Re: [Declude.JunkMail] HELP PLEASE !
I have Imail v6.06 with Declude 1.75. When I run the smtp32.exe it seems to be passing mail. When I have it call declude.exe it fails. What is "failing"? The E-mail is delivered unscanned? The E-mail is deleted? The E-mail sits in the spool? What do the log files show for a sample E-mail that you try sending? > Upon further work I have shut down Junkmail and have virus running and > things seems to be going ok. Any suggestion why junkmail stopped? My guess is that your DNS server is broken. If that happens, Declude JunkMail will have to wait until each timeout occurs, causing E-mail to stay in memory a long time. This can cause other problems, such as mail backing up. > Everything started when I was receiving SMTP errors What were the exact messages you were seeing? > if I turn off junkmail things seem to work better. Is that 100% better (as in performing identically or very close to the way that it had before this problem occured)? > I have a "DECLUDE" text file but it is just showing where the virus > scanner pops up a couple of errors (mostly errors creating or opening files) Is that the C:\Declude.log file you are referring to (where Declude will record if it can't figure out where to record log file entries to), or the actual log files (\IMail\spool\vir.log and \IMail\spool\dec.log)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] HELP PLEASE !
Hi John, Everything started when I was receiving SMTP errors and it kepy going down. I did see ALOT of spam going thru and I was updating the RAM anyways. When the server was shut down it wouldn't come back up. I set up my backup server. No there are not any there. I have noticed on this machine (it's an older machine) that if I turn off junkmail things seem to work better. I have a "DECLUDE" text file but it is just showing where the virus scanner pops up a couple of errors (mostly errors creating or opening files) . Hopefully On Friday I will be able to rebuild the broken machine and see if things work better. * TymeWyse Internet P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] * -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff (Lists) Sent: Wednesday, November 26, 2003 10:24 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] HELP PLEASE ! Hello Jeff. What exactly is happening? Any C:\Declude.GPx files? John Tolmachoff Engineer/Consultant/Owner eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Jeff Kratka > Sent: Wednesday, November 26, 2003 9:10 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] HELP PLEASE ! > > Today my mail server crashed and I have been trying to get things back up > and running. I have Imail v6.06 with Declude 1.75. When I run the > smtp32.exe > it seems to be passing mail. When I have it call declude.exe it fails. > > Any ideas.. > > > Jeff Kratka > * > TymeWyse Internet > P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417 > tel/fax: (541) 839-6027 - [EMAIL PROTECTED] > * > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] HELP PLEASE !
Also, go to a command prompt, change to the Imail directory, and type in without the quotes: "declude -diag >c:\decludediag.txt" Then post or send off list. John Tolmachoff Engineer/Consultant/Owner eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Jeff Kratka > Sent: Wednesday, November 26, 2003 10:15 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] HELP PLEASE ! > > Upon further work I have shut down Junkmail and have virus running and > things seems to be going ok. Any suggestion why junkmail stopped? > > Jeff Kratka > * > TymeWyse Internet > P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417 > tel/fax: (541) 839-6027 - [EMAIL PROTECTED] > * > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Jeff Kratka > Sent: Wednesday, November 26, 2003 9:10 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] HELP PLEASE ! > > > Today my mail server crashed and I have been trying to get things back up > and running. I have Imail v6.06 with Declude 1.75. When I run the > smtp32.exe > it seems to be passing mail. When I have it call declude.exe it fails. > > Any ideas.. > > > Jeff Kratka > * > TymeWyse Internet > P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417 > tel/fax: (541) 839-6027 - [EMAIL PROTECTED] > * > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] HELP PLEASE !
Anything in the logs? John Tolmachoff Engineer/Consultant/Owner eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Jeff Kratka > Sent: Wednesday, November 26, 2003 10:15 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] HELP PLEASE ! > > Upon further work I have shut down Junkmail and have virus running and > things seems to be going ok. Any suggestion why junkmail stopped? > > Jeff Kratka > * > TymeWyse Internet > P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417 > tel/fax: (541) 839-6027 - [EMAIL PROTECTED] > * > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Jeff Kratka > Sent: Wednesday, November 26, 2003 9:10 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] HELP PLEASE ! > > > Today my mail server crashed and I have been trying to get things back up > and running. I have Imail v6.06 with Declude 1.75. When I run the > smtp32.exe > it seems to be passing mail. When I have it call declude.exe it fails. > > Any ideas.. > > > Jeff Kratka > * > TymeWyse Internet > P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417 > tel/fax: (541) 839-6027 - [EMAIL PROTECTED] > * > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] HELP PLEASE !
Hello Jeff. What exactly is happening? Any C:\Declude.GPx files? John Tolmachoff Engineer/Consultant/Owner eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Jeff Kratka > Sent: Wednesday, November 26, 2003 9:10 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] HELP PLEASE ! > > Today my mail server crashed and I have been trying to get things back up > and running. I have Imail v6.06 with Declude 1.75. When I run the > smtp32.exe > it seems to be passing mail. When I have it call declude.exe it fails. > > Any ideas.. > > > Jeff Kratka > * > TymeWyse Internet > P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417 > tel/fax: (541) 839-6027 - [EMAIL PROTECTED] > * > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] HELP PLEASE !
