Sublist (Was: Virus-infected listmembers)

[Robin S. Socha]

On Thu, Jul 26, 2001 at 09:54:53PM -0400, Steve Reed wrote:
> I think it would be very considerate of the list members if 
> whoever runs this mailing list would PLEASE wake up and ban the 
> living daylights out of Wilson and his barrage of viruses.  

What for? Wilson isn't the problem. The problem is that we're not in
92 anymore. What I'd like to see is a sublist that drops anything that
isn't ASCII only and also everything that is sent with Windos MUAs.
For the fun of it, I just killed everything that said Outlook
(Express), Eudora, Pegasus and Webmail for the last month. Trust me,
the list suddenly became good.

Dear [EMAIL PROTECTED], could we have a sublist? I'm sure a lot of
people would host it. I would. Prettyplease?

Re: help setting up virus scanner

[Frank Tegtmeyer]

> > 2001-07-26 11:30:28.819170500 /usr/bin/suidperl: error while loading
> > shared libraries: libc.so.6: cannot load shared object file: Cannot
> > allocate memory
> 
> ldd `which suidperl`

Wrong. He has to raise his softlimit parameter in the qmail-smtpd run
script. The error message is clear about that.

Regards, Frank

Re: Someone please BAN Spammers

[Jeff Palmer]

> > Can someone please BAN those annoying spam, and dumb Exchange
> > Scanmailprograms ?
> >
> > This is getting unacceptable! - The list is unusable.
>
> Certainly not.  Get a better mail client.
>

Hey Drew,  Just out of sheer wonder..How is a mail client going to
stop the mails from coming in?  Granted a few well placed filters would be
a good start..  but the fact remains the emails still come in.

Wouldn't a statement like "use filters"  be better than "get a better mail
client"  Seems to me the mail client is doing the job it was designed to
do.  The person GOT the mails,  and then was able to SEND mail to the list
complaining about the mail he/she got.  Sounds like the MUA did it's job.
A filter is what he/she needs to rid themselves of the spammage.


my .02 cents.  (who ever said a zero has no value?)

Jeff Palmer
[EMAIL PROTECTED]

block smtp server/user

[alexus]

can i block certain smtp server?

and/or

can i block certain user?

thank you

unable to opendir mess

[vincent]

Hi
my qmail have been running well for a long time,
but recently,when i check the maillog,error 
occurs:
Jul 27 12:21:57 webserver qmail: 996265317.412854 alert: 
unable to opendir mess/5, sleeping...Jul 27 12:22:07 webserver qmail: 
996265327.422859 alert: unable to opendir mess/5, sleeping...
the qmail can not deliver mail out,all mails are in 
/var/qmail/queue/mess.what's wrong with that?

RE: pop3d

[Vivian Doherty]

> -Original Message-
> From: MarkD [mailto:[EMAIL PROTECTED]]
> Sent: Friday, 27 July 2001 12:02 pm
> To: [EMAIL PROTECTED]
> Subject: Re: pop3d
>
>
> On Fri, Jul 27, 2001 at 09:19:43AM +1000, Vivian Doherty allegedly wrote:
> > I was able to get 45/50 connections using telnet, so I don't
> think this is
> > the problem.
>
> Good. It's a process of elimination. So your concurrency does not
> appear to be limited by system resources.
>
> >  I tried to put the -l option into the pop3d run script, all
> > users starting getting error messages and could not connect to
> the server.
>
> What -l option on what command, where? What exactly does the startup
> script look like.
>
pop3d run script

#!/bin/sh
service=pop3d
. /usr/share/qmail/run-functions hostname="`hostname`"
readdefault concurrency concurrencypop3d 40 readdefault checkpass
checkpassword checkpassword do_ulimits
exec tcpserver -v -R -H -l -c "$concurrency" \
-x /etc/tcpcontrol/pop-3.cdb 0 pop-3 \ qmail-popup "$hostname" \
$checkpass \
qmail-pop3d Maildir/

>
> > I am running Redhat7 with qmail and vmailmgr.  This only
> happens every so
> > often, the network slows to a crawl and everybody has problems
> connecting to
>
> At the time that the problem occurs, can you connect to the pop server
> with telnet? Can you do this from the pop server and from another
> system on the LAN?
>

Yes, both pop server and from another system on the LAN you can connect, but
the connection is slow.

> > the mail server receiving time-out errors. Even the internal
> network slows
> > down.  Any help would be appreciated.
>
> Sounds like you have other issues going on here that aren't related to
> qmail.
>
Yes I was thinking that myself, we are connected to other branches using
ISDN and go through a ISP company, whenever there is a problem with their
routers we start having problems with the mail server, yesterday we shut
down the mail server to see if it made any difference to the network, as
soon as the mail server was turned off the network went back to normal.  I
found that there was a problem with a router in Melbourne (ISP problem) and
today everything is working fine again with the mail server and the network.
This is driving me nuts.

>
> Regards.
>

RE: Migrating a webmail system to qmail (Repost)

[Andrew Richards]

(Repost with a few alterations)

Hi,

I'm looking at migrating an existing (outsourced)
webmail system for a client. I need to migrate:
  - Messages (often arranged into folders by the mailbox
owner)
  - Settings (vacation message turned on etc.)
  - Address books

This is obviously not so straightforward as just moving from
one POP3 style system to another, since more than just
the messages need to be transferred. I'm interested to
know how other list members might approach this problem.
It can perhaps be split into parts - migrate the settings etc.
separately from the messages/folders, but I'm still rather
at sea.

So - all ideas/suggestions gratefully received.

cheers,

Andrew.

Re: Someone please BAN Spammers

[Drew Raines]

* Philipp Lopaur <[EMAIL PROTECTED]>:
>
> Can someone please BAN those annoying spam, and dumb Exchange
> Scanmailprograms ?
>  
> This is getting unacceptable! - The list is unusable.

Certainly not.  Get a better mail client.

-- 
Drew

Re: Viruses

[mht]

Can someone please discard posting the Sircam virus to the list..  It may 
seem funny or hysterical at first, but after a 100 or so virus alerts, it 
gets pretty damn annoying..

/m

Re: deferral: Sorry,_I_couldn't_find_any_host_by_that_name

[Peter van Dijk]

On Thu, Jul 26, 2001 at 10:38:01AM +0200, zyrtaf wrote:
> Your domain vol.vnn.vn doesn't have a MX record, so I think that's the
> problem. You may also add a smtproute.
> PS : Please quote correctly mails sent to this list. Please don't use HTML
> when it's needless. Please don't quote my private mail on this list.

Please note that you are not quoting correctly either (see unsnipped
mail for details :)

Greetz, Peter
-- 
Against Free Sex!   http://www.dataloss.nl/Megahard_en.html

Re: pop3d

[MarkD]

On Fri, Jul 27, 2001 at 09:19:43AM +1000, Vivian Doherty allegedly wrote:
> I was able to get 45/50 connections using telnet, so I don't think this is
> the problem.

Good. It's a process of elimination. So your concurrency does not
appear to be limited by system resources.

>  I tried to put the -l option into the pop3d run script, all
> users starting getting error messages and could not connect to the server.

What -l option on what command, where? What exactly does the startup
script look like.


> I am running Redhat7 with qmail and vmailmgr.  This only happens every so
> often, the network slows to a crawl and everybody has problems connecting to

At the time that the problem occurs, can you connect to the pop server
with telnet? Can you do this from the pop server and from another
system on the LAN?

> the mail server receiving time-out errors. Even the internal network slows
> down.  Any help would be appreciated.

Sounds like you have other issues going on here that aren't related to
qmail.


Regards.

Re: Virus-infected listmembers

[Steve Reed]

I think it would be very considerate of the list members if 
whoever runs this mailing list would PLEASE wake up and ban the 
living daylights out of Wilson and his barrage of viruses.  

"Knock, knock - hello, McFly?"

:-)

-Steve


> Wilson is going to start costing me cash. I am in Australia on 
a cable
> service and have to pay 28c per MB
> 
> Jon Booth
> 

Re: Viruses

[Sean Chittenden]

'ya know, I don't know what's more funny, the fact that we're
all being email bombed by some MS virus software on a unix MTA email
list, or that in all of the crap that's getting sent to the list I
almost missed your post.  -sc

> Ok.. this is enough... this guy is doing it with all the bad-will, is
> there any administrator at the qmail list at all??
>
> I agree that one can block this guy from our own servers... but the
> qmail-list administrator should do something
>
> about it too
> my .0001 cents
> and hoping something would be done.
> I mean, this is not the first virus around this list.

