473,246 Members | 1,793 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,246 software developers and data experts.

The ..... worm

<OT about the worm>
Jeessh, a lot of people have my email address.

I have received about 500 copies of the worm in the last 24 hours. My
mail spool at work was sooooo full I couldn't get out or relay or
anything. The wierd part is that it's my work address, and I'm
subscribed to almost all my lists through the address above or my
previous home address. YEARS ago I was using the work address for lists,
but not for a LOOOOOOOOOOOONG time.
</OT about the worm>
---------------------------(end of broadcast)---------------------------
TIP 8: explain analyze is your friend

Nov 11 '05 #1
9 1873
Running mozilla on linux and having my mail processed by postini,
_http://www.postini.com_, I haven't had any problems other that lots of
quarantined mail at postini. Having the mail quarantined off site saves
bandwith as well.

I work at an ISP and we use postini for all email that ends up on our
mail servers.

We used to run Spam Assassin for all our mail, but since we moved to
postini our bandwith savings have been great. I still have Spam Assassin
running for my account but postini is so good that I only get about 1%
of the UE {unsolicited email} that makes it through and Spam Assassin
usualy catches about half of the ones that make it through. In a week I
usaualy get about one UE to my inbox, 5 into my Spam Assassin mail box
and about 500 quarantined at postini. Now that I ahve my white lists
setup at postine I only get one or two legitimate messages captured per
week. I normaly get around 5000-10,000 messages a week, so the time
savings of having all UE quarantined off site where I can delete them
without downloading them save a lot of time and bandwidth.

I don't work for, or get kick backs for, Postini. They are worth while
looking into especialy for medium to large organizations, because they
keep their virus checkers and UE algorithms up to date and most large to
medium sized organizations can recoup their postini costs with their
savings in bandwidth, and lost productivity of staff having to download
and pick out the UE from the real mail, possibly getting infected by a
virus while doing so.

NOTE: I use UE so that Hormel {http://www.spam.com/} doesn't get upset
with me ;-)

Guy

PS Keep your worm to your self :-D

Dennis Gearon wrote:
<OT about the worm>
Jeessh, a lot of people have my email address.

I have received about 500 copies of the worm in the last 24 hours. My
mail spool at work was sooooo full I couldn't get out or relay or
anything. The wierd part is that it's my work address, and I'm
subscribed to almost all my lists through the address above or my
previous home address. YEARS ago I was using the work address for
lists, but not for a LOOOOOOOOOOOONG time.
</OT about the worm>

---------------------------(end of broadcast)---------------------------
TIP 7: don't forget to increase your free space map settings

Nov 11 '05 #2
Thing is, in my case it wasn't due to that many people, most were mainly
from one guy at rr.com

Common header:

Received: from LANCE (cs6711150-130.satx.rr.com [67.11.150.130])

And he was the source of 260 in one day, total so far = 609!

Really not sure why that happened - shouldn't the worm be sending to many
and not blast just one address. Is it blasting 500 copies to each person on
all the lists- but how's that going to make it spread faster.

At 02:18 PM 8/22/2003 -0700, Dennis Gearon wrote:
<OT about the worm>
Jeessh, a lot of people have my email address.

I have received about 500 copies of the worm in the last 24 hours. My mail
spool at work was sooooo full I couldn't get out or relay or anything. The
wierd part is that it's my work address, and I'm subscribed to almost all
my lists through the address above or my previous home address. YEARS ago
I was using the work address for lists, but not for a LOOOOOOOOOOOONG time.
</OT about the worm>

---------------------------(end of broadcast)---------------------------
TIP 6: Have you searched our list archives?

http://archives.postgresql.org

Nov 11 '05 #3
Lincoln Yeoh <ly***@pop.jaring.my> writes:
Thing is, in my case it wasn't due to that many people, most were
mainly from one guy at rr.com

Common header:

Received: from LANCE (cs6711150-130.satx.rr.com [67.11.150.130])

^^^^^

You should filter on this string (which MUST contain a dot according
to RFC 2821). You can do this by rejecting HELO/EHLO commands which
lack a ".". Be sure to activate this filter only for mail received
from the Internet; your local Windows clients might generate it, too.

