On Mar 16, 2004, at 10:31, Tony Finch wrote:
> On Tue, 16 Mar 2004, Tor Slettnes wrote:
>>
>> - What does "block port 25 traffic" mean? Inbound or outbound?
>> * If you mean inbound: Why?
>> Keep in mind that nearly all spam zombies and other infected
>> machines
>> have been compromised by other means (HTTP, NetBIOS/CIFS...),
>> not via
>> port 25.
>
> A very large proportion are compromised by email worms or spammed
> trojans.
This is irrelevant -- these worms/trojans have usually _not_ arrived at
the infected machine directly on port 25. Few Windows machines listen
on port 25 at all.
Usually what happens is that the (l)user opens an attachment (or
otherwise execute code) in their e-mail _client_, such as Outlook
Express. This client, in turn, has retreived the mail from a POP3 or
IMAP server, not via SMTP.
-tor
