RE: [Declude.JunkMail] Fail safe-- ideas
Hi Scott: I ran it and it appears to be working. When ran manually the report shows that it has detected an infected file. I also attached the virus.cfg for your review if possible. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Saturday, May 31, 2003 4:20 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Fail safe-- ideas In Declude JM perhaps it is not a bad idea to have some fail safe options. For example.. There are quite a few. :) I made a blank entry in our database which ended up as: BODY 20 CONTAINS it was blank after contains.. a number of emails failed this test by the time I found out about it. I think as a fail safe perhaps it is not a bad idea to ignore such entries or return error. Except if one can think of any situation where one wants such a filter. Thanks for pointing this out -- I'll see if we can add a failsafe for this. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Desktop.zip Description: Zip compressed data
RE: [Declude.JunkMail] Fail safe-- ideas
OUCH How did I post this to the list? This was to be sent to Scott only... OUCH OUCH OUCH... Forgot to set off my reply receipt :'( 5000 responses later... So sorry folks ... OUCH OUCH Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Saturday, May 31, 2003 4:50 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Fail safe-- ideas Hi Scott: I ran it and it appears to be working. When ran manually the report shows that it has detected an infected file. I also attached the virus.cfg for your review if possible. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Saturday, May 31, 2003 4:20 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Fail safe-- ideas In Declude JM perhaps it is not a bad idea to have some fail safe options. For example.. There are quite a few. :) I made a blank entry in our database which ended up as: BODY 20 CONTAINS it was blank after contains.. a number of emails failed this test by the time I found out about it. I think as a fail safe perhaps it is not a bad idea to ignore such entries or return error. Except if one can think of any situation where one wants such a filter. Thanks for pointing this out -- I'll see if we can add a failsafe for this. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Fail safe-- ideas
Not sure how doable is this or if it can be exploited by spammers, but as a fail safe, cant we setup a certain FROM and TO email accounts on a domain which we know any email going between those two accounts (from doesn't have to be an email account on server) is 99.99% never spam? This way if we mess up our declude config file so to tag the email coming from [EMAIL PROTECTED] to [EMAIL PROTECTED] (where we trust both accounts) as spam above X weight it will trip up some configurable alarm. The program MATCH I have does just that. If it finds a match in both the from and to address, it returns a fail to Declude, which you can then weight at say -250 so that it will always then cause the message to go through. Granted, that is not a Declude fail safe, but if you use the weighting system, it works. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Fail safe-- ideas
Glad to know im not way too off in my suggestions ... To make this closer to a failsafe, we can have your program check the weight already assigned to the configured match, if its above X weight, it would trigger a configurable alert (off site email, event log, log file...etc) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Sunday, June 01, 2003 2:13 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Fail safe-- ideas Not sure how doable is this or if it can be exploited by spammers, but as a fail safe, cant we setup a certain FROM and TO email accounts on a domain which we know any email going between those two accounts (from doesn't have to be an email account on server) is 99.99% never spam? This way if we mess up our declude config file so to tag the email coming from [EMAIL PROTECTED] to [EMAIL PROTECTED] (where we trust both accounts) as spam above X weight it will trip up some configurable alarm. The program MATCH I have does just that. If it finds a match in both the from and to address, it returns a fail to Declude, which you can then weight at say -250 so that it will always then cause the message to go through. Granted, that is not a Declude fail safe, but if you use the weighting system, it works. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Fail safe-- ideas
To make this closer to a failsafe, we can have your program check the weight already assigned to the configured match, if its above X weight, it would trigger a configurable alert (off site email, event log, log file...etc) But what about this scenario: [EMAIL PROTECTED] sends a message to [EMAIL PROTECTED] User1 is telling an adult joke to user2. This causes the weight of the message to be say 75. Using your suggestion, an alert will be sent. Now say user2 is the president of the company and is involved in an a***r with user1. When the admin receives the notice and passes it to the HR per policy, quite an embarrassing situation, no? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
