[Declude.JunkMail] ATTENTION: My E-mail address has changed

[marc . catuogno]

Please Change Your Address Book  

Thank you for emailing me.  Your email has been received, and I will 
respond as soon as possible.

We are pleased to announce that Rand Realty has recently affiliated with Better 
Homes and Gardens Real Estate.  Accordingly, our email addresses have 
changed from " prudentialrand.com" to " randrealty.com".  Please update 
your address book and direct all future messages to 
marc.catuo...@randrealty.com.   PLEASE START USING THIS NEW ADDRESS 
IMMEDIATELY  TO ENSURE DELIVERY.

There is no need to resend this message as it has been forwarded to the new 
address, but this will change shortly.  Thereafter, all E-mail received by 
this address will be returned without being forwarded to me. So please update 
your Address Book.  

[This message is auto-generated] 




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] mail server software

[Marc Catuogno]

If you are looking at smartermail I would make sure you don't have too many
Blackberry users. I moved off of IMAIL for Smartermail and on the whole it
was an improvement BUT with IMAIL people got their BB email.  Smartermail
has an intermittent issue with BB; some messages just randomly don't appear
on the BB.  Never had an issue until I moved to SM.  I put in a ticket, they
suggested an upgrade, the upgrade made even more people miss messages.  They
did a packet capture that proved that SM sent data to the BB on ONE single
missed message, they felt that was enough proof. 

I am going to have to tell all my users to forward the email to their BB
email accounts because that is the only reliable way of getting messages to
the BB from Smartermail - unless maybe you disable IMAP.   I suspect that it
has something to do with IMAP IDLE so I just turned that off, but last time
I did there was a 30 minute delay of email delivery.  I'm waiting for user
complaints.  I'm probably going to tell my users to forward, tired of being
SM's guinea pig and getting an answer like, "well our system sent the data".
I wish they had more of an interest in finding/fixing the issue instead of
just being right.

Their system has been pretty good but with the unreliability of delivery to
BB from their software  I am going to be looking at another solution in the
next few months...

 

Marc

 

From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Michael
Graveen
Sent: Tuesday, February 03, 2009 8:10 PM
To: declude.junkmail@declude.com
Subject: re: [Declude.JunkMail] mail server software

 

I use SmarterMail (www.smartertools.com) and like it a lot.  SmarterTools
has conversion tools to help you migrate your IMail domains to SmarterMail.

Hope this helps.

Mike

  _  


I am going to move from Imail soon.
Does any one have any recommendations on reasonable Mail Server software.
we need maybe 200 users, and we just pop our mail now.
I have been using Workgroup Share to add calendar sharing etc to our current
config.
Has any one used their Mail Server software and what do you think of it?
and will my junkmail still work with it?

Thanks for any help.

Bruce Loughlin



---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] automated response

[Marc Catuogno]

 
I will be out of the office and all day on 8/26/08 with no access to email.  If 
you are having urgent computer issues please contact [EMAIL PROTECTED] or 
[EMAIL PROTECTED]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] automated response

[Marc Catuogno]

 
I will be out of the office from 3pm on 7/10/08 and all day on 7/11/08 with 
limited access to email.  If you are having urgent computer issues please 
contact [EMAIL PROTECTED] or [EMAIL PROTECTED]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] automated response

[Marc Catuogno]

 
For today, 4/11/08, I will be out of the office with limited access to email.  
Please contact [EMAIL PROTECTED] or [EMAIL PROTECTED] for urgent computer 
issues.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] form spam filter

[Marc Catuogno]

One thing we did on our domain is to ban "pasting" so that the scripts
couldn't paste their info into our fields.  Also I just had an idea and
asked the webmaster if he could program the form to perform a different
action if the form page was opened for too short of a time period.  Like
shoot to a second page that would ask for a confirmation click or word to be
typed in. This assumes that a person would take significantly more time to
fill a form than a program, even if it is a keystroke generator

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin
Cox
Sent: Wednesday, April 09, 2008 11:54 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] form spam filter

 

Matt,

 

I did understand.  What I'm saying is that it doesn't always work.  To
clarify, in addition to less sophisticated automated form fillers that would
fill out all fields, there are also more sophisticated ones that use
keystroke generators to fill out forms.  I just saw one in the public domain
last month.  CAPTCHA doesn't have this problem, would defeat those automated
form fillers, and is therefore more reliable with similarly very little
effort to implement.


Darin.

 

 

- Original Message - 

From: Matt   

To: declude.junkmail@declude.com 

Sent: Wednesday, April 09, 2008 11:45 AM

Subject: Re: [Declude.JunkMail] form spam filter

 





No, I understood completely.  I've seen forms with fields hidden by DIVs
still filled out.  Some of the less sophisticated spam form fillers I've
seen used simply filled out every field.  They were not looking to see what
was "visible" and what wasn't.

Actually this is the part that you misunderstood.  The DIV's with visibility
hidden will never be filled out by real people, but they will get filled out
by form spam sending robots.  So if they get filled out, you pretend the
submission was successful, but you don't generate the E-mail.

It's a simple trick, and it works.

Matt

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Filter for Football

[Marc Catuogno]

Just an FYI, I just got this link claiming this is a trojan downloader

http://antivirus.about.com/b/a/257941.htm



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, September 12, 2007 1:07 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter for Football


You could create a filter that looks for 2 identifiers in the email then
score the filter in the global.cfg.

1. A phrase or word
2. The fact there is an IP as a URL

Example:

MINWEIGHTTOFAIL 2

ANYWHERE1   PCRE (?i:football|games?)
BODY1   PCRE
(http://((?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9
]|[01]?[0-9][0-9]?))

David


-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mon
Mariola - Rubén
Sent: Wednesday, September 12, 2007 11:28 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Filter for Football

This is only a sample. The IPs are different. At least I have counted about 
20 different subjects that declude has detected like spam and for each 
subject many combinations of bodies. 40% of the messages blocked by declude 
are of this type.

--
Subject: NFL Season Is Here!
Body:
The time has come for... FOOTBALL!
Don't miss a single game because you don't have the info you needed.
Have all the details for every game with our free game tracking system:
http://x.x.x.x/
--
Subject: Do you have your NFL Game List?
Body:
Football is back, Life may resume again!
Let us keep you on top of every game everyday.
Get all the info you need from our online game tracker:
http://x.x.x.x/
--
Subject: NFL Game List
Body:
We interrupt this life to bring you.FOOTBALL!
Know all the games, what time, what channel and the stats.
Stay informed for every game with our free game page:
http://x.x.x.x/
--
Subject: FOOTBALL! Are You ready?
Body:
Season is open and we do mean FOOTBALL!
Know all the games, what time, what channel and the stats.
Stay informed for every game with our free game page:

http://x.x.x.x/
--

Ruben Marti.
Mon Mariola, S.L.

- Original Message - 
From: David Barker
To: declude.junkmail@declude.com
Sent: Wednesday, September 12, 2007 4:36 PM
Subject: RE: [Declude.JunkMail] Filter for Football

Can you post an example ?




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] F-Prot 6?

[Marc Catuogno]

Your sarcasm is appreciated -  

I am used to users that don't listen or pay much attention, like asking
anti-virus questions on the junk mail list or asking a question that could
be answered by simply going to the website.

 

 

 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
SJ.Stanaitis
Sent: Thursday, August 23, 2007 9:53 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] F-Prot 6?

 

Your powers of observation boggle the mind.

 

--SJ

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc
Catuogno
Sent: Thursday, August 23, 2007 9:37 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] F-Prot 6?

 

So you have 100 users?

http://www.f-prot.com/products/prices/price_win_ms.html




F-PROT Antivirus for Windows Mail Servers



 

Number of Users

 

Annual license fee


 

1-24

 

US$ 269


 

25-49

 

US$ 359


 

50-99

 

US$ 449


 

100-199

 

US$ 719


 

200-299

 

US$ 989


 

300-399

 

US$ 1259


 

400-499

 

US$ 1529


 

500-749

 

US$ 1799


 

750-999

 

US$ 2069


 

1000-1999

 

US$ 2519


 

2000-2999

 

US$ 2969


 

3000-3999

 

US$ 3419


 

4000-4999

 

US$ 3869


 

5000-5999

 

US$ 4499

 

Marc Catuogno
MIS Director
Prudential Rand Realty
845-825-8025



-Original Message-
From: "SJ.Stanaitis" <[EMAIL PROTECTED]>
Sent 8/23/2007 9:04:42 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] F-Prot 6?



$500?  That's a steal.  Website answered my questions.

 

--SJ

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc
Catuogno
Sent: Wednesday, August 22, 2007 10:29 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] F-Prot 6?

 

Don't know - but it has a hefty price for legit use on a mail server unless
they have changed with the new version 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
SJ.Stanaitis
Sent: Wednesday, August 22, 2007 8:39 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] F-Prot 6?

 

Anyone here using F-Prot 6 with their Declude antivirus setup?  Does it
still have the command line scanner?

 

--SJ


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] F-Prot 6?

[Marc Catuogno]

So you have 100 users?
 
 http://www.f-prot.com/products/prices/price_win_ms.html
 
 
 
F-PROT Antivirus for Windows Mail Servers     Number of Users 
  Annual license fee     1-24   US$ 269     25-49   
US$ 359     50-99   US$ 449     100-199   US$ 719     
200-299   US$ 989     300-399   US$ 1259     400-499   
US$ 1529     500-749   US$ 1799     750-999   US$ 2069   
  1000-1999   US$ 2519     2000-2999   US$ 2969     
3000-3999   US$ 3419     4000-4999   US$ 3869     5000-5999 
  US$ 4499
 
 

Marc Catuogno
 MIS Director
 Prudential Rand Realty
 845-825-8025
 

 
 
 -Original Message-
 From: "SJ.Stanaitis" <[EMAIL PROTECTED]>
 Sent 8/23/2007 9:04:42 AM
 To: declude.junkmail@declude.com
 Subject: RE: [Declude.JunkMail] F-Prot 6?
 
   v\:* {behavior:url(#default#VML);} o\:* {behavior:url(#default#VML);} w\:* 
{behavior:url(#default#VML);} .shape {behavior:url(#default#VML);}
st1\:*{behavior:url(#default#ieooui) }  

$500?  That’s a steal.  Website answered my questions.

 

 

 

--SJ

 

 

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno
 Sent: Wednesday, August 22, 2007 10:29 AM
 To: declude.junkmail@declude.com
 Subject: RE: [Declude.JunkMail] F-Prot 6?

  

 

 

Don’t know – but it has a hefty price for legit use on a mail 
server unless they have changed with the new version 

 

 

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of SJ.Stanaitis
 Sent: Wednesday, August 22, 2007 8:39 AM
 To: declude.junkmail@declude.com
 Subject: [Declude.JunkMail] F-Prot 6?

  

 

 

Anyone here using F-Prot 6 with their Declude antivirus setup?  Does it 
still have the command line scanner?

 

 

 

--SJ

  
 ---
 This E-mail came from the Declude.JunkMail mailing list. To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type "unsubscribe Declude.JunkMail". The archives can be found
 at http://www.mail-archive.com. 
 ---
 This E-mail came from the Declude.JunkMail mailing list. To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type "unsubscribe Declude.JunkMail". The archives can be found
 at http://www.mail-archive.com. 
 ---
 This E-mail came from the Declude.JunkMail mailing list. To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type "unsubscribe Declude.JunkMail". The archives can be found
 at http://www.mail-archive.com.  

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] F-Prot 6?

[Marc Catuogno]

Don't know - but it has a hefty price for legit use on a mail server unless
they have changed with the new version 

 

  _  

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
SJ.Stanaitis
Sent: Wednesday, August 22, 2007 8:39 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] F-Prot 6?

 

Anyone here using F-Prot 6 with their Declude antivirus setup?  Does it
still have the command line scanner?

 

--SJ


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] automated response

[Marc Catuogno]

For the week of July 16th through July 23th I will be out of the office with 
limited access to voice mail and Email. Please contact [EMAIL PROTECTED] or 
[EMAIL PROTECTED] for immediate computer help.  Please contact [EMAIL 
PROTECTED] for any website issues.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] automated response

[Marc Catuogno]

For the week of July 9th through July 13th I will be out of the office with 
limited access to voice mail and Email. Please contact [EMAIL PROTECTED] or 
[EMAIL PROTECTED] for immediate computer help.  Please contact [EMAIL 
PROTECTED] for any website issues.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] 2006 Upgrade Webmail Problem

[Marc Catuogno]

I remember that one...  You could also have everyone log in with IMAP and
subscribe  : )

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Tuesday, December 26, 2006 10:31 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] 2006 Upgrade Webmail Problem


In the IMAP service, turn off force subscribe and it should be fine.

Matt



Chris Anton wrote:
> Hi all.  Glad that Ipswitch has the day off... too bad I don't.  We 
> upgraded to 2006.1 from 8.22 this weekend.  I am now getting a problem 
> with sub mail boxes in web mail... they don't show new messages, and I 
> can't view the messages.  Tried removing the .xml, .srt and .uid files 
> to no avail.  Checked the perms, and everything seems to be fine 
> there... This isn't affecting main mail boxes, just subs.  Found a 
> "Object reference not set to an instance of an object." when 
> attempting to reply to these sub mail box emails.  The mail boxes 
> don't even show the number of new messages.  Any thoughts Please help
>
> Best Regards,
>
> Chris Anton
> Web Solutions, Inc.
> Tel: 203-235- x25
> [EMAIL PROTECTED]
> www.websolutions.net
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com. 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] automated response

[Marc Catuogno]

For Wednesday, November 15th I will be out for most of the day with limited 
access to Email.  Please contact [EMAIL PROTECTED] or [EMAIL PROTECTED]  for 
urgent computer matters.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] automated response

[Marc Catuogno]

For Tuesday, November 14th I will be away for most of the day with limited 
access to my cell phone and no Email access.  Please contact [EMAIL PROTECTED] 
or [EMAIL PROTECTED]  for urgent computer matters.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Goober of the year

[Marc Catuogno]

?  Hmm - I guess my outlook nuked the message, can't even find it in the
sent messages... weird.

Basically I was thinking that someone smarter than myself should be able to
figure out a way to tag the subject of any e-mail auto-forwarded so the
'goobers' know not to report it.

I further wondered if the reason I have been blocked from AOL, Yahoo and
Hotmail because of the spam leakage being auto forwarded hitting some type
of Bayesian filters on those providers.  

We have agents who are 'grandfathered' into being allowed to forward and
won't give it up.

Marc

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell
([EMAIL PROTECTED])
Sent: Tuesday, August 01, 2006 2:40 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Goober of the year

Marc, 

Great point.  Very concise :) 

Darrell 


Marc Catuogno writes: 

>  
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com. 
> 
 


 ---
Check out http://www.invariantsystems.com for utilities for Declude, Imail, 
mxGuard, and ORF.  IMail/Declude Overflow Queue Monitoring, SURBL/URI 
integration, MRTG Integration, and Log Parsers.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Goober of the year

[Marc Catuogno]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] automated response

[Marc Catuogno]

For the days of July 25,26 & 27th  I will be out of the office.
For urgent computer matters please contact [EMAIL PROTECTED] 
[EMAIL PROTECTED] or [EMAIL PROTECTED]

Thank you,

Marc Catuogno


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Declude 4.3

[Marc Catuogno]

Well then if your profit is negative and they wish to share in it, then they 
owe you money right??