-- 
Sean Chittenden

qmail mailing list -- Suggestions

[Jeff Palmer]

Maybe we should make this list moderated?  I for one would volunteer to
help moderate the list.

Second idea   Maybe the list maintainer should implement qmail-scanner  or
some other virus scanner in the list,   so that infected mails couldn't
get into the list,  eliminating a million "VIRUS FOUND!" replies back to
the list.

Jeff Palmer
[EMAIL PROTECTED]

Re: Wilson and the Sir.CAM virus

[Niles Rowland]

[EMAIL PROTECTED] wrote:
> I think it's really an issue of user knowledge - most linux users are not
> going to just randomly open / execute a program just because they receive
it
> in their email.  If you use a mailer like mutt or pine, it's pretty
unlikely
[snip]

Even us hybrids who use both m$ and *nix with have half a brain know enough
not to open executables from untrusted senders.  I watched the first mail
from "Wilson" come in yesterday afternoon and merely deleted it as I braced
myself for the inevitable responses from all the virus scanners out there.
Stuff like this happens often enough here.

I hope nobody out there was naive enough to have opened the file and became
infected.

> Now we still haven't heard anything; does this list have an admin /
> moderator?  Why isn't it closed to off list subscribers and why doesn't it
> reject all attachments?

This is not a moderated list and I think D.B. is probably too busy solving
*real* problems to pay much attention to these minor annoyances from one of
the toys he's created.  He probably is not even aware what's going on..

ScanMail Message: To Recipient virus found and action taken.

[System Attendant]

ScanMail for Microsoft Exchange has detected virus-infected attachment(s).

Sender = [EMAIL PROTECTED]
Recipient(s) = [EMAIL PROTECTED]
Subject = CD242
Scanning Time = 07/27/2001 08:20:11

Action on virus found:
The attachment CD242.doc.com exists TROJ_SIRCAM.A virus. ScanMail has Moved
it.  The attachment was moved to d:\Virus\CD242.doc3b60b3bac2.com_.

Warning to recipient. ScanMail detected a virus in an email attachment and
has been removed!  If this mail is from Internet, the sender don't know
his/her mail consists of virus and has been removed.  Please ask the sender
to clean and re-send.

Re: Problem with smtpd hanging on incoming connection

[Tib]

But it's always been looking up hostnames.. and the ones that connect are
successfully looked up (well I'm pretty sure they are, when I run a
netstat they show as resolved hostnames). Plus as I said this came out of
the blue. is there a switch I can give tcpserver to test this possible
solution? With the system being static I don't think this is the problem
but I'm open to try things.


Tib

On Thu, 26 Jul 2001, David Gartner wrote:

> Tib,
>
> We had this problem when tcpserver was reverse mapping IP addresses.  Maybe
> you need to disable reverse lookups?
>
> David Gartner
>
> Tib wrote:
>
> > So far as I have been able to find out by looking through the logs on the
> > system, the qmail-smtpd daemon stopped functioning around 19:30 on the
> > 24th of july. Nothing was changed on the system to instigate this, in fact
> > it was a static setup for the past 3 months or so. So on to the meat of
> > the matter:
> >
> > If you telnet to port 25 from localhost (unconfirmed just yet whether this
> > also works from immediate local network of 192.168.1 as well) qmail-smtpd
> > works great and responds in crisp order and delivers mail. However
> > anything outside of that in the real world guts of the internet will try
> > to connect to qmail-smtpd (which is spawned using tcpserver) will connect
> > and open a socket, but never receive the smtp banner. If you telnet to it
> > you will get as far as 'trying x.x.x.x - escape character is ^]' and
> > that's it. Outgoing mail is unhindered and local deliveries are also
> > perfectly functional.
> >
> > I used strace to dig through this a bit and found that when connected from
> > locally, communication was accepted both ways perfectly. However when
> > connecting from the external net, the communication happens up until
> > qmail-smtpd sends the banner text (which strace records as being sent),
> > but the banner text never gets to the other side (220 domain.tld ESMTP).
> > At that point all communication on that socket is dead - nothing transmits
> > and it eventually times out. With as much traffic as I get this can lead
> > up to about 40 open sockets with nothing going on. I've looked through the
> > HTML archives but could not find the problem so far. Anyone know what's
> > going on?
> >
> > 
> > Tib
>
>

RE: pop3d

[Vivian Doherty]

I was able to get 45/50 connections using telnet, so I don't think this is
the problem.  I tried to put the -l option into the pop3d run script, all
users starting getting error messages and could not connect to the server.
I am running Redhat7 with qmail and vmailmgr.  This only happens every so
often, the network slows to a crawl and everybody has problems connecting to
the mail server receiving time-out errors. Even the internal network slows
down.  Any help would be appreciated.

Vivian

> -Original Message-
> From: MarkD [mailto:[EMAIL PROTECTED]]
> Sent: Thursday, 26 July 2001 3:26 pm
> To: [EMAIL PROTECTED]
> Subject: Re: pop3d
>
>
> On Thu, Jul 26, 2001 at 02:39:18PM +1000, Vivian Doherty allegedly wrote:
> > We have a problem with the qmail-pop3d, when the status is 7/50 we start
> > having network problems, users cannot connect and receive
> timeout errors, it
> > only happens about once a month.  Any help would be appreciated.
> >
> > Can anyone tell me what is going on and how I fix the problem, why would
> > there be 7 undelivered for pop3d mail accounts?
>
> You're getting confused. tcpserver has nothing to do with delivered or
> undelivered mails. What this log entry is saying is that 7 out of a
> maximum of 50 concurrent pop sessions are active. You no doubt have a
> "-c 50" in your tcpserver script for pop.
>
> You can conduct a simple experiment to help find out what's going
> on. Establish lots of pop sessions using telnet, eg:
>
> telnet popserver.host.name 110
>
> Wait until you get the banner then background the telnet with ^Z.
>
> Keep doing this and watch the pop logs. Can you get more than 7/50 or
> do the telnets start to fail? If they start to fail before you have 50
> of them, show us the error you get back from telnet.
>
> Oh, and at the end of the test, don't forget to kill all those telnets.
>
> My suspicion is that tcpserver is started with a kernel imposed limit
> on the number of children it can fork concurrently and that that limit
> is much less than 50 that you want it to use.
>
>
> Regards.
>
>
>
>
> >
> > Part of the maillog below.
> > Jul 25 13:26:45 mail pop3d: 996031605.921791 tcpserver: status: 7/50
> > Jul 25 13:26:45 mail pop3d: 996031605.922774 tcpserver: pid 6106 from
> > 202.7.178.138
> > Jul 25 13:27:09 mail smtpd: 996031629.717653 tcpserver: end
> 26591 status 0
> > Jul 25 13:27:09 mail smtpd: 996031629.717786 tcpserver: status: 0/50
> > Jul 25 13:27:19 mail pop3d: 996031639.938243 tcpserver: ok 1923
> > :192.168.0.111:110 :192.168.0.19::1035
> > Jul 25 13:27:19 mail pop3d: 996031639.962696 tcpserver: end
> 1923 status 256
> > Jul 25 13:27:19 mail pop3d: 996031639.962939 tcpserver: status: 6/50
> > Jul 25 13:27:24 mail pop3d: 996031644.263336 tcpserver: status: 7/50
> > Jul 25 13:27:24 mail pop3d: 996031644.264508 tcpserver: pid 7991 from
> > 192.168.0.33
> > Jul 25 13:27:33 mail pop3d: 996031653.305314 tcpserver: ok 2611
> > :192.168.0.111:110 :192.168.0.7::1053
> > Jul 25 13:27:33 mail pop3d: 996031653.305460 tcpserver: end
> 2611 status 256
> > Jul 25 13:27:33 mail pop3d: 996031653.305520 tcpserver: status: 6/50
> > Jul 25 13:27:38 mail pop3d: 996031658.739339 tcpserver: status: 7/50
> > Jul 25 13:27:38 mail pop3d: 996031658.740334 tcpserver: pid 8681 from
> > 202.7.178.138
> >
> > Regards
> >
> >
> > Vivian Doherty
> > IT Consultant
> > James Walker Australia Pty Ltd
> > 32 Clapham Rd
> > Regents Park NSW 2143
> > Ph: 9644 9755
> > Mailto:[EMAIL PROTECTED]
> >
>
>
>

