Re: [Clamav-users] Using ClamAV with Dspam - how do I verif y it's working?

2008-08-11 Thread Jeff Weinberger
Dennis, Chuck: Thank you - this helps. I think I have it all working now. I appreciate your help. --Jeff ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml

Re: [Clamav-users] simplest replacement for ancient amavis-perl

2008-08-11 Thread Andrew McGlashan
Charles Gregory wrote: > Non-compliant 'helo's and all that, but at least please tell me there > isn't a 'big' company out there that is failing to handle 4xx codes > properly (holding breath) Try: hotmail.com bigpond.com optusnet.com.au yahoo.com [for groups particularly...] Greylisting

Re: [Clamav-users] simplest replacement for ancient amavis-perl

2008-08-11 Thread Christopher X. Candreva
On Mon, 11 Aug 2008, David F. Skoll wrote: > S:220 smtp.example.net Go ahead > C:MAIL FROM:<[EMAIL PROTECTED]> > S:220 Sender OK > C:RCPT TO:<[EMAIL PROTECTED]> > S:451 Greylisted... try again later > C:RCPT TO:<[EMAIL PROTECTED]> > S:451 Greylisted... try again later > C:DATA > S:500 Need recipie

[Clamav-users] Greylisting (was Re: simplest replacement for ancient amavis-perl)

2008-08-11 Thread David F. Skoll
Chambers, Phil wrote: > The greylisting scheme I have implemented works at the DATA phase. It > uses the sender IP address (top 24 bits only), the sender e-mail address > and header date field to form the key for the message. Once a message > has passed the greylist test the original sender IP a

Re: [Clamav-users] simplest replacement for ancient amavis-perl

2008-08-11 Thread Chambers, Phil
> -Original Message- > > There are some big names that play badly with greylisting. They play > badly with greet-pause, too. A problem I've seen with > greylisting is the > round-robin MTA pool. Each is told in turn to come back later > and if the > pool is large it can take a long tim

Re: [Clamav-users] simplest replacement for ancient amavis-perl

2008-08-11 Thread Dennis Peterson
Charles Gregory wrote: > On Mon, 11 Aug 2008, rick pim wrote: >> > > prime advantages of greylisting -- the fact that it will never >> > > block 'real' mail -- turns out, um, not to be true. there are so many >> > > standards-noncompliant MTAs out there >> .. some of the offenders are hi

Re: [Clamav-users] simplest replacement for ancient amavis-perl

2008-08-11 Thread David F. Skoll
Charles Gregory wrote: > Could I just clarify this discussion? It started out with a specific > comment about greylisting, which I am preparing to implement. So naturally > it concerns me as to whether these remarks about 'big name' non-compliant > MTA's still apply specifically to greylisting. I

Re: [Clamav-users] simplest replacement for ancient amavis-perl

2008-08-11 Thread rick pim
Charles Gregory writes: > but at > least please tell me there isn't a 'big' company out there that is failing > to handle 4xx codes properly (holding breath) does IBM count? their canadian arm was a problem for a while and i had to whitelist their outgoing MTA. this has since been fixed, b

Re: [Clamav-users] simplest replacement for ancient amavis-perl

2008-08-11 Thread Charles Gregory
On Mon, 11 Aug 2008, rick pim wrote: > > > prime advantages of greylisting -- the fact that it will never > > > block 'real' mail -- turns out, um, not to be true. there are so many > > > standards-noncompliant MTAs out there > .. some of the offenders are high profile, fortune-500 compa

Re: [Clamav-users] simplest replacement for ancient amavis-perl

2008-08-11 Thread rick pim
Ian Eiloart writes: > --On 8 August 2008 13:06:00 -0400 rick pim <[EMAIL PROTECTED]> wrote: > > in practice, one of the > > prime advantages of greylisting -- the fact that it will never > > block 'real' mail -- turns out, um, not to be true. there are so many > > standards-noncompliant MTAs

Re: [Clamav-users] Havp + Clamav + Email.Trojan-8

2008-08-11 Thread Henrik K
On Mon, Aug 11, 2008 at 04:04:00PM +0400, Roman V. Isaev wrote: > > > I gave you example HAVP config to stop it more easily: > > > > > IGNOREVIRUS Email. > > < > > Yes, thanks, but I saw your letter after I alredy implemented my own > "solution" :) I just don't want to fiddle with