: )

Marc


-- Original Message --
From: "Darin Cox" <[EMAIL PROTECTED]>
Reply-To: declude.junkmail@declude.com
Date:  Thu, 20 Jul 2006 09:39:52 -0400

>MessageWhile customers are referred to us for our spam/virus filtering 
>capabilities, we do operate it as a cost center, as the labor and other 
>expenses involved are slightly higher than the additional revenue generated 
>from them.
>
>Darin.
>
>
>- Original Message - 
>From: Glenn \ WCNet 
>To: declude.junkmail@declude.com 
>Sent: Wednesday, July 19, 2006 8:32 PM
>Subject: Re: [Declude.JunkMail] Declude 4.3
>
>
>You're saying that email and spam/virus scanning is a service aspect that 
>specifically draws customers to an ISP.  I'm saying it doesn't, that's all.  
>I've not once heard a customer state that email service was the deciding 
>factor in choosing us, and there's no evidence it entices them to stay.
>
>
>- Original Message - 
>From: Kevin Bilbee 
>To: declude.junkmail@declude.com 
>Sent: Wednesday, July 19, 2006 5:01 PM
>Subject: RE: [Declude.JunkMail] Declude 4.3
>
>
>Then stop offering mail if it such a burden to the business. Explain to your 
>customer that they can 
>
> 
>
>can go to Hotmail or Yahoo.  When the addy gets horked by spammers, simply 
>abandon it and create another.
>
> 
>
>Let us know how many customers stay with your service. Of course you will not 
>be able to quantify the lost new business!
>
> 
>
> 
>
>Kevin Bilbee
>
> 
>
> 
>
>From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Glenn \ WCNet
>Sent: Wednesday, July 19, 2006 11:55 AM
>To: declude.junkmail@declude.com
>Subject: Re: [Declude.JunkMail] Declude 4.3
>
> 
>
>Hahahahaha!  E-mail hardly keeps or draws customers.  Anybody who wants 
>e-mail can go to Hotmail or Yahoo.  When the addy gets horked by spammers, 
>simply abandon it and create another.  Domain hosting, maybe a little.  
>However, I have domain customers who have never used their included mail 
>service.
>
> 
>
> 
>
>- Original Message - 
>
>From: Kevin Bilbee 
>
>To: declude.junkmail@declude.com 
>
>Sent: Wednesday, July 19, 2006 11:12 AM
>
>Subject: RE: [Declude.JunkMail] Declude 4.3
>
> 
>
>So then indirectly it does generate revenue. Because without it revenue would 
>be lost. The ISP users need to ask is what level of these services do I need 
>to offer to keep current customers happy and what level of service do I need 
>to land new business?
>
> 
>
> 
>
>Kevin Bilbee
>
> 
>
>From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL 
>PROTECTED])
>Sent: Wednesday, July 19, 2006 4:35 AM
>To: declude.junkmail@declude.com
>Subject: Re: [Declude.JunkMail] Declude 4.3
>
> 
>
>Kevin,
>
> 
>
>Mainly because in order to get other types of business that may bring revenue 
>(hosting, etc) this type of service is expected.  Look at any ISP/hosting 
>provider that is offering $5.00 a month hosting plans this is what everyone 
>competes with.  
>
> 
>
>Could you imagine yourself (consumer or small business) signing up with a 
>hosting provider and them not handling your email or even better not virus 
>scanning it?  Even with yahoo/gmail you get free spam filtering and virus 
>scanning.
>
> 
>
>Darrell
>
>
>Check out http://www.invariantsystems.com for utilities for Declude And Imail. 
> IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG 
>Integration, and Log Parsers.
>
>  - Original Message - 
>
>  From: Kevin Bilbee 
>
>  To: declude.junkmail@declude.com 
>
>  Sent: Tuesday, July 18, 2006 11:22 PM
>
>  Subject: RE: [Declude.JunkMail] Declude 4.3
>
>   
>
>  Question to thoes that are saying that spam/virus protestion is a lost 
> leader/not a revenue builder.
>
>   
>
>  If it does not generate revenue then why don't you stop offering spam/virus 
> protection?
>
>   
>
>   
>
>   
>
>  Kevin Bilbee
>
>
>  ---
>  This E-mail came from the Declude.JunkMail mailing list. To
>  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>  type "unsubscribe Declude.JunkMail". The archives can be found
>  at http://www.mail-archive.com. 
>
>
>---
>This E-mail came from the Declude.JunkMail mailing list. To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail". The archives can be found
>at http://www.mail-archive.com. 
>
>
>---
>This E-mail came from the Declude.JunkMail mailing list. To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail". The archives can be found
>at http://www.mail-archive.com. 
>
>
>---
>This E-mail came from the Declude.JunkMail mailing list. To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail". The archives can be found
>at http://www.mail-archive.com. 
>
>
>---
>Th

[Declude.JunkMail] FW: [SPAM]I must apologize for this unsolicited nature of my email. I am Mr. Lewis Musasike, General Manager (Treasury) of Development Bank of Southern Africa. This is an urgent and

[Marc Catuogno]

Is this Broken spamware?  I’ve
gotten a few of these over the past few days….

 









From: LEWIS MUSASIKE
[mailto:[EMAIL PROTECTED] 
Sent: Wednesday, June 28, 2006
4:33 AM
To: [EMAIL PROTECTED]
Subject: [SPAM]I must apologize
for this unsolicited nature of my email. I am Mr. Lewis Musasike, General
Manager (Treasury) of Development Bank of Southern Africa.
This is an urgent and very confidential business proposition. On June 6, 2001,a
Foreign Oil consult



 




 
  
  I have a new email address!
  
 




You can now email me at: [EMAIL PROTECTED]



- LEWIS MUSASIKE











---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.

[Declude.JunkMail] can't post again?

[Marc Catuogno]

I sent a sample of spam that I got to the list yesterday and it never made
it on the list... can I not post AGAIN??



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] FW: [SPAM]I must apologize for this unsolicited nature of my email. I am Mr. Lewis Musasike, General Manager (Treasury) of Development Bank of Southern Africa. This is an urgent and

[Marc Catuogno]

Is this from broken spamware? The whole ‘pitch’
is in the subject… What a pain to filter.

 









From: LEWIS MUSASIKE
[mailto:[EMAIL PROTECTED] 
Sent: Thursday, June 22, 2006 3:03
PM
To:
[EMAIL PROTECTED]
Subject: [SPAM]I must apologize
for this unsolicited nature of my email. I am Mr. Lewis Musasike, General
Manager (Treasury) of Development Bank of Southern Africa.
This is an urgent and very confidential business proposition. On June 6, 2001,a
Foreign Oil consult



 




 
  
  I have a new email address!
  
 




You can now email me at: [EMAIL PROTECTED]



- LEWIS MUSASIKE











---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.

[Declude.JunkMail] Test - can I post?

[Marc Catuogno]

Checking to see if I can post...



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Way OT: Find a virus in my network

[Marc Catuogno]

The sasser worm seems to ignore local networks and was only trying to get to
external IPs.  I tried ethereal and got no probes on the local net. I did
lock down 445 external but the Xincom has really weak logging so I couldn't
get any info from it.  Thanks though

I unplugged one switch at a time till the activity stopped... then I put it
back on and unplugged each active connection till the activity stopped.  It
was a completely unpatched 2000 machine with no anti-virus software...  The
agent is hanging by his neck in front of the building

Thanks

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Ncl Admin
Sent: Thursday, April 27, 2006 11:04 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Way OT: Find a virus in my network

At 10:29 AM 4/27/2006 -0400, you wrote:
>Marc Catuogno writes: 
>
> Anyone have any suggestions short of unplugging one Cat5 cable at a time? 
> 
> Marc 

Why not just scan your network from a XP box using something like
Networkactiv.com PIAFCTM.  Just lock down and look for 445 activity on the
inside of your network.

Then you can find the machine most likely. 
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Way OT: Find a virus in my network

[Marc Catuogno]

Darrell,

The Xincom that I'm using isn't all that flexible - I did try something but
didn't seem to work  

Marc

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darrell
([EMAIL PROTECTED])
Sent: Thursday, April 27, 2006 10:29 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Way OT: Find a virus in my network

Marc, 

Why don't you block 445 on the firewall (outbound) and look at the logs to 
see where they are coming from? 

Darrell 

 ---
Check out http://www.invariantsystems.com for utilities for Declude, Imail, 
mxGuard, and ORF.  IMail/Declude Overflow Queue Monitoring, SURBL/URI 
integration, MRTG Integration, and Log Parsers. 


Marc Catuogno writes: 

> 
> I had my ISP (dsl.net) call and tell me that there was virus activity on
our
> circuit, namely port scans on 445 (maybe Sasser?).  I have asked all my
> agents to run the removal tool and do windows update.  I have run Ethereal
> but it didn't seem to catch it.  I can't isolate the packets on my HP
> Procurve switch... 
> 
> Anyone have any suggestions short of unplugging one Cat5 cable at a time? 
> 
> Marc 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] OT: Windows update (maybe) breaks mapping to Linux box?

[Marc Catuogno]

Sorry for the quick OT post, but I don't have time to research it further.
But in one of our offices we have windows XP machines mapped to shared
drives on a Linux Red Hat box that suddenly couldn't be access. After the
latest auto update they could only see the Red Hat PC by IP address.   The
vendor for our accounting software said they had another client having the
same issues. I put an entry in the hosts file of the affected computers and
the mapping began to work.  Just in case any of you are in a similar
situation.

Marc

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] [OT] Drop Connection On First Invalid User

[Marc Catuogno]

I don't have the key referred to in the KB article.

I even did a search through my reg for "MaxInvalid" in case I was looking in
the wrong place and got nothing.  I am running 8.22 with Declude.  

Does the addition of Declude make a difference?


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Greg Evanitsky
Sent: Monday, March 27, 2006 9:00 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] [OT] Drop Connection On First Invalid User


On Mar 26, 2006, at 2:22 PM, Goran Jovanovic wrote:

> How are you going to drop the SMTP connection on the first or second
> invalid recipient?


In Imail.

http://support.ipswitch.com/kb/IM-20050831-DM01.htm

BTW, the support page says it works in 8.1+ but didn't for me.  
Upgraded to 8.22, works perfectly.

Thanks,

Greg Evanitsky
ACS, Inc.

(717) 248-2720 ext. 5113


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Going to junk in Hotmail/ Validating the IP??

[Marc Catuogno]

Sandy,

Thanks for the reply.
But if I changed the name to mail.prudentialrand.com - wouldn't that cause
any other domain name on the server to fail a HELO-PTR-A roundtrip test?

If you don't mind, what would you need to see in the logs and or headers to
see if there is an issue?  

Up until now I thought I was RFC compliant and my server was setup OK

Marc

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman
Sent: Wednesday, March 22, 2006 7:05 PM
To: Marc Catuogno
Subject: Re: [Declude.JunkMail] Going to junk in Hotmail/ Validating the
IP??

> Has anyone ever heard of "validating the IP" from the mail client to
> the  server?

It's  very  unlikely  that  this  has  anything to do with the initial
submission  from  MUA  to your SMTP server. Rather, the fact that your
server  is  HELOing as mail.prudentialrand.com, although its canonical
name  is  la01prudmail01.myrient.net,  will  cause your mail to fail a
HELO-PTR-A "roundtrip" test.

The exact text of the error message also implies that your return-path
(envelope  MAIL FROM:) does not match your header From: value. I don't
know if that's actually true; have to see a log to know.

--Sandy



Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]

SpamAssassin plugs into Declude!
 
http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release
/

Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail
Aliases!
 
http://www.imprimia.com/products/software/freeutils/exchange2aliases/downloa
d/release/
 
http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/re
lease/

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Going to junk in Hotmail/ Validating the IP??

[Marc Catuogno]

I've been having a fight with a few people at hotmail trying to get my mail
to stop going to the Junkmail folder.  Has anyone ever heard of "validating
the IP" from the mail client to the server?  Anything I can do here?  Any IP
I send from (the webclient, my home cable connection) still shows received
from marccatuogno [xxx.xxx.xxx.xxx.]  no ( ) around it.  I've never heard of
this until now



Received: from mail.prudentialrand.com ([64.63.165.172]) by
bay0-mc5-f13.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.1830); 

Wed, 15 Mar 2006 11:56:53 -0800 

Received: from marccatuogno [64.144.207.55] by mail.prudentialrand.com with
ESMTP 

(SMTPD32-8.15) id A1545640152; Wed, 15 Mar 2006 14:56:04 -0500 

From: "Marc Catuogno" <[EMAIL PROTECTED]> 


It still isn’t validating the IP.  If it did the IP would have parentheses
around the IP [64.63.165.172].  I wonder if the line X-Note: This E-mail was
sent from la01prudmail01.myrient.net ([64.63.165.172]). 
Return-Path: [EMAIL PROTECTED] is blocking this IP from being
validated.


---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] email from kelly [EMAIL PROTECTED]

[Marc Catuogno]

I just got an e-mail asking me to "update" my info with a form attached:
 
Dear Customer,
 
We are currently in the process of updating our records here at
Declude.  We are aware that you have purchased product from us in the   past
and would greatly appreciate your response in regards to thecurrent
status of your software.  Please use the attached document to   advise if
you are actively using the product and/or if you are in needof a product
upgrade and/or maintenance renewal.
We greatly appreciate your attention to this matter and look forward
to serving you as our customer.
 
Best Regards,
 
Kelley O'Connell
Declude - Internet Security Software

I KNOW I am paranoid - but it sounded like one of those scam e-mails.

Additionaly, Kelly if you are listening, always create a list or BCC
everyone 30-40 people in the TO: field

Thanks -

Marc

---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Hotmail's Junk folder- ARGH!

[Marc Catuogno]

Anyone know how to get my domain out of hotmail's Junk filtering?

---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] ?? Start of phish/virus campaign ??

[Marc Catuogno]

I got this one:


Hi! Just  to inform you that your email  is used by  a  spamer  who
intendsto steal bank account information thru a fake site. If
you are not involded, I can bring you additionnal information.  Check
attached file for a  proof. If you are,  you're a  little  son of a
bitch.




--JHYRUPLXCQFFELGFCEOR
Content-Type: application/octet-stream; name="proof.exe"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="proof.exe"

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Carter
Sent: Tuesday, February 28, 2006 10:18 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] ?? Start of phish/virus campaign ??

Starting to catch EXE attached messages with following subject lines coming
(at least currently) MESWILLEY.org [68.63.231.44].

You steal from innocent people
You are a criminal and will be busted!
Phshing is illigal
Where did you learn to scam?

John C
9:15p CST 
   
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: RE: [Declude.JunkMail] New spam tactic???

[Marc Catuogno]

Same name?  Personalized to the agent name? Also through RR in VA?  I'm
still interested in exactly what the angle is.. seems like  a lot of effort.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Erik
Sent: Saturday, February 04, 2006 1:48 PM
To: Declude.JunkMail@declude.com
Subject: [HOLD Weight]RE: [Declude.JunkMail] New spam tactic???

I guess it is!  We've had 2 reports day about it (and both ARE real estate
agents; say "he" is not on their list).  Interesting


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno
Sent: Saturday, February 04, 2006 7:37 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] New spam tactic???


Almost all of my agents received a letter like this:

-- Original Message --
From: "Joe Anderson" <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Date:  Fri, 3 Feb 2006 22:21:39 -0500

I believe I received an real estate newsletter from Joseph Moleano
in  Tarrytown, NY.

Please remove me from future emails.

Thanks

Joe

It seems very personal, addressed to the agent and with a reference to the
town the agent's office is in or service - but none of the agents sent a
newsletter to this guy.  I e-mailed him for a copy of it to make sure my
agents weren't spamming and very soon after I started to get more than usual
Viagra ads directed right to me, almost as if my reply subscribed me to the
suckers list.  Just wondering if anyone else has seen anything like this.  I
have included the headers below:

Received: from SMTP32-FWD by mail.prudentialrand.com
  (SMTP32) id A0CE902BD0086B842; Fri,  3 Feb 2006 21:09:47 
Received: from rrcs-queue-03.hrndva.rr.com [24.28.200.155] by
mail.prudentialrand.com with ESMTP
  (SMTPD32-8.15) id ACE92BD0086; Fri, 03 Feb 2006 21:09:45 -0500
Received: from rrcs-fep-10.hrndva.rr.com (rrcs-fep-10b.hrndva.rr.com
[172.28.200.148])
by rrcs-queue-03.hrndva.rr.com (8.13.5+Sun/8.12.10) with ESMTP id
k1429WcM008010
for <[EMAIL PROTECTED]>; Fri, 3 Feb 2006 21:09:32
-0500 (EST)
Received: from ZBDS ([24.199.134.250]) by rrcs-fep-10.hrndva.rr.com
  with ESMTP
  id <[EMAIL PROTECTED]>
  for <[EMAIL PROTECTED]>;
  Fri, 3 Feb 2006 21:08:32 -0500
From: "Joe Anderson" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Unsubscribe from Realtor Newsletter
Date: Fri, 3 Feb 2006 21:03:28 -0500
MIME-Version: 1.0
X-Mailer: Internal Email Service (4.1.1.692)
Message-ID: <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Declude-Sender: [EMAIL PROTECTED] [24.28.200.155]
X-Declude-Spoolname: D0CE902BD0086B842.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: CATCHALLMAILS [0]
X-Country-Chain: 
X-Note: This E-mail was sent from rrcs-mta-03.hrndva.rr.com
([24.28.200.155]).
X-RCPT-TO: <
 Status: U
X-UIDL: 428126141


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] New spam tactic???

[Marc Catuogno]

Almost all of my agents received a letter like this:

-- Original Message --
From: "Joe Anderson" <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Date:  Fri, 3 Feb 2006 22:21:39 -0500

I believe I received an real estate newsletter from Joseph Moleano
in  Tarrytown, NY.

Please remove me from future emails.

