Looks like this:
From: Hahaha <[EMAIL PROTECTED]>
Subject: Snowhite and the Seven Dwarfs - The REAL story!
Date: Sun, 07 Jan 2001 13:05:30 +0000
Today, Snowhite was turning 18. The 7 Dwarfs always where very educated and
polite with Snowhite. When they go out work at mornign, they promissed a
*huge* surprise. Snowhite was anxious. Suddlently, the door open, and the
Seven
Dwarfs enter...
At 01:00 PM 01/07/2001, Brian K. Gamble wrote:
>Does anyone know what is in the subject line on this virus so I can block
>it? I'm not finding much information on it.
>
>Thanks
>
>Brian
>----- Original Message -----
>From: Pat <[EMAIL PROTECTED]>
>To: <[EMAIL PROTECTED]>
>Sent: Sunday, January 07, 2001 3:53 AM
>Subject: RE: [IMail Forum] [IMail_Forum DIGEST]
>
>
> > Hi,
> >
> > I need to know more of this snowhite virus can anyone help??
> > A cure would be great but know where its coming from will help. I am so
>new
> > to this though, so please keep it as simple as you can. Thanks. Where can
>I
> > get this Declude AV?? is there anything else I might need??
> >
> > Patrick.
> >
> > -----Original Message-----
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED]]
> > Sent: 07 January 2001 8:11:am
> > Subject: [IMail_Forum DIGEST]
> >
> >
> > ----------------------------------------------------------------------
> >
> > Date: Sat, 06 Jan 2001 09:13:07 +0100
> > From: Len Conrad <[EMAIL PROTECTED]>
> > Subject: RE: [IMail Forum] Sending messages to AOL
> > Reply-To: [EMAIL PROTECTED]
> >
> > >I too just installed IMail and ran into the same problem. And I also
>just
> > >made the entries for MX, A and PTR in the DNS about 24 hrs ago. These
> > >changes seem to have filtered through already, but is it possible that
>AOL
> > >is just plain slow, and that is causing the emails to be kicked back to
>me?
> >
> > It depends on your TTL for the domain's DNS records. If the records
> > didn't exist but were asked for, then there is a "negative caching"
> > where a DNS will cache for the TTL period the failed requests, ie
> > cache the negative answers, just it caches the positive answers.
> >
> > When the emails are bounced to you, show us the log lines and error
> > number/reason that AOL is giving.
> >
> > AOL does not / cannot reject when reverse lookup fails because it
> > would reject 50% of Internet's mail servers. AOL does reject if the
> > "Mail From: sender@senderdomain" domain is not in DNS as A and/or MX
> > records.
> >
> > Len
> >
> >
> > http://BIND8NT.MEIway.com : Binary for ISC BIND 8.2.3 T9B for NT4 & W2K
> > http://IMGate.MEIway.com : Build free, hi-perf, anti-spam mail gateways
> >
> > ----------------------------------------------------------------------
> >
> > Date: Sat, 06 Jan 2001 09:17:30 +0100
> > From: Len Conrad <[EMAIL PROTECTED]>
> > Subject: Re: [IMail Forum] OT Question
> > Reply-To: [EMAIL PROTECTED]
> >
> > >Need - Radius server for NT/2000
> >
> > Emerald's RadiusNT has had a good reputation as a radius server. I do
> > not know whether it runs now on W2K. search www.google.com
> >
> > Len
> >
> >
> >
> > http://BIND8NT.MEIway.com : Binary for ISC BIND 8.2.3 T9B for NT4 & W2K
> > http://IMGate.MEIway.com : Build free, hi-perf, anti-spam mail gateways
> >
> > ----------------------------------------------------------------------
> >
> > Date: Sat, 06 Jan 2001 09:20:37 +0100
> > From: Len Conrad <[EMAIL PROTECTED]>
> > Subject: Re: [IMail Forum] Best AV Setup
> > Reply-To: [EMAIL PROTECTED]
> >
> > >I think best Antivirus solutions would be:
> > >To have two imgate's
> > >Scan incoming mail's with Len's imgate AV then forward to imail
> > >Scan Outgoing mail's with Scott's Declude then forward to 2. imgate
> > >for delivery.
