RE: [Declude.JunkMail] IPBYPASS and WHITELIST IP

2004-07-09 Thread John Tolmachoff \(Lists\)
The gateway server will be Imail/Declude as that will be doing all the Junkmail scanning. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Thursday, July 08, 2004

[Declude.JunkMail] Test Action Failure

2004-07-09 Thread Kevin Bilbee
Why did this not ROUTETO 07/09/2004 00:15:58 Q462a09e900349a60 Triggered CONTAINS filter SAVFILTER on X-Bulk: 99 [weight-0; X-Bulk: 99 07/09/2004 00:16:00 Q462a09e900349a60 Triggered IS filter REVDNSFILTER on localhost [weight-14; localhost]. 07/09/2004 00:16:00 Q462a09e900349a60 AHBLDOMAINS:8

Re: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread R. Scott Perry
Why did this not ROUTETO ... The test trigered the Contains for the SAVFILTER but SAVFILTER does not show up in the Tests Failed Section Well, there is a very clear answer to your question -- Declude JunkMail did not use the ROUTETO action for the SAVFILTER test because the E-mail did not fail

RE: [Declude.JunkMail] Error in log and email

2004-07-09 Thread R. Scott Perry
Thanks Matt. Here is my info for support tomorrow: I have Symantec Antivirus Corp 8.1. I have excludes in place for /imail, /email dirs, and /temp Declude 1.79i7 Imail 8.05 F-Prot 3.14a Do you have backup software running on the server? Do you also have Declude Hijack (in which case there is a

RE: [Declude.JunkMail] Error in log and email

2004-07-09 Thread Dan Horne
I once tried to set up the same config you have. What I found was that no matter what exclusions I put in place for SAV 8.1, it would still occasionally scan those directories. I believe it was due to scheduled network sweeps, although I have no proof of that. After working with it for a while,

Re: [Declude.JunkMail] IPBYPASS and WHITELIST IP

2004-07-09 Thread Matt
John, I think you misunderstood my suggestion. I was suggesting that you run MS SMTP as well as IMail/JunkMail on the gateway. Actually, I can tell you that running IMail/JunkMail as the actual gateway is a pretty bad idea at the moment. You really need some other product to do the address

[Declude.JunkMail] Country Configuration?

2004-07-09 Thread Doug Anderson
After looking at the manual/archives andgetting a little more confused I've decided to consult the masses. What would be the easiest way of adding a few points for emails NOT orgininating from Canada, US, and Mexico? We have users in all three areas so I'm guessing the nonenglish won't work

Re: [Declude.JunkMail] Country Configuration?

2004-07-09 Thread Scott Fisher
You could use Mailpure's foreign filter. It matches on Countries, HELO, Mailfrom and REVDNS. The trusted countries are listed at the end of the filter. Make sure you have the all_list.dat file Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 07/09/04 09:52AM After

RE: [Declude.JunkMail] Error in log and email

2004-07-09 Thread Danny K
I run a backup in the eraly morning hours only so this would not be the problem as the errors are all day long. I checked and Symantec is not scanning the spool directory. I don't have f-prot running on the server other then what declude does with it and I do not have Declude Hijack. What about

Re: [Declude.JunkMail] Country Configuration?

2004-07-09 Thread Dan Geiser
Hello, Doug, I would recommend using the COUNTRY/COUNTRIES functionality in a filter. Here is how I do it... 1. Download the file, http://www.declude.com/release/179/all_list.dat, and place it in the directory that your GLOBAL.CFG file is in. 2. Add the following... GLOBAL.CFG --

[Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Dan Geiser
Is this guy serious when he says "The test is available for download". What do we have to download? What version number includes this test? What is the format of the test? Is it just an IP4R test? What host name do we use? - Original Message - From: Barry @ CPHZ To:

RE: [Declude.JunkMail] IPBYPASS and WHITELIST IP

2004-07-09 Thread John Tolmachoff \(Lists\)
OK, I got it now. I will have to think about that. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Friday, July 09, 2004 7:38 AM To: [EMAIL PROTECTED] Subject:

Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Russ Uhte \(Lists\)
At 10:39 AM 7/9/2004, Dan Geiser wrote: Is this guy serious when he says The test is available for download. What do we have to download? What version number includes this test? What is the format of the test? Is it just an IP4R test? What host name do we use? I found that kinda strange as

Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Greg Foulks
Goto declude.com and you'll see what it is you have to download. Greg Dan Geiser wrote: Is this guy serious when he says The test is available for download. What do we have to download? What version number includes this test? What is the format of the test? Is it just an IP4R test? What

Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Jay Calvert
I don't think I have ever had an username and password with Declude. Where do we find this information? All we ever had to provide as verification was our Hostname. - Original Message - From: Dan Geiser To: [EMAIL PROTECTED] Sent: Friday, July 09, 2004 8:39 AM

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Andy Schmidt
Title: Message I guess they wrote a "setup" program that will install new code and even activate it for you. Hopefully, there'll be some "readme" inside that mysterious .EXE file. Otherwise, it is pretty much a cat in the sack! The installation process for the MTLDB: Download

Re: [Declude.JunkMail] Country Configuration?

2004-07-09 Thread Doug Anderson
Ok, that's where I was getting confused. Didn't have the countries file, couldn't find it on the site anywhere. - Original Message - From: Dan Geiser To: [EMAIL PROTECTED] Sent: Friday, July 09, 2004 10:14 AM Subject: Re: [Declude.JunkMail] Country

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread John Tolmachoff \(Lists\)
Title: Message Automatically changing the configuration files is a bad thing in my opinion. All my configuration files are built from scripts from base files, allowing to easily make changes to one section and then make the appropriate changes in what ever configuration files are

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Dan Horne
Title: Message I installed this test, but I'd like to voice my opinion that I do not like the way this test was distributed. I don't like anything messing with my global.cfg, even if it is a program distributed by Declude. It seemsto me thatthis was an attempt by the new owners to harvest

Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Doug Anderson
Admin server can not be reached...Error 3592. Need any special ports open or anything? - Original Message - From: Jay Calvert To: [EMAIL PROTECTED] Sent: Friday, July 09, 2004 10:49 AM Subject: Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database

Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread R. Scott Perry
I don't think I have ever had an username and password with Declude. Where do we find this information? All we ever had to provide as verification was our Hostname. If you purchased Declude before mid-April 2004, you won't have a username/password. In this case, you can go to

Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Russ Uhte \(Lists\)
At 10:49 AM 7/9/2004, Jay Calvert wrote: I don't think I have ever had an username and password with Declude. Where do we find this information? All we ever had to provide as verification was our Hostname. I never had one either, so I just clicked new user, and it asked me for an email

Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Matt
Russ Uhte (Lists) wrote: I found that kinda strange as well, but in blind faith, I did download and install it. So far it seems to be running very well. Very useful in conjunction with SA and Sniffer. All that I can tell about it is that it added a line to my global.cfg. I'm sure Scott or

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Tandem Group
Title: Message I agree. We build our config file from an external interface, and if we have anything added manually or from another source, it will be overwritten the first time we make changes through our interface. Erik Erik Hjelholt, Managing DirectorAlberni-dot-Net, a div. of Tandem

Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Matt
Scott, This is just in regard to the site and not the new test. Could you ask them to code the page in a way so that it doesn't reload every 10 seconds? I use Netscape 7 and it may be that it's just not friendly with that browser, but after a few minutes of sitting on the site, pressing my

RE: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Kevin Bilbee
OK why then the 07/09/2004 00:15:58 Q462a09e900349a60 Triggered CONTAINS filter SAVFILTER on X-Bulk: 99 [weight-0; X-Bulk: 99 here are the contents of the sav-smtp.txt that did not work, why? HEADERS END CONTAINS X-Bulk: 99 HEADERS END CONTAINS X-Bulk: 98 HEADERS END CONTAINS X-Bulk: 97

Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Scott Fisher
Allow ICMP packets fixed this for me. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 07/09/04 11:08AM Admin server can not be reached...Error 3592. Need any special ports open or anything? - Original Message - From: Jay Calvert To: [EMAIL PROTECTED]

