> That means there are still way to many e-mail servers out > there not using Declude Virus.
>From what I can see this virus is sending out messages containing a long list of recipients in the TO field. This turns out that there are not only some dumb mail-virus-filters out but also there are still some unpatched MS Exchange POP3 connectors out that are delivering the message not only to the local domain but also to all other recipients in the list. Having one such Pop3-Connector in the recipient list does mean the message comes twice to each recipient. Having two Pop3-Connectors does create a big problem because popconn2 redelivers messages from popconn1 and viceversa. All involved MTA's have to process as many messages as their bandwith allow, messages queues are full and all recipients recieve the messages in hundreds or thousands until A.) I block the sender address durring smtp envelope B.) The admins of the lazy maintained exchange server note that something goes slow this days and after hours and days of "I have no idea" they discover whats going on. Due to Sober.o we've had four of this issues in the last 48 hours one with 3 involved PopConns. > GRRRRRRRRRRRRr ..rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr! We should set up a filter that will send back to each sender who's mail header contains sources of unpatched exchange MTAs a warning message... Markus --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
