|
John,
Been there..doing that. My concern is that Customer
#2's email will be incorrectly blocked due to DECCON's "memory". I felt it would
be safer to stop the SMTP service before killing the deccon
instance.
-M
---
"Problems are only opportunities in work
clothes." -- Henry J. Kaiser
----- Original Message -----
Sent: Monday, February 07, 2005 2:53
AM
Subject: RE: [Declude.Virus] HiJack
Question
First, you should
be actively monitoring the HOLD2 directory. There are some scripts on the
Declude Tools sight that can be used for this.
Second, you do not
need to cycle the SMTP service. However, you will have to rename the HOLD2
files if you want to release them and then manually move
them.
John
Tolmachoff
Engineer/Consultant/Owner
eServices For
You
-----Original
Message-----
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Marc
Sent: Sunday, February 06,
2005 11:12
PM
To: declude.virus@declude.com
Subject: [Declude.Virus] HiJack
Question
Scenario: Dialup ISP using dynamic
IP allocation.
Customer #1 using IP address
of 1.2.3.4 trips threshold #2. Logs off.
Customer #2 logs on and obtains
the same IP that customer #1 had (1.2.3.4)
My understanding is that HiJack
will block Customer #2's outbound email as well. At least until the
Declude Console (DECCON.EXE) is closed.
Question: If this is true, is it
acceptable practice to cleanup HOLD2, stop the SMTP service, kill the DECCON
PID and restart the SMTP service? Thx.
-M
---
"The toughest
part of getting to the top of the ladder, is getting through the crowd at the
bottom." -- unknown
|