---------------------------(end of broadcast)---------------------------
TIP 7: don't forget to increase your free space map settings

Nov 11 '05 #4
On Fri, 22 Aug 2003 14:18:19 -0700
Dennis Gearon <ge*****@fireserve.net> wrote:
I don't have it, but I did get a spam from ge*****@oit.edu or was that
real?

Why does this list even use real addresses? Why not have From and To the same?
i.e. pg***********@postgresql.org

Is it a social issue or technical? I'd be surprised if it was the latter.

<OT about the worm>
Jeessh, a lot of people have my email address.

I have received about 500 copies of the worm in the last 24 hours. My
mail spool at work was sooooo full I couldn't get out or relay or
anything. The wierd part is that it's my work address, and I'm
subscribed to almost all my lists through the address above or my
previous home address. YEARS ago I was using the work address for lists,
but not for a LOOOOOOOOOOOONG time.
</OT about the worm>
---------------------------(end of broadcast)---------------------------
TIP 8: explain analyze is your friend


---------------------------(end of broadcast)---------------------------
TIP 6: Have you searched our list archives?

http://archives.postgresql.org

Nov 11 '05 #5
On Wed, Aug 27, 2003 at 15:49:26 -0700,
expect <ex****@ihubbell.com> wrote:

Why does this list even use real addresses? Why not have From and To the same?
i.e. pg***********@postgresql.org

Is it a social issue or technical? I'd be surprised if it was the latter.


As you have been told previously, not everyone who posts to these lists
are on the lists and their address is needed to get replies.

---------------------------(end of broadcast)---------------------------
TIP 3: if posting/reading through Usenet, please send an appropriate
subscribe-nomail command to ma*******@postgresql.org so that your
message can get through to the mailing list cleanly

Nov 11 '05 #6
expect <ex****@ihubbell.com> writes:
Other lists I subscribe to do not suffer from the spam plague in the way this
list does. I wish I'd known that before signing on rather than after.


[ raised eyebrow ] I subscribe to many mailing lists. On most of the
other lists I have to apply spam filtering to what arrives, but the PG
lists are very nearly spam-free (thanks to Marc's hard work). I dunno
what you are complaining about.

regards, tom lane

---------------------------(end of broadcast)---------------------------
TIP 8: explain analyze is your friend

Nov 11 '05 #7
On Thu, Aug 28, 2003 at 12:17:21AM -0400, Tom Lane wrote:
expect <ex****@ihubbell.com> writes:
Other lists I subscribe to do not suffer from the spam plague in the way this
list does. I wish I'd known that before signing on rather than after.


[ raised eyebrow ] I subscribe to many mailing lists. On most of the
other lists I have to apply spam filtering to what arrives, but the PG
lists are very nearly spam-free (thanks to Marc's hard work). I dunno
what you are complaining about.


It is a valid complaint. The fact was that the archives (at least on
archives.postgresql.org) kept the email addresses verbatim, right in front
of the eyes of any spammer's web crawler.

Fortunately, Cristoph Dalitz's repeated complaints have finally caused
Marc to reconfigure MHonArc so it won't publish the addresses.

You are right in that there is very little spam coming from the lists
themselves...

--
Alvaro Herrera (<alvherre[a]dcc.uchile.cl>)
We take risks not to escape from life, but to prevent life escaping from us.

---------------------------(end of broadcast)---------------------------
TIP 2: you can get off all lists at once with the unregister command
(send "unregister YourEmailAddressHere" to ma*******@postgresql.org)

Nov 11 '05 #8
Tom Lane wrote:
expect <ex****@ihubbell.com> writes:

Other lists I subscribe to do not suffer from the spam plague in the way this
list does. I wish I'd known that before signing on rather than after.