> > >
> > >What do you guys think?
> >
> > You don't need both, since IMGateAV scans, your choice, both in and
> > out. I assume
> > Scott's does the same.
> >
> > Len
> >
> >
> >
> > http://BIND8NT.MEIway.com : Binary for ISC BIND 8.2.3 T9B for NT4 & W2K
> > http://IMGate.MEIway.com : Build free, hi-perf, anti-spam mail gateways
> >
> > ----------------------------------------------------------------------
> >
> > From: Mike Nice <[EMAIL PROTECTED]>
> > Date: Sat, 06 Jan 01 08:23:59 -0500
> > Subject: Re: [IMail Forum] Email Spoofs And Spam.
> > Reply-To: [EMAIL PROTECTED]
> > In <009301c07752$8d3af9d0$5601a8c0@KEVINCPC>, on 01/01/00 at 12:00 AM,
> > "Kevin Cross" <[EMAIL PROTECTED]> said:
> >
> > >Lately our users have been receiving a lot of spam through our mail
> > >server that seem to be untraceable. There is no "From:" entry in the
> > >message headers and in many cases no "To:" entries as well. Does anyone
> > >know how I can use the message filters to stop these messages from being
> > >received? Or any other methods I can use to filter this spam and email
> > >spoofs out?
> >
> > To identify the sender, you need to match IP address and time to
> > customer login.
> >
> > This is the signature of one of the plugins of the "Snow White"
> > W32/hybris virus. The message comes from someone on your system. If you
> > look at the Q*.SMD file on the queue, you will probably find garbage
> > characters (not even ASCII) for the FROM and TO addresses. If one of
> > those garbage characters happens to be an '@', IMail accepts the message,
> > where it sits in the queue.
> >
> > I had to manually delete these messages from the queue until I
> > installed Declude AV, which neatly redirects those messages to the
> > quarantine directory.
> >
> > --
> > -----------------------------------------------------------
> > Mike Nice <[EMAIL PROTECTED]>
> > -----------------------------------------------------------
> >
> > ----------------------------------------------------------------------
> >
> > From: "Terry L Fritts" <[EMAIL PROTECTED]>
> > Date: Sat, 6 Jan 2001 08:10:12 -0600
> > Subject: [IMail Forum] Declude Install
> > Reply-To: [EMAIL PROTECTED]
> > I installed Scott Perry's ([EMAIL PROTECTED]) http://www.declude.com
> > Declude this morning along with Frisk's http://www.complex.is f-prot
>command
> > line virus scanner.
> >
> > I spent less than 30 minutes most of which was trying to figure out how
> > f-prot worked and how to set the command line arguments in the deculde
>virus
> > cfg file. Probably to actually install Declude itself is under 5 minutes.
> >
> > Declude is a very nice product.
> >
> > Terry Fritts
> >
> >
> >
> >
> >
> >
> >
> > ----------------------------------------------------------------------
> >
> > Date: Sat, 06 Jan 2001 09:37:49 -0500
> > From: Hawk <[EMAIL PROTECTED]>
> > Subject: [IMail Forum] Imail Configuration
> > Reply-To: [EMAIL PROTECTED]
> >
> > Hi all,
> >
> > I want to setup Imail to service 2 domains w/o setting up a virtual. Can
> > simple enter the domains in the host aliases? What is the limit for that
> > list?
