Re: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
on 2/4/03 1:23 PM, R. Scott Perry wrote: Would it be possible to change the format to this? COMMENTS comments 5 x 10 0 COMMENTS comments 5 weight 10 0 Where the number is the minimum needed to fail the test. The second value indicates whether or not the admin wants a cumulative weight. The third and forth values indicate base weights as normal. I'll check to see if we may be able to do that. Is this request available in the latest interim release or are you still checking into it? Thanks, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
Would it be possible to change the format to this? COMMENTS comments 5 x 10 0 COMMENTS comments 5 weight 10 0 Where the number is the minimum needed to fail the test. The second value indicates whether or not the admin wants a cumulative weight. The third and forth values indicate base weights as normal. I'll check to see if we may be able to do that. Is this request available in the latest interim release or are you still checking into it? There still isn't a final answer on this one. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
COMMENTS comments 5 x 10 0 where the 5 means that 5 such comments have to be encountered This means 5 OR MORE comments have to be encountered right? Not exactly 5? Bill -Original Message- From: R. Scott Perry Sent: Mon, 03 Feb 2003 19:05:41 -0500 Subject: RE: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released Does the comments test require non-whitespace beforeafter the comments in order to trigger? So that most legit messages will not trigger it? Yes. So the most common types of comments, such as: !-- This is a comment at the beginning of a line -- or: alert( Hello, World ); !-- This says hello to the world -- will not count. The test is defined in the global.cfg file as follows: COMMENTS comments 5 x 10 0 where the 5 means that 5 such comments have to be encountered (the 10 is the weight that will be added for E-mail that fails the test). Alternatively, you can use: COMMENTS comments weight x 10 0 In this case, the weight of the E-mail will be increased by the number of anti-filtering comments that are found (plus the base weight of the test). So if there are 3 in there, the weight will be increased by 13 (10 for failing the test, and 1 for each anti-filtering comment found). If there are 40 such comments, a total of 50 would be added to the weight of the E-mail. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
on 2/3/03 7:05 PM, R. Scott Perry wrote: The test is defined in the global.cfg file as follows: COMMENTS comments 5 x 10 0 where the 5 means that 5 such comments have to be encountered (the 10 is the weight that will be added for E-mail that fails the test). Alternatively, you can use: COMMENTS comments weight x 10 0 OK, I must not be thinking correctly. I understand the first example but I'm confused on the second example. If I wanted to add 5 for every comment line found in a message, and the weight of the test is 10, wouldn't I put the number 5 where the word weight is, thereby making the two comment lines identical? Thanks, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
The test is defined in the global.cfg file as follows: COMMENTS comments 5 x 10 0 where the 5 means that 5 such comments have to be encountered (the 10 is the weight that will be added for E-mail that fails the test). Alternatively, you can use: COMMENTS comments weight x 10 0 OK, I must not be thinking correctly. I understand the first example but I'm confused on the second example. If I wanted to add 5 for every comment line found in a message, and the weight of the test is 10, wouldn't I put the number 5 where the word weight is, thereby making the two comment lines identical? The formula for the weight that is added to the E-mail is: b + n, where b is the base weight of the test (10 in both examples above), and b is either 0 (in the first example) or the number of anti-filtering comments that are found. There isn't an option for a multiplier (so that an E-mail with 20 comments would get a weight of 100 and an E-mail with 40 comments would get a weight of 200). So you can't add 5 for every comment. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
Hi; This Comments filter is already working great. It is catching the trick quite nicely. Great job.. Any plan to also add the variation of this trick -- simply: =2Ecom=2F http=3A=2F=2F Or the likes? These tricks are now causing our URL filters not to be as effective. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, February 04, 2003 10:00 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released The test is defined in the global.cfg file as follows: COMMENTS comments 5 x 10 0 where the 5 means that 5 such comments have to be encountered (the 10 is the weight that will be added for E-mail that fails the test). Alternatively, you can use: COMMENTS comments weight x 10 0 OK, I must not be thinking correctly. I understand the first example but I'm confused on the second example. If I wanted to add 5 for every comment line found in a message, and the weight of the test is 10, wouldn't I put the number 5 where the word weight is, thereby making the two comment lines identical? The formula for the weight that is added to the E-mail is: b + n, where b is the base weight of the test (10 in both examples above), and b is either 0 (in the first example) or the number of anti-filtering comments that are found. There isn't an option for a multiplier (so that an E-mail with 20 comments would get a weight of 100 and an E-mail with 40 comments would get a weight of 200). So you can't add 5 for every comment. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
