Re: [Declude.JunkMail] opening a ticket with Declude support

[Matt]

Gary, Sorry, this was my own incomplete read on your message headers.  SmarterMail doesn't insert a Received header when you use Webmail, but I should have caught that. I'm with David about the potential cause of the issue.  Looks like something is stealing the message, and that something is likely SmarterMail.  It's too bad that SmarterMail can't work like IMail does with the queue/spool.  Maybe in 3.0 it will, but I would think that people from Declude would need to show them the light if they haven't already figured that one out. Matt Gary Steiner wrote: What made you think I was on IMail? I'm using SmarterMail 2.6. The Declude version I'm running is 2.0.6 (I purchased the product in July 2005). AUTOWHITELIST is definitely not ON. Here's a little snippet from the log file: 09/26/2005 01:25:17 39819112 Msg failed WEIGHT30 (Weight of 31 reaches or exceeds the limit of 30.). Action="" 09/26/2005 01:25:17.022 39819112 [2408] actionsdata[ i ] = [26 Sep 2005] 09/26/2005 01:25:17.022 39819112 [2408] ACTION_HOLD - holddir [C:\SMARTERMAIL\SPOOL\spam] 09/26/2005 01:25:17.022 39819112 [2408] ACTION_HOLD - datafile [C:\SMARTERMAIL\SPOOL\proc\39819112.EML] 09/26/2005 01:25:17.022 39819112 [2408] ACTION_HOLD - recipfile [C:\SMARTERMAIL\SPOOL\proc\39819112.HDR] 09/26/2005 01:25:17.022 39819112 [2408] ACTION_HOLD - datahold [C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.EML] 09/26/2005 01:25:17.022 39819112 [2408] ACTION_HOLD - reciphold [C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.HDR] 09/26/2005 01:25:17 39819112 Subject: [EMAIL PROTECTED] ---> $1.56 per dose pmonkz qdvfg ouo 09/26/2005 01:25:17 39819112 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 219.13.84.45 ID: A3FF561BF4 09/26/2005 01:25:17 39819112 Tests failed [weight=31]: CATCHALLMAILS=IGNORE NOLEGITCONTENT=WARN IPNOTINMX=WARN CBL=WARN MXRATE-BLOCK=WARN SORBS-DUHL=WARN SPAMBAG=WARN FIVETENSRC=WARN ROUTING=WARN WEIGHT6=WARN WEIGHT10=HOLD WEIGHT14=HOLD WEIGHT20=HOLD WEIGHT30=HOLD 09/26/2005 01:25:17 39819112 Action(s) taken for [[EMAIL PROTECTED]] = IGNORE WARN HOLD [LAST ACTION="" 09/26/2005 01:25:17.022 39819112 [2408] Done Looping 09/26/2005 01:25:17.022 39819112 [2408] RecipFile( C:\SMARTERMAIL\SPOOL\proc\39819112.HDR ); 09/26/2005 01:25:17.022 39819112 [2408] QUEUEFILE_SAVEFILE = newhdrfile = [C:\SMARTERMAIL\SPOOL\proc\39819112.HDR] 09/26/2005 01:25:17.022 39819112 [2408] QUEUEFILE_SAVEFILE = newemlfile = [C:\SMARTERMAIL\SPOOL\proc\39819112.EML] 09/26/2005 01:25:17 39819112 Cumulative action(s) taken on this email = IGNORE WARN HOLD [LAST ACTION="" 09/26/2005 01:25:17.022 39819112 [2408] AlterMessage 09/26/2005 01:25:17.022 39819112 [2408] Subject = [] 09/26/2005 01:25:17.022 39819112 [2408] Warning = [X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: CBL: "Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=219.13.84.45" X-RBL-Warning: MXRATE-BLOCK: "http://www.mxrate.com/lookup/refused.asp?ipaddress=219.13.84.45" X-RBL-Warning: SORBS-DUHL: "Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml?219.13.84.45" X-RBL-Warning: SPAMBAG: 45.84.13.219.blacklist.spambag.org. X-RBL-Warning: FIVETENSRC: 45.84.13.219.blackholes.five-ten-sg.com. X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam [2000010f]. X-RBL-Warning: WEIGHT6: Weight of 31 reaches or exceeds the limit of 6. X-Declude-Sender: [EMAIL PROTECTED] [219.13.84.45] X-Declude-Spoolname: 39819112.EML X-Declude-Note: Scanned by Declude 2.0.6 (http://www.declude.com/x-note.htm) for spam. X-Declude-Scan: Score [31] at 01:25:17 on 26 Sep 2005 X-Declude-Tests: NOLEGITCONTENT, IPNOTINMX, CBL, MXRATE-BLOCK, SORBS-DUHL, SPAMBAG, F 09/26/2005 01:25:17.022 39819112 [2408] Header = [] 09/26/2005 01:25:17.022 39819112 [2408] Footer = [--- [This E-mail scanned for viruses by Declude Virus] ] 09/26/2005 01:25:17.022 39819112 [2408] MoveFile in AlterMessage - datafile = [C:\SMARTERMAIL\SPOOL\proc\39819112.EML] TempFile = [C:\SMARTERMAIL\SPOOL\proc\39819112.EM$] 09/26/2005 01:25:17.022 39819112 [2408] CreateHoldFolder parameter [C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.EML] 09/26/2005 01:25:17.022 39819112 [2408] Hold directory is [C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005] 09/26/2005 01:25:17.022 39819112 [2408] Moving file to spam hold directory [C:\SMARTERMAIL\SPOOL\proc\39819112.EML][C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.EML] 09/26/2005 01:25:17 39819112 ERROR: Could not move spam to hold! Code: [2] Error String: [The system cannot find the file specified.] [C:\SMARTERMAIL\SPOOL\proc\39819112.EML] [C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.EML] 09/26/2005 01:25:17.022 39819112 [2408] Moving file to spam hold directory [C:\SMARTERMAIL\SPOOL\proc\39819112.HDR][C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.HDR] 09/26/2005 01:25:17 39819112 ERROR: Could not move spam to hold! Code: [2] Error String: [The system cannot find the file