That's what I always say.[1] Having said that, we did have an instance of http:[EMAIL PROTECTED] which, rather than sending itself to the address indicated by our MX records (which all point at Messagelabs), came straight to our gateway (which has no public DNS records pointing to it). It was caught by our internal AV software, but it had us worried for a while. We have since tightened up the gateway[2] so that *only* Messagelabs can connect on port 25, so that particular problem shouldn't recur.
Interesting behaviour from the virus, though. My guess is that it looks into message headers on the infected machine for originating IP addresses to send itself to rather than using DNS, but if anyone has any other explanations, I'd be interested in hearing them... [1] http://www.messagelabs.com [2] Please insert standard remarks concerning stable doors, horses, etc.[3] [3] And throw in a "mutter" or two for good measure Les Bessant MCSE mailto:[EMAIL PROTECTED] IT Manager, Sanderson Townend & Gilbert Acting in a personal capacity http://www.tiggercam.co.uk - New, improved and with more bounce! -----Original Message----- From: Kevin Miller [mailto:[EMAIL PROTECTED]] Sent: 08 July 2002 16:06 To: Exchange Discussions Subject: RE: New Virus? I love not caring what comes out. Just knowing that I am covered. --Kevinm KMAP-SR, M, WLKMMAS, UCC+WCA, And Beyond http://www.daughtry.ca/ For Graphics and WebDesign, GO here! - The information in this communication and any attachments is confidential and may be legally privileged. It is intended solely for the addressee. If you are not the intended recipient any use, review, dissemination, distribution or copying of this information is strictly prohibited. If you have received this communication in error please notify us immediately on 0191 261 2681 and delete the original message and any copies of it. Any opinions, conclusions or other information in this message that do not relate to the official business of Sanderson Townend & Gilbert are neither given nor endorsed by the firm. ________________________________________________________________________ This e-mail has been scanned for all viruses by Star Internet. The service is powered by MessageLabs. For more information on a proactive anti-virus service working around the clock, around the globe, visit: http://www.star.net.uk ________________________________________________________________________ _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