> >
> > IE: countryschool.org countryschool.com
> >
> > ----------------------------------------------------------------------
> >
> > From: "Will Hall" <[EMAIL PROTECTED]>
> > Date: Sat, 6 Jan 2001 10:35:43 -0500
> > Subject: Re: [IMail Forum] OT Question
> > Reply-To: [EMAIL PROTECTED]
> > Thanks Len
> >
> >
> > Will Hall
> > C. W. Networks
> > MCP / MCP+i / MCSE
> > i-Net+ / Network + / CNA
> > 219.583.6860
> > ----- Original Message -----
> > From: "Len Conrad" <[EMAIL PROTECTED]>
> > To: <[EMAIL PROTECTED]>
> > Sent: Saturday, January 06, 2001 3:17 AM
> > Subject: Re: [IMail Forum] OT Question
> >
> >
> > >
> > > >Need - Radius server for NT/2000
> > >
> > > Emerald's RadiusNT has had a good reputation as a radius server. I do
> > > not know whether it runs now on W2K. search www.google.com
> > >
> > > Len
> > >
> > >
> > >
> > > http://BIND8NT.MEIway.com : Binary for ISC BIND 8.2.3 T9B for NT4 & W2K
> > > http://IMGate.MEIway.com : Build free, hi-perf, anti-spam mail gateways
> > >
> > >
> > > Please visit http://www.ipswitch.com/support/mailing-lists.html
> > > to be removed from this list.
> > >
> > > An Archive of this list is available at:
> > > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> > >
> >
> > ----------------------------------------------------------------------
> >
> > Date: Sat, 06 Jan 2001 17:24:49 +0100
> > From: Len Conrad <[EMAIL PROTECTED]>
> > Subject: Re: [IMail Forum] OT Question
> > Reply-To: [EMAIL PROTECTED]
> >
> > >Thanks Len
> >
> > another one: http://www.tccsoftware.com/software.asp
> >
> > Len
> >
> >
> >
> > http://BIND8NT.MEIway.com : Binary for ISC BIND 8.2.3 T9B for NT4 & W2K
> > http://IMGate.MEIway.com : Build free, hi-perf, anti-spam mail gateways
> >
> > ----------------------------------------------------------------------
> >
> > Date: Sat, 6 Jan 2001 10:45:35 -0700
> > From: "Chuck Schick" <[EMAIL PROTECTED]>
> > Subject: Re: [IMail Forum] OT Question
> > Reply-To: [EMAIL PROTECTED]
> > It sounds like a two part process. We use Vircom's radius product and
> > combine it with Boardtown's platypus billing software within a customer
> > information module. The radius and the billing software use the same SQL
> > database. The customer can access his account from the WWW. see his
> > account status, usage, change password, etc.
> >
> > It has worked well for us but it does cost money although we though the
> > price was reasonable.
> >
> > C. Schick
> >
> >
> > ---------- Original Message ----------------------------------
> > From: "Will Hall" <[EMAIL PROTECTED]>
> > Reply-To: [EMAIL PROTECTED]
> > Date: Fri, 5 Jan 2001 22:35:40 -0500
> >
> > >OK Guys heres on for off the topic.
> > >
> > >Need - Radius server for NT/2000
> > >
> > >Would Like -
> > >
> > >Ability to admin from www, ability for users to change own pass from www,
> > >users be able to check monthly usage time from www.
> > >
> > >Any suggestions???
> > >
> > >
> > >Will Hall
> > >C. W. Networks
> > >MCP / MCP+i / MCSE
> > >i-Net+ / Network + / CNA
> > >219.583.6860
> > >
> > >
> > >Please visit http://www.ipswitch.com/support/mailing-lists.html
> > >to be removed from this list.
> > >
> > >An Archive of this list is available at:
> > >http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> > >
> > ----------------------------------------------------------------------
> >
> > From: "Randy Sherwyn" <[EMAIL PROTECTED]>
> > Date: Sat, 6 Jan 2001 15:22:33 -0500
> > Subject: RE: [IMail Forum] OT Question
> > Reply-To: [EMAIL PROTECTED]
> > Absolutely, Vircom PRRS Radius is the cream of the crop. We use it the
>same
> > way with Rodopi for billing.