That's quoted printable stuff. _M | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of Kami Razvan | Sent: Tuesday, February 04, 2003 10:14 AM | To: [EMAIL PROTECTED] | Subject: RE: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released | | | Hi; | This Comments filter is already working great. It is | catching the trick | quite nicely. Great job.. | | Any plan to also add the variation of this trick -- simply: | | =2Ecom=2F | http=3A=2F=2F | | Or the likes? These tricks are now causing our URL filters | not to be as | effective. | | Regards, | Kami | | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of R. | Scott Perry | Sent: Tuesday, February 04, 2003 10:00 AM | To: [EMAIL PROTECTED] | Subject: Re: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released | | | | The test is defined in the global.cfg file as follows: | | COMMENTS comments 5 x 10 0 | | where the 5 means that 5 such comments have to be | encountered (the | 10 is the weight that will be added for E-mail that fails | the test). | Alternatively, you can use: | | COMMENTS comments weight x 10 0 | | OK, I must not be thinking correctly. | | I understand the first example but I'm confused on the | second example. | If I wanted to add 5 for every comment line found in a | message, and the | weight of the test is 10, wouldn't I put the number 5 where the word | weight is, thereby making the two comment lines identical? | | The formula for the weight that is added to the E-mail is: b | + n, where | b is the base weight of the test (10 in both examples | above), and b is | either 0 (in the first example) or the number of | anti-filtering comments | that are found. | | There isn't an option for a multiplier (so that an E-mail | with 20 comments | would get a weight of 100 and an E-mail with 40 comments | would get a weight | of 200). So you can't add 5 for every comment. | -Scott | | --- | [This E-mail was scanned for viruses by Declude Virus | (http://www.declude.com)] | | --- | This E-mail came from the Declude.JunkMail mailing list. To | unsubscribe, | just send an E-mail to [EMAIL PROTECTED], and type unsubscribe | Declude.JunkMail. The archives can be found at | http://www.mail-archive.com. | | --- | [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
Scott, Would it be possible to change the format to this? COMMENTS comments 5 x 10 0 COMMENTS comments 5 weight 10 0 Where the number is the minimum needed to fail the test. The second value indicates whether or not the admin wants a cumulative weight. The third and forth values indicate base weights as normal. Jerod M. Bennett Director of Media Production Pixelpushers, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, February 04, 2003 7:00 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released The test is defined in the global.cfg file as follows: COMMENTS comments 5 x 10 0 where the 5 means that 5 such comments have to be encountered (the 10 is the weight that will be added for E-mail that fails the test). Alternatively, you can use: COMMENTS comments weight x 10 0 OK, I must not be thinking correctly. I understand the first example but I'm confused on the second example. If I wanted to add 5 for every comment line found in a message, and the weight of the test is 10, wouldn't I put the number 5 where the word weight is, thereby making the two comment lines identical? The formula for the weight that is added to the E-mail is: b + n, where b is the base weight of the test (10 in both examples above), and b is either 0 (in the first example) or the number of anti-filtering comments that are found. There isn't an option for a multiplier (so that an E-mail with 20 comments would get a weight of 100 and an E-mail with 40 comments would get a weight of 200). So you can't add 5 for every comment. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
Would it be possible to change the format to this? COMMENTS comments 5 x 10 0 COMMENTS comments 5 weight 10 0 Where the number is the minimum needed to fail the test. The second value indicates whether or not the admin wants a cumulative weight. The third and forth values indicate base weights as normal. I'll check to see if we may be able to do that. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
Does the comments test require non-whitespace beforeafter the comments in order to trigger? So that most legit messages will not trigger it? -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Monday, February 03, 2003 5:36 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released We have just released Declude JunkMail v1.67 (beta). See http://www.declude.com/junkmail/manual.htm . Notable changes since the last beta include: o Adds an AUTOWHITELIST ON option, to automatically whitelist addresses in recipient's address book o Adds a comments test type, to detect anti-filter HTML comments (such as unsub!-- user --cribe) Other additions and fixes can be found in the release notes, at http://www.declude.com/relnotes.htm . --- Quick Resource Reference: Tech Support: [EMAIL PROTECTED] Mailing List: Send E-mail to [EMAIL PROTECTED] with subscribe declude.virus your name or subscribe declude.junkmail your name in the body New Releases List: Send E-mail to [EMAIL PROTECTED] with subscribe declude.releases your name in the body Troubleshooting: See manual URL above; look at Troubleshooting section Emergency Uninstall: See manual URL above; look at Emergency Uninstall section Urgent Support: urgent @declude.com (for urgent/time-sensitive issues only) Declude Addons/Tools URL: http://www.declude.com/tools Manuals: http://www.declude.com/virus/manual.htm , http://www.declude.com/junkmail/manual.htm , http://www.declude.com/hijack/manual.htm . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
Does the comments test require non-whitespace beforeafter the comments in order to trigger? So that most legit messages will not trigger it? Yes. So the most common types of comments, such as: !-- This is a comment at the beginning of a line -- or: alert( Hello, World ); !-- This says hello to the world -- will not count. The test is defined in the global.cfg file as follows: COMMENTS comments 5 x 10 0 where the 5 means that 5 such comments have to be encountered (the 10 is the weight that will be added for E-mail that fails the test). Alternatively, you can use: COMMENTS comments weight x 10 0 In this case, the weight of the E-mail will be increased by the number of anti-filtering comments that are found (plus the base weight of the test). So if there are 3 in there, the weight will be increased by 13 (10 for failing the test, and 1 for each anti-filtering comment found). If there are 40 such comments, a total of 50 would be added to the weight of the E-mail. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