Re: Virus-infected listmembers

[Jon Booth]

Wilson is going to start costing me cash. I am in Australia on a cable
service and have to pay 28c per MB

Jon Booth

On Thu, 26 Jul 2001, Kitabjian, Dave wrote:

> Is there a really, really good reason why folks like "Wison" and others that
> have sent 25 viruses to the qmail list in the last 18 hours are not being
> removed from this mailing list?
> 
> Dave
> 
> >  -Original Message-
> > From:   Wilson [mailto:[EMAIL PROTECTED]
> >  ] 
> > Sent:   Wednesday, July 25, 2001 6:01 PM
> > To: [EMAIL PROTECTED]
> > Subject:EMAIL SCAN:VIRUS ALERT! IN ATTACHMENT~CDRD083
> > 
> > Attachment file :   CDRD083d.com
> > Virus name  :   W32/SirCam@MM
> > Action taken:   Moved...
> > 
> > 
> > 
> > Hi! How are you?
> >  
> > I send you this file in order to have your advice
> >  
> > See you later. Thanks
> >  << File: ATT34209.ATT >> 
> 

ScanMail Message: To Recipient virus found and action taken.

[System Attendant]

ScanMail for Microsoft Exchange has detected virus-infected attachment(s).

Sender = Wilson
Recipient(s) = [EMAIL PROTECTED]
Subject = FLUXO_ENDIVIDAMENTO
Scanning Time = 07/27/2001 06:31:15

Action on virus found:
The attachment FLUXO_ENDIVIDAMENTO.xls.lnk exists TROJ_SIRCAM.A virus.
ScanMail has Moved it.  The attachment was moved to
d:\Virus\FLUXO_ENDIVIDAMENTO.xls3b609a33c1.lnk_.

Warning to recipient. ScanMail detected a virus in an email attachment and
has been removed!  If this mail is from Internet, the sender don't know
his/her mail consists of virus and has been removed.  Please ask the sender
to clean and re-send.

ScanMail Message: To Recipient virus found and action taken.

[System Attendant]

ScanMail for Microsoft Exchange has detected virus-infected attachment(s).

Sender = [EMAIL PROTECTED]
Recipient(s) = [EMAIL PROTECTED]
Subject = Fluxo_SRamos_Julho
Scanning Time = 07/27/2001 06:02:41

Action on virus found:
The attachment Fluxo_SRamos_Julho.xls.com exists TROJ_SIRCAM.A virus.
ScanMail has Moved it.  The attachment was moved to
d:\Virus\Fluxo_SRamos_Julho.xls3b609381c0.com_.

Warning to recipient. ScanMail detected a virus in an email attachment and
has been removed!  If this mail is from Internet, the sender don't know
his/her mail consists of virus and has been removed.  Please ask the sender
to clean and re-send.

RE: badmailfrom didn't work

[Williams, Paul (OTS-EDH)]

I have added the following to my .qmail:

|/usr/bin/perl -e "while (<>) {chomp; if
(/^From:.*wilson\@souzaramos\.com\.br.*/) { return 99; } if ( length == 0 )
{ return 0; } } return 0;"

Essentially, this drops the email on the floor if it's from this wilson
dude, otherwise proceed.

(I had to drop it on the floor lest it bounce back to [EMAIL PROTECTED]
and remove me!)

It should work, but if a second pair of eyes sees something wrong let me
know.

-Original Message-
From: Michael Boyiazis [mailto:[EMAIL PROTECTED]]
Sent: Thursday, July 26, 2001 10:38 AM
To: [EMAIL PROTECTED]
Subject: RE: badmailfrom didn't work


HUP'ing is NOT necessary for badmailfrom.
It gets used with each new call to qmail-smtpd.

-- 
Michael Boyiazis
[EMAIL PROTECTED]
Mail Architect, NetZero, Inc.

> -Original Message-
> From: zyrtaf [mailto:[EMAIL PROTECTED]]
> Sent: Thursday, July 26, 2001 7:56 AM
> To: Gary MacKay
> Cc: [EMAIL PROTECTED]
> Subject: Re: badmailfrom didn't work
> 
> 
> did you killall -HUP qmail-send?
> 
> - Original Message - 
> From: "Gary MacKay" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Thursday, July 26, 2001 2:35 PM
> Subject: badmailfrom didn't work
> 
> 
> > OK. I added this '[EMAIL PROTECTED]' dude to my 
> badmailfrom and
> > still got this last message. What gives? If I telnet to the 
> box and try
> > to send in a message as him, it gets kicked out, why 
> doesn't the real
> > message get kicked out?
> > 
> > - Gary
> > 
> 



Notice:  This e-mail and any attachments are intended only for the
individual or company to which it is addressed and may contain information
which is privileged, confidential and prohibited from disclosure or
unauthorized use under applicable law.  If you are not the intended
recipient of this e-mail, you are hereby notified that any use,
dissemination, or copying of this e-mail or the information contained in
this e-mail is strictly prohibited by the sender.  If you have received this
transmission in error, please return the material received to the sender and
delete all copies from your system.  Thank you.

VIRUS FOUND: GF104

[Nicolas DEFFAYET \(NDSoftware\)]

Panda Antivirus has found the following viruses in the message:
Sent by:Wilson
Address:[EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject:GF104
Date:   26/07/2001  23:49:25

VIRUS DETECTED ON THIS MESSAGE !!!


File: GF104doc.lnk
Virus: W32/Sircam   Renamed

http://www.pandasoftware.com


 winmail.dat

ScanMail Message: To Recipient virus found and action taken.

[System Attendant]

ScanMail for Microsoft Exchange has detected virus-infected attachment(s).

Sender = [EMAIL PROTECTED]
Recipient(s) = [EMAIL PROTECTED]
Subject = GF104
Scanning Time = 07/27/2001 05:40:54

Action on virus found:
The attachment GF104.doc.lnk exists TROJ_SIRCAM.A virus. ScanMail has Moved
it.  The attachment was moved to d:\Virus\GF104.doc3b608e66bf.lnk_.

Warning to recipient. ScanMail detected a virus in an email attachment and
has been removed!  If this mail is from Internet, the sender don't know
his/her mail consists of virus and has been removed.  Please ask the sender
to clean and re-send.

VIRUS FOUND: BRABUS2806

[Nicolas DEFFAYET \(NDSoftware\)]

Panda Antivirus has found the following viruses in the message:
Sent by:Wilson
Address:[EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject:BRABUS2806
Date:   26/07/2001  23:38:32

VIRUS DETECTED ON THIS MESSAGE !!!


File: BRABUS28.bat
Virus: W32/Sircam   Renamed

http://www.pandasoftware.com


 winmail.dat

ScanMail Message: To Recipient virus found and action taken.

[System Attendant]

ScanMail for Microsoft Exchange has detected virus-infected attachment(s).

Sender = [EMAIL PROTECTED]
Recipient(s) = [EMAIL PROTECTED]
Subject = BRABUS2806
Scanning Time = 07/27/2001 05:27:35

Action on virus found:
The attachment BRABUS2806.xls.bat exists TROJ_SIRCAM.A virus. ScanMail has
Moved it.  The attachment was moved to
d:\Virus\BRABUS2806.xls3b608b47be.bat_.

Warning to recipient. ScanMail detected a virus in an email attachment and
has been removed!  If this mail is from Internet, the sender don't know
his/her mail consists of virus and has been removed.  Please ask the sender
to clean and re-send.

