Re: Sobig Traffic

[Scott Bradner <sob () HARVARD EDU>]

you can use procmail with sendmail and thsi sort of filter
is easy with procmail

Scott


----
From: Greg Graeff <ggraeff () PPC EDU>
Subject: Re: [SECURITY] Sobig Traffic
To: SECURITY () LISTSERV EDUCAUSE EDU
Precedence: list

If you are doing this with sendmail,  can you share this with the group?

Thanks.

-Greg


-----Original Message-----
From: Bruhn, Mark S. [mailto:mbruhn () INDIANA EDU]
Sent: Monday, September 08, 2003 12:54 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Sobig Traffic


We're filtering on these subject lines, at our mail relays.  Obviously,
some of these can easily be legitimate subjects, but we've had very few
complaints.
M.

> Re: Thank you!
> Thank you!
> Your details
> Re: Details
> Re: Re: My details
> Re: Approved
> Re: Your application
> Re: Wicked screensaver
> Re: That movie

--
Mark S. Bruhn, CISSP
Chief IT Security and Policy Officer
Indiana University
812-855-0326


-----Original Message-----
From: Barros, Jacob [mailto:jkbarros () GRACE EDU]
Sent: Monday, September 08, 2003 11:51 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Sobig Traffic


Our exchange server is still getting hit with email messages containing
the Sobig.f virus. The viruses is being deleted but we're losing system
resources in the process.  Do any of you know if there is a way that I
can filter/block those messages before it hits the exchange server? Can
it even be done or should we just ride out the storm.  Am I on the wrong
track in thinking that this bug is on the outside and in fact may be
resident on one of our internal machines?

**********
Participation and subscription information for this EDUCAUSE Discussion
Group discussion list can be found at http://www.educause.edu/cg/.

**********
Participation and subscription information for this EDUCAUSE Discussion
Group discussion list can be found at http://www.educause.edu/cg/.

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.