On Mon, 08 Dec 2003 14:19 , Jason Haar <[EMAIL PROTECTED]> sent:
>On Mon, 2003-12-08 at 14:02, McKeever Chris wrote: >> from the /var/qmail/supervise/qmail-smtpd/run: >> exec /usr/local/bin/softlimit -m 10000000 >> >> can that be too small? I will boost it to 12000000 and see what happens I thought the upgrade to 1.20 and increasing the softlimit to 12000000 did the trick, went a week clean. Then in the last two days a few slipped on by..I boosted the softlimit to 150000000 as well. Here is a weird part, it may be coincidental, but as soon as I turned debugging off, that is when they started slipping in...does that make _any_ sense?? I am going to turn debuging back on and see what happens.. from the second box: 41 Mail to [EMAIL PROTECTED] from Raquel Darian ; W95/Hybris.PI.003 - /mail-data/atmail-users/tmp/fist-fucking-1.EXE: W95/Hybris.PI.003 FOUND 12/12/03 23:19:08 40 Mail to [EMAIL PROTECTED] from "Net Mail Service" < > ; Exploit.IFrame.Gen - /mail-data/atmail-users/tmp/msg-23210-1.html: Exploit.IFrame.Gen FOUND 12/12/03 12:47:47 39 Mail to [EMAIL PROTECTED] from ajarkin ; Worm/Klez.H - /mail-data/atmail-users/tmp/eminem_0: Worm/Klez.H FOUND 12/12/03 10:38:21 38 Mail to [EMAIL PROTECTED] from GayeMacchini ; Worm/Klez.H - /mail-data/atmail-users/tmp/cents: Worm/Klez.H FOUND 06/12/03 14:47:34 >> > >I don't know - that's the point! You have to find this out for yourself. >It's totally dependant on - well - everything. > > >> Also note that the two that were caught by the second box were at very off-peak >> hours: >> > >That won't mean anything. > >> 37 Mail to [EMAIL PROTECTED] from "Net Delivery Service" ; Exploit.IFrame.Gen - >> /mail-data/atmail-users/tmp/msg-9716-1.html: >> Exploit.IFrame.Gen FOUND 05/12/03 05:33:32 >> 36 Mail to [EMAIL PROTECTED] from "Internet Email Delivery Service" ; >> Exploit.IFrame.Gen - /mail-data/atmail-users/tmp/msg-4478- 1.html: >> Exploit.IFrame.Gen FOUND 05/12/03 02:08:15 >> >> Any other ideas? >> > >Well, were they big messages, or messages with attachments? What makes >them different from the ones that go through fine - that's what you have >to ask yourself. > ------------------------------------------- Chris McKeever If you want to reply directly to me, please use cgmckeever--at--prupref---dot---com http://www.prupref.com ---- Prudential Preferred Properties www.prupref.com ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Qmail-scanner-general mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