Upon further work I have shut down Junkmail and have virus running and things seems to be going ok. Any suggestion why junkmail stopped? Jeff Kratka * TymeWyse Internet P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] * -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Kratka Sent: Wednesday, November 26, 2003 9:10 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] HELP PLEASE ! Today my mail server crashed and I have been trying to get things back up and running. I have Imail v6.06 with Declude 1.75. When I run the smtp32.exe it seems to be passing mail. When I have it call declude.exe it fails. Any ideas.. Jeff Kratka * TymeWyse Internet P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] * --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help please
It's working for my customers. The fact that the all of my customers have been getting plenty of virus alerts from Declude/Virus certainly helped. They trust our judgment, that we inspect and block email for good (and easily AVOIDABLE!) reasons. I have THREE very large domains for which I created a custom configuration where the REVDNS does not ALERT, but rather uses the SUBJECT action. They simply had too many prospective customers where Reverse DNS was missing and "educating the mail administrator" was taking a lot of their productive time. Best Regards Andy -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Webmaster Oilfield Directory Sent: Saturday, December 01, 2001 09:33 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Help please How did you feel this configuration worked, did you have any complaints about bouncing "legitimate mail" or not... or was your averages pretty good. sheldon --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Help please
How did you feel this configuration worked, did you have any complaints about bouncing "legitimate mail" or not... or was your averages pretty good. sheldon - Original Message - From: "Andy Schmidt" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Saturday, December 01, 2001 1:32 PM Subject: Re: [Declude.JunkMail] Help please > Adolfo: > > Here an excerpt of my GLOBAL.CFG file > > RBL ip4rblackholes.mail-abuse.org 127.0.0.2 > DUL ip4rdialups.mail-abuse.org 127.0.0.3 > RSS ip4rrelays.mail-abuse.org 127.0.0.2 > > OSRELAY ip4rrelays.osirusoft.com127.0.0.2 6 0 > OSDUL ip4rrelays.osirusoft.com127.0.0.3 > OSSRC ip4rrelays.osirusoft.com127.0.0.4 7 0 > OSSMART ip4rrelays.osirusoft.com127.0.0.5 5 0 > OSSOFT ip4rrelays.osirusoft.com127.0.0.6 > OSLIST ip4rrelays.osirusoft.com127.0.0.7 5 0 > OSFORM ip4rrelays.osirusoft.com127.0.0.8 5 0 > > ORBZINPUTS ip4r orbz.gst-group.co.uk 127.0.0.3 5 0 > ORBZOUTPUTS ip4r orbz.gst-group.co.uk 127.0.0.2 5 0 > ORBZPOST ip4r orbz.gst-group.co.uk 127.0.0.9 5 0 > ORDB ip4r relays.ordb.org * > SPAMCOP ip4r bl.spamcop.net 127.0.0.2 7 0 > > MAILFROM envfrom > PERCENT percent > BADHEADERS badheaders x x 5 0 > SPAMHEADERS spamheaders x x 3 0 > SPAMROUTING spamrouting x x 4 0 > REVDNS revdnsexists x x 5 0 > > HEUR10 heuristics 10 x 4 0 > HEUR9 heuristics 9 x 4 0 > HEUR8 heuristics 8 x 3 0 > HEUR heuristics > > WEIGHT10 weight x x 10 0 > WEIGHT8 weight x x 8 0 > > > And here the matching $Default%.junkmail: > > RBL BOUNCE > DUL BOUNCE > RSS BOUNCE > OSDUL BOUNCE > OSSOFT BOUNCE > ORDB BOUNCE > WEIGHT10 BOUNCE > WEIGHT8 SUBJECT SPAM: [See Headers] > REVDNS ALERT > > OSRELAY WARN > OSSRC WARN > OSSMART WARN > OSLIST WARN > OSFORM WARN > > ORBZINPUTS WARN X-RBL-WARNING: Suspected SPAM. %REMOTEIP% found in > %TESTDOMAIN%. %WARNING% > ORBZOUTPUTS WARN X-RBL-WARNING: Suspected SPAM. %REMOTEIP% found in > %TESTDOMAIN%. %WARNING% > ORBZPOST WARN X-RBL-WARNING: Suspected SPAM. %REMOTEIP% found in > %TESTDOMAIN%. %WARNING% > > SPAMCOP WARN X-RBL-WARNING: Suspected SPAM. %WARNING% > > MAILFROM HOLD > PERCENT HOLD > BADHEADERS WARN X-Declude-Note: SMTP headers violate RFCs. %WARNING% > SPAMHEADERS WARN X-RBL-WARNING: Suspected SPAM. %WARNING% > SPAMROUTING WARN X-RBL-WARNING: Suspected SPAM. %WARNING% > HEUR WARN X-RBL-WARNING: Suspected SPAM. %WARNING% > > > Best Regards > Andy Schmidt > > H&M Systems Software, Inc. > 600 East Crescent Avenue > Suite 203 > Upper Saddle River, NJ 