Moin folks. On Tue, 2 Mar 2004, Tom Knight wrote:

...

Can't you block the IP's that send the virii?

What, like 195.135.221.131?

Realistically, unless you know all PCs that may have been infected.... no.

Realistically you can block, reject, drop or whatever every mail that contains a (known) virus. Tho' there's a need for a virusscanner on the mailserver which I guess is missing here. Arjen, why should they block them? You are afraid cause you use Outlook? ;^) Cheers, Michael -- It's a book about a Spanish guy called Manual, you should read it. -- Dilbert

Why not just stop using M$ Outbreak and Exchange? Outbreak is the only client that is propagating these virii ... On Tue, 2004-03-02 at 11:50, Bob Vickers wrote:

Arjen,

Sadly I don't think that would achieve anything. Typically infected computers only send out their payload once, so the security team would be wasting their valuable time shutting a stable door when the horse was well and truly bolted. And then they would have to spend more time dealing with the inevitable request to reopen it (even if they refuse the request it still takes time).

Bob

On Tue, 2 Mar 2004, Arjen Runsink wrote:

...

Hi.

Can't you block the IP's that send the virii?

BB, Arjen

-- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here

============================================================== Bob Vickers R.Vickers@cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691 -- -- Raymond Leach Network Support Specialist http://www.knowledgefactory.co.za "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import" Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28 --

On Tue, 2004-03-02 at 13:41, Arjen Runsink wrote:

Hi,

Quoting Ray Leach :

...

Why not just stop using M$ Outbreak and Exchange? Outbreak is the only client that is propagating these virii ...

the mailing list software filters out the headers of a sending server so you can't see my mailserver software. But you can see my MUA.

User-Agent: Internet Messaging Program (IMP) 4.0-cvs

And btw, Exchange is not (yet) a virus/worm feast like outlook. never seen one written for it.

How about this one: http://securityresponse.symantec.com/avcenter/venc/data/trojan.aprilfool.htm...

BB, Arjen -- -- Raymond Leach Network Support Specialist http://www.knowledgefactory.co.za "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import" Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28 --

On Tue, 2004-03-02 at 13:45, Tom Knight wrote:

...

-----Original Message----- From: Ray Leach [mailto:raymondl@knowledgefactory.co.za] Sent: 02 March 2004 11:19 To: SuSE Security Subject: Re: [suse-security] FSCKING VIRII

Why not just stop using M$ Outbreak and Exchange? Outbreak is the only client that is propagating these virii ...

This was a generalisation ....

Point 1: Arjan isn't using Outlook, check the headers ;-) Point 2: Outlook isn't the only MUA that propagates these worms. Bagle (for example) uses its own smtp engine and relies on a (stupid) user opening an attachment. The only reliance is use of Windows and lack of virus awareness. Yes, let's start a virus training school ....

Point 3: In the "real world" people have to battle an awful lot to dump Outlook and Exchange (think corporate investment), and until that's done they may still have to support these programs.

So, if they start planning their migration to the 'new and better' MTA and MUA to coincide with the extinction of there precious 'corporate investment', then they have nothing to lose (except maybe a whole lot of virii). Does it actually make (business) sense to keep a product that is falling behind all the time and to continually 'have' to spend more money on supporting products and resources to 'protect the corporate investment'? That's like flushing your money down the toilet in hopes that one day it will all come back out at you ...

On the other hand... Something is stripping the viral attachment from these messages, why can't it just dump the entire message?

Agreed, but then we would have to agree on what attachments (if any) to allow to the list, or was it which ones to dump ...?

HTH,

Tom. -- -- Raymond Leach Network Support Specialist http://www.knowledgefactory.co.za "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import" Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28 --

Too much time already wasted on the subject ;)