Thanks

Joe

It seems very personal, addressed to the agent and with a reference to the
town the agent's office is in or service - but none of the agents sent a
newsletter to this guy.  I e-mailed him for a copy of it to make sure my
agents weren't spamming and very soon after I started to get more than usual
Viagra ads directed right to me, almost as if my reply subscribed me to the
suckers list.  Just wondering if anyone else has seen anything like this.  I
have included the headers below:

Received: from SMTP32-FWD by mail.prudentialrand.com
  (SMTP32) id A0CE902BD0086B842; Fri,  3 Feb 2006 21:09:47 
Received: from rrcs-queue-03.hrndva.rr.com [24.28.200.155] by
mail.prudentialrand.com with ESMTP
  (SMTPD32-8.15) id ACE92BD0086; Fri, 03 Feb 2006 21:09:45 -0500
Received: from rrcs-fep-10.hrndva.rr.com (rrcs-fep-10b.hrndva.rr.com
[172.28.200.148])
by rrcs-queue-03.hrndva.rr.com (8.13.5+Sun/8.12.10) with ESMTP id
k1429WcM008010
for <[EMAIL PROTECTED]>; Fri, 3 Feb 2006 21:09:32
-0500 (EST)
Received: from ZBDS ([24.199.134.250]) by rrcs-fep-10.hrndva.rr.com
  with ESMTP
  id <[EMAIL PROTECTED]>
  for <[EMAIL PROTECTED]>;
  Fri, 3 Feb 2006 21:08:32 -0500
From: "Joe Anderson" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Unsubscribe from Realtor Newsletter
Date: Fri, 3 Feb 2006 21:03:28 -0500
MIME-Version: 1.0
X-Mailer: Internal Email Service (4.1.1.692)
Message-ID: <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Declude-Sender: [EMAIL PROTECTED] [24.28.200.155]
X-Declude-Spoolname: D0CE902BD0086B842.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: CATCHALLMAILS [0]
X-Country-Chain: 
X-Note: This E-mail was sent from rrcs-mta-03.hrndva.rr.com
([24.28.200.155]).
X-RCPT-TO: <
 Status: U
X-UIDL: 428126141


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Best Sniffer Weights

[Marc Catuogno]

I have it at just over 1/3 of my delete weight, but I would suggest the you
use comment first before you implement any significant weight...

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Chris Anton
Sent: Monday, January 30, 2006 4:56 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Best Sniffer Weights

Hi all. We just installed message sniffer tonight and are working on
tweaking it. What are your recommendations for best weights?  Also,
suggestions on other settings welcomed.  Thanks!
-Anton
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Adding text to Subject of FORWARDED e-mail

[Marc Catuogno]

Can Declude, IMAIL (or anything) add text to subject of an e-mail that is
being forwarded to an outside e-mail address?

I have too many users (that I am not allowed to stop) forwarding their
e-mail to AOL.  Of course some SPAM slips through and they hit "report spam"
effectively reporting my server as SPAM.  I would like to add something to
the subject of these e-mails so that they know it was from Prudential Rand
and MAYBE, just maybe, they won't hit that stupid useless button

Thanks -

Marc

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Domain Keys?

[Marc Catuogno]

Is there any way to implement Domain Keys with Declude (1.82)or IMAIL (8.15)
Or any version? Anyway to put domain keys in any other way?

Yahoo is once again delivering any e-mail from my IP to their Bulk folder, I
figured if I can use their Domain Keys system I would have a better chance
of getting our mail delivered.  I have filled out all the Yahoo forms, but I
get nothing but generic canned responses.  I may change my IP over this

Thanks -

Marc

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] WAY OT: COVAD VOIP

[Marc Catuogno]

I have been considering switching many of our office from POTS lines to
COVAD voice over IP.  Since this is such a diverse and well informed group,
I was wonder if anyone has any experience with them or suggestions as to
alternate VOIP providers. Off list replies are welcomed.

Thanks -

Marc

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Mail sent to Yahoo! address ends up in Bulk folder

[Marc Catuogno]

There are several places where you can go on the Yahoo site to apply for
bulk sender status and so on.  The same thing happened to me and they won't
tell me why we got put there and we were only removed on a "temporary
basis".  It was very frustrating, I even had contacts higher up in Yahoo
because Prudential has a partnership with them and it did me absolutely no
good.  The e-mails I got back from the techs there were mostly canned
useless responses.  I almost changed my IP because it would be easier then
dealing with them.  Here are some of the links to try to help.

http://help.yahoo.com/help/us/mail/defer/defer-03.html

http://help.yahoo.com/help/us/mail/bulk/bulk-01.html

http://help.yahoo.com/help/us/mail/defer/defer-01.html

http://help.yahoo.com/help/mail/manage/manage-06.html

Good luck~





-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
[EMAIL PROTECTED]
Sent: Tuesday, October 04, 2005 3:36 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Mail sent to Yahoo! address ends up in Bulk
folder

Thanks John for your reply,

I sent an email to my test Yahoo! account and it went into the Bulk email 
folder.  I opened it up and clicked on the option for full headers.  There 
was not anything that gave any indication as to why it had been put there. 
They probably don't to keep the spammers from figuring out a way around 
them.

Anyone have any other thoughts?

Any help would be appreciated,
Don

- Original Message - 
From: "John T (Lists)" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, October 04, 2005 2:07 PM
Subject: RE: [Declude.JunkMail] Mail sent to Yahoo! address ends up in Bulk 
folder


> Best place to start is to find out why it is being placed there. I believe
> Yahoo adds header lines for filtering, so getting the headers from the
> recipient would be the place to start.
>
> John T
> eServices For You
>
>
>> -Original Message-
>> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
>> [EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED]
>> Sent: Tuesday, October 04, 2005 11:53 AM
>> To: Declude.JunkMail@declude.com
>> Subject: [Declude.JunkMail] Mail sent to Yahoo! address ends up in Bulk
> folder
>>
>> When any customer sends an email through our server to a Yahoo! address,
> the
>> email get put into the Bulk mail folder.
>>
>> Has anyone else experienced this behavior and have any suggestions?  Does
>> anyone have a phone number for the Yahoo! Postmaster to help resolve this
>> issue
>>
>> Thanks in advance,
>> Don
>>
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> type "unsubscribe Declude.JunkMail".  The archives can be found
>> at http://www.mail-archive.com.
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] OT:AOL report spam - add a tool?

[Marc Catuogno]

I have an agent who is sending out a stupid e-mail letter every Friday.  I
have set up the AOL feedback loop and two to three people report her as spam
every week.  I don't know what AOL's tolerance is, but I really don't want
to get listed by them again.

SOMEONE at AOL told her this:

IT person - add a tool to header to notify use when mail list hits spam - 

Anyone ever hear of such a thing??? If it is possible I'd like to set it up
before I tell her she can't send the messages anymore an piss off one of our
top agents.

Marc




---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] FW: [SPAM]Please Restore Your Account Access

[Marc Catuogno]

Title: PayPal








 

 

 

This actually looks really, real… I
can’t tell anymore…..

 

 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] 
Sent: Friday,
 September 09, 2005 10:05 PM
To:
[EMAIL PROTECTED]
Subject: [SPAM]Please Restore Your
Account Access

 




 
  
  
  
 




 


 
  
  
  
 
 
  
  
  
 


 




 
  
  
   


 
  
  Account Verification Notice
  
 



   
   

Dear Margaret
Kirwan,

As part of our security measures, we regularly screen activity in the PayPal
system. We recently contacted you after noticing an issue on your
account.We requested information from you for the following reason: 
A recent review of your account determined that we require some additional
information from you in order to provide you with secure service. 
You must click
the link below to verify your information below.

 
  
  
  
   






 

   
   


 

   
  
  
  
  
 






 
 
Thank you for using PayPal!
The PayPal Team

   
   






   
   


 
  
  Please do not reply
  to this e-mail. Mail sent to this address cannot be answered. For
  assistance, log
  in to your PayPal account and choose the "Help" link in the
  footer of any page.
  
  To receive email notifications in plain text instead of HTML, update your
  preferences here. 
  
 
 
  
  
  
 



   
   


PayPal Email ID PP059

   
  
  
  
  
  
  
  
  
   


 
  
  
   

Protect Your
Account Info

   
  
   
  
   

Make sure you
never provide your password to fraudulent websites. 

To safely and securely access the PayPal website or your account, open
a new web browser (e.g. Internet Explorer or Netscape) and type in the
PayPal URL (https://www.paypal.com/us/) to be sure you are on the real
PayPal site.

PayPal will never ask you to enter your password in an email.

For more information on protecting yourself from fraud, please review
our Security Tips at https://www.paypal.com/us/securitytips


   
  
  
  
 
 
  
  
   

Protect Your
Password

   
  
   
  
   

You should never give your PayPal password to anyone,
including PayPal employees.


   
  
  
  
 



   
  
  
  
 




 






---
[This E-mail scanned for viruses by Declude Virus]

[Declude.JunkMail] WAY OT: Search Companion 2003

[Marc Catuogno]

The 2003 Search companion in Sever 2003 sucks - I just moved from a 2000
sever.  Does anyone know how to modify its default setting?
When I used to dig through held e-mails on the 2000 server I would use it to
find and delete e-mail by using the "containing text" field. So when I saw
the e-mail was from somespammer.com I would search the spam folder for that
and delete all the *smd files containing that text.

NOW when I do the same search I get NO results.  When I change the file
extension to .txt instead of .smd the search then finds all the files.  So
M$ decided unless it is a file type in KNOWS it isn't going to bother
searching for my string.  I tried to create .SMD as a new file type, and a
text file to no avail.

Any suggestions about this???

---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] NOT getting list e-mails AGAIN

[Marc Catuogno]

Has this list and the virus list dumped anyone else recently?  I'd feel
better if someone said "yes".

This is the second time in about two months that I suddenly stopped getting
Declde e-mails.  Last time they said it had something to do with their DNS
but it concerns me that I may also be missing e-mails from other people as
well.

Thanks,

Marc


---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] IMAIL 8.2 support?

[Marc Catuogno]

Just wondering...if the Declude people are close to having this working yet?

I'm being forced to jump up to at least 8.1 because IPswitch hasn't patched
the IMAP vulnerability in the 8.05 that I am running.  As long as I have to
renew the SA I wouldn't mind running their most up to date software 8.2 as
long as I am paying for it.

Not trying to be a nag or anything  :) 


---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] How do I stop this ?

[Marc Catuogno]

I would block 66.234.78.118 in IMAIL'S SMTP control access, I'm guessing it
is just a zombie machine.

If it a reject message you can complain to the tech responsible for the IP.

NetRange:   66.234.64.0 - 66.234.95.255 
CIDR:   66.234.64.0/19 
NetName:INJU-2BLK
NetHandle:  NET-66-234-64-0-1
Parent: NET-66-0-0-0-0
NetType:Direct Allocation
NameServer: ASLAN.IJ.NET
NameServer: NS2.IJ.NET
Comment:ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate:2002-02-22
Updated:2005-05-19

TechHandle: EF233-ARIN
TechName:   Feinstein, Eric 
TechPhone:  +1-813-855-7793
TechEmail:  [EMAIL PROTECTED] 

Good luck I've been complaining to Road Runner for a month and they still
won't admit it is their problem causing the 20+ stupid backscatter e-mails
I've been getting daily.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of William Stillwell
Sent: Tuesday, August 09, 2005 9:22 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] How do I stop this ?

Header:
 
Headers of the email message:
Received: from ablebody.net [66.234.78.118] by ablebody.net with ESMTP
  (SMTPD-8.20) id AC800914; Tue, 09 Aug 2005 09:15:44 -0400
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: Your password has been successfully updated



 
 
There has to be a way to stop this crap from coming thru ? Is there
any SPF tests?
 
 
 
 
 

---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Strange messages (Subject: 1)

[Marc Catuogno]

I have received a few of these myself.  I have also banned 1.txt -
considering a ban on *.txt temporarily because I get the feeling this is
some kinda test.

Marc

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler
Sent: Saturday, July 23, 2005 1:56 PM
To: Declude.Virus@declude.com
Cc: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Strange messages (Subject: 1)

In the last hours a I can see some strange messages (see attached samples)
send from different servers and obviously forged mailfrom adresses.

Each message has as Subject and as Body "1" and an attached but empty file
named "1.txt"
The mailfrom-adress seems to be the first part of the recipients adress +
some random domain name.

I've added "1.txt" to the Declude Virus BANNAME-List.

Markus

---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: RE: [Declude.JunkMail] Bounced viruses or e-mail I'm confused...

[Marc Catuogno]

THANK YOU!

I am going to forward this to Road Runner support (with your permission).  I
kept telling them that this was something going on THEIR network and they
kept telling me no.  

I feel a little less like I am going crazy - 

Thanks-

Marc

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
Sent: Tuesday, July 12, 2005 11:35 AM
To: Declude.JunkMail@declude.com
Subject: [OVER DELETE]RE: RE: [Declude.JunkMail] Bounced viruses or e-mail
I'm confused...

Not all viruses use their own SMTP engine; this was likely one of the
recent MyTob variants that tries to use the SMTP server of the current
user.

The virus can do this with some success because many ISPs use routing or
firewalls to allow their users to use their servers as an open relay,
because a) that buys them close relay status to the Internet, and b)
it's easier than authentication.  Also, many ISPs don't do outbound
virus scanning on the basis of "we don't want a false positive to even
possibly interfere with our customers' communications".

Here's a writeup on one of the recent viruses that uses the ISP's mail
server:

http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=43250


Andrew 8)


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno
Sent: Tuesday, July 12, 2005 7:43 AM
To: Declude.JunkMail@declude.com
Subject: RE:RE: [Declude.JunkMail] Bounced viruses or e-mail I'm
confused...

Thanks for the explanation.  I figured that this is a home user with and
infected PC claiming to be prudentialrand.com  but I guess where I am
confused is that I thought most of the current viruses have their own
SMTP engine and didn't use the ISP's mail server. So I didn't expect the
ISP mail server to be involved. 

When I reported this to Road Runner, they said it had nothing to do with
them or their network so I thought I was way off the mark.  But it is
one their users infected machine sending through their SMTP.  Um, right?

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jeff Robertson
Sent: Tuesday, July 12, 2005 10:00 AM
To: Declude.JunkMail@declude.com
Subject: [OVER DELETE]RE: [Declude.JunkMail] Bounced viruses or e-mail
I'm confused...

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- 
> [EMAIL PROTECTED] On Behalf Of Marc Catuogno
> Sent: Monday, July 11, 2005 11:12 PM
> To: Declude.JunkMail@declude.com
> Subject: SV [Declude.JunkMail] Bounced viruses or e-mail I'm
confused...
> 
> 
> 
> Please bear with me.  I've been getting bounces that I don't 
> understand, and I do feel stupid.  If any one has the time or patience

> to clear help me this up it would be appreciated:
> 
> If a virus forges my e-mail address as the from and attempts to send 
> it to a non-existent user on my domain - wouldn't the bounce message 
> simply be coming from my domain?  It looks like other servers are 
> answering for prudentialrand.com - am I nuts? Highly confused? 
> Screwed?

Unless I'm off the mark, this is backscatter mail.  It is common for
virus-infected or otherwise spamming computers to claim to be something
they are not.  What appears to be happening in your case is that an
infected computer (claiming to be prudentialrand.com) sends out a
message to its ISP's mail server.  The ISP's mail server looks up the MX
and sends the message to your mail server.  As soon as your server
receives the RCPT TO information, it rejects the message because the
recipient doesn't exist.
Since your server rejected the message before actually accepting it (as
it should), it is up to the sending server to send the bounce message.
Since the original forged message has one of your addresses as the
sender, the sending server delivers a bounce there. 

> 
> I see lines like the following in non deliverable messages:
> 
> Received: from prudentialrand.com (cpe-68-174-20-197.si.res.rr.com
> [68.174.20.197])
--- the spamming computer claiming to be you

>   by ms-smtp-03.rdc-nyc.rr.com (8.12.10/8.12.7) with ESMTP id
> j6BMlhGi015287
--- their RoadRunner mail server, most likely

>   for <[EMAIL PROTECTED]>; Mon, 11 Jul 2005 18:47:44 -0400
(EDT)
> Message-Id: <[EMAIL PROTECTED]>
> From: [EMAIL PROTECTED]
> To: [EMAIL PROTECTED]
> 
> 
> Received: from prudentialrand.com (ipn36373-b01578.cidr.lightship.net
> [216.204.209.74])
>   by spirit.lightshipmail.net (Postfix) with ESMTP id DD5571D5A6D
>   for <[EMAIL PROTECTED]>; Mon, 11 Jul 2005 20:58:09 -0400
(EDT)
> From: [EMAIL PROTECTED]
> To: [EMAIL PROTECTED]
> 
> FULL HEADERS BELOW:
> 
> MESSAGE 1:
> 
> Received: from spirit.lightshipmail.net [216.204.0.205] by
--- ISP's mail serve

RE:RE: [Declude.JunkMail] Bounced viruses or e-mail I'm confused...

[Marc Catuogno]

Thanks for the explanation.  I figured that this is a home user with and
infected PC claiming to be prudentialrand.com  but I guess where I am
confused is that I thought most of the current viruses have their own SMTP
engine and didn't use the ISP's mail server. So I didn't expect the ISP mail
server to be involved. 

When I reported this to Road Runner, they said it had nothing to do with
them or their network so I thought I was way off the mark.  But it is one
their users infected machine sending through their SMTP.  Um, right?

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jeff Robertson
Sent: Tuesday, July 12, 2005 10:00 AM
To: Declude.JunkMail@declude.com
Subject: [OVER DELETE]RE: [Declude.JunkMail] Bounced viruses or e-mail I'm
confused...