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread R. Scott Perry
It seems to me that this was an attempt by the new owners to harvest information about Declude users via the signup mechanism. I believe the reason for requiring the signup information is to help ensure that customers with up-to-date Service Agreements get to use the test at no cost, while

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Keith Purtell
I tried that, and it claimed my email address did not exist on their system. I've only had one email address the entire time we've done business with Declude. Keith Purtell, Web/Network Administrator VantageMed Corporation CONFIDENTIALITY NOTICE: This email message, including any attachments,

Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database testfor Declude JunkMail

2004-07-09 Thread Scott Fisher
Another question too... If mailserver changes IP numbers, will I have to re-install to use the test? Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 07/09/04 11:12AM Russ Uhte (Lists) wrote: I found that kinda strange as well, but in blind faith, I did download and

Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread R. Scott Perry
Why a 5 MB download for an IP4R test? I was a bit surprised, too, when I saw that it was a 5.6MB file. :) Also, I think it would be a very good idea to have a process of opting-out customers from the data collection (or rather opt-in as that is the standard that we use for judging spam and

Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Franco Celli
I ran the test few minutes with 0 weight and alert action, so far near all messages were false positive. BTW: I don't fully understand the idea behind this test. --- Franco Celli --- [Quipo ISP - Questa E-mail e' stata controllata dal programma Declude Virus] [Quipo ISP - This

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread R. Scott Perry
I tried that, and it claimed my email address did not exist on their system. I've only had one email address the entire time we've done business with Declude. You need to log on as a new account. The website does not know about customers from before the new website was put online.

Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database testfor Declude JunkMail

2004-07-09 Thread R. Scott Perry
If mailserver changes IP numbers, will I have to re-install to use the test? Not currently, but that could change. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread John Tolmachoff \(Lists\)
Maybe all of this has been considered, but I didn't get much from the E-mail or from the site in this regard. I did not even get an e-mail about this. Maybe Scott does not like me, getting back at me for all the intern jokes. ;) John Tolmachoff Engineer/Consultant/Owner eServices For You

Re[2]: [Declude.JunkMail] IPBYPASS and WHITELIST IP

2004-07-09 Thread Sanford Whiteman
Actually, I can tell you that running IMail/JunkMail as the actual gateway is a pretty bad idea at the moment. You really need some other product to do the address validation for the recipients on the gateway and drop the bad stuff before scanning it. I could likely adapt

RE: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread R. Scott Perry
OK why then the 07/09/2004 00:15:58 Q462a09e900349a60 Triggered CONTAINS filter SAVFILTER on X-Bulk: 99 [weight-0; X-Bulk: 99 Because a line in the filter matched. But: here are the contents of the sav-smtp.txt that did not work, why? HEADERS END CONTAINS X-Bulk: 99 HEADERS END CONTAINS

Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Sanford Whiteman
Allow ICMP packets fixed this for me. That's a pretty big issue, IMO. Lots of SOHO routers don't allow you to pick-and-choose different ICMP traffic types, so if you're blocking any, you end up blocking all. Why does this thing need ICMP? I don't know of other LiveReg-type stuff requiring

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Andy Ognenoff
BTW: I don't fully understand the idea behind this test. I agree...can someone explain the rationale behind this test? How effective will this be at identifying spam? - Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the

Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread R. Scott Perry
Why does this thing need ICMP? I don't know of other LiveReg-type stuff requiring access on a port other than the port on which the registration server _actually_ runs on. Apparently, it pings the server to make sure that it is reachable, and if the ping doesn't come back, it is assumed

Re: Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Scott Fisher
Let me clarify to fix the 3592 during install, I had to stop blocking the ICMP protocol on my router. After the install, I was able to resume blocking the ICMP protocol. It looks like the install program attempts to ping home to see if the admin server is available. Not as ideal as I would like

RE: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Scott Fisher
-Scott Can you clarify the END for me? Would this fail the test if the e-mail came with a revdns of us.info? revdns 10 contains info revdns end contains info mailfrom 10 contains info Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 07/09/04 11:44AM OK why then

Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Matt
Scott, Thanks for the answers. I just wanted to add my comments to two very important things. Is there also an exclusion for ECAIR viruses and more importantly, is there an exclusion for things like macro viruses that will get sent from legitimate servers? We will certainly be looking at

RE: Re[2]: [Declude.JunkMail] IPBYPASS and WHITELIST IP

2004-07-09 Thread John Tolmachoff \(Lists\)
What, is Sandy reading my mind? You beat me to it. First, I needed to find out what DB the main server is using. Most domains are external with some using the registry. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED]

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread R. Scott Perry
BTW: I don't fully understand the idea behind this test. I agree...can someone explain the rationale behind this test? How effective will this be at identifying spam? The idea is that people are reporting 60% to 85% of spam coming from zombies -- IP addresses that have trojan horses installed

RE: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread R. Scott Perry
Can you clarify the END for me? It ends the processing of the filter. Would this fail the test if the e-mail came with a revdns of us.info? revdns 10 contains info revdns end contains info mailfrom 10 contains info In this case, the E-mail would fail the test (the first line fails the test; the

Re: Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Doug Anderson
We block all incoming and outgoing icmp traffic. A live reg should check at 80 or 443 because that typical allowable outbound traffic in my opinion. - Original Message - From: Sanford Whiteman [EMAIL PROTECTED] To: Scott Fisher [EMAIL PROTECTED] Sent: Friday, July 09, 2004 11:47 AM

Re: [Declude.JunkMail] IPBYPASS and WHITELIST IP

2004-07-09 Thread Matt
Sandy, If I could pump in any list of address (not just locally hosted), and also wildcard domains, and do it fully within IMail, I would definitely be interested. I've been chasing the ORF route, but despite it's leanness, it still has to handle the message with a separate process and that

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Andy Schmidt
Hi Scott: The IPs that we list are those that were sending viruses in the past; therefore, they will likely be sending spam in the future. I wonder, whether most corporate PCs (with identifiable, fix IP addresses) are more likely to be protected behind firewalls or mail servers with virus

RE: Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Andy Schmidt
Hi Scott: Considering that most administrators will block ANY TCP/IP traffic from/to a server and only open exactly those 2 or 3 ports that are needed for its primary function, you can assume that trying to ping will not be permitted - thus preventing install. Whoever wrote this doesn't seem to

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread R. Scott Perry
[Responding to two posts] So - if some dial-up/dynamic PC gets infected, that IP address will likely be assigned to someone else who happens to connect tomorrow? Is your test eliminating any dial-up/dynamic IPs, since by definition the infected/spam workstation will change IPs? But, by

RE: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Kevin Bilbee
I get it now. But, is there anyway to fail the test and end the test in one line instead of two. For example the way I under stand now it is if you want to short circut a test you would use END, but this would not fail the test to if you want the test to fail you would have to do something like

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Dan Horne
a good admin will allow ICMP traffic through, *unless* they believe it to be a specific security risk Sorry, disagree there. A *good* admin will recognize that ICMP *IS* a security risk. It allows remote computers to build a map of your network and find out what IP addresses are valid. While

Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Matt
Please take this as being constructive. I'm not out to prove a point with spam blocking, I'm out to just simply block spam and deliver good E-mail. When some idiot blasts legitimate mail from DUL space, the problem becomes mine to solve, and my customers expect for me to solve it, period.

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread John Tolmachoff \(Lists\)
Dan, while you make a good point, there is a balance to everything. A couple of years ago I attended a MS security seminar in Irvine. They brought up a very good point Security is like a triangle. The three points are cost, function and safety. The point inside the triangle where your security

Re: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Matt
Kevin, Think about using "MAXWEIGHT 10" in the beginning of the file. This will end the test immediately when a score of 10 is reached. This can be an effective incremental method of saving processing power. It can also be redefined so you can have groupings of filter lines at weight 10,

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Dan Horne
Ah, but you DO recognize that ICMP is a threat, and so you have set access-rules on it. That was my main point. And as Sandy pointed out, there are many firewalls out there that do NOT allow you to set access-rules other than allow ICMP globally or disallow ICMP globally. For an admin that must

Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread David Sullivan
M Why a 5 MB download for an IP4R test? Yea, I don't get this. Does this harvest virus IPs from our system and report them back to Declude? -- Best regards, Davidmailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus

RE: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Kevin Bilbee
OK that makes sence. I will try it. thanks Matt Kevin Bilbee -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of MattSent: Friday, July 09, 2004 11:33 AMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] Test Action FailureKevin,Think

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread John Tolmachoff \(Lists\)
That said, I do appreciate the effort here with this test, and as with anything it will evolve and become stronger and more accurate, but I just hope that you don't limit yourself from doing the right thing just because of a real-world condition that doesn't make sense to you. I am going to

RE: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Kevin Bilbee
A small problem I see with this is a new test that I do not want to add weight to. So I just did a MAXWEIGHT 1 and made each line a weight of 1. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Matt Sent: Friday, July 09, 2004 11:33 AM To:

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Russ Uhte \(Lists\)
At 01:38 PM 7/9/2004, Dan Horne wrote: Ah, but you DO recognize that ICMP is a threat, and so you have set access-rules on it. That was my main point. And as Sandy pointed out, Obviously ICMP _CAN_ be a security risk, but so is having your network connected to the Internet. I know a lot of

Re: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Matt
Kevin, You can accomodate for that by giving it a negative weight in your Global.cfg. The total weight is a combination of the two and the Global.cfg score won't be assessed without a positive hit on a filter line (END statements don't count). Matt Kevin Bilbee wrote: A small problem I see

Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread R. Scott Perry
M Why a 5 MB download for an IP4R test? Yea, I don't get this. Does this harvest virus IPs from our system and report them back to Declude? No. A beta version of Declude Virus released about 6 months ago added a new feature to automatically detect forging viruses. It does this by sending a DNS

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread R. Scott Perry
Scott, did you create this test, or is it otherwise your idea? I helped come up with the original idea. However, most of the design and development work was done by others, with occasional input from me. Scott, are you in control of features and changes to declude.exe, or are others now

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread John Tolmachoff \(Lists\)
Scott, are you in control of features and changes to declude.exe, or are others now influencing your decisions? The owners of the company make the final decisions. However, I can say that for the time being at least, no changes will be made to the declude.exe code without my knowledge

RE: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Kevin Bilbee
So you are saying in the global.cfg to give the test a -1 and set MAXWEIGHT 0 in the filter file??? Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Matt Sent: Friday, July 09, 2004 11:58 AM To: [EMAIL PROTECTED] Subject: Re:

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread R. Scott Perry
The owners of the company make the final decisions. However, I can say that for the time being at least, no changes will be made to the declude.exe code without my knowledge (there could potentially be changes I don't agree with, but at least I'll know if that does happen). But what about

RE: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Scott Fisher
I think you'd want to give the test a -1 in the global.cfg, with a MAXWEIGHT 1 within the filter. So you'd net a 0 then. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 07/09/04 02:21PM So you are saying in the global.cfg to give the test a -1 and set MAXWEIGHT 0 in the

Re: [Declude.JunkMail] Test Action Failure

2004-07-09 Thread Matt
In your Global.cfg give it a -1. In your filter file, set the MAXWEIGHT to 1 and score each line of the filter as 1 as well. One hit will end the filter with a score of 1 and then the -1 from the Global.cfg will be added to that for a total of 0. If you set MAXWEIGHT to 0, the filter will

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Databasetest for Declude JunkMail

2004-07-09 Thread Scott Fisher
So this would explain why there hasn't been a new alpha declude.exe for over a month. If my declude.exe doesn't get refreshed monthly, it starts to spoil! Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 07/09/04 02:19PM The owners of the company make the final

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Scott Fisher
I was taking the optimistic interpretation that a big new release was around the corner. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 07/09/04 02:31PM Sounds like new features are going to be slow going from this point??? Kevin Bilbee -Original Message-

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread R. Scott Perry
Sounds like new features are going to be slow going from this point??? Until the next release, most likely. But after that, it should be back to the usual rate. :) -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail

