Virii detection very low

[Jeff A. Earickson]

On Tue, 25 Oct 2005, Drew Marshall wrote:

>>> 
>>> Lull before the storm? It's been quiet on the list for ages now. I can't 
>>> believe the virus writers have given up.
>>> 
>>> Drew
>>> 
>> 
>> Drew,
>>   Not true.  We have been getting our butts kicked in the last week
>> by Windoze boxes infected with Mytob variants that quickly morph into
>> spambots.  Some spambots go directly out to the Internet, and some route 
>> email via our mail server.  Our legit mail server ended up in Spamcop this 
>> morning.  Ouch.  The IPBlock feature of MailScanner has been some help here 
>> but it isn't pretty.  The virus writers have an unholy alliance with the 
>> spammers now.
>> 
>> Jeff Earickson
>> Colby College
>
> Jeff
>
> Ouch, not nice. Looks like I am one of the lucky few. i don't have huge 
> numbers of messages but I would expect 1-2% used to be viruses and currently 
> I haven't seen a virus for a good couple of days. Doesn't stop the Spam 
> (Which is still being eaten my MS/ SA) which is at it's normal levels.
>
> Do/ (Did!) you have a rule set not spam scanning internal clients? I guess if 
> you have a load of spambot infected boxes from Mr Gates you have to scan for 
> spam in both directions but the internal stuff must be a nightmare :-(

I always have.  The only thing that is trusted is 127.0.0.1 on the mail 
server itself.  The IPBlock feature of MS has been a help.

Jeff

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!