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Marc Catuogno
> Sent: Monday, July 11, 2005 11:12 PM
> To: Declude.JunkMail@declude.com
> Subject: SV [Declude.JunkMail] Bounced viruses or e-mail I'm confused...
> 
> 
> 
> Please bear with me.  I've been getting bounces that I don't understand,
> and
> I do feel stupid.  If any one has the time or patience to clear help me
> this
> up it would be appreciated:
> 
> If a virus forges my e-mail address as the from and attempts to send it to
> a
> non-existent user on my domain - wouldn't the bounce message simply be
> coming from my domain?  It looks like other servers are answering for
> prudentialrand.com - am I nuts? Highly confused? Screwed?

Unless I'm off the mark, this is backscatter mail.  It is common for
virus-infected or otherwise spamming computers to claim to be something they
are not.  What appears to be happening in your case is that an infected
computer (claiming to be prudentialrand.com) sends out a message to its
ISP's mail server.  The ISP's mail server looks up the MX and sends the
message to your mail server.  As soon as your server receives the RCPT TO
information, it rejects the message because the recipient doesn't exist.
Since your server rejected the message before actually accepting it (as it
should), it is up to the sending server to send the bounce message.  Since
the original forged message has one of your addresses as the sender, the
sending server delivers a bounce there. 

> 
> I see lines like the following in non deliverable messages:
> 
> Received: from prudentialrand.com (cpe-68-174-20-197.si.res.rr.com
> [68.174.20.197])
--- the spamming computer claiming to be you

>   by ms-smtp-03.rdc-nyc.rr.com (8.12.10/8.12.7) with ESMTP id
> j6BMlhGi015287
--- their RoadRunner mail server, most likely

>   for <[EMAIL PROTECTED]>; Mon, 11 Jul 2005 18:47:44 -0400 (EDT)
> Message-Id: <[EMAIL PROTECTED]>
> From: [EMAIL PROTECTED]
> To: [EMAIL PROTECTED]
> 
> 
> Received: from prudentialrand.com (ipn36373-b01578.cidr.lightship.net
> [216.204.209.74])
>   by spirit.lightshipmail.net (Postfix) with ESMTP id DD5571D5A6D
>   for <[EMAIL PROTECTED]>; Mon, 11 Jul 2005 20:58:09 -0400 (EDT)
> From: [EMAIL PROTECTED]
> To: [EMAIL PROTECTED]
> 
> FULL HEADERS BELOW:
> 
> MESSAGE 1:
> 
> Received: from spirit.lightshipmail.net [216.204.0.205] by
--- ISP's mail server again

> mail.prudentialrand.com with ESMTP
>   (SMTPD32-8.05) id A70D12200C6; Mon, 11 Jul 2005 21:04:13 -0400
> Received: by spirit.lightshipmail.net (Postfix)
--- their mail server is running Postfix, which generated the bounce to you

>   id 0B4BE1D5BBC; Mon, 11 Jul 2005 20:58:12 -0400 (EDT)
> Date: Mon, 11 Jul 2005 20:58:12 -0400 (EDT)
> From: [EMAIL PROTECTED] (Mail Delivery System)
> Subject: Undelivered Mail Returned to Sender
> To: [EMAIL PROTECTED]
> MIME-Version: 1.0
> Content-Type: multipart/report; report-type=delivery-status;
>   boundary="DD5571D5A6D.1121129892/spirit.lightshipmail.net"
> Message-Id: <[EMAIL PROTECTED]>
> X-IMAIL-SPAM-VALFROM: (19005638)
> X-Declude-Sender: <> [216.204.0.205]
> X-Declude-Spoolname: D170d012200c613e1.SMD
> X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
> spam.
> X-Spam-Tests-Failed: None [0]
> X-Country-Chain:
> X-Note: This E-mail was sent from  ([216.204.0.205]).
> 
> This is a MIME-encapsulated message.
> 
> --DD5571D5A6D.1121129892/spirit.lightshipmail.net
> Content-Description: Notification
> Content-Type: text/plain
> 
> This is the Postfix program at host spirit.lightshipmail.net.
> 
> I'm sorry to have to inform you that your message could not be
> be delivered to one or more recipients. It's attached below.
> 
> For further assistance, please send mail to 
> 
> If you do so, p

[Declude.JunkMail] Bounced viruses or e-mail I'm confused...

[Marc Catuogno]

Please bear with me.  I've been getting bounces that I don't understand, and
I do feel stupid.  If any one has the time or patience to clear help me this
up it would be appreciated:

If a virus forges my e-mail address as the from and attempts to send it to a
non-existent user on my domain - wouldn't the bounce message simply be
coming from my domain?  It looks like other servers are answering for
prudentialrand.com - am I nuts? Highly confused? Screwed?

I see lines like the following in non deliverable messages:

Received: from prudentialrand.com (cpe-68-174-20-197.si.res.rr.com
[68.174.20.197])
by ms-smtp-03.rdc-nyc.rr.com (8.12.10/8.12.7) with ESMTP id
j6BMlhGi015287
for <[EMAIL PROTECTED]>; Mon, 11 Jul 2005 18:47:44 -0400 (EDT)
Message-Id: <[EMAIL PROTECTED]>
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]


Received: from prudentialrand.com (ipn36373-b01578.cidr.lightship.net
[216.204.209.74])
by spirit.lightshipmail.net (Postfix) with ESMTP id DD5571D5A6D
for <[EMAIL PROTECTED]>; Mon, 11 Jul 2005 20:58:09 -0400 (EDT)
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]

FULL HEADERS BELOW:

MESSAGE 1:

Received: from spirit.lightshipmail.net [216.204.0.205] by
mail.prudentialrand.com with ESMTP
  (SMTPD32-8.05) id A70D12200C6; Mon, 11 Jul 2005 21:04:13 -0400
Received: by spirit.lightshipmail.net (Postfix)
id 0B4BE1D5BBC; Mon, 11 Jul 2005 20:58:12 -0400 (EDT)
Date: Mon, 11 Jul 2005 20:58:12 -0400 (EDT)
From: [EMAIL PROTECTED] (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: [EMAIL PROTECTED]
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="DD5571D5A6D.1121129892/spirit.lightshipmail.net"
Message-Id: <[EMAIL PROTECTED]>
X-IMAIL-SPAM-VALFROM: (19005638)
X-Declude-Sender: <> [216.204.0.205]
X-Declude-Spoolname: D170d012200c613e1.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: None [0]
X-Country-Chain: 
X-Note: This E-mail was sent from  ([216.204.0.205]).

This is a MIME-encapsulated message.

--DD5571D5A6D.1121129892/spirit.lightshipmail.net
Content-Description: Notification
Content-Type: text/plain

This is the Postfix program at host spirit.lightshipmail.net.

I'm sorry to have to inform you that your message could not be
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to 

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The Postfix program

<[EMAIL PROTECTED]>: host mail.prudentialrand.com[64.63.165.172] said:
550 unknown user <[EMAIL PROTECTED]> (in reply to RCPT TO command)

--DD5571D5A6D.1121129892/spirit.lightshipmail.net
Content-Description: Delivery report
Content-Type: message/delivery-status

Reporting-MTA: dns; spirit.lightshipmail.net
X-Postfix-Queue-ID: DD5571D5A6D
X-Postfix-Sender: rfc822; [EMAIL PROTECTED]
Arrival-Date: Mon, 11 Jul 2005 20:58:09 -0400 (EDT)

Final-Recipient: rfc822; [EMAIL PROTECTED]
Action: failed
Status: 5.0.0
Diagnostic-Code: X-Postfix; host mail.prudentialrand.com[64.63.165.172]
said:
550 unknown user <[EMAIL PROTECTED]> (in reply to RCPT TO command)

--DD5571D5A6D.1121129892/spirit.lightshipmail.net
Content-Description: Undelivered Message
Content-Type: message/rfc822

Received: from prudentialrand.com (ipn36373-b01578.cidr.lightship.net
[216.204.209.74])
by spirit.lightshipmail.net (Postfix) with ESMTP id DD5571D5A6D
for <[EMAIL PROTECTED]>; Mon, 11 Jul 2005 20:58:09 -0400 (EDT)
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: lnsuh
Date: Mon, 11 Jul 2005 20:58:37 -0400
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="=_NextPart_000_0001_F70A1BAE.73E16A2C"
X-Priority: 3
X-MSMail-Priority: Normal
Message-Id: [EMAIL PROTECTED]


MESSAGE 2:
Headers:
Received: from SMTP32-FWD by mail.prudentialrand.com
  (SMTP32) id A047001F2; Mon, 11 Jul 2005 18:57:02 -0400
Received: from ms-smtp-03.rdc-nyc.rr.com [24.29.109.7] by
mail.prudentialrand.com with ESMTP
  (SMTPD32-8.05) id A7E973D0088; Mon, 11 Jul 2005 18:51:21 -0400
Received: from localhost (localhost)
by ms-smtp-03.rdc-nyc.rr.com (8.12.10/8.12.7) id j6BMlmGi015336;
Mon, 11 Jul 2005 18:47:48 -0400 (EDT)
Date: Mon, 11 Jul 2005 18:47:48 -0400 (EDT)
From: Mail Delivery Subsystem <[EMAIL PROTECTED]>
Message-Id: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="j6BMlmGi015336.1121122068/ms-smtp-03.rdc-nyc.rr.com"
Subject: [OVER DELETE]Returned mail: see transcript for details
Auto-Submitted: auto-generated (failure)
X-IMAIL-SPAM-VALFROM: (121438344)
X-RBL-Warning: ANTI-AV: Message failed ANTI-AV test (line 167, weight 7)
X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 153, weight 4)
X-RBL-Warning: ANTI-GIBBERISH: Message failed ANTI-GIBBERISH test (line 

[Declude.JunkMail] Returned message - maybe I'm stupid...

[Marc Catuogno]

I've contacted RoadRunner's customer care regarding returned messages that I
am getting from, what I assume, is them everyday.  If someone more learned
than I can help I would appreciate it. It looks to me that one of their
clients has a virus and somewhere in the loop it is getting repaired and
returned to a non-existent user on my domain.  Anyone have any ideas?  These
messages are really annoying me. 

Here are the headers of the message:
Received: from SMTP32-FWD by mail.prudentialrand.com
  (SMTP32) id A045C178E; Fri,  8 Jul 2005 17:52:08 -0400
Received: from ms-smtp-02.rdc-nyc.rr.com [24.29.109.6] by
mail.prudentialrand.com with ESMTP
  (SMTPD32-8.05) id A585A5A00A6; Fri, 08 Jul 2005 17:52:05 -0400
Received: from localhost (localhost)
by ms-smtp-02.rdc-nyc.rr.com (8.12.10/8.12.7) id j68LmfId002241;
Fri, 8 Jul 2005 17:48:41 -0400 (EDT)
Date: Fri, 8 Jul 2005 17:48:41 -0400 (EDT)
From: Mail Delivery Subsystem <[EMAIL PROTECTED]>
Message-Id: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="j68LmfId002241.1120859321/ms-smtp-02.rdc-nyc.rr.com"
Subject: Returned mail: see transcript for details
Auto-Submitted: auto-generated (failure)
X-IMAIL-SPAM-VALFROM: (173670566)
X-RBL-Warning: ANTI-AV: Message failed ANTI-AV test (line 167, weight 7)
X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 153, weight 4)
X-RBL-Warning: ANTI-GIBBERISH: Message failed ANTI-GIBBERISH test (line 127,
weight -4)
X-RBL-Warning: Y!DIRECTED: Message failed Y!DIRECTED test (line 229, weight
11)
X-RBL-Warning: ANTI-Y!DIRECTED: Message failed ANTI-Y!DIRECTED test (line
60, weight -11)
X-Declude-Sender: <> [24.29.109.6]
X-Declude-Spoolname: Df5850a5a00a6198c.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: IPNOTINMX, ANTI-AV, GIBBERISH, ANTI-GIBBERISH,
Y!DIRECTED, ANTI-Y!DIRECTED, CATCHALLMAILS [7]
X-Country-Chain: 
X-Note: This E-mail was sent from ms-smtp-02-smtplb.rdc-nyc.rr.com
([24.29.109.6]).
X-RCPT-TO: [EMAIL PROTECTED]>
Status: U
X-UIDL: 410406537

Here is the message that I am getting and it has two attachments:

The original message was received at Fri, 8 Jul 2005 17:48:38 -0400 (EDT)
from rrcs-24-97-203-24.nys.biz.rr.com [24.97.203.24]

   - The following addresses had permanent fatal errors -
<[EMAIL PROTECTED]>
(reason: 550 unknown user <[EMAIL PROTECTED]>)

   - Transcript of session follows -
... while talking to mail.prudentialrand.com.:
>>> RCPT To:<[EMAIL PROTECTED]>
<<< 550 unknown user <[EMAIL PROTECTED]>
550 5.1.1 <[EMAIL PROTECTED]>... User unknown


Attachment1 called details.txt:

Reporting-MTA: dns; ms-smtp-02.rdc-nyc.rr.com
Received-From-MTA: DNS; rrcs-24-97-203-24.nys.biz.rr.com
Arrival-Date: Fri, 8 Jul 2005 17:48:38 -0400 (EDT)
Final-Recipient: RFC822; [EMAIL PROTECTED]
Action: failed
Status: 5.1.1
Remote-MTA: DNS; mail.prudentialrand.com
Diagnostic-Code: SMTP; 550 unknown user <[EMAIL PROTECTED]>
Last-Attempt-Date: Fri, 8 Jul 2005 17:48:41 -0400 (EDT)

Attachment2 called ATT0006.txt:
Received: from prudentialrand.com (rrcs-24-97-203-24.nys.biz.rr.com
[24.97.203.24])
by ms-smtp-02.rdc-nyc.rr.com (8.12.10/8.12.7) with ESMTP id
j68LmbId002217
for <[EMAIL PROTECTED]>; Fri, 8 Jul 2005 17:48:38 -0400 (EDT)
Message-Id: <[EMAIL PROTECTED]>
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: You have successfully updated your password
Date: Fri, 8 Jul 2005 17:48:39 -0400
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="=_NextPart_000_0013_A45E3A39.04F33EA8"
X-Priority: 3
X-MSMail-Priority: Normal
X-Virus-Scanned: Symantec AntiVirus Scan Engine
X-Virus-Scan-Result: Repaired 15810 [EMAIL PROTECTED]


Marc Catuogno
MIS Director
Prudential Rand Realty
Office: 845-770-1279
Cell:   914-906-1126


---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] WAY OT: Anti- Identity theft advice

[Marc Catuogno]

I have a great deal of respect for the people on this list and I hope you
don't feel this is a waste of time. I got this e-mail from one of my agents
and I am going to share it with the entire company - I thought maybe some of
you would care to do the same. I searched Hoasbusters.org first and called
the numbers and they are legit.


ATTORNEY'S ADVICE -- NO CHARGE Read this and make a copy for your files in
case you need to refer to it someday. Maybe we should all take some of his
advice! 

A corporate attorney sent the following out to the employees in his company 

1. The next time you order checks have only your initials (instead of first
name) and last name put on them. If someone takes your checkbook, they will
not know if you sign your checks with just your initials or your first name,
but your bank will know how you sign your checks. 

2. Do not sign the back of your credit cards. Instead, put "PHOTO ID
REQUIRED." 

3. When you are writing checks to pay on your credit card accounts, DO NOT
put the complete account number on the "For" line Instead, just put the last
four numbers. The credit card company knows the rest of the number, and
anyone who might be handling your check as it passes through all the check
processing channels won't have access to it 

4. Put your work phone # on your checks instead of your home phone. If you
have a PO Box use that instead of your home address. If you do not have a PO
Box, use your work address. Never have your SS# printed on your checks.
(DUH!) You can add it if it is necessary. But if you have it printed, anyone
can get it. 

5. Place the contents of your wallet on a photocopy machine. Do both sides
of each license, credit card, etc. You will know what you had in your wallet
and all of the account numbers and phone numbers to call and cancel. Keep
the photocopy in a safe place. I also carry a photocopy of my passport when
I travel either here or abroad. We've all heard horror stories about fraud
that's committed on us in stealing a name, address, Social Security number,
credit cards. 

Unfortunately, I, an attorney, have firsthand knowledge because my wallet
was stolen last month. Within a week, the thieve(s) ordered an expensive
monthly cell phone package, applied for a VISA credit card, had a credit
line approved to buy a Gateway computer, received a PIN number from DMV to
change my driving record information online, and more. But here's some
critical information to limit the damage in case this happens to you or
someone you know: 

1. We have been told we should cancel our credit cards immediately. But the
key is having the toll free numbers and your card numbers handy so you know
whom to call. Keep those where you can find them. 

2. File a police report immediately in the jurisdiction where your credit
cards, etc., were stolen. This proves to credit providers you were diligent,
and this is a first step toward an investigation 
(if there ever is one.) 

But here's what is perhaps most important of all :  (I never even thought to
do this.) 

3. Call the 3 national credit reporting organizations immediately to place a
fraud alert on your name and Social Security number. I had never heard of
doing that until advised by a bank that called to tell me an application for
credit was made over the Internet in my name. The alert means any company
that  checks your credit knows your information was stolen, and they have to
contact you by phone to authorize new credit. 