07458-1846 > > Phone: +1 201 934-3414 x20 (Business) > Fax:+1 201 934-9206 > > http://www.hm-software.com/ > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Adolfo > Justiniano > Sent: Saturday, December 01, 2001 03:58 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] MISSING_REVERSE_DNS:Help please > > > Hello everyone, > > I'm new to the list, I just bought Declude Junkmail. > > I need some help, I've been experiencing with several settings in my > global.cfg file without success because I was catching many legitimate > emails, now to be safe I'm just holding those messages that fail the > MAILFROM and SPAMCOP tests that seem to me almost 100% secure. > > Does any of you have a configuration that is pretty efective in catching > spam, preferably using the weighting system. I would appreciate if you could > share it with me (it could be off-list if you prefer). > > Thank you, > > Adolfo Justiniano > e-mail: [EMAIL PROTECTED] > http://www.scbbs.net > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". You can E-mail > [EMAIL PROTECTED] for assistance. You can visit our web > site at http://www.declude.com . > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". You can E-mail > [EMAIL PROTECTED] for assistance. You can visit our web > site at http://www.declude.com . > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Help please
Adolfo: Here an excerpt of my GLOBAL.CFG file RBL ip4rblackholes.mail-abuse.org 127.0.0.2 DUL ip4rdialups.mail-abuse.org 127.0.0.3 RSS ip4rrelays.mail-abuse.org 127.0.0.2 OSRELAY ip4rrelays.osirusoft.com127.0.0.2 6 0 OSDUL ip4rrelays.osirusoft.com127.0.0.3 OSSRC ip4rrelays.osirusoft.com127.0.0.4 7 0 OSSMART ip4rrelays.osirusoft.com127.0.0.5 5 0 OSSOFT ip4rrelays.osirusoft.com127.0.0.6 OSLIST ip4rrelays.osirusoft.com127.0.0.7 5 0 OSFORM ip4rrelays.osirusoft.com127.0.0.8 5 0 ORBZINPUTS ip4rorbz.gst-group.co.uk127.0.0.3 5 0 ORBZOUTPUTS ip4rorbz.gst-group.co.uk127.0.0.2 5 0 ORBZPOSTip4rorbz.gst-group.co.uk127.0.0.9 5 0 ORDBip4rrelays.ordb.org * SPAMCOP ip4rbl.spamcop.net 127.0.0.2 7 0 MAILFROMenvfrom PERCENT percent BADHEADERS badheaders x x 5 0 SPAMHEADERS spamheaders x x 3 0 SPAMROUTING spamrouting x x 4 0 REVDNS revdnsexistsx x 5 0 HEUR10 heuristics 10 x 4 0 HEUR9 heuristics 9 x 4 0 HEUR8 heuristics 8 x 3 0 HEURheuristics WEIGHT10weight x x 10 0 WEIGHT8 weight x x 8 0 And here the matching $Default%.junkmail: RBL BOUNCE DUL BOUNCE RSS BOUNCE OSDUL BOUNCE OSSOFT BOUNCE ORDBBOUNCE WEIGHT10BOUNCE WEIGHT8 SUBJECT SPAM: [See Headers] REVDNS ALERT OSRELAY WARN OSSRC WARN OSSMART WARN OSLIST WARN OSFORM WARN ORBZINPUTS WARNX-RBL-WARNING: Suspected SPAM. %REMOTEIP% found in %TESTDOMAIN%. %WARNING% ORBZOUTPUTS WARNX-RBL-WARNING: Suspected SPAM. %REMOTEIP% found in %TESTDOMAIN%. %WARNING% ORBZPOSTWARNX-RBL-WARNING: Suspected SPAM. %REMOTEIP% found in %TESTDOMAIN%. %WARNING% SPAMCOP WARNX-RBL-WARNING: Suspected SPAM. %WARNING% MAILFROMHOLD PERCENT HOLD BADHEADERS WARNX-Declude-Note: SMTP headers violate RFCs. %WARNING% SPAMHEADERS WARNX-RBL-WARNING: Suspected SPAM. %WARNING% SPAMROUTING WARNX-RBL-WARNING: Suspected SPAM. %WARNING% HEURWARNX-RBL-WARNING: Suspected SPAM. %WARNING% Best Regards Andy Schmidt H&M Systems Software, Inc. 600 East Crescent Avenue Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.hm-software.com/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Adolfo Justiniano Sent: Saturday, December 01, 2001 03:58 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] MISSING_REVERSE_DNS:Help please Hello everyone, I'm new to the list, I just bought Declude Junkmail. I need some help, I've been experiencing with several settings in my global.cfg file without success because I was catching many legitimate emails, now to be safe I'm just holding those messages that fail the MAILFROM and SPAMCOP tests that seem to me almost 100% secure. Does any of you have a configuration that is pretty efective in catching spam, preferably using the weighting system. I would appreciate if you could share it with me (it could be off-list if you prefer). Thank you, Adolfo Justiniano e-mail: [EMAIL PROTECTED] http://www.scbbs.net --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