RE: Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Cris Porter
I recommend in the future to just tell us what line to add. A 5mb download seems overkill for this. Cris Porter JVC America -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Friday, July 09, 2004 2:02 PM To: [EMAIL PROTECTED] Subject:

[Declude.JunkMail] NOW OT: ICMP

2004-07-09 Thread Dan Horne
if you block ICMP, you break IP. That's the bottom line, and nobody can argue that. Sorry, but I can and will argue with that. ICMP relies on IP, not the other way around. IP works with or without ICMP. RFC792, which defines ICMP, states The purpose of these control messages is to provide

Re: [Declude.JunkMail] NOW OT: ICMP

2004-07-09 Thread Russ Uhte \(Lists\)
At 03:03 PM 7/9/2004, Dan Horne wrote: if you block ICMP, you break IP. That's the bottom line, and nobody can argue that. Sorry, but I can and will argue with that. ICMP relies on IP, not the other way around. IP works with or without ICMP. RFC792, which defines ICMP, states The purpose of

[Declude.JunkMail] SPF and MTLDB Issue?

2004-07-09 Thread Grant Griffith - Declude JM
Hello All, We implemented SPF a few weeks ago and I just went thru the logs of the past couple of weeks and noticed there is nothing in any logs showing this test. I also just implemented the new MTLDB test and the same issue, never see a WARN in the logs and I have them set to WARN if failed. I

RE: [Declude.JunkMail] NOW OT: ICMP

2004-07-09 Thread Dan Horne
Ah, but ICMP does still work on your machine. You can still ping internally. It's just that those machines outside your firewall can't REACH your machine with ICMP. There is nothing in the RFC that even implies that I must allow all ICMP packets to reach my network. Even if you're using a

Re: [Declude.JunkMail] NOW OT: ICMP

2004-07-09 Thread Doug Anderson
Actually Russ, ICMP still works. Can you ping 127.0.0.1, the local loop back? Can you ping other items on your local network? It comes down intranet vs internet separated by a firewall. Many corporations kill ICMP externally, but it works fine internally and is used as intended OR they allow

[Declude.JunkMail] MTLDB Uninstall

2004-07-09 Thread Junkmail Support
Hello all, The test seems to be stable on our system. However, I looked around and there are a couple of DLLs installed on C:\ProgramFiles\ComputerHorizons\MTLDB. One seems to indicate that it is cyphering or creating/using a secure token of some purpose. In scanning the regisrty, I also notice

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Andy Schmidt
Hi Scott: As a rule of thumb, when people ask me for assistance regarding troubles reaching a computer and I can't ping it, I tell them that it can't be pinged, and they have to take care of it from there. If you disable a vital networking tool, you need to accept the consequences. That's

Re: Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Jay Calvert
Scott, We know the Computer Horizons was sold, how much control do you have over Declude these days? One of the best things I liked about Declude was your constant collaboration on IMail and this group. How often do we see and IMail developer in the IMail forum. Do have any say as to what is

Re: [Declude.JunkMail] NOW OT: ICMP

2004-07-09 Thread Russ Uhte \(Lists\)
At 03:45 PM 7/9/2004, Doug Anderson wrote: Actually Russ, ICMP still works. Can you ping 127.0.0.1, the local loop back? Can you ping other items on your local network? It comes down intranet vs internet separated by a firewall. Many corporations kill ICMP externally, but it works fine internally

RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Russ Uhte \(Lists\)
At 03:59 PM 7/9/2004, Andy Schmidt wrote: Hi Scott: As a rule of thumb, when people ask me for assistance regarding troubles reaching a computer and I can't ping it, I tell them that it can't be pinged, and they have to take care of it from there. If you disable a vital networking tool, you need

Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Marc
I couldn't agree more with Matt. It's annoying as all heck. -M - Original Message - From: Matt To: [EMAIL PROTECTED] Sent: Friday, July 09, 2004 12:17 PM Subject: Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail Scott, This is just in regard

