<br><br><div class="gmail_quote">2009/2/4 Randal, Phil <span dir="ltr"><<a href="mailto:prandal@herefordshire.gov.uk">prandal@herefordshire.gov.uk</a>></span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Whilst everything comes from the same IP (client's MTA),
the Received headers should have the infected box's IP
address.</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2"></font></span> </div>
<div dir="ltr" align="left"><span><font color="#0000ff" face="Arial" size="2">Give that/those a high score in spamassassin, and tell the
client to clean their infected PCs</font></span></div>
<div><font color="#0000ff" face="Arial" size="2"></font> </div></div></blockquote><div><br>You mean mannually check headers? and then add a high score?<br> </div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div><div></div>
<div><span><font color="#0000ff" face="Arial" size="2">Cheers,</font></span></div>
<div><span><font color="#0000ff" face="Arial" size="2"></font></span> </div>
<div><span><font color="#0000ff" face="Arial" size="2">Phil</font></span></div>
<div><span></span><font face="Arial" size="2">--</font>
<br><font face="Arial" size="2">Phil Randal | Networks Engineer</font> <br><font face="Arial" size="2">Herefordshire Council | Deputy Chief Executive's Office |
I.C.T. Services Division</font> <br><font face="Arial" size="2">Thorn Office Centre,
Rotherwas, Hereford, HR2 6JT</font> <br><font face="Arial" size="2">Tel: 01432
260160</font> <br><font face="Arial" size="2">email:
<a href="mailto:prandal@herefordshire.gov.uk" target="_blank">prandal@herefordshire.gov.uk</a></font> </div>
<p><font face="Arial" size="2">Any opinion expressed in this e-mail or any attached
files are those of the individual and not necessarily those of Herefordshire
Council.</font></p>
<p><font face="Arial" size="2">This e-mail and any attached files are confidential
and intended solely for the use of the addressee. This communication may contain
material protected by law from being passed on. If you are not the intended
recipient and have received this e-mail in error, you are advised that any use,
dissemination, forwarding, printing or copying of this e-mail is strictly
prohibited. If you have received this e-mail in error please contact the sender
immediately and destroy all copies of it.</font></p>
<div> </div><br>
<div dir="ltr" align="left" lang="en-us">
<hr>
<font face="Tahoma" size="2"><b>From:</b> <a href="mailto:mailscanner-bounces@lists.mailscanner.info" target="_blank">mailscanner-bounces@lists.mailscanner.info</a>
[mailto:<a href="mailto:mailscanner-bounces@lists.mailscanner.info" target="_blank">mailscanner-bounces@lists.mailscanner.info</a>] <b>On Behalf Of </b>Eduardo
Casarero<br><b>Sent:</b> 04 February 2009 15:22<br><b>To:</b> MailScanner
discussion<br><b>Subject:</b> OT: Filtering OutBound SPAM<br></font><br></div>
<div></div>Hi, i've a rare scenario with one of my customers and i though that
someone from here could give me some fresh(?) ideas.<br><br>My client has it's
own MTA (wich i don't manage, neither have access to logs, etc) and it sends all
outbound traffic to my server that has (MScanner, SA, clamav, dcc, pyzor, razor,
some custom rules, etc).<br><br>The problem i've right now is that (i assume)
some malware stole valid user/passwords to authenticate in the smtp server of my
client, so tons of spam are trying to get out to internet through my
server.<br><br>Althogh all anti-spam stuff seems to work, i need some new
countermeasures to stop this at MailScanner stage (i cant do anything at MTA
level because everything comes from the same ip).<br><br>Any
idea?<br><br>something like my own checksum repository, or url blacklist, or
header authentication matching, etc.<br><br>Any help would be
appreciated.<br><br>Eduardo.<br></div>
<br>--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
<br></blockquote></div><br>