Re: [tlug] swan

[Godwin Stewart <gstewart@example.com>]

And Thus Spake David Santinoli <u235@example.com> (on Mon, 22 Sep 2003
13:48:28 +0200):

> In this particular case (Swen), the usefulness of DNSBLs seems quite
> limited, since it appears that this virus knows how to propagate itself
> through the infected user's ISP mailserver, rather than initiating a
> direct connection from the infected host to the MX of the victim (which
> would typically be blocked by a dial-up DNSBL).

I guess I've just been lucky in that they've all been coming from networks
which were already blocklisted because of spam (notably charter.net and,
unfortunately for you, the whole of Italy). The rest are being sent to a
non-existent (munged) e-mail address I use in usenet, and they're coming
from all over the place.

The thing to do, if you can, is to make the MTA respond with a temporary
failure code (451) so that the sending ISP's outbound spool grows out of
proportion. *THAT* will catch their attention much more than any complaint
(which will get lost in the flood of virmen anyway) and make their
subscribers clean up their machines.

-- 
G. Stewart   --   gstewart@example.com -- gstewart@example.com
Registered Linux user #284683 (Slackware 9.0)
---------------------------------------------------------------
Spotted in a toilet of a London office:
TOILET OUT OF ORDER. PLEASE USE FLOOR BELOW.

Attachment: pgp00080.pgp
Description: PGP signature