for IMail mailservers.> Declude Virus: Catches known 
  viruses and is the leader in mailserver> vulnerability 
  detection.> Find out what you have been missing: Ask for a free 
  30-day evaluation.>> ---> [This E-mail was scanned 
  for viruses by Declude Virus(http://www.declude.com)]>> ---> 
  This E-mail came from the Declude.JunkMail mailing list.  To> 
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and> type 
  "unsubscribe Declude.JunkMail".  The archives can be found> at 
  http://www.mail-archive.com.>>---[This 
  E-mail was scanned for viruses by Declude Virus 
  (http://www.declude.com)]---This E-mail came from the 
  Declude.JunkMail mailing list.  Tounsubscribe, just send an 
  E-mail to [EMAIL PROTECTED], andtype "unsubscribe 
  Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.___Scott MacLean[EMAIL PROTECTED]ICQ: 9184011http://www.nerosoft.com

RE: [Declude.JunkMail] OT: Imail v6 and Windows Update

[Jeff Maze - Hostmaster]

That's true..  Version 6 works just fine for what we use it for and don't
need to spend the $1500 it'll take to upgrade to version 8 (running version
6 unlimited).  I guess that's just business though..

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jose Gosende
Sent: Thursday, July 17, 2003 9:38 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update


Yea, and expose my server's security to fix some GUI issue? Sounds like
Ipswitch should provide a maintenance release for v6.0 users to eradicate
this problem.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Denny Jodeit
Sent: Thursday, July 17, 2003 10:27 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] OT: Imail v6 and Windows Update


If you remove Critical Update # Q328310, the problem goes away. This does
work, I have experienced it. Ipswitch issued a patch for this problem for
versions 7.x and above, but stated they will never issue one for Ver. 6.
This is per Ipswitch KB article IM-20021218-DM01

HTH,
Denny

- Original Message -
From: "Jose Gosende" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, July 17, 2003 10:12 AM
Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update


> wow, and I thought it was a terminal services issue.
> I've had this problem for quite some time and would love
> to hear a workaround. BTW, how do you know a Windows update caused 
> this problem?
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Jeff Maze - 
> Hostmaster
> Sent: Thursday, July 17, 2003 10:05 AM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] OT: Imail v6 and Windows Update
>
>
> Hello,
> Was wondering if anyone knew what the Microsoft update it was that 
> caused the display of the IMail manager to be shifted and un-readable. 
> Dang new people installed it and now I can't edit any of the entries, 
> etc. Thanks.. Jeff
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus 
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: Imail v6 and Windows Update

[Jeff Maze - Hostmaster]

Thanks for all the replies..

I went to uninstall it and it came up saying that "some or all of the
following may not work after uninstall" and gave a list of five things
including the network adapter.  Time for a back up and hope for a quick
reinstall if it crashes hard.  hahaha

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Denny Jodeit
Sent: Thursday, July 17, 2003 9:27 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] OT: Imail v6 and Windows Update


If you remove Critical Update # Q328310, the problem goes away. This does
work, I have experienced it. Ipswitch issued a patch for this problem for
versions 7.x and above, but stated they will never issue one for Ver. 6.
This is per Ipswitch KB article IM-20021218-DM01

HTH,
Denny

- Original Message - 
From: "Jose Gosende" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, July 17, 2003 10:12 AM
Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update


> wow, and I thought it was a terminal services issue.
> I've had this problem for quite some time and would love
> to hear a workaround. BTW, how do you know a Windows update caused 
> this problem?
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Jeff Maze - 
> Hostmaster
> Sent: Thursday, July 17, 2003 10:05 AM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] OT: Imail v6 and Windows Update
>
>
> Hello,
> Was wondering if anyone knew what the Microsoft update it was that 
> caused the display of the IMail manager to be shifted and un-readable. 
> Dang new people installed it and now I can't edit any of the entries, 
> etc. Thanks.. Jeff
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus 
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
>
>


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: Imail v6 and Windows Update

[Jeff Maze - Hostmaster]

Because the new person read there was an security update and ran Windows
Update and downloaded and installed everything.

I found the link in Ipswich's web site.  It has something to do with Q328310
and version 6.06 and 7.07 of Imail.  Update iMail to 7.15 and all is well.
BUT since we're running version 6, there's no fix from Ipswich besides
uninstalling that Microsoft update.  Hope all goes well.


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jose Gosende
Sent: Thursday, July 17, 2003 9:12 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] OT: Imail v6 and Windows Update


wow, and I thought it was a terminal services issue.
I've had this problem for quite some time and would love
to hear a workaround. BTW, how do you know a Windows update caused this
problem?

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Jeff Maze -
Hostmaster
Sent: Thursday, July 17, 2003 10:05 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] OT: Imail v6 and Windows Update


Hello,
Was wondering if anyone knew what the Microsoft update it was that
caused the display of the IMail manager to be shifted and un-readable.
Dang new people installed it and now I can't edit any of the
entries, etc.
Thanks.. Jeff


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] OT: Imail v6 and Windows Update

[Jeff Maze - Hostmaster]

Hello,
Was wondering if anyone knew what the Microsoft update it was that
caused the display of the IMail manager to be shifted and un-readable.
Dang new people installed it and now I can't edit any of the
entries, etc.
Thanks.. Jeff


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] IP Blacklists

[Jeff Maze - Hostmaster]

Add the following line to your global.cfg file:

BLACKLISTIP ipfile  x:\IMail\Declude\ipfile.txt x   20

(edit the x:\IMail\Declude to the location of your IMail directory location)

And then put the attached file into your Declude directory..

