OT: Regex question

[Craig Daters]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Jun 27, 2005, at 4:45 PM, Scott Silva wrote:

> Kai Schaetzl spake the following on 6/27/2005 4:31 PM:
>> Craig Daters wrote on         Mon, 27 Jun 2005 14:45:00 -0700:
>>
>>
>>> Our users have been getting inundated with email purporting to be 
>>> from
>>> my companies "support" team (which is me, btw) informing them that
>>> their email accounts are about to be suspended, or that their account
>>> details have been updated, to "please verify the details contained in
>>> the attached file."
>>
>>
>> Why don't you simply block east. and west.verizon.net on MTA level? 
>> Why
>> waste sa or MS time on them? It's all dynamic IP blocks, as far as I 
>> can
>> see from our logs there's no legitimate mail coming from those.
>>
>> Kai
>>
> Sounds like the Mytob virus.
> I hope you are running a FEW virus scanners on your MailScanner 
> machines.
>

Oh yeah! Wouldn't have it any other way :). I've got ClamAV and F-Prot 
on the mail server, then each workstation has a copy of Norton 
AntiVirus Corp Ed., but so far, nothing has made it past MailScanner.

I'm just getting tired of all the calls from our employees who do not 
bother to read the warning that MailScanner sends in place of the 
infected message. I have even sent a global message to everyone to 
explain what is happening and what to expect. I continue to get calls, 
"What should I do about this message?"
>
- ---
Craig Daters (craig at westpress.com)
Systems Administrator

West Press
1663 West Grant Road
Tucson, Arizona 85745

(520) 624-4939 x208
(520) 624-2715 fax
www.westpress.com

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBQsFQJxBVT8XLuTbnEQJkBwCg9zxKimY1UOiQZTFyxwox6cTAD44AoNwT
sex4DI13bEMCbQDuXN7AS1NU
=iMBX
-----END PGP SIGNATURE-----


--
Please note: It is the policy of West Press that all e-mail
sent to and from any @westpress.com address may be recorded
and monitored. Unless it is West Press related business,
please do not send any material of a private, personal,
or confidential nature to this or any @westpress.com
e-mail address.

This message has been scanned for UCE (spam), viruses,
and dangerous content, and is believed to be clean 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!