filter MS ebomb virus

[John F Davis]

In article <ITocb.19646$R%***@nntp-post.primus.ca>, ***@primus.ca
says...

Since 2003-09-18, I have been receiving several hundred MS ebomb virus
bogus security pack/patch update/upgrade messages. I am not pleased. Is
there a truly effective e-mail filter that works with NetTamer?

There are several that work with you ISP even before Netamer sees it,
Mailwasher comes to mine as does SpamPal (though I don't know if SpamPal
runs local or remote) there are anti-spams services.

Beyond that there is a "local" filter (Search on NTLSERV and you will
find it, I think it's "Killfile" but alas, I'm not sure) Ok, I'm sure,
it's KillFile (just checked)

I get about 10 to 1 spam here, Totaly out of control

[Jay T. Blocksom]

On Wed, 24 Sep 2003 22:27:52 GMT, in <alt.comp.shareware.nettamer>, "Robert

Since 2003-09-18, I have been receiving several hundred MS ebomb virus
bogus security pack/patch update/upgrade messages. I am not pleased.

[snip]

You are surely referring to the W32.Swen.A worm:

<http://www.f-prot.com/virusinfo/descriptions/swena.html>
<http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SWEN.A&VSect=T>
<http://www.symantec.com/avcenter/venc/data/***@mm.html>

The worm is aimed at you because it harvests target addresses directly from
Usenet. But take heart -- you're not alone: My mail server has killed
something in excess of 750 copies of it so far, NOT counting the estimated
3,000+ delivery attempts that didn't make it far enough through the SMTP
tapdance to give the virus scanner a whack at it (my server is heavily
protected against spam and other abuse via static blocks and DNSbls).

Is there a truly effective e-mail filter that works with NetTamer?

[snip]

By the time any "e-mail filter" you could run at the client level could do
possibly anything, it's too late -- the crap has already been delivered;
hence, you've already wasted the bandwidth on it (and at ~150K per, you have
every right to be *extremely* "not pleased").

You *should* be bitching long and loud at your ISP, because at this point in
the game there is really no excuse for them still letting ANY copies of this
now-well-known worm into your mailbox. Note that through all of this mess,
my server has actually delivered exactly ONE copy -- i.e., the one that
prompted me to update the server's virus definitions file back on 9/18/03;
since then, nada (tho' the server has been kept busy dealing with the crap
storm).
--
Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet01[at]appropriate-tech.net


"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: E-Mail address in "From:" line is INVALID! Remove +SPAMBLOCK to mail.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this E-Mail address is expressly prohibited
under USC Title 47, Section 227. Violators are subject to charge of up to
$1,500 per incident or treble actual costs, whichever is greater.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[Jay T. Blocksom]

On Thu, 25 Sep 2003 01:58:22 GMT, in <alt.comp.shareware.nettamer>, John F

Post by John F Davis
says...

Since 2003-09-18, I have been receiving several hundred MS ebomb virus
bogus security pack/patch update/upgrade messages. I am not pleased. Is
there a truly effective e-mail filter that works with NetTamer?

There are several that work with you ISP even before Netamer sees it,

[snip]

That's is a bit of stretch, at best; but I undertand wht you're trying to
get at.

Post by John F Davis
Mailwasher comes to mine

[snip]

Yuck.

Mailwasher is seriously broken crapware, especially the so-called "bounce
feature" (which turns your system into a robo-spamming menace to the entire
internet, and is ample cause for you to lose your ISP account due to the AUP
violations it commits on your behalf -- the author of this garbage should be
shot).

If you MUST use some sort of "mail preview" utility, try "POP3 Scan
Mailbox", or JBMail (no, I am *not* the "JB" in question there -- it's
written by Jem Berkes). Of course, both of these (like the ones you
mentioned) are Windows-based apps, the latter requiring Win9x/NT4 or later
(POP3 Scan Mailbox wil run under Windows 3.1x).
--
Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet01[at]appropriate-tech.net


"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: E-Mail address in "From:" line is INVALID! Remove +SPAMBLOCK to mail.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this E-Mail address is expressly prohibited
under USC Title 47, Section 227. Violators are subject to charge of up to
$1,500 per incident or treble actual costs, whichever is greater.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -