Re: [Exim] What to do with messages that seem to be virus-i…

Pàgina inicial
Delete this message
Reply to this message
Autor: Giuliano Gavazzi
Data:  
A: Toralf Lund, Exim Mailing List
Assumpte: Re: [Exim] What to do with messages that seem to be virus-infected?
At 1:26 pm +0100 2004/03/06, Toralf Lund wrote:
>But, don't virus messages often come from machines that don't have an
>SMTP server at all, but where the MUA connects to a remote one, possibly
>at an ISP?


no. If you see a virus in action it will usually open lots of
different connections to the MX of the target addesses. From the
point of view of delivery *alone* the virus acts as a small SMTP
server. I guess this is because delivering all the messages via a
single SMTP server would be easily detected and blocked.

Giuliano