I've built this list over the last 8-10 months now.

Hope this helps..

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Rob Salmond
Sent: Thursday, July 17, 2003 7:42 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] IP Blacklists


The manual is pretty clear about how to setup IP blacklists, but it doesn't
specifically say what IP's you are blacklisting.  Is this the source IP of
the message, or the mailserver it was sent from / mailserver it hopped
through?

Rob Salmond
Ontario Die Company
(519)-576-8950 ext. 132


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



ipfile.zip
Description: Zip compressed data

[Declude.JunkMail] OT: Hackers try to get points this weekend..

[Jeff Maze - Hostmaster]

http://www.driverheaven.net/index.php?action=view&s=6f6fd9a1c35681a95272ecec
6235161d&articleid=3793

Copy and paste into web browser to read article..


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] "Subject Contains" test

[Jeff Maze - Hostmaster]

Ahh, ok.. Thanks..


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Smart Business
Lists
Sent: Tuesday, July 01, 2003 8:29 AM
To: Jeff Maze - Hostmaster
Subject: Re: [Declude.JunkMail] "Subject Contains" test


Jeff,

Tuesday, July 1, 2003 you wrote:
JMH> I was wondering if there was a "subject contains" type of test. 
JMH> E.g. A message subject line contains Viagra, kinky, xxx, sex, etc. 
JMH> it will fail the tests.
JMH> Is there something like this already?  Thanks..


  That is filtering and it is available in the pro version.


Terry Fritts


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] "Subject Contains" test

[Jeff Maze - Hostmaster]

Hello,
I was wondering if there was a "subject contains" type of test.
E.g. A message subject line contains Viagra, kinky, xxx, sex, etc. it will
fail the tests.
Is there something like this already?  Thanks..


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Unknown Folder

[Jeff Maze - Hostmaster]

I hope it's because of F-Prot!  I noticed these too, but we have maybe 10 or
so right now.  If anyone knows what they're for or if they can be deleted,
I'd be interested..

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Saturday, June 28, 2003 3:03 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Unknown Folder



>In my spool folder this morning are a bunch of ".vir" folders with 
>1_1.exe in them. I have not encountered these before.
>What are they?

The \IMail\spool\*.vir directories are temporary directories that Declude 
Virus uses to scan attachments.

It is normal to see those directories come and go; if they remain for more 
than 2 hours, then there was a problem with the scanning (the log file 
would have more details).  It is safe to delete those directories if they 
are more than 2 hours old.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: Spam Alert: [Declude.JunkMail] For real?

[Jeff Maze - Hostmaster]

I'm sure there are a couple "friends" that you could contact on IRC and just
see how "HACKER-PROOF" their system truly are.  hahaha

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Sean Fahey
Sent: Friday, June 06, 2003 9:25 AM
To: [EMAIL PROTECTED]
Subject: Spam Alert: [Declude.JunkMail] For real?


Declude blocked this (thankfully) but because it's so blatant, I went ahead
and read it... had to check my blood pressure afterwards. It got me thinking
though - would a real spammer send this out or was it the work of a
vigilante. The rest of the e-mail posts phone numbers, cell phones, business
addresses, web sites a lot of contact info.

>>> BEGIN SPAM PITCH <<<

Welcome to the 2nd Edition of the Efficient Systems "Money Making Newsletter
- (And please pass this e-mail along to any interested friends & associates
who are looking to make THOUSANDS per day doing BULK E-MAIL!)

My name is Richard Schuler, I'm a 23 year old Multi-Millionare and I'm
inviting you to Learn How to Spam Millions of People Per Day like I do. My
Online Pharmacy Business is the single largest E-mail marketing company in
the world today. Efficient Systems of Dania, Florida proudly sends OVER 600
MILLION SPAM E-MAILS per day, every single day, through a rapidly growing
network of saavy and aggressive worldwide marketing partners and our rapidly
growing in-house e-mail marketing team to play an agressive, currently $60
Million dollars per year "numbers game". We are directly responsible for up
to 70% of the online Viagra and Pharmacy E-Mail SPAM generated sales on the
net today and by far the largest E-Mail Marketing operation of this kind in
the world, bar none! When it comes to numbers, ours are DEFINATELY the
HIGHEST!

Why are we so successful?? 1. Because, simply put, NO ONE can bring us down!
And 2. Because we KICK ASS with Our HACKER-PROOF and ANTI-SPAMMER-PROOF
sales websites and because when you get right down to it, PEOPLE ARE LIKE
SHEEP, and if the "sheep" get enough e-mail shoved at them, the sheep WILL
become customers! It's that simple and it's the key to our success and the
prosperity of our partners! We've just kicked off a drive to recruit
THOUSANDS of new sales partners and affiliates. Some of our largest Spammers
are being paid $55,000 per week! Contact us and JOIN US NOW!

...remainder of spam truncated.

>>> END SPAM PITCH <<<

Ready to Get Started and Start Sending Lots of E-Mail For Us??

Call or E-Mail me NOW!
http://wwwmyrxbiz.com/

Sincerely,

Richard Schuler
E-Mail me by Clicking HERE
My Personal Phone numbers are:
1-800-879-6704
954-536-9448
954-650-3364
 Get Your Private Website NOW and start getting the E-MAIL out!

Contact: Angelo


Web Operations Manager
Land: 1-800-879-6704
Cell: 954-993-5731


[EMAIL PROTECTED]
AIM: ngel
http://wwwmyrxbiz.com/


EFFICIENT SYSTEMS
2148 SW 38TH STREET
DANIA, FL 33312
1-800-879-6704


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.