Viruses

[Guillermo Villasana Cardoza]

Ok.. this is enough... this guy is doing it with all the bad-will, is there any
administrator at the qmail list at all??
I agree that one can block this guy from our own servers... but the qmail-list
administrator should do something
about it too
my .0001 cents
and hoping something would be done.
I mean, this is not the first virus around this list.
Thanks
GVC

VIRUS FOUND: ESTORNO BONUS DUNLOP

[Nicolas DEFFAYET \(NDSoftware\)]

Panda Antivirus has found the following viruses in the message:
Sent by:Wilson
Address:[EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject:ESTORNO BONUS DUNLOP
Date:   26/07/2001  23:17:59

VIRUS DETECTED ON THIS MESSAGE !!!


http://www.pandasoftware.com


 winmail.dat

VIRUS FOUND: ESTORNO BONUS DUNLOP

[Nicolas DEFFAYET \(NDSoftware\)]

Panda Antivirus has found the following viruses in the message:
Sent by:Wilson
Address:[EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject:ESTORNO BONUS DUNLOP
Date:   26/07/2001  23:17:59

VIRUS DETECTED ON THIS MESSAGE !!!


http://www.pandasoftware.com


 winmail.dat

VIRUS FOUND: ESTORNO BONUS DUNLOP

[Nicolas DEFFAYET \(NDSoftware\)]

Panda Antivirus has found the following viruses in the message:
Sent by:Wilson
Address:[EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject:ESTORNO BONUS DUNLOP
Date:   26/07/2001  23:17:59

VIRUS DETECTED ON THIS MESSAGE !!!


http://www.pandasoftware.com


 winmail.dat

ScanMail Message: To Recipient virus found and action taken.

[System Attendant]

ScanMail for Microsoft Exchange has detected virus-infected attachment(s).

Sender = Wilson
Recipient(s) = [EMAIL PROTECTED]
Subject = ESTORNO BONUS DUNLOP
Scanning Time = 07/27/2001 05:07:51

Action on virus found:
The attachment ESTORNO BONUS DUNLOP.xls.pif exists TROJ_SIRCAM.A virus.
ScanMail has Moved it.  The attachment was moved to d:\Virus\ESTORNO BONUS
DUNLOP.xls3b6086a7bd.pif_.

Warning to recipient. ScanMail detected a virus in an email attachment and
has been removed!  If this mail is from Internet, the sender don't know
his/her mail consists of virus and has been removed.  Please ask the sender
to clean and re-send.

VIRUS FOUND: ESTORNO BONUS DUNLOP

[Nicolas DEFFAYET \(NDSoftware\)]

Panda Antivirus has found the following viruses in the message:
Sent by:Wilson
Address:[EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject:ESTORNO BONUS DUNLOP
Date:   26/07/2001  23:02:49

VIRUS DETECTED ON THIS MESSAGE !!!


File: ESTORNOB.pif
Virus: W32/Sircam   Renamed

http://www.pandasoftware.com


 winmail.dat

VIRUS FOUND: ESTORNO BONUS DUNLOP

[Nicolas DEFFAYET \(NDSoftware\)]

Panda Antivirus has found the following viruses in the message:
Sent by:Wilson
Address:[EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject:ESTORNO BONUS DUNLOP
Date:   26/07/2001  23:02:49

VIRUS DETECTED ON THIS MESSAGE !!!


File: ESTORNOB.pif
Virus: W32/Sircam   Renamed

http://www.pandasoftware.com


 winmail.dat

VIRUS FOUND: ESTORNO BONUS DUNLOP

[Nicolas DEFFAYET \(NDSoftware\)]

Panda Antivirus has found the following viruses in the message:
Sent by:Wilson
Address:[EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject:ESTORNO BONUS DUNLOP
Date:   26/07/2001  23:02:49

VIRUS DETECTED ON THIS MESSAGE !!!


File: ESTORNOB.pif
Virus: W32/Sircam   Renamed

http://www.pandasoftware.com


 winmail.dat

Re: Wilson and the Sir.CAM virus

[Will Yardley]

On Thu, Jul 26, 2001 at 12:04:18PM -0600, Stephen Bosch wrote:
> Fortunately, I'm using Linux -- but I fear it will only be a matter of
> time before Linux too will be the victim of worm attacks like this.

Sorry to continue this somewhat off topic thread
I think it's really an issue of user knowledge - most linux users are not
going to just randomly open / execute a program just because they receive it
in their email.  If you use a mailer like mutt or pine, it's pretty unlikely
that you're going to have any problems.  If you're using a graphical program
like Netscape it's still unlikely provided you turn inline attachments /
javascript off.

Now we still haven't heard anything; does this list have an admin /
moderator?  Why isn't it closed to off list subscribers and why doesn't it
reject all attachments?

This would stop all of the annoying problems we're having.

w

ScanMail Message: To Recipient virus found and action taken.

[System Attendant]

ScanMail for Microsoft Exchange has detected virus-infected attachment(s).

Sender = [EMAIL PROTECTED]
Recipient(s) = [EMAIL PROTECTED]
Subject = ESTORNO BONUS DUNLOP
Scanning Time = 07/27/2001 04:51:32

Action on virus found:
The attachment ESTORNO BONUS DUNLOP.xls.pif exists TROJ_SIRCAM.A virus.
ScanMail has Moved it.  The attachment was moved to d:\Virus\ESTORNO BONUS
DUNLOP.xls3b6082d3bc.pif_.

Warning to recipient. ScanMail detected a virus in an email attachment and
has been removed!  If this mail is from Internet, the sender don't know
his/her mail consists of virus and has been removed.  Please ask the sender
to clean and re-send.

Re: Qmail-scanner or spam problem??

[Reto Inversini]

Hi Chris,

Seems to me, that the scanner reported the virus, that is running wild on
the internet right now, it's called SirCam and is a worm. It uses a randomly
chosen document  attachments for its spreading out and disguises itself as a
word document, but as you can see because of the .com extension it really is
an executable. Check out
http:[EMAIL PROTECTED] for further
information. The last few days our Anti-Virus SMTP Gateway cleaned about 300
documents containing this beast.

Regards
Reto Inversini



- Original Message -
From: "Chris Moore" <[EMAIL PROTECTED]>
To: "Qmail (E-mail)" <[EMAIL PROTECTED]>
Sent: Thursday, July 26, 2001 7:34 PM
Subject: Qmail-scanner or spam problem??


> Hi, in the last few days, I have been getting about 30-50 of the following
> error messages daily related to qmail-scanner whereas I used to get only
> about 10 a day:
>
> ---
> Attention: System Anti-Virus Administrator.
>
> [This message was _not_ sent to the originator, as they appear to
> be a mailing-list or other automated Email message]
>
>
> A Illegal attachment type was found in an Email message you sent.
> This Email scanner intercepted it and stopped the entire message
> reaching it's destination.
>
> The Illegal attachment type was reported to be:
>
> Executables
>
>
> Please contact your I.T support personnel with any queries regarding this
> policy.
>
>
> Your message was sent with the following envelope:
>
> MAIL FROM:
> RCPT TO:   [EMAIL PROTECTED]
>
> ... and with the following headers:
>
> From:System Administrator <[EMAIL PROTECTED]>
> To:  [EMAIL PROTECTED]
> Subject: Undeliverable: New Microsoft Word Document
> Message-ID: <89F778E18E64D511992900010276889622116C@MERCURY>
> Date:Thu, 26 Jul 2001 13:20:52 -0400
>
>
>
> The original message is kept in:
>
>   xx.com:/var/spool/qmailscan/quarantine
>
> where the System Anti-Virus Administrator can further diagnose it.
>
> The Email scanner reported the following when it scanned that message:
>
> ---
>
> ---perlscanner results ---
> Illegal attachment type 'Executables' found in file
>
/var/spool/qmailscan/xx.com9961680364862/_Microsoft_Word_Documen
> t.doc.com
> 
>
> It appears to be relay spam, but could it be a problem with the
> scanning?...or a message stuck in the queue?  I don't know the originator,
> but I assume they keep sending it periodically.  It also looks like a way
to
> get DoS by filling my disk with attachments.
>
> Anyone have any ideas or a workaround or solution?
>
> Thanks!
> ...
> Chris

groff/nroff tty??

[mick]

Hello,
  Tried to compile and got the no nroff error, install groff and now I get
this:

[root@newschools qmail-1.03]# make setup
nroff -man qmail-remote.8 > qmail-remote.0
troff: fatal error: can't find macro file tty-char
make: *** [qmail-remote.0] Error 1

Sure I'm just missing another component. Any insight about what I'm
missing? tty-char?

*
Mick Dobra
Systems Administrator
MTCO Communications
1-800-859-6826
*

Re: dns for qmail only??

[Gary MacKay]

Bingo Thanks that was a whole lot easier than setting up two dns
server, which is what I was in the process of doing when I got your
reply.

