Virus epidemic, 11,000 messages waiting!

[Stephen Swaney]

________________________________________
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf
Of Max Kipness
Sent: Tuesday, June 15, 2004 5:14 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: Virus epidemic, 11,000 messages waiting!

> Ok, I figured out that all the email is under /var/spool/mqueue.in. 
> I can't even grep * in there because of so many files.
 
Any suggestions?
 
Yes, Get mail flowing again first:

Shutdown Mailscanner
Move the directory 

        mv var/spool/mqueue.in var/spool/mqueue.in.hold

Create a new directory var/spool/mqueue.in with the same permissions /
ownership as var/spool/mqueue.in.hold

Restart MailScanner. Mail is now flowing again.

Work on the files in var/spool/mqueue.in.hold to remove the junk. Move any
leftover good files into the new /var/spool/mqueue.in to send them on their
way.

Steve
Stephen Swaney
President
Fortress Systems Ltd.
Steve.Swaney at FSL.com
________________________________________
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf
Of Max Kipness
Sent: Tuesday, June 15, 2004 4:09 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Virus epidemic, 11,000 messages waiting!
Hi,
 
I have a client that has been is being hit by 10000 plus emails with zafi in
them. He told me that he was not receiving email, so I looked at his log and
saw that 11,000 emails are ready to be processed.
 
It seems like all the emails are sent to one person, so I've gut that user
account off in /etc/access which is working fine.
 
I have to question though.
 
1) I thought that all messages waiting to be processed were in
/var/spool/MailScanner/incoming in the various subdirectories. I had a
script that counted the messages there on one of my servers. However on this
server, only 150 are in there. Where are the other 11,000? The last lines I
see in the log say: New Batch: Found 11.000 messagins waiting.
 
2) Does anyone have a script would find email from this certain person and
delete? Or is there anyway not to have MailScanner process at this point?
 
Thanks,
Max
-------------------------- MailScanner list ----------------------
To leave, send leave mailscanner to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/ and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html