Author: Giuliano Gavazzi Date: To: Toralf Lund, Exim Mailing List Subject: Re: [Exim] What to do with messages that seem to be
virus-infected?
At 1:26 pm +0100 2004/03/06, Toralf Lund wrote: >But, don't virus messages often come from machines that don't have an
>SMTP server at all, but where the MUA connects to a remote one, possibly
>at an ISP?
no. If you see a virus in action it will usually open lots of
different connections to the MX of the target addesses. From the
point of view of delivery *alone* the virus acts as a small SMTP
server. I guess this is because delivering all the messages via a
single SMTP server would be easily detected and blocked.