Re: [Clamav-users] Havp + Clamav + Email.Trojan-8

2008-08-11 Thread Roman V. Isaev
> I gave you example HAVP config to stop it more easily: > > > IGNOREVIRUS Email. > < Yes, thanks, but I saw your letter after I alredy implemented my own "solution" :) I just don't want to fiddle with clamd any more until 18:00 (end of the workday). IGNOREVIRUS is a good soluti

Re: [Clamav-users] simplest replacement for ancient amavis-perl

2008-08-11 Thread G.W. Haywood
Hi there, On Mon, 11 Aug 2008 Ian Eiloart wrote: > RFC2821 defines the behaviour of an MTA, and anything that breaks > the standard can't expect to deliver email. That's our policy here. Hehe, I bet you'd change that policy pretty sharpish if the people sending the emails wanted to give you mone

Re: [Clamav-users] simplest replacement for ancient amavis-perl

2008-08-11 Thread Ian Eiloart
--On 8 August 2008 14:16:49 -0400 "David F. Skoll" <[EMAIL PROTECTED]> wrote: > Tilman Schmidt wrote: > >>> telnet isps-smtp-server 25 > >> In my experience that's very unusual behaviour for a virus. >> The vast majority try to connect directly to the recipient's MX. > > I see both. Regardless

Re: [Clamav-users] simplest replacement for ancient amavis-perl

2008-08-11 Thread Ian Eiloart
--On 8 August 2008 13:06:00 -0400 rick pim <[EMAIL PROTECTED]> wrote: > Gerard writes: > > Employing 'greylisting' would vastly improve the chances of eliminating > > the acceptance of SPAM at the MTA level. > > it certainly does. unfortunately, in practice, one of the > prime advantages of gr

Re: [Clamav-users] Havp + Clamav + Email.Trojan-8

2008-08-11 Thread Андрей Волков
Henrik K пишет: > On Mon, Aug 11, 2008 at 12:45:51PM +0400, Roman V. Isaev wrote: > > Your virus database was updated at 9 august 2008, and a lot of sites are > recognised as virus threat. For example: ixbt.com, thg.ru, > overclockers.ru. > Virus is: > Submission-ID: 4157162

Re: [Clamav-users] Havp + Clamav + Email.Trojan-8

2008-08-11 Thread Henrik K
On Mon, Aug 11, 2008 at 12:45:51PM +0400, Roman V. Isaev wrote: > > > > Your virus database was updated at 9 august 2008, and a lot of sites are > > > > recognised as virus threat. For example: ixbt.com, thg.ru, > > > > overclockers.ru. > > > > Virus is: > > > > Submission-ID: 4157162 > > > > Send

Re: [Clamav-users] Havp + Clamav + Email.Trojan-8

2008-08-11 Thread Roman V. Isaev
> > > Your virus database was updated at 9 august 2008, and a lot of sites are > > > recognised as virus threat. For example: ixbt.com, thg.ru, > > > overclockers.ru. > > > Virus is: > > > Submission-ID: 4157162 > > > Sender: Ricardo > > > Added: Email.Trojan-8 > > > I think that this is mistake.

Re: [Clamav-users] Havp + Clamav + Email.Trojan-8

2008-08-11 Thread Henrik K
On Mon, Aug 11, 2008 at 11:27:57AM +0400, Roman V. Isaev wrote: > > Your virus database was updated at 9 august 2008, and a lot of sites are > > recognised as virus threat. For example: ixbt.com, thg.ru, overclockers.ru. > > Virus is: > > Submission-ID: 4157162 > > Sender: Ricardo > > Added: Email.

Re: [Clamav-users] Havp + Clamav + Email.Trojan-8

2008-08-11 Thread Roman V. Isaev
> Your virus database was updated at 9 august 2008, and a lot of sites are > recognised as virus threat. For example: ixbt.com, thg.ru, overclockers.ru. > Virus is: > Submission-ID: 4157162 > Sender: Ricardo > Added: Email.Trojan-8 > I think that this is mistake. Yes!!! rambler.ru and utr