specified.] [C:\SMARTERMAIL\SPOOL\proc\39819112.EML] [C:\SMARTERMAIL\SPOOL\spam\26 Sep 2005\39819112.EML] -------- Original Message -------- From: Matt <[EMAIL PROTECTED]> Sent: Tuesday, September 27, 2005 4:10 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] opening a ticket with Declude support Gary, If you want help resolving this from the list members, it would be best to post your Declude version and product levels, one such log snippet for a message, and also your global.cfg and the associated $default$.junkmail. I did note that you are using IMail 8.05, and I am on IMail 8.15 and have no such issues, though I am not using the HOLD action, but instead the COPYFILE action. There is a possibility that you have AUTOWHITELIST ON in your global.cfg, and you have users than have themselves or others on their own domain in their Webmail address books, and the effect of that would be to whitelist the message if it came from a spammer that forged the sender to match one of these entries. This is a common thing for people with AUTOWHITELIST ON to experience, though your description doesn't match exactly the circumstances here. Chances are that your issues can be solved with changing your configuration and it might well not be a bug. Matt Gary Steiner wrote: I've been receiving a flurry of spam over the past two days where the spam gets delivered with no Declude header in the message. When viewing the log files, it seems that Declude scanned the message, found it to have a heavy spam weight, tried to move it to the hold directory, and failed with an error. I've reported this problem several times to Declude since I first installed the product back in July. Its resolution has not been pressing, since the number of spams getting through has been relatively few. However, for some reason over the past two days (coincidentally since 3.x came out) the number of these spams has increased dramatically, enough so that I've received complaints from my customers. The thing that the spams seem to have in common is that they are sent to multiple addreses within the domain. The implication is that when the message arrives, it creates a single file in the spool folder, but since it is sent to multiple addresses Declude scans it more than once. But since the file was already moved to hold from a previous scan, Declude experiences the file error and delivers the message anyway. -------- Original Message -------- From: "David Barker" <[EMAIL PROTECTED]> Sent: Tuesday, September 27, 2005 2:12 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] opening a ticket with Declude support Hi Gary, Currently the we have the ticket response system temporarily disabled. As far as I am aware we have received all your messages. The way to open a ticket is to send an email to support @ declude.com you can also submit a ticket using http://support.declude.com/Customer/SubmitTicket.aspx Under general circumstances, support emails are answered within 24 hours on business days. Which are Mon - Fri. If you feel that support is taking too long to respond please feel free to email me directly dbarker @ declude.com As for your support tickets, 1. SmarterMail picking up on RBL's that Declude is not is currently under review and as soon as we have an answer to this I will let you know 2. The header in the body is badly formed emails due to broken mail clients. This is not a bug in declude but we are currently looking into a way to bette handle these exceptions. 3. AVAFTERJM ON This is the way to have Declude EVA (Virus) run after Declude JunkMail,tthis directive is located in your virus.cfg file. What specific issues are you refering to with 2.x ? I will follow up on this and respond. David B www.declude.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Gary Steiner Sent: Tuesday, September 27, 2005 12:01 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] opening a ticket with Declude support It used to be that when I sent an email to [EMAIL PROTECTED] I would get an automatic reply like the following: Thank you for submitting a ticket to support. Your ticket number is [xxx-xxxxxxxx-xxxx]. Please keep this ticket number for your records and include it in the subject (including brackets) of all future emails regarding this issue. Thank You. Declude Technical Support That doesn't happen anymore. If I do get a reply from [EMAIL PROTECTED], it is usually from a specific support person like David Barker. Other messages I have sent to [EMAIL PROTECTED] received no response, and for all I know ended up in the bit bucket. How does one open a ticket with Declude support? Is the email method no longer viable? Should I be using the web site at http://support.declude.com/Customer/SubmitTicket.aspx ? I would love to download the 3.x upgrade, but I don't want to take on 3.x until I see resolution of the issues with 2.x. Or at least a statement from Declude saying that all the problems I've been having with 2.x are fixed in 3.x. --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.