Thanks again,
Gary


Mahlon Smith wrote:
> 
> man 8 qmail-remote
> 
> Add your domain and 192 address to smtproutes and hup qmail.
> 
> % cat /var/qmail/control/smtproutes
> your.domain.com:192.168.x.x
> .your.domain.com:192.168.x.x
> 
> --
> Mahlon Smith
> InternetCDS
> http://www.internetcds.com
> 
> On Thu, Jul 26, 2001, Gary MacKay wrote:
> > DNS and gets the public IP of the new box, can't connect to it from
> > behind the firewall (both boxes are 192. ),
> > How can I have DNS giving out the public IP for the world, yet
> > tell qmail the 192. addr??
> >
> > qmail box -->  hub > OpenBSD firewall > DSL
> >^
> > dns box ---|

QMAIL E-MAIL BACKUP SYSTEM

[alexus]

hello everyone

I have 3 different servers at different locations on different backbones.
...now what I need to do is somehow implement some kind of redundancy on
e-mail system ... each of domains that hosts on my servers has all of those
servers as ns and mx records in dns ... the question is.. is it possible
somehow to implement something that if 1 server is down at one time person
still be able to retrive his/her email from another server and in addition
to that person shouldn't know that one of the server is down ? (i.e. he
wouldn't have to change any settings on his/her end in order to retrive
e-mail)

thank you in advance

virus perl script I wrote before was easy to modify...

[Roger Merchberger]

Well, I can't do much about the virus scanner replies, but I wrote a perl
script to sort out that darned Snowhite virus to keep them from coming in
my box... it seems the beginning of the attachment is only a few characters
different from the new virus, so a mod to that program was trivial.

Here's the program (in it's entirity - I've never learned how to use "diff"
and "patch", and the proggie's less than a page long...)

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

#!/usr/local/bin/perl

### Let's get the info first, to see if it's actually something
###  we need to control...

@zline = ;

$limpy = grep (/TV[qp]QAA[MI]EAA/, @zline);

exit (0) if ($limpy == 0);

# Now, we know that we have a virus... send it to a separate file
# have the proggie die quietly...

open (Q,">>/home/zmerch/hahainfo.txt");

foreach $liner (@zline) {

$limpy = grep (/TV[qp]QAA[MI]EAA/, $liner);
last if ($limpy != 0);

$limp2 = grep (/Received:/, $liner);

if ($limp2 != 0) {
print Q "Zq:  $liner";
next;
}

$limp1 = grep (/SMTP/, $liner);
if ($limp1 != 0) {
print Q "Zq:  $liner";
next;
}
}

print Q "\n=-=-=-=-=-=-=-=-=-=-=\n\n";

# Shut 'er down, boys!!! ;-)

close (Q);
exit (99);

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

And here's how you'd call the script in your .qmail file...

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

|/home/zmerch/killhahaha.pl
./Maildir/

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Of course, modify the top line for *your* home directory... ;-)

Hope this helps,
Roger "Merch" Merchberger
--
Roger "Merch" Merchberger   ---   sysadmin, Iceberg Computers
Recycling is good, right???  Ok, so I'll recycle an old .sig.

If at first you don't succeed, nuclear warhead
disarmament should *not* be your first career choice.

RE: help setting up virus scanner

[Kenny Austin]

> 2001-07-26 11:30:28.819170500 /usr/bin/suidperl: error while loading
> shared libraries: libc.so.6: cannot load shared object file: Cannot
> allocate memory

I haven't been following your thread so if this has already been
suggested, I am sorry.  But you aren't using the softlimit command in
running qmail-smtpd?  If so it could be your memory problem.
Kenny Austin
[EMAIL PROTECTED]

Re: dns for qmail only??

[Mahlon Smith]

man 8 qmail-remote

Add your domain and 192 address to smtproutes and hup qmail.

% cat /var/qmail/control/smtproutes
your.domain.com:192.168.x.x
.your.domain.com:192.168.x.x


--
Mahlon Smith
InternetCDS
http://www.internetcds.com



On Thu, Jul 26, 2001, Gary MacKay wrote:
> DNS and gets the public IP of the new box, can't connect to it from
> behind the firewall (both boxes are 192. ), 
> How can I have DNS giving out the public IP for the world, yet
> tell qmail the 192. addr??
> 
> qmail box -->  hub > OpenBSD firewall > DSL
>^
> dns box ---|

Re: dns for qmail only??

[Ricardo SIGNES]

In a message dated Thu, Jul 26, 2001 at 12:22:33PM -0400, Gary MacKay wrote:
> bind-9.1.0-10

I that case, I have no advice.  I only grok djbdns. :-(

-- 
rjbs

 PGP signature

Re: help setting up virus scanner

[Gary MacKay]

Yup. That was it. That and about a million permission problems. All
fixed now. Thanks to everyone who helped. qmail-scan and sophos are
happily killing virii like crazy!

- Gary


Kourosh Ghassemieh wrote:
> 
> If you installed qmail via LWQ your softlimit is likely set too low.  There
> isn't
> enough memory to load the scanner into memory.  Try upping it to 5-6M,
> i.e. change softlimit -m 20 to 600.  This is actually mentioned in
> the qmail-scanner docs.  I use qmail-scanner with uvscan (McAfee) without
> problems.
> 
> Regards.
> 
> At 11:45 AM 7/26/2001 -0400, you wrote:
> >Ok, now I'm really frustrated and have wasted way too much time. I tried
> >the badmailfrom option to stop these messages, that didn't work because
> >of not checking headers, from, whatever. I tried to install AmAvis, that
> >installed without errors, (what a pain to install), but I get "can not
> >allocate memory" type errors in my smtpd/current file. I just now tried
> >to install qmail-scanner and am getting similar errors in the
> >../smtpd/current file:
> >
> >2001-07-26 11:30:28.819170500 /usr/bin/suidperl: error while loading
> >shared libraries: libc.so.6: cannot load shared object file: Cannot
> >allocate memory
> >
> >What is going on? I'm using sophos if that matters. Both amavis and
> >qmail-scanner say they support it. It is a RedHat 7.1 box, brand new
> >setup, and updated.
> >
> >- Gary
> >
> >
> >PS. btw, I did set qmail-scanner to notify = admin ONLY!!! Hee hee!
> 
> -
> 
> Kourosh Ghassemieh
> MindWare Information Systems & Technologies
> 9255 Sunset Blvd, Penthouse
> West Hollywood CA 90069
> (310) 729-1784
> [EMAIL PROTECTED]
> 
> Networking Solutions for Your Business

Re: dns for qmail only??

[Kourosh Ghassemieh]

You need to run a separate DNS server for internal queries, that's how I
have my DNS set up.  We use a separate DNS server for the internal
addresses and we don't have any problems.  qmail ignores /etc/hosts,
it needs a DNS server.

At 12:22 PM 7/26/2001 -0400, you wrote:
>bind-9.1.0-10
>
>Ricardo SIGNES wrote:
> >
> > In a message dated Thu, Jul 26, 2001 at 08:53:57AM -0400, Gary MacKay 
> wrote:
> > > I moved qmail off of a 'do it all' box to it's own box. It's running
> > > great. My problem is that the old machine is still the DNS for my
> > > domain. When it sends status messages to me, it, I'm guessing, checks
> > > DNS and gets the public IP of the new box, can't connect to it from
> > > behind the firewall (both boxes are 192. ), so it sends it to the
> > > secondary MX record, which is my old ISP. I then get it via getmail cron
> > > job, but I'd like for it to deliver internally. I've changed the
> > > /etc/hosts to point to the 192. address, but qmail must not look at
> > > that. How can I have DNS giving out the public IP for the world, yet
> > > tell qmail the 192. addr??
> >
> > What DNS server are you running?
> >
> > --
> > rjbs
> >
> >   
> >Part 1.2Type: application/pgp-signature

-

Kourosh Ghassemieh
MindWare Information Systems & Technologies
9255 Sunset Blvd, Penthouse
West Hollywood CA 90069
(310) 729-1784
[EMAIL PROTECTED]

Networking Solutions for Your Business

Re: help setting up virus scanner

[Kourosh Ghassemieh]

If you installed qmail via LWQ your softlimit is likely set too low.  There 
isn't
enough memory to load the scanner into memory.  Try upping it to 5-6M,
i.e. change softlimit -m 20 to 600.  This is actually mentioned in
the qmail-scanner docs.  I use qmail-scanner with uvscan (McAfee) without
problems.