By the time I was advised to do this, almost two weeks after the theft, all
the damage had been done There are records of all the credit checks
initiated by the thieves' purchases, none of which I knew about before
placing the alert. Since then, no additional damage has been done, and the
thieves threw my wallet away This weekend (someone turned it in). It seems
to have stopped them dead in their tracks. 

Now, here are the numbers you always need to contact about your wallet, etc,
has been stolen: 
1.) Equifax: 1-800-525-6285 
2.) Experian (formerly TRW): 1-888-397-3742 
3.) Trans Union: 1-800-680-7289 
4.) Social Security Administration (fraud line): 1-800-269-0271 

We pass along jokes on the Internet; we pass along just about everything.
But if you are willing to pass this information along, it could really help
someone that you care about.

---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] OT:MAIL going to YAHOO BULK Folder

[Marc Catuogno]

I'm not sure why but any e-mail from prudentialrand.com is going to the BULK
folder in Yahoo. 
I am going to check out some stuff on yahoo, but I was wondering if anyone
had any insight into this issue.

Thanks -
Marc

---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: Anybody in Northern NJ have space and bandwidth available?

[Marc Catuogno]

There is a place in Pearl River, NY (right next to Montvale) that used to do
T1s and give you a free office when you bought one from them.  I don't know
what they are doing now, they were ok when I used them for DSL like two
years ago.

http://www.frontline.net/



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty
Sent: Friday, June 17, 2005 2:54 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] OT: Anybody in Northern NJ have space and
bandwidth available?

Hi all,

I discovered today that I need to move my hardware to a new location next 
weekend. Since it takes 30 days to get T1 lines installed, I'm up the creek.

I have about a dozen servers to move, all but three rackmounted, and we use 
about 1.5mbps at peak during the day.

At the moment, I'm thinking of a temporary home for a month or so, but we 
could make it permanent for the right location and price.

All suggestions welcomed!

-d


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Problem with Whitelist

[Marc Catuogno]

Got any “whitelist anywhere”
entries?  It looks like it says IP-Whitelist – did it come from a
whitelisted IP address?

 

-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kyle Fisher
Sent: Thursday, June 02, 2005 1:47
PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail]
Problem with Whitelist

 

I am trying to figure out why this
email transaction started off with the Last Action = "" then went to
WHITELIST.  My global.cfg has WHITELIST AUTH and AUTOWHITELIST, but I
checked the Imail log and this person did not AUTH and the recipients are not
in this person’s webmail address book.    

 

Any ideas

Kyle

 

 

 

 

06/02/2005 10:31:45
Q265E0149717D Subject: FW: Scripture for Thursday

06/02/2005 10:31:45
Q265E0149717D From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED]  IP: 198.216.117.200 ID: 

06/02/2005 10:31:45
Q265E0149717D Tests failed [weight=-192]: CMDSPACE=WARN IPNOTINMX=IGNORE
NOLEGITCONTENT=IGNORE IP-WHITELIST=IGNORE CATCHALLMAILS=IGNORE 

06/02/2005 10:31:45
Q265E0149717D Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN 
[LAST ACTION="">

06/02/2005 10:31:45
Q265E0149717D L16 Message OK

06/02/2005 10:31:45
Q265E0149717D Subject: FW: Scripture for Thursday

06/02/2005 10:31:45
Q265E0149717D From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED]  IP: 198.216.117.200 ID: 

06/02/2005 10:31:45
Q265E0149717D Tests failed [weight=-192]: CMDSPACE=WARN IPNOTINMX=IGNORE
NOLEGITCONTENT=IGNORE IP-WHITELIST=IGNORE CATCHALLMAILS=IGNORE 

06/02/2005 10:31:45
Q265E0149717D Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN 
[LAST ACTION="">

06/02/2005 10:31:45 Q265E0149717D
L17 Message OK

06/02/2005 10:31:45
Q265E0149717D Subject: FW: Scripture for Thursday

06/02/2005 10:31:45
Q265E0149717D From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]  IP: 198.216.117.200
ID: 

06/02/2005 10:31:45 Q265E0149717D
Tests failed [weight=-192]: CMDSPACE=WARN IPNOTINMX=IGNORE
NOLEGITCONTENT=IGNORE IP-WHITELIST=IGNORE CATCHALLMAILS=IGNORE 

06/02/2005 10:31:45
Q265E0149717D Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN 
[LAST ACTION="">

06/02/2005 10:31:45
Q265E0149717D L18 Message OK

06/02/2005 10:31:45
Q265E0149717D Subject: FW: Scripture for Thursday

06/02/2005 10:31:45
Q265E0149717D From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] 
IP: 198.216.117.200 ID: 

06/02/2005 10:31:45
Q265E0149717D Tests failed [weight=-192]: CMDSPACE=WARN IPNOTINMX=IGNORE
NOLEGITCONTENT=IGNORE IP-WHITELIST=IGNORE CATCHALLMAILS=IGNORE 

06/02/2005 10:31:45
Q265E0149717D Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN 
[LAST ACTION="">

06/02/2005 10:31:45
Q265E0149717D Skipping4 E-mail from [EMAIL PROTECTED]   ;
whitelisted [EMAIL PROTECTED]   ].

06/02/2005 10:31:45
Q265E0149717D L19 Message OK

06/02/2005 10:31:45
Q265E0149717D Subject: FW: Scripture for Thursday

06/02/2005 10:31:45
Q265E0149717D From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED]  IP: 198.216.117.200 ID: 

06/02/2005 10:31:45
Q265E0149717D Tests failed [weight=0]: CATCHALLMAILS=IGNORE 

06/02/2005 10:31:45
Q265E0149717D Action(s) taken for [EMAIL PROTECTED] = WHITELISTED [LAST
ACTION="">

06/02/2005 10:31:45
Q265E0149717D L20 Message OK

06/02/2005 10:31:45
Q265E0149717D Subject: FW: Scripture for Thursday

06/02/2005 10:31:45
Q265E0149717D From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PR

RE: [Declude.JunkMail] ANOTHER message Declude didn't delete.

[Marc Catuogno]

THANK YOU~ there was one person who had the weight 30 'blank' in their
.junkmail file so it skipped the test.

Marc

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Brad Morgan
Sent: Thursday, June 02, 2005 11:04 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] ANOTHER message Declude didn't delete.

Check your log files to see what config file is being used.  I had a similar
problem because I updated $default$.junkmail but failed to update all of the
per domain / per user .junkmail files, my own in particular!

Regards,

Brad Morgan
IT Manager
Horizon Interactive Inc.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] ANOTHER message Declude didn't delete.

[Marc Catuogno]

Anyone?  Anyone? Buehler?

Received: from server.tl4s.com [147.202.39.144] by mail.prudentialrand.com
with ESMTP
  (SMTPD32-8.05) id A8F42960114; Thu, 02 Jun 2005 09:26:12 -0400
Received: from [212.35.74.41] (port=2257 helo=comp)
by server.tl4s.com with esmtpa (Exim 4.50)
id 1DdpeJ-000128-TP; Thu, 02 Jun 2005 08:22:17 -0500
From: "eBay" <[EMAIL PROTECTED]>
Subject: [SPAM]**eBay Summary Confirmation**
To: [EMAIL PROTECTED]
Content-Type: text/plain;iso-8859-1
Reply-To: [EMAIL PROTECTED]
Date: Thu, 2 Jun 2005 16:22:22 +0300
X-Priority: 3
X-Library: Indy 8.0.25
X-AntiAbuse: This header was added to track abuse, please include it with
any abuse report
X-AntiAbuse: Primary Hostname - server.tl4s.com
X-AntiAbuse: Original Domain - prudentialrand.com
X-AntiAbuse: Originator/Caller UID/GID - [0 0] / [47 12]
X-AntiAbuse: Sender Address Domain - ebay.com
X-Source: 
X-Source-Args: 
X-Source-Dir: 
Message-Id: <[EMAIL PROTECTED]>
X-RBL-Warning: SORBS-SPAM: "Spam Received See:
http://www.dnsbl.sorbs.net/lookup.shtml?147.202.39.144";
X-RBL-Warning: SPAMCOP: "Blocked - see
http://www.spamcop.net/bl.shtml?147.202.39.144";
X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]"
X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam
[420f].
X-RBL-Warning: SNIFFER: Message failed SNIFFER: 53.
X-RBL-Warning: SUBJECTFILTER: Message failed SUBJECTFILTER test (line 156,
weight 0)
X-RBL-Warning: WEIGHT10: Weight of 45 reaches or exceeds the limit of 10.
X-RBL-Warning: WEIGHT25: Weight of 45 reaches or exceeds the limit of 25.
X-RBL-Warning: WEIGHT40: Weight of 45 reaches or exceeds the limit of 40.
X-Declude-Sender: [EMAIL PROTECTED] [147.202.39.144]
X-Declude-Spoolname: D08f4029601143e0e.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: SORBS-SPAM, SPAMCOP, NOABUSE, IPNOTINMX,
NOLEGITCONTENT, SPAMHEADERS, SNIFFER, SUBJECTFILTER, WEIGHT10, WEIGHT15,
WEIGHT20, WEIGHT25, WEIGHT30, WEIGHT40, CATCHALLMAILS [45]
X-Country-Chain: 
X-Note: This E-mail was sent from ns1.tl4s.com ([147.202.39.144]).

Marc Catuogno
MIS Director
Prudential Rand Realty
Office: 845-770-1279
Cell:   914-906-1126


---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Declude NOT deleting overdelete weight messages

[Marc Catuogno]

I delete at 30 - the "X-RBL-Warning weight 30" test is missing from the
headers.  This message was in the hold directory and it wasn't alone.  I
also couldn't find Dbb7e005a0052a96c.SMD (or any part of it) in the
dec0601.log file. Declude 1.82 - IMAIL 8.05 

Anyone have any ideas?



Received: from 64.63.165.172 [220.121.168.240] by mail.prudentialrand.com
  (SMTPD32-8.05) id AB7E5A0052; Wed, 01 Jun 2005 09:43:26 -0400
Received: from localhost ([EMAIL PROTECTED])
by Mklaud.hannah.org (8.12.4/8.121/Submit) with ESMTP id
g57KIOGP014981; Wed, 01 Jun 2005 17:35:50 +0300
Message-ID: <[EMAIL PROTECTED]>
Date: Wed, 01 Jun 2005 10:40:50 -0400
From: "Hilary Harrell" <[EMAIL PROTECTED]>
X-Mailer: GoldMine [5.50.10310]
To: [EMAIL PROTECTED]
Subject: [SPAM]Marilyn Reed
X-Not-Needed: M$ Windows.
X-IMAIL-SPAM-VALFROM: (5898322)
X-RBL-Warning: BLITZEDALL: "Open proxy - see
http://opm.blitzed.org/220.121.168.240";
X-RBL-Warning: CBL: "Blocked - see
http://cbl.abuseat.org/lookup.cgi?ip=220.121.168.240";
X-RBL-Warning: DSBL: "http://dsbl.org/listing?220.121.168.240";
X-RBL-Warning: SPAMCOP: "Blocked - see
http://www.spamcop.net/bl.shtml?220.121.168.240";
X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command.
X-RBL-Warning: HELOBOGUS: Domain 64.63.165.172 has no MX or A records
[0301].
X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 220.121.168.240
with no reverse DNS entry.
X-RBL-Warning: SNIFFER: Message failed SNIFFER: 61.
X-RBL-Warning: MOREIPS: spam taiwan
X-RBL-Warning: FOREIGN: Message failed FOREIGN test (line 823, weight 2)
X-RBL-Warning: TLD-ASIAN: Message failed TLD-ASIAN test (line 161, weight 2)
X-RBL-Warning: WEIGHT10: Weight of 102 reaches or exceeds the limit of 10.
X-RBL-Warning: WEIGHT25: Weight of 102 reaches or exceeds the limit of 25.
X-RBL-Warning: WEIGHT40: Weight of 102 reaches or exceeds the limit of 40.
X-RBL-Warning: WEIGHT50: Weight of 102 reaches or exceeds the limit of 50.
X-Declude-Sender: [EMAIL PROTECTED] [220.121.168.240]
X-Declude-Spoolname: Dbb7e005a0052a96c.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: BLITZEDALL, CBL, DSBL, SPAMCOP, CMDSPACE, HELOBOGUS,
IPNOTINMX, NOLEGITCONTENT, REVDNS, SNIFFER, MOREIPS, HEADERS, FOREIGN,
TLD-ASIAN, WEIGHT10, WEIGHT15, WEIGHT20, WEIGHT25, WEIGHT30, WEIGHT40,
WEIGHT50, CATCHALLMAILS [102]
X-Country-Chain: 
X-Note: This E-mail was sent from [No Reverse DNS] ([220.121.168.240]).


---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Problem forwarding to AOL

[Marc Catuogno]

I just got about 40-50 returned e-mails from people who have forwarded their
e-mails from my domain to AOL.  I was able to get an individual e-mail
straight through to AOL and a forwarded e-mail through as well.  Many people
on my server have their e-mail forwarded, to my chagrin, and only the AOL
e-mails bounced.  

This was in the log
http://postmaster.info.aol.com/errors/554hvub1.html

It gave me a number to AOL that was answered live (I almost fainted) and I
gave him the specific error, he told me it was a bad URL in the e-mail I
sent.  The e-mail I sent was a warning about a scam e-mail - the link in the
e-mail triggered their bounce.  I'm usually the first to bash AOL but I must
admit they handled this one pretty well...

Just thought I'd share.  I guess this will teach me to break up the scam
links
 

---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Declude 1.82 deleting whitelisted e-mail -

[Marc Catuogno]

Here are the log entries of the missing message:

 

05:18 09:11 SMTPD(04B8) Authenticated [EMAIL PROTECTED],
session treated as local.

05:18 09:11 SMTPD(0B170142) [68.236.184.7] MAIL FROM:
<[EMAIL PROTECTED]>

05:18 09:11 SMTPD(0B170142) [68.236.184.7] RCPT TO:
<[EMAIL PROTECTED]>

05:18 09:11 POP3D  (05c8) logoff for
david.hoechster R:0, D:0, P:0

05:18 09:11 SMTPD(0B170142) [68.236.184.7] RCPT TO:
<[EMAIL PROTECTED]>

05:18 09:11 SMTPD(0B170142) [68.236.184.7] RCPT TO:
<[EMAIL PROTECTED]>

05:18 09:11 SMTPD(0B170142) [68.236.184.7] RCPT TO:
<[EMAIL PROTECTED]>

05:18 09:11 SMTPD(0B170142) [68.236.184.7] RCPT TO: <[EMAIL PROTECTED]>

05:18 09:11 SMTPD(0B170142) [68.236.184.7] RCPT TO:
<[EMAIL PROTECTED]>

D:\IMail\spool\D3ef11bc9009e2c7d.SMD 7389

05:18 09:11 SMTPD(1BC9009E) performing antispam checks

 

05/18/2005 09:11:17 Q3ef11bc9009e2c7d NOT bypassing
whitelisting of E-mail with weight >=35 (36) and at least 6 recipients (1).

05/18/2005 09:11:17 Q3ef11bc9009e2c7d Tests failed
[weight=36]: AHBL=WARN SBL=WARN BADHEADERS=WARN NOLEGITCONTENT=IGNORE SPFPASS=IGNORE
SNIFFER=WARN WEIGHT10=WARN WEIGHT15=SUBJECT WEIGHT20=HOLD WEIGHT25=WARN
WEIGHT30=DELETE CATCHALLMAILS=IGNORE

 

If it is NOT bypassing whitelisting, it should be whitelisted and these
tests shouldn’t run – right?

 

Bottom line, this message is not getting delivered and this is the only
trace I can find.

 

RE: [Declude.JunkMail] Verizon Faced With Lawsuits Over Blocking eMail From Foreign IP Addresses

[Marc Catuogno]

[EMAIL PROTECTED]

http://www.kohnswift.com/bio_boni.htm

Lets sign him up for a lot of spam from Korea, Japan, etc and see how he
feels about blocking foreign IPs then...

Sorry to go off on a rant here

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darrell
([EMAIL PROTECTED])
Sent: Wednesday, May 18, 2005 2:02 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Verizon Faced With Lawsuits Over Blocking eMail
>From Foreign IP Addresses

Verizon Communications has been hit with several lawsuits as a result of the

company's policy of blocking email from IP addresses in foreign countries in

an effort to reduce spam.  The complaint asks that Verizon cease blocking 
email and that it compensate customers for losses on behalf of business 
customers.  A second class action lawsuit was filed on behalf of residential

customers.  In addition, a New Jersey businessman has filed a lawsuit 
against Verizon because he says his email has been blocked from getting to 
his customers. 

http://www.securitypipeline.com/showArticle.jhtml?articleID=163101524 

 
DLAnalyzer - Comprehensive reporting for Declude Junkmail and Virus.  
Download a copy today - http://www.invariantsystems.com 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Verizon Faced With Lawsuits Over Blocking eMail From Foreign IP Addresses

[Marc Catuogno]

That is f-ed up right there...

The damned lawyers are gonna get rich and every VZ customer will get a
coupon for a free day of service.  

