RE: WORM_MIMAIL.A Anyone have any info on what this does yet?

From: Christopher X. Candreva (chrisat_private)
Date: Fri Aug 01 2003 - 12:18:30 PDT

Next message: Scott M. Algatt: "Re: WORM_MIMAIL.A Anyone have any info on what this does yet?"

Previous message: Schmehl, Paul L: "RE: Command Line RPC vulnerability scanner?"
In reply to: Schmehl, Paul L: "RE: WORM_MIMAIL.A Anyone have any info on what this does yet?"
Next in thread: Michael.Washingtonat_private: "Re: WORM_MIMAIL.A Anyone have any info on what this does yet?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Fri, 1 Aug 2003, Schmehl, Paul L wrote:

> <http://securityresponse.symantec.com/avcenter/venc/data/w32.mimail.a@mm
> .html>
>
> We're blocking message.zip at the gateway.

It seems to use admin@(recipientdomain.com) as the envelope from address, so
if you don't use admin@ as a valid sending account, blocking mail from
admin@yourdomin  has put a stop to the bulk comming in.

It't wont stop everything, such as any forwarded from outside accounts, but
it will decrease the load on your virus scanner.

-Chris

==========================================================
Chris Candreva  -- chrisat_private -- (914) 967-7816
WestNet Internet Services of Westchester
http://www.westnet.com/

---------------------------------------------------------------------------
----------------------------------------------------------------------------

Next message: Scott M. Algatt: "Re: WORM_MIMAIL.A Anyone have any info on what this does yet?"
Previous message: Schmehl, Paul L: "RE: Command Line RPC vulnerability scanner?"
In reply to: Schmehl, Paul L: "RE: WORM_MIMAIL.A Anyone have any info on what this does yet?"
Next in thread: Michael.Washingtonat_private: "Re: WORM_MIMAIL.A Anyone have any info on what this does yet?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Aug 01 2003 - 13:28:24 PDT