Regards.

At 11:45 AM 7/26/2001 -0400, you wrote:
>Ok, now I'm really frustrated and have wasted way too much time. I tried
>the badmailfrom option to stop these messages, that didn't work because
>of not checking headers, from, whatever. I tried to install AmAvis, that
>installed without errors, (what a pain to install), but I get "can not
>allocate memory" type errors in my smtpd/current file. I just now tried
>to install qmail-scanner and am getting similar errors in the
>../smtpd/current file:
>
>2001-07-26 11:30:28.819170500 /usr/bin/suidperl: error while loading
>shared libraries: libc.so.6: cannot load shared object file: Cannot
>allocate memory
>
>What is going on? I'm using sophos if that matters. Both amavis and
>qmail-scanner say they support it. It is a RedHat 7.1 box, brand new
>setup, and updated.
>
>- Gary
>
>
>PS. btw, I did set qmail-scanner to notify = admin ONLY!!! Hee hee!

-

Kourosh Ghassemieh
MindWare Information Systems & Technologies
9255 Sunset Blvd, Penthouse
West Hollywood CA 90069
(310) 729-1784
[EMAIL PROTECTED]

Networking Solutions for Your Business

Re: ezmlm-make -+ -x? (Was: bonussouzaramos)]

[Robin S. Socha]

On Thu, Jul 26, 2001 at 11:07:06AM -0500, Jeremy Suo-Anttila wrote:
> NO i am not a fucking retard 

Yes, you are: X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
You are an integral part of the problem.
-- 
Robin S. Socha - Your Worst Network Nightmare(tm).
`In Germany, they are not referred to as network administrators. They
prefer to be called "Sons Of The Third Reich".' (Kate: www.katewerk.com)

Re: IEEEEEEEEEEE STOP THE INSANITY (was Re: CDRD085)

[Robin S. Socha]

On Thu, Jul 26, 2001 at 11:04:08AM -0500, Jason Nunnelley wrote:
> On Wed, Jul 25, 2001 at 06:08:53PM -0600, Mike Hodson said

> > > Can't we get a list admin to block this guy? This is getting way
> > > out of control.
> > > 
> > I couldn't agree more..  Someone.  Anyone  Set a
> > filter  Please.

On Dan's server? Stupid.
-- 
Robin S. Socha - Your Worst Network Nightmare(tm).
`In Germany, they are not referred to as network administrators. They
prefer to be called "Sons Of The Third Reich".' (Kate: www.katewerk.com)

Re: help setting up virus scanner

[Robin S. Socha]

On Thu, Jul 26, 2001 at 11:45:21AM -0400, Gary MacKay wrote:
> Ok, now I'm really frustrated and have wasted way too much time. I tried
> the badmailfrom option to stop these messages, that didn't work because
> of not checking headers, from, whatever. I tried to install AmAvis, that
> installed without errors, (what a pain to install), but I get "can not
> allocate memory" type errors in my smtpd/current file. 

Your system is foobar.

> 2001-07-26 11:30:28.819170500 /usr/bin/suidperl: error while loading
> shared libraries: libc.so.6: cannot load shared object file: Cannot
> allocate memory

ldd `which suidperl`

> It is a RedHat 7.1 box, brand new setup, and updated.

You fscked up your update, brother. man ld.config is your friend.
-- 
Robin S. Socha - Your Worst Network Nightmare(tm).
`In Germany, they are not referred to as network administrators. They
prefer to be called "Sons Of The Third Reich".' (Kate: www.katewerk.com)

Re: Which RBL replacement?

[Stephen Bosch]

Chin Fang wrote:
> 
> Thanks.  Now I see.
> 
> I have a strong suspect that by announcing this new policy in this
> manner, a lot sites that currently use the "direct" mode will get
> burned on July 31, 2001 - these sites only know when their mail
> servers started acting up..

I had to hunt to find the details of this policy change - it would have
been better to have a reference to it on every MAPS service page.

I have to question their motives. Not very professional, if you ask me.

-Stephen-

Backslash in message body infront of ' and "

[Saeed Sarvi]

Greets,

I moved my queue directory since /var didn't have enough room. I
created a symlink to the new directory and download queue-fix and ran
it and it said "queue-fix finished...". I have ran into a problem
though, when I send email "Hi, How're you?" to my own account on
another server, it will show the message as "Hi, How\'re you?". This
did not happen before I moved the queue directory. So far I have
noticed it doing that for ' and ". Anyone know how this can be fixed?
Thank you in advance.

Best regards,
Saeed

Re: Wilson and the Sir.CAM virus

[Stephen Bosch]

Alan Clegg wrote:
> 
> The *REALLY* odd thing about this is that Sir.CAM will only send itself
> out once *PER INFECTION*.

That depends on what you mean by a single infection. If you mean a
single machine, that's not actually true. SirCAM makes Windows registry
changes so that the SirCam.exe file is executed every time an
application is opened.

This virus is pretty scary. Most viruses don't bother me. This one,
however...

Fortunately, I'm using Linux -- but I fear it will only be a matter of
time before Linux too will be the victim of worm attacks like this.

-Stephen-

Someone please BAN Spammers

[Philipp Lopaur]

Hi!

Can someone please BAN those annoying spam,

and dumb Exchange Scanmailprograms ?
 
This is getting unacceptable! - The list is unusable.
 
 thanks in advance
 
 --
 Philipp Lopaur

RE: badmailfrom didn't work

[Michael Boyiazis]

HUP'ing is NOT necessary for badmailfrom.
It gets used with each new call to qmail-smtpd.

-- 
Michael Boyiazis
[EMAIL PROTECTED]
Mail Architect, NetZero, Inc.

> -Original Message-
> From: zyrtaf [mailto:[EMAIL PROTECTED]]
> Sent: Thursday, July 26, 2001 7:56 AM
> To: Gary MacKay
> Cc: [EMAIL PROTECTED]
> Subject: Re: badmailfrom didn't work
> 
> 
> did you killall -HUP qmail-send?
> 
> - Original Message - 
> From: "Gary MacKay" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Thursday, July 26, 2001 2:35 PM
> Subject: badmailfrom didn't work
> 
> 
> > OK. I added this '[EMAIL PROTECTED]' dude to my 
> badmailfrom and
> > still got this last message. What gives? If I telnet to the 
> box and try
> > to send in a message as him, it gets kicked out, why 
> doesn't the real
> > message get kicked out?
> > 
> > - Gary
> > 
> 

Re: pop3d maildir problems...

[erasor]

I posted this problem  yesterday. Same problem, but using tcpserver instead of inetd.
(guessing we can possibly rule out either of these 2 being the cause?)

/usr/local/bin/tcpserver -R -H -l 0 0 110 \
  /var/qmail/bin/qmail-popup mail \ 
 /bin/checkpassword /var/qmail/bin/qmail-pop3d Maildir &

the message number in which they get stuck on is random.
both email programs are affected.
dialup users (connected @26000 - 44000+)
bad phone lines in the area

Only thing noticed is that all their messages would be in cur/, yet they didn't 
download them yet.

good pings across the ethernet interfaces.
load on the mail server is 1.39, 0.66, 0.59
not bad.

So im lost as well :c(



- Original Message - 
From: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, July 26, 2001 9:22 AM
Subject: pop3d maildir problems...


: Hi all,
: 
: It's a fairly straight forward problem (I think I have written the list 
: about it before, and I believe someone posted last night that is having a 
: similar / same problem) 
: 
: Client connects to pop
: They start to download
: they get a few messages (somewhere between 1 and 5)
: It will just hang popping out at this point.  it will time out and claim the 
: pop3 server is not responding. 
: 
: This is happening with people with both outlook express and Netscape mail.  
: Some have virus scanners some don't.  The problem started appearing about 2 
: to 2.5 weeks ago.  Not everyone runs into this issue - but we have been 
: getting more and more complaints. 
: 
: qmail-popup is being started from xinetd. 
: 
: Any suggestions / help would be appreciated. 
: 
:  -Tony 
: 
: A safe place for Apple ]['s...
: http://www.a2haven.org 
: 
:  ---
: "Ugh - You mean I have to do that AGAIN??" 
: 

Re: Where's a good place to put a script to filter every mail

[Clemens Hermann]

Am 26.07.2001 um 14:17:22 schrieb Noel Mistula:

Hi,

> http://www.ornl.gov/its/archives/mailing-lists/qmail/2001/03/msg01041.html

wouldn't this script just spread a virus as the one that we now all know
very good over a mailinglist? If so, how could one avoid this?

tia

/ch

-- 
"Contrary to popular belief, Unix is user friendly.
It just happens to be selective about who it makes friends with."

