Article View: sci.electronics.design
Article #2576Re: Worm and Virus attack
From: Active8
Date: Sat, 20 Sep 2003 13:22
Date: Sat, 20 Sep 2003 13:22
66 lines
4007 bytes
4007 bytes
In article <bkhf2202hoc@drn.newsguy.com>, whill@picovolt.com says... > Active8 wrote... > > > > wow. i'm only at 83. that's around 30 more since the last time i posted, > > which was the post you replied to. if you really mean that you deleted > > them rather than bounced them, ouch. you may or may not have confirmed > > a valid e-mail addy. > > I've now received over 3000 of these, each of which has a 106k > bytes-long worm. That's 320MB of downloads from my mail server > in Pittsburgh in the last 24 hours. My Comcast cable modem has > a slow upload speed of about 150k bits/sec, so if I were to have > bounced these messages, that would have taken about 5 hours of > full upload traffic. It's hard to see how folks with ordinary > POTS modems could survive such an attack. good point, but i wasn't aware that bouncing did that. figure that with mailwasher, you're viewing the message on the server which requires a download, but it's still on the server. a bounce message should be just that, a bounce message, no? i just bounced 15 as a test. that would be 1.59MB or 12.72Mb at 14.4kbps dial-up upload speed or 883 sec. it took 30 sec. :-) from the help: Clicking the Bounce box on a message or selecting E-mail/Mark for Bouncing from the menu sends a faked �address not found� message to the address that the message originated from. This reduces the possibility of more spam e-mail coming from this address. Checking the Bounce box will automatically check the Delete checkbox. Some messages may meet the virus or spam-like material selection criteria that is configured into MailWasher and these will automatically be set to Bounce and Delete. However you may unset these checkboxes if you wish to receive the mail. end of topic so the mail is viewed but not downloaded and the only thing sent is a bounce message. > > They're coming in at the rate of about four a minute right now. > I spent some time trying to set filters, but the quasi-random > nature of the Swen email headings makes that impractical with > my The Bat! email client. I'm ready to change programs again. i know of no filter rule ( i'm using pegasus mail, but checked out the bat. i think bat would be a good client and pegasus a good list server) that would handle this random crap. i'm up to 90 now. about 4 per hour. BTW, mailwasher can blacklist mail from certain users, so any repeat from the same random sender will be blaclisted. it has filters. the 2 filters that come with it (unchecked by default) are for mail sent to "undisclosed recipient" and mail not specifically to you (me). mike > > Thanks, > - Win > >
Technical Details
Message-ID:
<MPG.19d61eb5500badb298987a@news.east.earthlink.net>Path:
arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!logbridge.uoregon.edu!newshub.sdsu.edu!elnk-nf2-pas!newsfeed.earthlink.net!stamper.news.pas.earthlink.net!stamper.news.atl.earthlink.net!newsread2.news.atl.earthlink.net.POSTED!not-for-mailReferences:
<3f4939c.0309190951.5ee61d08@posting.google.com> <MPG.19d5451b792bd6a698986c@news.east.earthlink.net> <3F6BB55E.7E2D4EFD@earthlink.net> <MPG.19d603bed5e27573989875@news.east.earthlink.net> <bkhf2202hoc@drn.newsguy.com>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII X-Google-Thread: 112d1e,4a531e8bd9cad7b2 X-Google-Attributes: gid112d1e,public X-Google-Thread: 113866,4a531e8bd9cad7b2 X-Google-Attributes: gid113866,public X-Google-ArrivalTime: 2003-09-20 06:22:48 PST Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!logbridge.uoregon.edu!newshub.sdsu.edu!elnk-nf2-pas!newsfeed.earthlink.net!stamper.news.pas.earthlink.net!stamper.news.atl.earthlink.net!newsread2.news.atl.earthlink.net.POSTED!not-for-mail From: Active8 <mREMOVEcolasono@earthlink.net.invalid> Newsgroups: sci.electronics.design,austin.internet Subject: Re: Worm and Virus attack Message-ID: <MPG.19d61eb5500badb298987a@news.east.earthlink.net> References: <3f4939c.0309190951.5ee61d08@posting.google.com> <MPG.19d5451b792bd6a698986c@news.east.earthlink.net> <3F6BB55E.7E2D4EFD@earthlink.net> <MPG.19d603bed5e27573989875@news.east.earthlink.net> <bkhf2202hoc@drn.newsguy.com> Organization: S X-Newsreader: MicroPlanet Gravity v2.60 Lines: 66 Date: Sat, 20 Sep 2003 13:22:48 GMT NNTP-Posting-Host: 209.173.120.170 X-Complaints-To: abuse@earthlink.net X-Trace: newsread2.news.atl.earthlink.net 1064064168 209.173.120.170 (Sat, 20 Sep 2003 09:22:48 EDT) NNTP-Posting-Date: Sat, 20 Sep 2003 09:22:48 EDT