Marc

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darrell
([EMAIL PROTECTED])
Sent: Wednesday, May 18, 2005 2:02 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Verizon Faced With Lawsuits Over Blocking eMail
>From Foreign IP Addresses

Verizon Communications has been hit with several lawsuits as a result of the

company's policy of blocking email from IP addresses in foreign countries in

an effort to reduce spam.  The complaint asks that Verizon cease blocking 
email and that it compensate customers for losses on behalf of business 
customers.  A second class action lawsuit was filed on behalf of residential

customers.  In addition, a New Jersey businessman has filed a lawsuit 
against Verizon because he says his email has been blocked from getting to 
his customers. 

http://www.securitypipeline.com/showArticle.jhtml?articleID=163101524 

 
DLAnalyzer - Comprehensive reporting for Declude Junkmail and Virus.  
Download a copy today - http://www.invariantsystems.com 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Layman's Explanation of E-Mail Spoofing

[Marc Catuogno]

Ditto - sometimes I add that if someone wanted to mail objectionable
postcards, used your postal return address and chose random address from the
phone book the result would be the same.  Some people would throw them away
(delete), some would complain to you and ask why you would send something
like that, the bad addresses would get returned to you by the post office
that is simply doing its job. 

I have sent out this explanation about 5-6 times, they all still ask me why
they are getting the undeliverables  : ) 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of David Sullivan
Sent: Tuesday, May 17, 2005 11:04 AM
To: Dan Geiser
Subject: Re: [Declude.JunkMail] Layman's Explanation of E-Mail Spoofing

Hello Dan,

Tuesday, May 17, 2005, 10:57:13 AM, you wrote:

Don't know of an outside source, but I always explain it like a normal
envelope.

You can write ANY address you want as the return address and
drop it in a public mailbox. If it isn't delivered, it will be
returned to the address that was written on the envelope. The post
office doesn't care whose address it is.

Try that.

-- 
Best regards,
 Davidmailto:[EMAIL PROTECTED]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] German political spam

[Marc Catuogno]

I am seeing randomized addresses, but they seem to be from "related
industries".  We are in real-estate, the address are random then @ other
real-estate companies, title companies, etc.

All the e-mails that have gotten through have been from

conversent.net 204.17.110.18 

Probably some genius real-estate agent that got infected - I haven't looked
at all the e-mails that get held yet.

Marc

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darrell
([EMAIL PROTECTED])
Sent: Sunday, May 15, 2005 9:51 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] German political spam

What are the return/sender addresses looking like?  Randomized?

Darrell
---
Check out http://www.invariantsystems.com for utilities for Declude And
Imail.  IMail Queue Monitoring, Declude Overflow Queue Monitoring, SURBL/URI
integration, MRTG Integration, and Log Parsers.

- Original Message ----- 
From: "Marc Catuogno" <[EMAIL PROTECTED]>
To: 
Sent: Sunday, May 15, 2005 9:34 AM
Subject: RE: [Declude.JunkMail] German political spam


I've added all the phases that I have found in the e-mails that got through
to me.  I don't do much internationally so my weighting and inclusion may be
harsh for those that do.

Marc

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler
Sent: Sunday, May 15, 2005 3:50 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] German political spam

Attached is the updated filter file containing 3 additional subject filter
lines.

Markus



> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler
> Sent: Sunday, May 15, 2005 9:25 AM
> To: Declude.JunkMail@declude.com
> Subject: RE: [Declude.JunkMail] German political spam
>
>
> > Anyone else getting hit with massive waves of German spam as a
> > byproduct of modified Sober code continuing from around 2 pm EDT
> > today, or am I 'unique' in this?
>
> Yes, I've identified 3 tipical body phrases that can be used
> to filter for.
> Se atached zip/txt file.
> Maybe it's incomplete and so should be updated. Please send
> additional strings also in zipped ttxt files in order to
> bypass already existing filters.
>
> Markus
>

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] HOAX e-mail filters

[Marc Catuogno]

When ever I see an e-mail chain letter, virus alert, etc I check it against:

http://hoaxbusters.ciac.org/

I was wondering if anyone has a filter for all these "don't dial this area
code", "don't sniff the perfume", "the Cancer society will dontate $.05" - 

Anyone think it is worth the effort to make one?


---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] OT - headers script for Outlook or Express

[Marc Catuogno]

Anyone have any ideas how to give challenged users a really easy way to get
the headers out of Outlook or Outlook express and forward them to my spam
account?  As soon as I start talking to most of them about right clicking,
copying, pasting etc they get this strange blank look on their face...

Also I thought a "report spam" button on the IMAIL web interface that would
copy the full headers, and forward them and the e-mail to a pre-determined
address wouldn't be to hard, anyone have anything like this?  Or any
suggestions on how to get the headers from spam that gets through the all
the filters?

Thanks -

Marc

---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Whitelist anywhere broken?

[Marc Catuogno]

Thanks - I have told him to make sure he puts the code in the body of the
e-mail under his signature.

Marc

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darrell
([EMAIL PROTECTED])
Sent: Sunday, March 06, 2005 11:53 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Whitelist anywhere broken?

If you practice putting the code words in the subject than you could be
affected by the "subject" bug that was in the 1.8.x train.  I believe domain
that use domain keys like gmail will trigger this bug.

Here is a link that first talks about it.
http://www.mail-archive.com/declude.junkmail@declude.com/msg21811.html

Darrell
---
Check out http://www.invariantsystems.com for utilities for Declude And
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG
Integration, and Log Parsers.
- Original Message - 
From: "Marc Catuogno" <[EMAIL PROTECTED]>
To: 
Sent: Sunday, March 06, 2005 11:37 PM
Subject: [Declude.JunkMail] Whitelist anywhere broken?


I am running 1.82 and it seems that the whitelist isn't working.  I don't
want to post what the phase I am using is, but please be assured it is not
working.  The person sending the e-mail is using mail2web which is listed in
SORBS, comes out of Canada and he is sending from my domain and not
authenticating, he also tends to curse a bit in some of his e-mails (he
works support).  You can see why is mail would get held.  It seems as if the
code words work only if they LEAD the subject, they don't work anywhere
else.  I'm still afraid to move to Declude 2.X...

Is this broken in 1.82?  Or is there another explanation that I am missing?

Thanks -
Marc



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Whitelist anywhere broken? DISREGARD

[Marc Catuogno]

Disregard - I'm an idiot. There was a trailing space in my global config
file after my phrase. Apologies!

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno
Sent: Sunday, March 06, 2005 11:37 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Whitelist anywhere broken?

I am running 1.82 and it seems that the whitelist isn't working.  I don't
want to post what the phase I am using is, but please be assured it is not
working.  The person sending the e-mail is using mail2web which is listed in
SORBS, comes out of Canada and he is sending from my domain and not
authenticating, he also tends to curse a bit in some of his e-mails (he
works support).  You can see why is mail would get held.  It seems as if the
code words work only if they LEAD the subject, they don't work anywhere
else.  I'm still afraid to move to Declude 2.X... 

Is this broken in 1.82?  Or is there another explanation that I am missing?

Thanks - 
Marc



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Whitelist anywhere broken?

[Marc Catuogno]

I am running 1.82 and it seems that the whitelist isn't working.  I don't
want to post what the phase I am using is, but please be assured it is not
working.  The person sending the e-mail is using mail2web which is listed in
SORBS, comes out of Canada and he is sending from my domain and not
authenticating, he also tends to curse a bit in some of his e-mails (he
works support).  You can see why is mail would get held.  It seems as if the
code words work only if they LEAD the subject, they don't work anywhere
else.  I'm still afraid to move to Declude 2.X... 

Is this broken in 1.82?  Or is there another explanation that I am missing?

Thanks - 
Marc



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Held Kodak easyshare Headers

[Marc Catuogno]

This is one that actually got held, I don't know how it was sent or from
what version:

X-RBL-Warning: NEGATIVEHEADERS: Message failed NEGATIVEHEADERS test (line
14, weight -16)
X-RBL-Warning: GARBAGE: Message failed GARBAGE test (line 38, weight 8)
X-RBL-Warning: SPAMDOMAINS1: Spamdomain 'prudentialrand.com' found: Address
of [EMAIL PROTECTED] sent from invalid
snj-us-pcwp-701-att.kodak.com.
X-RBL-Warning: SUBJECTFILTER: Message failed SUBJECTFILTER test (line 325,
weight 10)
X-RBL-Warning: SUBJECTSCAM: Message failed SUBJECTSCAM test (line 325,
weight 10)
X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 137, weight 4)
X-RBL-Warning: ANTI-GIBBERISH: Message failed ANTI-GIBBERISH test (line 106,
weight -4)
X-RBL-Warning: GIBBERISHSUB: Message failed GIBBERISHSUB test (line 99,
weight 4)
X-RBL-Warning: ANTI-GIBBERISHSUB: Message failed ANTI-GIBBERISHSUB test
(line 29, weight -4)
X-RBL-Warning: BASE64SUB: Message failed BASE64SUB test (line 86, weight 7)
X-RBL-Warning: WEIGHT10: Weight of 25 reaches or exceeds the limit of 10.
X-RBL-Warning: WEIGHT25: Weight of 25 reaches or exceeds the limit of 25.
X-Declude-Sender: [EMAIL PROTECTED] [63.240.114.196]
X-Declude-Spoolname: D9b7f1abb00e84a53.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: IPNOTINMX, NOLEGITCONTENT, NEGATIVEHEADERS, GARBAGE,
SPAMDOMAINS1, SUBJECTFILTER, SUBJECTSCAM, GIBBERISH, ANTI-GIBBERISH,
GIBBERISHSUB, ANTI-GIBBERISHSUB, BASE64SUB, WEIGHT10, WEIGHT15, WEIGHT20,
WEIGHT25 [25]
X-Country-Chain: 
X-Note: This E-mail was sent from snj-us-pcwp-701-att.kodak.com
([63.240.114.196])

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] IMAIL ranks last as exchange alternative:

[Marc Catuogno]

Wow ~ thanks – nice response time!

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Ralph Krausse
Sent: Wednesday, March 02, 2005 5:56 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] IMAIL ranks last as exchange alternative:

Marc,

    I just spoke with Kerio and though the article says they support 3rd
party applications, it is 3rd party applications they have integrated into
their application. While talking with them in some depth, as of right now
their system wouldn’t allow us to be put in the middle to do that processing
we need to do.  I asked them to keep us on a list if they release a API we
could write to.

Ralph


From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno
Sent: Wednesday, March 02, 2005 8:05 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] IMAIL ranks last as exchange alternative:

http://reviews.zdnet.co.uk/software/internet/0,39024165,39188758,00.htm
 
 
Sorry for the re-post from Imail forum, but incase any of you don’t follow
it….
 
Any plans for Declude to integrate with Kerio???  : ) 
 
 

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Kodak EZ Share (headers)

[Marc Catuogno]

Here are the headers – I have something with Kodak in my negative headers to
try to let this stuff through…

Received: from snj-us-pcwp-708.us.kodak.com [63.240.114.217] by
mail.prudentialrand.com with ESMTP
  (SMTPD32-8.05) id A37246900BC; Wed, 02 Mar 2005 14:26:42 -0500
Received: from picturecd.kodak.com (ool-182cf376.dyn.optonline.net
[24.44.243.118])
by snj-us-pcwp-708.us.kodak.com (8.11.7p2/8.11.7) with SMTP id
j22JDa617939
for <[EMAIL PROTECTED]>; Wed, 2 Mar 2005 19:13:37 GMT
Message-Id: <[EMAIL PROTECTED]>
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: 3/02/05
Date: Wed, 02 Mar 2005 14:13:38 -0500
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary=1_boundary
X-RBL-Warning: IPNOTINMX: 
X-Declude-Sender: [EMAIL PROTECTED] [63.240.114.217]
X-Declude-Spoolname: D1372046900bcd817.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: IPNOTINMX, NOLEGITCONTENT, NEGATIVEHEADERS,
SPAMDOMAINS1, GIBBERISH, ANTI-GIBBERISH [-10]
X-Country-Chain: 
X-Note: This E-mail was sent from snj-us-pcwp-708-att.kodak.com
([63.240.114.217]).
X-IMAIL-SPAM-HTML-FEATURES: (Image Tag)
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 387273370

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt
Sent: Wednesday, March 02, 2005 11:46 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Kodak EZ Share

>> All these get held on my system because you send it from “your” e-mail
address without authenticating, so it never gets whitelisted with Whitelist
Auth and it fails my spam domains test.  But if you aren’t seeing them at
all, I’d guess it is the attachment size. <<
 
Marc - can you post the headers from the held message file.  You mention it
fails the spam domains test - for all we know there are other factors (such
as the sending IP, or the HELO string) that cause his Postfix spam gateway
to block the messages...

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:    +1 201 934-9206 
 
- Original Message - 
From: Marc Catuogno 
To: Declude.JunkMail@declude.com 
Sent: Wednesday, March 02, 2005 7:01 AM
Subject: RE: [Declude.JunkMail] Kodak EZ Share

All these get held on my system because you send it from “your” e-mail
address without authenticating, so it never gets whitelisted with Whitelist
Auth and it fails my spam domains test.  But if you aren’t seeing them at
all, I’d guess it is the attachment size.
 
Marc

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Kodak EZ Share

[Marc Catuogno]

Title: Message









I’m having someone try to send me
something from a dock in a little bit as soon as I have the headers I will
post.

 

-Original
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt
Sent: Wednesday, March 02, 2005
11:46 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail]
Kodak EZ Share

 



>> All these get held on my system because you send it from
“your” e-mail address without authenticating, so it never gets
whitelisted with Whitelist Auth and it fails my spam domains test.  But if
you aren’t seeing them at all, I’d guess it is the attachment size.
<<





 





Marc - can you post the
headers from the held message file.  You mention it fails the spam
domains test - for all we know there are other factors (such as the sending IP,
or the HELO string) that cause his Postfix spam gateway to block the
messages...



 

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:    +1 201 934-9206 



 





-
Original Message - 





From: Marc Catuogno 





To: Declude.JunkMail@declude.com






Sent: Wednesday, March
02, 2005 7:01 AM





Subject:
RE: [Declude.JunkMail] Kodak EZ Share





 



All these get held on my
system because you send it from “your” e-mail address without
authenticating, so it never gets whitelisted with Whitelist Auth and it fails
my spam domains test.  But if you aren’t seeing them at all,
I’d guess it is the attachment size.

 

Marc

[Declude.JunkMail] IMAIL ranks last as exchange alternative:

[Marc Catuogno]

Title: Message









http://reviews.zdnet.co.uk/software/internet/0,39024165,39188758,00.htm

 

 

Sorry for the re-post from Imail forum,
but incase any of you don’t follow it….

 

Any plans for Declude to integrate with Kerio??? 
: ) 

 

 

RE: [Declude.JunkMail] Kodak EZ Share

[Marc Catuogno]

All these get held on my system because
you send it from “your” e-mail address without authenticating, so it
never gets whitelisted with Whitelist Auth and it fails my spam domains test. 
But if you aren’t seeing them at all, I’d guess it is the
attachment size.

 

Marc

 

-Original
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Richard Farris
Sent: Tuesday, March 01, 2005 6:45
PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Kodak
EZ Share

 



I have Kodak EZ
Share that allows you to take pictures with your digital camera and email them
out...when I email them to myself from another computer I never get them
unless I tell it to send as is..if I choose "Best for email" I wont
get them. Other customers are telling me they are not getting pictures
either...





 





I am trying to
figure out why..I have taken out all my Imail rules and all .zip files from the
virus config...and by the way...it won't even send them to an account that I
have whitelisted..





 





Does anyone know
where I could look to find out why I am not getting them..they go to my
yahoo.com account just fine..and I have tried to decipher the log files with no
luck.





 





Could it be the
virus program is deleting them?  I use FPROT..





 





I am sure there are
more customers that are not getting pictures that I have not heard from yet..






Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet"







- Original
Message - 





From: Scott
Fisher 





To: Declude.JunkMail@declude.com






Sent: Tuesday,
March 01, 2005 3:36 PM





Subject: Re:
[Declude.JunkMail] Log Corruption





 





It's the same log
format except that all the messages for a specific email are grouped together.
Well most of the time they are grouped together.





It does make
eyeball parsing of the log easier. 





 





I load the logs
into a database daily. With the 1.8x versions, I'll need to code around a new
type of log corruption every one to two months. 





For the 3 days I
was running 2.x, I had to code around 4 new corruption issues.





Visually there is
also more corruption.





 





Odd things is that
I never get log corruption in message sniffer. So somebody is writing out logs
that don't get corrupt.





 





- Original Message
- 







From: Matt 





To: Declude.JunkMail@declude.com






Sent: Tuesday,
March 01, 2005 3:16 PM





Subject: Re:
[Declude.JunkMail] Log Corruption





 



There has always been
corruption of the logs.  What seems to have changed here is that there is
a new log format and the programmed exceptions in DLanalyzer are no longer able
to handle the types of corruption as seamlessly as in the past.