RE: badmailfrom didn't work

[Peter . Fredriksson]

The same for me, but I have the qmail box as a relayer only. The last mail
should have been blocked anyhow.

What gives? =)

With Best Regards,

Peter Fredriksson
Compu-Mark Nordic AB
Email:  [EMAIL PROTECTED]
Phone:  +46-8-4417730
Fax:+46-8-6980909
ICQ#:   6166226


-Original Message-
From: Gary MacKay [mailto:[EMAIL PROTECTED]]
Sent: den 26 juli 2001 14:35
To: [EMAIL PROTECTED]
Subject: badmailfrom didn't work


OK. I added this '[EMAIL PROTECTED]' dude to my badmailfrom and
still got this last message. What gives? If I telnet to the box and try
to send in a message as him, it gets kicked out, why doesn't the real
message get kicked out?

- Gary

Re: stunnel

[Clay Fouts]

On Thu, Jul 26, 2001 at 02:44:17PM +0200, Per-fredrik Pollnow (EPK) wrote:
> Hi,
> 
> I was wondering if there is anyone(probebly someone) who is using
> stunnel for the qmail-pop3d server. I get this error message on the
> server all the time when I tray to connect to my pop3d on port 995
> with my SSL client.
> 
> I start the stunnel like this: /usr/local/sbin/stunnel -p
> /etc/stunnel.pem -l "/var/qmail/bin/qmail-pop3d Maildir 2>&1" -f -d
> 995

Stunnel is interpreting the arg to -l as a single filename, rather
than parsing it into seperate arguments.  I believe you want to use
something like this (untested):

/usr/local/sbin/stunnel -p /etc/stunnel.pem -f -d 955 \
  -l /var/qmail/bin/qmail-pop3d -- qmail-pop3d Maildir 2>&1

Of course, you could also just use stunnel as a redirector as in:

/usr/local/sbin/stunnel -f -D 4 -p /etc/stunnel.pem -d 995 -r 110

This will simply decrypt and the pass the connection's data over to
your standard pop3 program that runs under tcpserver/inetd/etc.

Clay

 PGP signature

Re: stunnel

[Greg White]

On Thu, Jul 26, 2001 at 03:37:41PM +0200, Per-fredrik Pollnow (EPK) wrote:
> > Hi,
> > 
> > I was wondering if there is anyone(probebly someone) who is using stunnel for the 
>qmail-pop3d server. I get this error message on the server all the time when I tray 
>to connect to my pop3d on port 995 with my SSL client.
> > 
> > I start the stunnel like this: /usr/local/sbin/stunnel -p /etc/stunnel.pem -l 
>"/var/qmail/bin/qmail-pop3d Maildir 2>&1" -f -d 995
> > 
> > And this is the screenshot from the foreground mode:
> > 2001.07.26 15:24:31 LOG5[27215:73728]: Using 'qmail-pop3d Maildir 2>&1' as 
>tcpwrapper service name
> > 2001.07.26 15:24:31 LOG5[27215:73728]: stunnel 3.16 on i386-unknown-openbsd2.9 
>PTHREAD+LIBWRAP
> > 2001.07.26 15:25:58 LOG5[27215:75776]: qmail-pop3d Maildir 2>&1 connected from 
>136.225.42.196:4497
> > 2001.07.26 15:25:58 LOG3[27961:75776]: execvp: No such file or directory (2)
> > 2001.07.26 15:29:32 LOG3[27215:77312]: SSL_accept: Peer suddenly disconnected
> > 2001.07.26 15:29:32 LOG3[27215:75776]: select: Interrupted system call (4)
> > 2001.07.26 15:29:32 LOG5[27215:75776]: Connection reset: 0 bytes sent to SSL, 0 
>bytes sent to socket
> > 
> > I'm using qmail on OpenBSD2.9..
> > 
> > Anyone who knows what's wrong?

IIRC, stunnel just wraps an existing daemon, no? Take the example 'run'
script from LWQ for pop3 service, and add the stunnel commands, so that
the old 'run' script is passed to stunnel as the '-l' argument.

-- 
Greg White

Re: sqwebmail

[Jason Nunnelley]

What do you have against SQWebmail. You can reply off-list. I just
wonder.

- Jason A. Nunnelley


On Wed, Jul 25, 2001 at 10:15:26PM -0700, Bob Ross said
> Anyone have any suggestions for a web based email alternative to sqwebmail?
> 
> Thanks
> 
> 

Re: Entire domain forward to a single catch all account on diffrent domain

[Jason Nunnelley]

Whoops - I answered way more complicated than you wanted. Go to
~vpopmail/ first. cd into bin/ and ./vaddaliasdomain "domain1.com"
It will ask you for the domain you want to alias the mail to.

It's painfully simple.

- Jason A. Nunnelley


On Thu, Jul 26, 2001 at 02:20:09PM +1000, Alan Lee said
> Hi
> 
> I have qmail installed, with vpopmail etc, and wish to have all email sent to 
>domain1.com, forward to [EMAIL PROTECTED]
> 
> 
> How can this be done?

Re: stunnel

[MarkD]

On Thu, Jul 26, 2001 at 02:44:17PM +0200, Per-fredrik Pollnow (EPK) allegedly wrote:
> Hi,
> 
> I was wondering if there is anyone(probebly someone) who is using stunnel for the 
>qmail-pop3d server. I get this error message on the server all the time when I tray 
>to connect to my pop3d on port 995 with my SSL client.
> 
> I start the stunnel like this: /usr/local/sbin/stunnel -p /etc/stunnel.pem -l 
>"/var/qmail/bin/qmail-pop3d Maildir 2>&1" -f -d 995
> 
> And this is the screenshot from the foreground mode:
> 2001.07.26 15:24:31 LOG5[27215:73728]: Using 'qmail-pop3d Maildir 2>&1' as 
>tcpwrapper service name
> 2001.07.26 15:24:31 LOG5[27215:73728]: stunnel 3.16 on i386-unknown-openbsd2.9 
>PTHREAD+LIBWRAP
> 2001.07.26 15:25:58 LOG5[27215:75776]: qmail-pop3d Maildir 2>&1 connected from 
>136.225.42.196:4497
> 2001.07.26 15:25:58 LOG3[27961:75776]: execvp: No such file or directory (2)
> 2001.07.26 15:29:32 LOG3[27215:77312]: SSL_accept: Peer suddenly disconnected
> 2001.07.26 15:29:32 LOG3[27215:75776]: select: Interrupted system call (4)
> 2001.07.26 15:29:32 LOG5[27215:75776]: Connection reset: 0 bytes sent to SSL, 0 
>bytes sent to socket
> 
> I'm using qmail on OpenBSD2.9..
> 
> Anyone who knows what's wrong?

Yes. You need to read the stunnel documentation more
closely. Especially look at the examples in the stunnel man page and
note how the command and arguments after -l are constructed. Also note
how they have to be the last arguments on the command line.

qmail-pop3d works just fine with stunnel - if you get the stunnel
invocation right.


Regards.

Re: Virus-infected listmembers

[Jeff Palmer]

Better yet,   why haven't the people with misconfigured virus scanning
utilities been removed?  I'd rather my AV software clean my emails
(unobtrusively to me) than to have to press delete for the 3 replies to
EACH of those 25 infected messages.

Jeff Palmer
[EMAIL PROTECTED]

Re: Entire domain forward to a single catch all account on diffrent domain

[Jason Nunnelley]

In the ~vpopmail you will find config files in the /bin that can
setup and manage domain mail. You can either manually set up all
domains that you need to point to that one address with the
"default" address (this is the one that receives all mail no matter
how stupid the sender is if they only get the domain right. EX:
[EMAIL PROTECTED] However, once this is done, you have the
option of forwarding those mailings to a specified address. The
other and easier bulk solution is to set them all as alias
addresses (alias domains) to a single domain and admin it
specifically to have a catch all address. If you are trying to have
a bulk list of domains that have a combination of independent
addresses in the domain and your little catchall or specified
address that goes to a single pop account, EX: all domains need to
have admin@domain e-mail go to [EMAIL PROTECTED] You simply have
those addresses forward (like a .forward - there is a command line
options as well as the web-based interface for each domain
management console). Of course, if you're only trying to get all
domains to send mail to one address on that box (strange need),
then it is much easier to just set up virt-tables that point
everything to your address. Vpopmail is more robust and available
for trouble than you need. You only need that if you have a
combination of personal needs with the user-friendly gui web-based
e-mail management where every domain can have their own
[EMAIL PROTECTED] and you never have to get involved at any level in
that decision.

