Date: Tue, 04 Dec 2001 19:34:31 -0600 From: Len Conrad <LConrad@Go2France.com> To: freebsd-security@freebsd.org Subject: Re: Mail list is posting gone virus!!!! Message-ID: <5.1.0.14.2.20011204193019.05f01c18@mail.Go2France.com> In-Reply-To: <4.3.2.7.2.20011204172959.04d112e0@localhost> References: <01d701c17d10$a8b334b0$0001300a@lhtech.lhtek.com> <C1EC3AA970F8D311BA4D0050BAB07BA870491B@nhex1101.cologic.co.nz>
next in thread | previous in thread | raw e-mail | index | archive | help
>Also no excuse. Our heuristic checker caught the very first copy >(See http://www.brettglass.com/spam/paper.html) and would run >just fine on the FreeBSD mail servers. the freebsd hubs run postfix, afaik, which can block on single and double file extensions, like .scr, .doc.scr. Our FreeBSD AV box sees no BadTrans or Goner because the postfix front-ends reject them as attachments. For volumes, here's FreeBSD + Kaspersky for Tue through first 20 hours: Grand Totals ------------ messages 352086 received 386330 delivered 5 forwarded 1 deferred (1 deferrals) 16844 bounced 47 rejected 6288m bytes received 7786m bytes delivered 63730 senders 10594 sending hosts/domains 45609 recipients 6828 recipient hosts/domains giving: 1 Infected with I-Worm.Magistr.b.poly 1 Infected with Macro.Word97.Sattelite.b 1 Infected with from=bounce-members-68677@lists.naela.org 1 Infected with from=info@kalistaderm.com 1 Infected with from=bounce-members-67997@lists.naela.org 1 Infected with Macro.Word97.Ethan 1 Infected with I-Worm.Hybris.f 1 Infected with I-Worm.Hybris.c 3 Infected with I-Worm.Magistr.a.poly 3 Infected with I-Worm.KakWorm 3 Infected with from=emailtesting@gfi.com 6 Infected with I-Worm.Badtrans 7 Infected with Win32.FunLove.4070 8 Infected with I-Worm.MTX 34 Infected with I-Worm.Hybris.b 99 Infected with I-Worm.Magistr.a 101 Infected with I-Worm.Magistr.b 281 Infected with I-Worm.BadtransII 522 Infected with I-Worm.Sircam.c 582 Infected with I-Worm.Goner 1657 TOTAL Len http://MenAndMice.com/DNS-training http://BIND8NT.MEIway.com : ISC BIND 8.2.4 for NT4 & W2K http://IMGate.MEIway.com : Build free, hi-perf, anti-abuse mail gateways To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5.1.0.14.2.20011204193019.05f01c18>