[ raised eyebrow ] I subscribe to many mailing lists. On most of the
other lists I have to apply spam filtering to what arrives, but the PG
lists are very nearly spam-free (thanks to Marc's hard work). I dunno
what you are complaining about.

regards, tom lane

---------------------------(end of broadcast)---------------------------
TIP 8: explain analyze is your friend

I get no spam or worms from the email I use on this list.
---------------------------(end of broadcast)---------------------------
TIP 4: Don't 'kill -9' the postmaster

Nov 11 '05 #9


On Thu, 28 Aug 2003, Alvaro Herrera wrote:
Fortunately, Cristoph Dalitz's repeated complaints have finally caused
Marc to reconfigure MHonArc so it won't publish the addresses.


Actually, someone finally providing me with a means to 'mangle' the
addresses caused me to reconfigure it ... Christoph could complain until
his face turned blue, but if I didn't have a means to do it, it would
never have been done *shrug*
---------------------------(end of broadcast)---------------------------
TIP 9: the planner will ignore your desire to choose an index scan if your
joining column's datatypes do not match

Nov 11 '05 #10

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

3
by: Chung Leong | last post by:
See http://www.theregister.co.uk/2005/11/07/linux_worm/
0
by: RollForward Wizard | last post by:
Exciting Oracle News Oracle DB Worm Code Published http://www.eweek.com/article2/0,1895,1880682,00.asp?kc=ewnws110205dtx1k0000599 Researcher: Oracle Passwords Crack in Mere Minutes...
14
by: Chuck Grimsby | last post by:
As many of you know, I occasionally get messages from the MS team on various things. Today I got the following, and (personally) I think it certainly is worthy of passing on. If you haven't...
44
by: Julian V. Noble | last post by:
Dear C Mavens, Anyone here getting hosts of spam with nefarious attachments, purporting to be from M$ or its lackeys, into your mailbox? I neglected to spoof my header, and since Hurricane...
1
by: David H. Lipman | last post by:
w32/sdbot.worm do not download or open
0
by: Mohamoss | last post by:
Microsoft has been made aware of a worm identified as “W32.Sasser.worm” and it is currently circulating on the Internet. The worm exploits the Local Security Authority Subsystem Service (LSASS)...
0
by: abbasky | last post by:
### Vandf component communication method one: data sharing ​ Vandf components can achieve data exchange through data sharing, state sharing, events, and other methods. Vandf's data exchange method...
2
isladogs
by: isladogs | last post by:
The next Access Europe meeting will be on Wednesday 7 Feb 2024 starting at 18:00 UK time (6PM UTC) and finishing at about 19:30 (7.30PM). In this month's session, the creator of the excellent VBE...
0
by: stefan129 | last post by:
Hey forum members, I'm exploring options for SSL certificates for multiple domains. Has anyone had experience with multi-domain SSL certificates? Any recommendations on reliable providers or specific...
0
Git
by: egorbl4 | last post by:
Скачал я git, хотел начать настройку, а там вылезло вот это Что это? Что мне с этим делать? ...
1
by: davi5007 | last post by:
Hi, Basically, I am trying to automate a field named TraceabilityNo into a web page from an access form. I've got the serial held in the variable strSearchString. How can I get this into the...
0
by: MeoLessi9 | last post by:
I have VirtualBox installed on Windows 11 and now I would like to install Kali on a virtual machine. However, on the official website, I see two options: "Installer images" and "Virtual machines"....
0
by: DolphinDB | last post by:
The formulas of 101 quantitative trading alphas used by WorldQuant were presented in the paper 101 Formulaic Alphas. However, some formulas are complex, leading to challenges in calculation. Take...
0
by: ryjfgjl | last post by:
ExcelToDatabase: batch import excel into database automatically...
0
isladogs
by: isladogs | last post by:
The next Access Europe meeting will be on Wednesday 6 Mar 2024 starting at 18:00 UK time (6PM UTC) and finishing at about 19:15 (7.15PM). In this month's session, we are pleased to welcome back...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.