RE: [Declude.JunkMail] NOW OT: ICMP

2004-07-09 Thread Andy Schmidt
one case that comes to mind is PMTU. I've seen first hand instances where a corporation blocked all ICMP traffic, and then some of my users couldn't access that companies website. For whatever reason, the remote web server had a smaller than normal MTU size Yes - ICMP should be blocked

RE: [Declude.JunkMail] ICMP

2004-07-09 Thread Andy Schmidt
You've never had to request additional IP blocks from an upstream provider have you?? Do that occasionally - the last time in May. I fill out the form, and voila, half a day later Quest assigns another C-class for my T3s. (We are multi-vendor redundant, but I don't recall right now, if I

RE: [Declude.JunkMail] NOW OT: ICMP

2004-07-09 Thread Russ Uhte \(Lists\)
At 04:44 PM 7/9/2004, Andy Schmidt wrote: one case that comes to mind is PMTU. I've seen first hand instances where a corporation blocked all ICMP traffic, and then some of my users couldn't access that companies website. For whatever reason, the remote web server had a smaller than normal MTU

RE: [Declude.JunkMail] ICMP

2004-07-09 Thread Russ Uhte \(Lists\)
At 04:49 PM 7/9/2004, Andy Schmidt wrote: You've never had to request additional IP blocks from an upstream provider have you?? Do that occasionally - the last time in May. I fill out the form, and voila, half a day later Quest assigns another C-class for my T3s. Boy, that would be nice. ATT's

Re: Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Bill Landry
- Original Message - From: R. Scott Perry [EMAIL PROTECTED] I recommend in the future to just tell us what line to add. So do I. :) But management won this one. A 5mb download seems overkill for this. Agreed. I didn't even know until today that the install program was going to

RE: Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread John Tolmachoff \(Lists\)
It appears from posts over others there are some dlls involved. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Friday, July 09, 2004 3:33 PM To: [EMAIL

Re: Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Bill Landry
- Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] It appears from posts over others there are some dlls involved. Ah, okay, I will download then. Thanks! Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came

RE: Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Kevin Bilbee
Nope it is just a line in the conifig it is an ip4r test and the only thing it does it add a line to the global.cfg after of course getting your information and making you sign up for the website. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]

Re: Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Bill Landry
- Original Message - From: Kevin Bilbee [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, July 09, 2004 4:41 PM Subject: RE: Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail Nope it is just a line in the conifig it is an ip4r test and the

Re: Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread R. Scott Perry
We know the Computer Horizons was sold, how much control do you have over Declude these days? That depends on how you define control (no, I'm not a politician!). In this case, the level of control isn't clearly defined. The transition of management can be tricky, and needs to be handled

Re: [Declude.JunkMail] MTLDB Uninstall

2004-07-09 Thread R. Scott Perry
I also looked in the Control Panel Add/Remove Programs and there is no entry for the MTLDB program that was installed. I looked for an uninstall method and couldn't find anything. Did I miss something or is it my imagination that the MTLDB test code or registry entries must be manually removed?

RE: Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread John Tolmachoff \(Lists\)
Put another way, while the new owners do some things differently than I would have (as is always the case with a transition in management), I haven't seen them do anything that I would really disapprove of. If I did, though, I am sure that they would listen to me and give serious thought to

RE: [Declude.JunkMail] MTLDB Uninstall

2004-07-09 Thread Kevin Bilbee
I see the folder on my test system where I installed the MTLDB test. I then moved the global.cfg line to my production server and I am getting log entries so I beleive it is running. I have it at a weight of 0 for now. I did not run the install on my production system. Kevin Bilbee

RE: Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread R. Scott Perry
Well, I think this new test is maybe testing the waters, as so far, even though I like the idea, I do not like the implementation of this test, and have not yet done it on my server, nor on the other Imail/Declude servers I consult/maintain on. The reports so far from those that have implemented

RE: Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail

2004-07-09 Thread Todd Holt
I have a message more for management more than Scott (and I hope they are listening!): Don't fix what aint broken! Declude has a solid following because of the way that Scott has treated IMail users in the past with feature upgrades, release methods and great support. If the new management is

  1   2   >