* This is the modus mailing list * When Klez hit about 9 or 12 months ago we disabled all inbound and outbound Virus reports. It was a handy service that yielded great "brownie points" with customers and non-customers alike, but as they saying goes No Good Deed Goes Unpunished. Once the spammers, hackers and virus makers teamed up, they each added their own insight to make the now SuperWorms. Spammers teach the virus makers to hide the sender, virus makers harvest new emails for spamming, spammers and virus makers open ports on infected machines to spread their spam or run web servers from private PC's, and so on and so on. Hell, I think the biggest threat in the near future will be the rampant spyware running around. We maintain a health-care related company in our region and these guys will run webshots on their PC and they of course answer yes to every "free download" everytime they log into the webshots website and before long you see them typing someone's social security number and "poof" you have three pop-up ads running from Gator and a host of other utilities. Nice and scary isn't it, imagine someone at your mortgage company that has this utility installed, was this what the internet was supposed to be?
Just my .02, Ken Grimes ----- Original Message ----- From: "TDE Internet" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, January 30, 2004 10:30 AM Subject: [Modus] Pong > * This is the modus mailing list * > > At 11:37 AM 01/30/2004 -0500, you wrote: > >* This is the modus mailing list * > > > >Jeff, > > > >Under normal everyday operations sending sender notification for virus works > >well. I can't tell you how many emails and calls we have received from > >customers that are not even ours thanking us for informing that that had a > >virus. In fact we have taken hundreds on customers away from other ISP's > >because of the notification. Of course now that MYDOOM is on the seen that > >changed everything. We now have turned off notification completely. > > > >Charles > > > > Guess each has had their own history with this. When we first went to modusMail, we were sending to both the sender and receiver when a virus was discovered. Our thought process was much like yours, in that we felt most would want to know. That all changed when some jerk complained about the notification message and went to SpamCop. We ended up in their RBL and took a bit to get off their list, and only after we told them we would stop sending notification messages. While we had it set to send notifications to the sender, we had nothing but grief. Let the receiver tell the sender they have a virus. The Mydoom is just one of many virus/worm that have bogus from addresses over the past year or so. In fact about every virus in my quarantine has a bogus from address (Klez, Mimail, Mydoom, etc), and nearly all new virus/worms are that way now. > > Jim > TDE Internet > > > > > > >-----Original Message----- > >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of > >Jeff - MIS Sciences Corporation > >Sent: Thursday, January 29, 2004 12:27 PM > >To: [EMAIL PROTECTED] > >Subject: [Modus] Pong > > > >* This is the modus mailing list * > > > >Charles > > > >Why do you send "Sender" notification? Most all of the sending addresses are > >bogus and all that does is compound the problem. You then get a > >"undeliverable message" , so you now have increased the number of emails > >again. > > > >Jeff > > > >----- Original Message ----- > >From: "Charles Shaffer" <[EMAIL PROTECTED]> > >To: <[EMAIL PROTECTED]> > >Sent: Thursday, January 29, 2004 09:39 > >Subject: [Modus] Pong > > > > > >* This is the modus mailing list * > > > >I agree by send notification we are compounding the issue. For Example our > >server receives an email containing MY DOOM. That is a single message but if > >we send out Sender/Recipient notifications it now increase to three emails > >total. Not to mention postmaster notifications. So to recap one nasty MY > >DOOM email spawns 2 - 3 additional emails, we would be helping the virus in > >it DOS attack by increasing the mail load but 50% - 75%. > > > >Just something to think about. > > > >Charles > > > >-----Original Message----- > >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of > >postmaster > >Sent: Thursday, January 29, 2004 8:21 AM > >To: '[EMAIL PROTECTED]' > >Subject: [Modus] Pong > > > >* This is the modus mailing list * > > > >Everything is ok here - except that I had to write a Sieve script to protect > >us from all the foolish virus alerts from admins who make MyDoom even worse > >by giving false alarms to forged sender addresses stolen from adddress > >books: > > > >if allof( > > body :text :contains [ "virus" ], > > body :text :contains > > [ > > "alert", > > "attachment", > > ".bat", > > ".com", > > ".cmd", > > ".exe", > > ".hta", > > ".lnk", > > ".scr", > > ".shs", > > ".vb ", > > ".zip" > > ] > > ) { discard; stop; } > > > >I had LOTS of customers calls who received all kinds of dumb warnings, some > >automated sender responses even told our people: "your compunter is > >infected, contact your admin!". > > > >I hate this kind of crap, especially when a it comes from infected networks > >(as you see when you check the headers). This is almost worse than spam... > >But with the script from above all alerting crap is dumped. > > > >It seems easier to protect from MyDoom than from stupid email server > >configurations... > > > >Kai Fiebach > >Musikhochschule Luebeck, Germany > >http://www.mh-luebeck.de > > > >-----Original Message----- > >From: Suneel Jhangiani [mailto:[EMAIL PROTECTED] > >Sent: Thursday, January 29, 2004 1:56 PM > >To: [EMAIL PROTECTED] > >Subject: [Modus] Ping > > > > > >I haven't seen an email on the list for a full 8 hours now, just wondering > >if you guys are all hurting from the MyDoom attack? > > > > > >Regards, > > > >Suneel Jhangiani > >Inter-Computer Technology Ltd. > > > >** > >To unsubscribe, send an Email to: [EMAIL PROTECTED] > >with the word "UNSUBSCRIBE" in the body or subject line. > > > > > >** > >To unsubscribe, send an Email to: [EMAIL PROTECTED] > >with the word "UNSUBSCRIBE" in the body or subject line. > > > > > >** > >To unsubscribe, send an Email to: [EMAIL PROTECTED] > >with the word "UNSUBSCRIBE" in the body or subject line. > > > > > >** > >To unsubscribe, send an Email to: [EMAIL PROTECTED] > >with the word "UNSUBSCRIBE" in the body or subject line. > > > ** > To unsubscribe, send an Email to: [EMAIL PROTECTED] > with the word "UNSUBSCRIBE" in the body or subject line. ** To unsubscribe, send an Email to: [EMAIL PROTECTED] with the word "UNSUBSCRIBE" in the body or subject line.
