RE: Worm.SCO.A (W32/Mydoom@MM)

["Dan Bartley" <bartleyd () corp netcarrier com>]

I assume you mean anti-virus notification, not an NDR. The NDRs are
generated because the Trojan is using a list of common names for every
domain it picks up on. You can't disable NDRs, that would be bad
practice.

Best Regards, 

Dan Bartley

-----Original Message-----
From: Shawn Jackson [mailto:sjackson () horizonusa com] 
Sent: Tuesday, January 27, 2004 14:41
To: security-basics () securityfocus com
Subject: RE: Worm.SCO.A (W32/Mydoom@MM)


        Everyone on the list please, if you can, set your MTA's to not
send a anti-virus NDR to the sender of the virus, seaming the sender is
most likely spoofed it won't do too much good.

        In example if your using amavis-new set your
$final_virus_destiny to D_DISCARD.

Shawn Jackson
Systems Administrator
Horizon USA
1190 Trademark Dr #107
Reno NV 89521

www.horizonusa.com
Email: sjackson () horizonusa com
Phone: (775) 858-2338
             (800) 325-1199 x338

------------------------------------------------------------------------
---
Ethical Hacking at InfoSec Institute. Mention this ad and get $720 off
any 
course! All of our class sizes are guaranteed to be 10 students or less.

We provide Ethical Hacking, Advanced Ethical Hacking, Intrusion
Prevention, 
and many other technical hands on courses. 
Visit us at http://www.infosecinstitute.com/securityfocus to get $720
off 
any course!  
------------------------------------------------------------------------
----




---------------------------------------------------------------------------
Ethical Hacking at InfoSec Institute. Mention this ad and get $720 off any
course! All of our class sizes are guaranteed to be 10 students or less.
We provide Ethical Hacking, Advanced Ethical Hacking, Intrusion Prevention,
and many other technical hands on courses.
Visit us at http://www.infosecinstitute.com/securityfocus to get $720 off
any course!
----------------------------------------------------------------------------