I haven't seen the new log format, but I would imagine that if they built it in
a column format and kept it to a single line, similar to Web logging standards,
it should be even easier to parse the data and correct for issues.  If
they didn't keep to consistent columns, then this could be just as big of an
issue to parse as before and a lot of the exception rules would have to be
rewritten for the new format.

Matt



Goran Jovanovic wrote: 

Yesterday's report on my declude logfile showed =...10.01%02/28/2005..10.01%FF156FB0094D05A.10.01%I00510.01%QCEA370970074D08A...10.01%SET.10.01%SNIFFQCE053ABD0086D062..10.01% This is from  Total Messages Processed: 12,316 And loglevel set to HIGH and the size of the file is 122 MB I am running 2.0.5    Goran Jovanovic The LAN Shoppe     

-Original Message-From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-[EMAIL PROTECTED]] On Behalf Of Colbeck, AndrewSent: Tuesday, March 01, 2005 2:33 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Log Corruption I had the opposite experience.  Back at, oh, 1.7x I ran on LOGLEVELHIGH, and had lots of log corruption.  I had to drop down to MID.  Theincrease in spam volume made it such that at MID, I had lots of logcorruption again. With 2.x and the lines being written in a batch, I noticed an    

immediate  

drop in my disk usage and a huge drop in corrupted lines. Andrew 8) -Original Message-From: [EMAIL PROTECTED][mailto:[EMAIL PROTECTED]] On Behalf Of Andy SchmidtSent: Tuesday, March 01, 2005 9:22 AMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Log Corruption  Hi, Yesterday was actually a good day (here a snippet): TEST # FAILED   Percentage18:51:5810.01%SNIF02/28/2005..10.01%SPA02/28/2005...10.01%WEIG02/28/2005..10.01% Sure, I used to get reports that were "clean", but considering it onlyhappens a "few" times a day, I don't 

RE: [Declude.JunkMail] Filter question

[Marc Catuogno]

I have my own domain in the spamdomains test and then I have Whitelist Auth
so almost anytime something appears to me from [EMAIL PROTECTED] if it isn't
whitelisted because of authentication it adds quite a bit of weight.  The
major down side is that when people send e-mail from websites that have you
fill in the from address.  Since these don't authenticate they often get
caught as well.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Carter
Sent: Thursday, February 24, 2005 8:58 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Filter question

The following header lines are the basis of my question.  The "from" domain
(mine) does not match the "from" [IP] address (not mine.)

Received: from jcjc.edu [65.240.76.232] by bobcat.jcjc.edu with ESMTP
  (SMTPD32-8.15) id AB4F105B014E; Wed, 23 Feb 2005 17:01:35 -0600
From: "Returned mail" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]

This may have been discussed before and I just didn't use the right search
words, but ...  has anyone worked on a filter/external program/whatever that
could check for match/mismatch of the from address and the from IP in the
"Received:" line.  Example: One could specify the domains and IP's that must
match each other.  If they don't, boost the score by whatever makes one
happy.

My logic: whether it is an uncaught virus (like MyDoom.BE) or junk mail, it
doesn't matter. If your users see email supposedly from you, they are going
to be more likely to open it and suffer the results. Is this worth working
on?  Has someone done something on this?

Thanks,
John


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SmarterMail Held email recovery

[Marc Catuogno]

Wow any of those scripts available for sale? 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
Sent: Wednesday, February 23, 2005 9:27 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] SmarterMail Held email recovery

Aha!  That's pretty nifty, Kevin.

Well, *if* SmarterMail doesn't have the ability to re-queue without
scanning, I'd suggest that you could add a bit more development to your
web application to accomodate automatic counterweighting of re-queued
messages.

You're a programmer, so I don't have to detail a technique for inserting
a magic cookie into the header, and have Declude check for the cookie
and counterweight/whitelist appropriately.  But heck, I figured it was
worth mentioning here.

Andrew 8)

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
Sent: Wednesday, February 23, 2005 5:55 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] SmarterMail Held email recovery


I do not monitor my hold directory manually. I have a program the sends
and email to all the users that have held email from the previous day
with a recovery link for each message. The user has the option to
recover the mesage or not. If they recover the message it is requeued
and then delivered. A copy of the message source is also sent to our
abuse@ email address to be analyzed and adjusted or to notify the admin
of the sending server of the problem.

Most of the messages that get held with our configuration fail due to
SFP, HELOBOGUS, and RDNS otherwise I have very few false positives from
filters to adjust for. I do not adjust for IP4 black list failures a
server would have to be in 2 or 3 black lists to be held.



Kevin Bilbee






> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Colbeck, 
> Andrew
> Sent: Wednesday, February 23, 2005 5:39 PM
> To: Declude.JunkMail@declude.com
> Subject: RE: [Declude.JunkMail] SmarterMail Held email recovery
>
>
> Well, I guess our goals differ.
>
> So although with IMail+Declude you can re-queue without scanning (your
> way) as well as re-queue with scanning (my way), I choose to re-queue 
> with scanning AND fix the reason why the message was held.
>
> Re-queuing with scanning forces me to fix it, and I also try to fix it

> so that it is also fixed for future messages.
>
> So, while we wait for an official answer to your question (Hello,
> Declude?) can you tell us why you want to re-queue without scanning?
>
> Andrew 8)
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
> Sent: Wednesday, February 23, 2005 5:04 PM
> To: Declude.JunkMail@declude.com
> Subject: RE: [Declude.JunkMail] SmarterMail Held email recovery
>
>
> SmarterMail executes declude allover again.
>
> >
> > I never simply re-queue for delivery a message that was held.  I 
> > always re-queue such that Declude would scan it again.
>
> When you requeue a message with Imail the only thing you need to do it

> move the D and Q files to the spool folder, they will not be rescanned

> by declude.
>
> >
> > Which implies that I must also do something about my Declude 
> > configuration to counterweight this and future messages from the 
> > same sender, e.g. with a REVDNS or a REMOTEIP negative weight.
>
> By countreweighting a messages that failed would only cause it to not 
> fail the first time. I want to take a message that failed and was held

> and requeue it for delivery. When requeueing the message it should not

> be scanned again by declude.
>
>
> > p.s. With IMail, I re-queue a message for scanning and delivery by 
> > moving the D*.SMD to the spool folder, and then moving the Q*.SMD 
> > file
>
> > to the spool\overflow folder. I also edit the D*.SMD file before I 
> > move it, to remove any previous header additions, so that on the 
> > next Declude scan, it gets only the "corrected" headers.
>
> This is not necessary. See above!
>
>
>
> Kevin Bilbee
>
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus 
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail

RE: [Declude.JunkMail] OT: Internet Usage - Monitoring and Filtering Apps

[Marc Catuogno]

Here is the site where we purchased some blocks (free for individual users)

http://www.spywareguide.com/blockfile.php

This was the file that my guy put together - just copy it into a text file
and save as .reg, double click and integrate. I have tested it on XP ONLY.
This file works to help me stop the agents from screwing up the machines too
easily. It is a bit restrictive.


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explor
er]
"DisallowRun"=dword:0001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explor
er\DisallowRun]
"1"="aim.exe"
"2"="stcloader.exe"
"3"="sahagent.exe"
"4"="wsup.exe"
"5"="wintoolsA.exe"
"6"="wintoolsS.exe"
"7"="datemanager.exe"
"8"="precisiontime.exe"
"9"="gmt.exe"
"10"="ymsgr_tray.exe"
"11"="ypager.exe"
"12"="waol.exe"
"13"="aol.exe"
"14"="YServer.exe"
"15"="Ymsgr_tray.exe"
"16"="yupdater.exe"
"17"="name of app here.exe"
"18"="name of app here.exe"
"19"="name of app here.exe"
"20"="name of app here.exe"

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED]
Sent: Wednesday, February 16, 2005 8:06 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] OT: Internet Usage - Monitoring and
Filtering Apps

Marc,

I would be interested in these keys for some of the workstaions here if you
do not mind sharing them. 

Thanks

Stu

At 05:46 PM 2/15/2005 -0500, you wrote:
>If these are machines that the company owns and you can install them...
>I have some Reg Keys that a guy who works under me wrote for windows XP
that
>blocks AOL-IM download and some others. It also prevents certain selected
>sites from being accessed and prevents things like "my bargain buddy" from
>being installed. Will really frustrate you average user. If you can get
away
>with limited accounts, I can't, I wish I could, but that really makes it
>tough for them to screw around.  If you want I can share them...
>
>Marc
>
>-Original Message-
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED] On Behalf Of Patrick Childers
>Sent: Tuesday, February 15, 2005 2:00 PM
>To: Declude.JunkMail@declude.com
>Subject: [Declude.JunkMail] OT: Internet Usage - Monitoring and Filtering
>Apps
>
>Sorry for the OT but...
>
>It seems we have a lot of goofing off during the work day around here!
>
>Therefore, I am looking for recommendations for software (or hardware)
based
>solutions for internet monitoring/filtering in a corporate setting of less
>than 150 users. Any suggestions?
>
>Thanks,
>~Patrick
>
>---
>[This E-mail scanned for viruses by Declude/McAfee]
>
>---
>[This E-mail was scanned for viruses by Declude Virus
>(http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>---
>[This E-mail scanned for viruses by Declude Virus]
>
>
>
>---
>[This E-mail scanned for viruses by Declude Virus]
>
>---
>[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>
>

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: Internet Usage - Monitoring and Filtering Apps

[Marc Catuogno]

If these are machines that the company owns and you can install them...
I have some Reg Keys that a guy who works under me wrote for windows XP that
blocks AOL-IM download and some others. It also prevents certain selected
sites from being accessed and prevents things like "my bargain buddy" from
being installed. Will really frustrate you average user. If you can get away
with limited accounts, I can't, I wish I could, but that really makes it
tough for them to screw around.  If you want I can share them...

Marc

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Patrick Childers
Sent: Tuesday, February 15, 2005 2:00 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] OT: Internet Usage - Monitoring and Filtering
Apps

Sorry for the OT but...

It seems we have a lot of goofing off during the work day around here!

Therefore, I am looking for recommendations for software (or hardware) based
solutions for internet monitoring/filtering in a corporate setting of less
than 150 users. Any suggestions?

Thanks,
~Patrick

---
[This E-mail scanned for viruses by Declude/McAfee]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] AMEX fails routing test

[Marc Catuogno]

Thanks for 2 cents...I did check why it got held immediately.

It got held because of a reverse DNS filter that I have since removed
(sometimes I use "contains" a little over-zealously) I did lower the
spamrouting test a little and the nolegit is at "0" (Hmm not sure why I'm
running it then)
I wasn't complaining that it got held - I was just wondering why something
that looked to me like it was from Amex would fail the test.  Did they have
it routed badly?  Or did the test screw up?

I've been meaning to seriously tweak my Declude set-up, re-read the manuals
and archives and find the best combo test, look into weight range, the stop
action.
Maybe I'll play with it today and make my server go "boom"


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
Sent: Friday, February 11, 2005 2:15 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] AMEX fails routing test

YOU may want to chang your config to use weightrange instean of weight. It
will difinitivly choose the actio that will happen and avoid confusion.

Why was this message held anyway. Based on the failed tests I would not hold
this message on our server.

I do not know what filter does. But I would not give verymany points to
ROUTING and 0 points to NOLEGITCONTENT. Also I have seen many false
positives on NOABUSE and would not weight that one either.

My 2 cents,
Kevin Bilbee

> -Original Message-
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno
> Sent: Thursday, February 10, 2005 4:09 AM
> To: Declude.JunkMail@declude.com
> Subject: [Declude.JunkMail] AMEX fails routing test
> 
> 
> X-RBL-Warning: ROUTING: This E-mail was routed in a poor 
> manner consistent with spam [210f].
> X-Declude-Sender: [EMAIL PROTECTED] [193.32.34.73]
> X-Declude-Spoolname: D465d077100c4763a.SMD
> X-Note: This E-mail was scanned by Declude JunkMail 
> (www.declude.com) for spam.
> X-Spam-Tests-Failed: NOABUSE, BONDEDSENDER, NOLEGITCONTENT, 
> ROUTING, SPFPASS, FILTER, WEIGHT10, WEIGHT20, WEIGHT15, WEIGHT25 [27]
> X-Country-Chain: 
> X-Note: This E-mail was sent from phxamgw01.aexp.com ([193.32.34.73]).
> 
> Those are the headers from a held e-mail - I just thought it 
> was odd, while possible, that Amex would have poor routing.  
> Was it just because it was from England?
> 
> 
> ---
> [This E-mail scanned for viruses by Declude Virus]
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus 
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
> type "unsubscribe Declude.JunkMail".  The archives can be 
> found at http://www.mail-archive.com.
> 

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Having list issues

[Marc Catuogno]

I'm sorry if you are getting posts from multiple 
addresses from me.  I am just having list 
issues.

[Declude.JunkMail] not getting any list e-mails -

[Marc Catuogno]

I am getting nothing from Declude (JM or V) or Imail and I checked the
archive and there are many messages I haven't received.  I don't think I
changed anything.  Could I just be off the lists somehow???  Anyone else
having issues? If someone can contact me with some suggestions off list I'd
appreciate it.

Thanks -

Marc Catuogno


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] AMEX fails routing test

[Marc Catuogno]

X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent
with spam [210f].
X-Declude-Sender: [EMAIL PROTECTED] [193.32.34.73]
X-Declude-Spoolname: D465d077100c4763a.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: NOABUSE, BONDEDSENDER, NOLEGITCONTENT, ROUTING,
SPFPASS, FILTER, WEIGHT10, WEIGHT20, WEIGHT15, WEIGHT25 [27]
X-Country-Chain: 
X-Note: This E-mail was sent from phxamgw01.aexp.com ([193.32.34.73]).

Those are the headers from a held e-mail - I just thought it was odd, while
possible, that Amex would have poor routing.  Was it just because it was
from England?


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] 2005 SpamHeaders - Fix -

[marc catuogno]

Joshua,

I don't know if this has been suggested, but to completely rule out the new
Declude 1.82 as the culprit could you revert to your previous version of
Declude, comment out the spamheaders test, and see if your CPU is still
maxed.

Marc

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Joshua M. Hughes
Sent: Wednesday, January 05, 2005 3:28 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix -

John,

It took me a while to get these stats. I reviewed the SMTP logs for 12/4,
12/5, 12/7, & 12/8. I know the server was running fine during this week.
Usage is as follows.

12/4 - 83,170 messages
12/5 - 82,065 messages
12/7 - 95,087 messages
12/8 - 95,730 messages

I reviewed the SMTP logs for the 1/2, 1/3, & 1/4. These are current and
usage is as follows.

1/1 - 59,717 messages
1/2 - 63,795 messages
1/3 - 78,945 messages
1/4 - 79,410 messages

It appears as if the beginning of last month, when we were running fine, had
a lot more messages being delivered.

The only things I see in the log disturbing for today are:

[EMAIL PROTECTED] 4.63.108.6=   1130 messages
<>  =   1068 messages 

I have an ipfile that I have set to automatically delete anything from the
ip 4.63.108.6 because they have been the top sender of the log for three
days. However, this messages is still being processed.


Matt,

Average SMTP log size is between 102MB to 200MB. This appears normal. The
drive that the logs were on wasn't severely fragmented however, I
de-fragmented it anyway. The drive that the spool directory is on is 86%
free but about 60% fragmented. This drive could be de-fragmented however,
I'm worried about de-fragmenting while the CPU is at 100%.


Thank you,
Joshua
Sunline Team
(941) 206-7870
 
http://www.sunline.net/
 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Wednesday, January 05, 2005 12:17 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix

The CPU spike is probably do to sheer volume.

What is the current volume of messages being processed?

John Tolmachoff
Engineer/Consultant/Owner
eServices For You


> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Joshua M. Hughes
> Sent: Wednesday, January 05, 2005 8:22 AM
> To: Declude.JunkMail@declude.com
> Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix
> 
> I have not upgraded to fix the 2005 spamheaders test as of yet. Our CPU
has
> been maxed out and the server bogged down since my return after the New
> Year. I have commented out the spamheaders test and the CPU is still
maxed.
> I went into IMAIL and changed the delivery application from declude.exe to
> smtp32.exe and restarted the SMTP service and the processing dropped from
> 100% to approximately 13% - 20%. I placed the declude.exe back in as the
> delivery application and the processor utilization shot right back up.
This
> narrows it down to declude however, I have not yet pin pointed exactly
what
> is causing the increase in processor usage. Under the assumption this was
> caused by one of my few minor changes before the New Year I reversed all
> changes made the week before the New Year. Still the processor is maxed
out.
> Any thoughts, any ideas? I don't want to go through and comment out each
> test one at a time to find which the offender is.
> 
> Thank you,
> Joshua
> Sunline Team
> (941) 206-7870
> 
> http://www.sunline.net/
> 
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
> Sent: Tuesday, January 04, 2005 10:18 AM
> To: Declude.JunkMail@declude.com
> Subject: Re: [Declude.JunkMail] 2005 SpamHeaders - Fix
> 
> Hi, Scott, et.al,
> I have upgraded to the new Declude.exe v1.82.  Within a matter of minutes
of
> doing this upgrade I've noticed that my mail server has started to bog
down.
> I don't know if I'm getting his with a new wave of spam and the server's
> straining to keep up or if there might be something in the new Declude
code
> which would cause the .EXE to not run as quickly or as efficiently as
> before.
> 
> I'm not pointing fingers.  I just wanted to know if there's been any
> possible performance changes because of the bug fix.  If not I'll look
> somewhere else.
> 
> Thanks In Advance,
> Dan Geiser
> [EMAIL PROTECTED]
> 
> 
> ---
> E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan)
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://

RE: [Declude.JunkMail] What version am I running? PLEASE IGNORE!