> >
> > Randy
> > TNT Online
> > Ft. Myers, FL
> >
> > >
> > > It sounds like a two part process. We use Vircom's radius
> > > product and combine it with Boardtown's platypus billing software
> > > within a customer information module. The radius and the billing
> > > software use the same SQL database. The customer can access his
> > > account from the WWW. see his account status, usage, change
> > > password, etc.
> > >
> > > It has worked well for us but it does cost money although we
> > > though the price was reasonable.
> > >
> > > C. Schick
> > >
> > >
> > > ---------- Original Message ----------------------------------
> > > From: "Will Hall" <[EMAIL PROTECTED]>
> > > Reply-To: [EMAIL PROTECTED]
> > > Date: Fri, 5 Jan 2001 22:35:40 -0500
> > >
> > > >OK Guys heres on for off the topic.
> > > >
> > > >Need - Radius server for NT/2000
> > > >
> > > >Would Like -
> > > >
> > > >Ability to admin from www, ability for users to change own pass from
>www,
> > > >users be able to check monthly usage time from www.
> > > >
> > > >Any suggestions???
> >
> >
> > ----------------------------------------------------------------------
> >
> > From: "Wayne Smith" <[EMAIL PROTECTED]>
> > Date: Sat, 6 Jan 2001 16:34:53 -0500
> > Subject: Re: [IMail Forum] Best AV Setup
> > Reply-To: [EMAIL PROTECTED]
> > Len
> >
> > I'd agree that you don't need both, but if/when Declude has the option to
> > not scan e-mail based on the IP address passing the mail to it, you could
> > have the IMGateAV box scan incoming and leave outbound mail to the Imail
>box
> > without having to reconfigure the users or change outbound mail
> > processing... assuming you have the memory, Disk IO, and CPU time on the
> > Imail box for it.
> >
> > Would make for good load balancing and not having to change too much at
>one
> > time. We currently don't have outbound mail shipped through any of our
> > postfix boxes. The Imail server does fine about getting the mail out. If
> > we were doing mailing list delivery, that would probably change.
> >
> > *********************************
> > Wayne Smith, CNE/MCSE/CCNP/CCDP
> > Computer Resources (http://www.cros.net)
> >
> > ----- Original Message -----
> > From: "Len Conrad" <[EMAIL PROTECTED]>
> > To: <[EMAIL PROTECTED]>
> > Sent: Saturday, January 06, 2001 3:20 AM
> > Subject: Re: [IMail Forum] Best AV Setup
> >
> > <<< snip >>>>
> >
> > > You don't need both, since IMGateAV scans, your choice, both in and
> > > out. I assume
> > > Scott's does the same.
> > >
> > > Len
> > >
> > >
> > >
> > > http://BIND8NT.MEIway.com : Binary for ISC BIND 8.2.3 T9B for NT4 & W2K
> > > http://IMGate.MEIway.com : Build free, hi-perf, anti-spam mail gateways
> >
> >
> > ----------------------------------------------------------------------
> >
> > From: "Jim Jones, Jr." <[EMAIL PROTECTED]>
> > Date: Sat, 6 Jan 2001 19:31:31 -0600
> > Subject: [IMail Forum] Best AV Setup ? what about brightmail ?
> > Reply-To: [EMAIL PROTECTED]
> > We are looking at the Brightmail solution... it scans for spam and virus,
> > however, I don't know if it scans outgoing mail... It costs $5.00 per
> > mailbox per year and that incudes the sun server that it runs on.
> >
> > Has anyone had experience with this solution ? good or bad? I would like
> > some stories before we make any further decisions...
> >
> > Thanks,
> >
> > Jim
> >
> >
> >
> > Please visit http://www.ipswitch.com/support/mailing-lists.html
> > to be removed from this list.
> >
> > An Archive of this list is available at:
> > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> >
>
>
>Please visit http://www.ipswitch.com/support/mailing-lists.html
>to be removed from this list.
>
>An Archive of this list is available at:
>http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
_______________________
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
