I see this with Zafi as well. This from another list regarding Zafi: ===== This Hungarian originated virus initiates a Dictionary attack on domain names that if finds on the infected machine. It does not use DNS to find the MX records, but instead guesses the host name (such as 'mail' or 'mx'), prepends it to the domain name, and then proceeds with it's dirty work using Hungarian sounding names. =====
Thus this particular virus will bypass gateway machines and send directly to the hostname "A" record, which is typically pointed to the IMail server so that customers can reach the IMail server via their e-mail clients. That's one of the reasons why we do virus scanning on our gateway machines and our IMail servers.
WORD!!! Me too... I'm glad I'm not the only one seeing this!!
Thanks,
Russ
--- [This E-mail scanned for viruses by Declude Virus]
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