[marc catuogno]

Duh - TOO early for me I must have copied an old .exe - I just did it again
and now have 1.82 - Sorry, my bad.

Marc


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of marc catuogno
Sent: Wednesday, January 05, 2005 7:12 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] What version am I running?


Does this still work? \IMail\Declude -diag 

I thought I was on 1.81 and I just D/Led the fix and replaced declude.exe
and I wanted to check the version through the diag and it gave me
"Diagnostics ON (Declude v1.80)" I assumed that this would be version 1.82 -
did I do something wrong?

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] What version am I running?

[marc catuogno]

Does this still work? \IMail\Declude -diag 

I thought I was on 1.81 and I just D/Led the fix and replaced declude.exe
and I wanted to check the version through the diag and it gave me
"Diagnostics ON (Declude v1.80)" I assumed that this would be version 1.82 -
did I do something wrong?

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] 2005 SpamHeaders Glitch?

[marc catuogno]

Scott,

I have been and still am a very satisfied Declude customer.  I wasn't
looking for a faster fix, or an interim release, I didn't even want to
complain, just:

1. An acknowledgement on the list from someone that they knew about the
problem - it WAS a holiday and I think people should have lives - but just a
"hey we know" within 24 hours would've been nice.

2. A simple e-mail note to all customers ASAP stating "The spamheaders test
has a bug causing it to catch and add weight to every e-mail sent in 2005.
It is suggested that you comment it out or reduce (or remove) its weight to
avoid false positives.  We are working on a fix and will post it to the
website as soon as possible"

I don't want to argue numbers or percentages or how significant the test is
in scope of catching spam - 15% is significant enough should it cause an
e-mail to be held or deleted.  I would hate to have to tell someone that
their sales lead is gone because of a program glitch.

That's all. Maybe a group e-mail bugtrack @ d .com or something that people
can subscribe to or something.  I just know that I would've been pissed had
I not checked the list and shut off the test and was never notified.  Maybe
I am spoiled by how proactive Declude has been in the past.

Marc 


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Monday, January 03, 2005 4:02 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] 2005 SpamHeaders Glitch?


>I also agree it would have been nice to have a warning announcement about 
>the Spam
>Header test being broken officially from Declude, more timely, and along
>with advice what to do in the interim. This is not the same Declude
>operation to me as in years past!

FWIW, it was handled very similarly to how I would have handled it.

I consider the SPAMHEADERS test to be a very minor test, as it did not 
catch a large amount of spam (about 8% when we last tested), and had a 
significant amount of false positives.  As a result, we only counted 
SPAMHEADERS towards 15% of the default spam detection weight.  The test can 
easily be commented out to prevent it from running.

Yes, in the past, I could have come out with an interim version more 
quickly.  However, it should also be noted that there was always a lot of 
debate about the interims; many people did not like them.  And even so, I 
would have only come out with an interim for the latest version (in this 
case, a beta), which would not have provided any options for customers who 
can only run release versions.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.



This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] FW: [sniffer] Sniffer Notifications now failing declude spamheaders test

[Marc Catuogno]

I 
don't mean to be a nag but this was just posted to the sniffer forum and is 
exactly what I was talking about. It is almost 48 hours after the first post 
discussing this bug and there is still no e-mail from Declude that I am aware of 
that has gone out.    
 
-Original Message-From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED]On Behalf Of Jim 
MatuskaSent: Monday, January 03, 2005 11:02 AMTo: 
sniffer@SortMonster.comSubject: [sniffer] Sniffer Notifications now 
failing declude spamheaders test
Has anything changed recently in the format of the 
sniffer notification messages?  I am noticing all the notifications for the 
last few days have been failing decludes spamheaders test, this hasn't happened 
before.
 
Jim Matuska Jr.Computer Tech2, CCNANez 
Perce TribeInformation Systems[EMAIL PROTECTED]
 
 

RE: [Declude.JunkMail] Silence?

[marc catuogno]

Barry,

Happy New Year to you as well. I understand that you don't want to have an
official response until there is a fix. Wouldn't it be a good practice to
send an e-mail to all customers advising them that the spamheaders test is
broken and they should reduce the weight or comment out the test to reduce
false positives? Personally I had that test as 1/2 half of my hold weight
1/3 my delete weight so if I hadn't checked the list I would've lost some
legit e-mails. I'd bet not everyone monitors the list and some people aren't
aware that every e-mail is getting extra weight.

Marc

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Barry Simpson
Sent: Sunday, January 02, 2005 2:46 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Silence?

The reason there has been no official post is that we are currently looking
at the issue and will post our position when we have a solution to release
to all affected customers.

Happy New Year

Barry

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of marc catuogno
Sent: Sunday, January 02, 2005 2:33 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Silence?


I'm a little disturbed that there has been no official e-mail or reply on
this list about the 2005 spam headers bug.  I understand there was a
holiday, but shouldn't someone official have said something by now?

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Silence?

[marc catuogno]

I'm a little disturbed that there has been no official e-mail or reply on
this list about the 2005 spam headers bug.  I understand there was a
holiday, but shouldn't someone official have said something by now?

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] 2005 SpamHeaders Glitch?

[marc catuogno]

Did anyone try "loosen spamheaders on"?

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry
Sent: Saturday, January 01, 2005 12:36 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] 2005 SpamHeaders Glitch?

- Original Message - 
From: "Dave Doherty" <[EMAIL PROTECTED]>

> I set it to zero weight temporarily. I also sent an email direct to Scott
> and Barry.

Why run the test at all if you're going to set the weight to zero anyway -
just comment out the test until it's fixed.

I can see this causing some major problems for users that are not
subscribers of this list, or who do not actively monitor it.  I'm wondering
if the only fix for this is a new declude.exe file?  If that's the case,
CPHZ has got their early New Year's work cut out for them...

Bill

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: Re[2]: [Declude.JunkMail] ENDing surbl filter file

[marc catuogno]

I believe it was "the more they OVERTAKE the plumbing, the easier it is to
stop up the drain"  Oh geez I need a life

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil
Sent: Monday, December 06, 2004 4:23 PM
To: Colbeck, Andrew
Subject: Re[2]: [Declude.JunkMail] ENDing surbl filter file

On Monday, December 6, 2004, 10:50:19 AM, Andrew wrote:




CA> So... I don't know how antispam software in general is adapting to those
CA> anti-SURBL (or just anti-filtering) techniques, but the short of is that
CA> your optimization is a good idea to save mail processing time, but not
CA> against at least one spam gang.

I love it when they do things like this. We simply code for the
structure of their obfuscation and frequently this is enough to
capture whole families of new campaigns.

... what is it that Scotty said about the hyperwarp drive as he was
handing parts to McCoy... "The more they rethink the plumbing, the
easier it is to stop up the works..."

A good argument for a diversified approach to spam filtering is that
one mechanism often creates countermeasures that can be exploited by
another.

_M



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Suggestion: Most "stringent" test

[marc catuogno]

Thanks.  I will try this.  Also thank you for not just flatly referring me
to the manual, where I found this documented after you told me the name of
the test.



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Rick Davidson
Sent: Sunday, November 07, 2004 8:52 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Suggestion: Most "stringent" test

Try this in your global config file, it will cause an email to be 
unwhitelisted and go through the testing process

BYPASSWHITELIST   bypasswhitelist  x y 0 0

where x is the weight you want to assign
where y is the amount of recipients required to skip the whitelist

no setting is required in $default$.junkmail

works wonders for me

Rick Davidson
National Systems Manager
North American Title Group
-
- Original Message - 
From: "marc catuogno" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Saturday, November 06, 2004 5:38 PM
Subject: [Declude.JunkMail] Suggestion: Most "stringent" test


Or some other name if it is possible -

I'd like to stop e-mails from being whitelisted because my users have their
own name in their address book and someone sends to multiple people as one
of my users.  Also I'd like to stop e-mails being delivered to multiple
recipients because one person has the sender in their address book.  SO
maybe if there are multiple recipients maybe there could be a test in
Declude that causes the most restrictive action (hold, delete, etc) instead
of the least restrictive (whitelist) action.  This way the user can still
get e-mails from [EMAIL PROTECTED] if it is sent directly, but if some
idiot tries to use this to get around blocks by sending to a list of address
it will be deleted.  Is this possible?  Is there something like this?

Thanks - Marc

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Suggestion: Most "stringent" test

[marc catuogno]

Or some other name if it is possible - 

I'd like to stop e-mails from being whitelisted because my users have their
own name in their address book and someone sends to multiple people as one
of my users.  Also I'd like to stop e-mails being delivered to multiple
recipients because one person has the sender in their address book.  SO
maybe if there are multiple recipients maybe there could be a test in
Declude that causes the most restrictive action (hold, delete, etc) instead
of the least restrictive (whitelist) action.  This way the user can still
get e-mails from [EMAIL PROTECTED] if it is sent directly, but if some
idiot tries to use this to get around blocks by sending to a list of address
it will be deleted.  Is this possible?  Is there something like this?

Thanks - Marc

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] REVERSE DNS TEST BROKEN

[marc catuogno]

I don't know what it was but I had named the test REVDNS and it looked like
this:

REVDNS  filter D:\REVDNS.txtx   0   0

This caused a dupe test and didn't work:

I then changed it to:

DNS filter D:\DNS.txt   x   0   0

And the regular REVDNS test didn't run - nothing in the log at normal log
level - just wasn't checking REVDNS.

Then I changed it to:

reverse filter D:\reverse.txt   x   0   0

And now Declude is scanning the Reverse DNS.  

Weird ~ but as long as it is working, I'd just suggest that no one define a
test called DNS. not that anyone else would make that silly mistake.  





-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of marc catuogno
Sent: Friday, September 17, 2004 8:34 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] REVERSE DNS TEST BROKEN

I foolishly was creating a test and called it REVDNS - then realized that it
was a duplicate test - I changed the name.  Now the REVDNS test doesn't
work.

REVDNS  revdnsexistsx   x   10  0

That is the line in my global config

And this is line in an e-mail this morning:

X-Note: This E-mail was sent from  ([205.188.157.38]).

And there hasn't been a REVDNS failure since I broke it with the duplicate
test.

How do I get it to work again???



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] REVERSE DNS TEST BROKEN

[marc catuogno]

I foolishly was creating a test and called it REVDNS - then realized that it
was a duplicate test - I changed the name.  Now the REVDNS test doesn't
work.

REVDNS  revdnsexistsx   x   10  0

That is the line in my global config

And this is line in an e-mail this morning:

X-Note: This E-mail was sent from  ([205.188.157.38]).

And there hasn't been a REVDNS failure since I broke it with the duplicate
test.

How do I get it to work again???



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] How do I get a copy of all messages that fail a certain test?

[marc catuogno]

Or you could use an independent .junkmail file for the account that you are
copying to and not have a delete action for any weight so the action would
be something other than delete.  I have an account that the JM file changes
the subject to HOLD WEIGHT and DELETE WEIGHT so I know where I need to
tweak. I THINK that may work as well...

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of System
Administrator
Sent: Friday, August 13, 2004 9:35 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] How do I get a copy of all messages that
fail a certain test?

on 8/13/04 9:18 AM, Bud Durland wrote:

> I belive the remedy is to create a second test, of the same type with
> the same criteria, and make COPYTO the action for that new test

I'm currently doing that. Apparently, the over the delete weight messages
get deleted before the copyto takes place.

Greg

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]




---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities

[marc catuogno]

If you are using LDAP that is completely and horribly hackable and I don't
think there is a patch below 7.

Marc

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jose Gosende
Sent: Friday, July 16, 2004 9:57 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities

Does anyone know of any vulnerabilities in iMail 6.06?
Within a minute after turning on iMail's SMTP service my
server becomes completely unresponsive and eventually
goes down. I've also installed all of the 6.06 related patches
from Ipswitch's site.

Jose
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.721 / Virus Database: 477 - Release Date: 7/16/2004

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]




---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] why/how this was white listed..how to stop it?

[marc catuogno]

I am running Declude 1.79 and Imail 8.05, I have autowhitelist on and
whitelist auth.  This user (Bernie Cohen) had himself in his address book
and it looks like the spammer had the from e-mail to be bernie's e-mail
address.  I thought it was difficult to fake the "x-declude sender"? 

I like the autowhitelist feature because it gives my users the ability to
receive jokes and other e-mails that may otherwise be filtered by adding
friends and so on to their address books.

Should I advise all my users NOT to have themselves in the address book to
prevent spammers from exploiting this feature?  Is there anything else that
I can do?

DECLUDE LOG:

06/04/2004 14:05:16 Qb9d22cdb01326288 Skipping4 E-mail from
[EMAIL PROTECTED]; whitelisted [EMAIL PROTECTED]
06/04/2004 14:05:16 Qb9d22cdb01326288 Skipping4 E-mail from
[EMAIL PROTECTED]; whitelisted [EMAIL PROTECTED]


IMAIL LOG:
06:04 14:05 SMTPD(2CDB0132) [69.14.41.135]
D:\IMail\spool\Db9d22cdb01326288.SMD 10188
06:04 14:05 SMTPD(2CDB0132) performing antispam checks

HEADERS:
Received: from SMTP32-FWD by mail.prudentialrand.com
  (SMTP32) id A06583D2D; Fri,  4 Jun 2004 14:05:17 -0400
Received: from d14-69-135-41.try.wideopenwest.com [69.14.41.135] by
mail.prudentialrand.com
  (SMTPD32-8.05) id A9D22CDB0132; Fri, 04 Jun 2004 14:05:06 -0400
X-Message-Info: G010J836ZEU98eoBqnK02XKX34ePtyaP755
Received: from [54.89.60.212] by
[EMAIL PROTECTED] via HTTP; Fri, 04 Jun
2004 21:53:29 +0300
Date: Fri, 04 Jun 2004 12:51:29 -0600
Message-ID: <[EMAIL PROTECTED]@prudentialrand.com>
Reply-To: "Jason Morton" <[EMAIL PROTECTED]>
From: "Jason Morton" <[EMAIL PROTECTED]>
To: "Bernie.cohen" <[EMAIL PROTECTED]>
Subject: Re:Soma,valium,xanax,etc shipped overnight
Date: Fri, 04 Jun 2004 14:50:29 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--907020264053734"
X-Declude-Sender: [EMAIL PROTECTED] [69.14.41.135]
X-Declude-Spoolname: Db9d22cdb01326288.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: Whitelisted [0]
X-Country-Chain: 
X-Note: This E-mail was sent from d14-69-135-41.try.wideopenwest.com
([69.14.41.135]).
X-IMAIL-SPAM-HTML-FEATURES: (Image Tag)
X-RCPT-TO: [EMAIL PROTECTED]>
Status: U
X-UIDL: 378182572



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Declude headers missing from several e-mails

[marc catuogno]

Thanks -

It looks as if it was an aberration.  I've checked a few different day's
logs and didn't see "could not lock file" in any other log.  Something must
have been up.  Maybe I should look through the logs more thouroughly and
more often : )

Anything out there that could alert me to the fact that Declude hasn't
scanned a file (I know that is a broad question) something that would scan
the logs and e-mail me immediately if Declude encounters a severe error that
causes an e-mail (or e-mails) not to be scanned?

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Thursday, May 06, 2004 7:17 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Declude headers missing from several e-mails


>No backup software, no on access scanning.  I am having some other problems
>with the machine - I'm about to nuke it regardless - I just wanted to make
>sure that declude was still being called to scan for viruses until I get
>this box formatted... ugh

Unfortunately, if the files can't be locked by Declude, then it is likely 
that the E-mails would not get scanned for viruses.  Declude expects to 
have exclusive access to those files.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]




---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Declude headers missing from several e-mails

[marc catuogno]

No backup software, no on access scanning.  I am having some other problems
with the machine - I'm about to nuke it regardless - I just wanted to make
sure that declude was still being called to scan for viruses until I get
this box formatted... ugh 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Wednesday, May 05, 2004 8:07 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Declude headers missing from several e-mails


>There were e-mails delivered between 5:15 and 5:33 - This "could not lock
>message" should've just effected just that one e-mail.  It shouldn't have
>stopped Declude from being called for 15 minutes. Correct?
>After a closer look at the logs, this was what I found - what could cause
so
>many errors?

Was there backup software running during those 15 minutes?  It sounds like 
something was interfering with the files that only Declude should have had 
access to, and backup software and on-access virus scanners are the 2 
common culprits.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]




---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.