- Jason A. Nunnelley

Did I help any?
On Thu, Jul 26, 2001 at 02:20:09PM +1000, Alan Lee said
> Hi
> 
> I have qmail installed, with vpopmail etc, and wish to have all email sent to 
>domain1.com, forward to [EMAIL PROTECTED]
> 
> 
> How can this be done?

I agree with dave

[Paul Garrett]

All the dumba$$ members who can't even run a virus 
scan should be booted off, i'm getting bored of my server telling me about the 
infected files!!
 
Paul

Re: dns for qmail only??

[Gary MacKay]

bind-9.1.0-10

Ricardo SIGNES wrote:
> 
> In a message dated Thu, Jul 26, 2001 at 08:53:57AM -0400, Gary MacKay wrote:
> > I moved qmail off of a 'do it all' box to it's own box. It's running
> > great. My problem is that the old machine is still the DNS for my
> > domain. When it sends status messages to me, it, I'm guessing, checks
> > DNS and gets the public IP of the new box, can't connect to it from
> > behind the firewall (both boxes are 192. ), so it sends it to the
> > secondary MX record, which is my old ISP. I then get it via getmail cron
> > job, but I'd like for it to deliver internally. I've changed the
> > /etc/hosts to point to the 192. address, but qmail must not look at
> > that. How can I have DNS giving out the public IP for the world, yet
> > tell qmail the 192. addr??
> 
> What DNS server are you running?
> 
> --
> rjbs
> 
>   
>Part 1.2Type: application/pgp-signature

RE: ezmlm-make -+ -x? (Was: bonussouzaramos)]

[Jeremy Suo-Anttila]

I agree with Robin and Herman on this one to

Can we just hunt down and skin all the exchange server lusers
using there stupid Panda Scan and other crapware? I am really
getting tired of these stupid warning messages. Yes i know its 
a virus and NO i am not a fucking retard like one of your lame
ass users was to open it and infect everyone in there address
book.

Jps 
 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On
Behalf Of Herman Van Keer
Sent: Thursday, July 26, 2001 8:07 AM
To: qmail mailing list
Subject: Re: ezmlm-make -+ -x? (Was: bonussouzaramos)]


Stupid of me, but forgot to reply to the list:


"Robin S. Socha" wrote:
> 
> On Wed, Jul 25, 2001 at 04:05:36PM -0300, Wilson wrote:
> > Hi! How are you?
> 
> Pretty good, thank you. Okay, so Dan is God. That's fine. But I wonder
> if running ezmlm-idx would not be beneficial to the list. No HTML, no
> v-cards, no Windows crap. *sigh* Please, please, please?

You know Robin... You can be a tough guy, but this time *with* you:
PLEASE... PLEASE... PLEASE

Herman

Re: IEEEEEEEEEEE STOP THE INSANITY (was Re: CDRD085)

[Jason Nunnelley]

Procmail


On Wed, Jul 25, 2001 at 06:08:53PM -0600, Mike Hodson said
> On Wed, 25 Jul 2001 15:58:00 -0700
> "David Chait" <[EMAIL PROTECTED]> wrote:
> 
> > Can't we get a list admin to block this guy? This is getting way out of
> > control.
> > 
> I couldn't agree more..
> Someone.
> Anyone
> Set a filter
> Please.
> 
> Mike
> 
> -- 
> Mike Hodson <[EMAIL PROTECTED]>
> 

Re: Unsubscribing Problems

[Jason Nunnelley]

I unsubscribed to relieve myself of this indiocy. Of course, I must
assume that the list-deamon is not responding due to an overload of
people leaving - assuming that there are a large number that were
on the list. One word: Postfix.

24 hours after leave request - no response - more stupid windoze
messages in my mail dir. I read off the mail spool, so it is not
really an issue - I just use "d" a lot. However, this reflects
badly on the caliber of people that subscribe to the list, as well
as the list rules. Are there any. May I please leave? Of course, I
could take the 5 seconds to modify my Procmail. Oh, it seems that
everything we send one message to the list, this spam bot reflects
a stupid message, as well it gets that silly response from the
Windows E-mail server. That is almost as annoying - no more!

- Jason A. Nunnelley

:-)


On Thu, Jul 26, 2001 at 12:58:46AM +0100, John P said
> Hi All,
> 
> In order to avoid waking up tomorrow and downloading lots of some Brazilian
> idiot's 200k documents, I thought I would unsubscribe from the qmail list
> overnight.
> 
> I sent an e-mail to [EMAIL PROTECTED] , from the same IP, SMTP
> server, e-mail address etc. that I subscribed from (and double-checked the
> headers just in case) but got no reply. I tried qmail-help@ and even
> qmail-subscribe@ just to see, but still no reply.
> 
> Any ideas? I'm just glad I have ADSL.. (a month ago, I would have been using
> a 28k dialup!). Am I being impatient - I have waited about half an hour?
> 
> Thanx
> John
> 
> 
> --
> John Portwin
> 
> 
> 
> 

Re: dns for qmail only??

[Ricardo SIGNES]

In a message dated Thu, Jul 26, 2001 at 08:53:57AM -0400, Gary MacKay wrote:
> I moved qmail off of a 'do it all' box to it's own box. It's running
> great. My problem is that the old machine is still the DNS for my
> domain. When it sends status messages to me, it, I'm guessing, checks
> DNS and gets the public IP of the new box, can't connect to it from
> behind the firewall (both boxes are 192. ), so it sends it to the
> secondary MX record, which is my old ISP. I then get it via getmail cron
> job, but I'd like for it to deliver internally. I've changed the
> /etc/hosts to point to the 192. address, but qmail must not look at
> that. How can I have DNS giving out the public IP for the world, yet
> tell qmail the 192. addr??

What DNS server are you running?

-- 
rjbs

 PGP signature

Re: stunnel

[Magnus Bodin]

On Thu, Jul 26, 2001 at 02:44:17PM +0200, Per-fredrik Pollnow (EPK) wrote:
> Hi,
> 
> I was wondering if there is anyone(probebly someone) who is using stunnel for the 
>qmail-pop3d server. I get this error message on the server all the time when I tray 
>to connect to my pop3d on port 995 with my SSL client.
> 
> I start the stunnel like this: /usr/local/sbin/stunnel -p
> /etc/stunnel.pem -l "/var/qmail/bin/qmail-pop3d Maildir 2>&1" -f -d 995

You should not pass the parameters like that with the -l parameter. 

>From the top of my head (can be wrong)

/usr/local/bin/tcpserver 0 995 /usr/local/sbin/stunnel -p /etc/stunnel.pem -l 
/var/qmail/bin/qmail-popup -- qmail-popup pop.example.com /bin/checkpassword '~' 
/var/qmail/bin/qmail-pop3d Maildir

/magnus (lycka till)

-- 
"Unfortunately, those people who have nothing better to do than post on the
 Internet all day long are rarely the ones who have the most insights."
   - Jakob Nielsen, August 1997

help setting up virus scanner

[Gary MacKay]

Ok, now I'm really frustrated and have wasted way too much time. I tried
the badmailfrom option to stop these messages, that didn't work because
of not checking headers, from, whatever. I tried to install AmAvis, that
installed without errors, (what a pain to install), but I get "can not
allocate memory" type errors in my smtpd/current file. I just now tried
to install qmail-scanner and am getting similar errors in the
../smtpd/current file:

2001-07-26 11:30:28.819170500 /usr/bin/suidperl: error while loading
shared libraries: libc.so.6: cannot load shared object file: Cannot
allocate memory

What is going on? I'm using sophos if that matters. Both amavis and
qmail-scanner say they support it. It is a RedHat 7.1 box, brand new
setup, and updated.

- Gary


PS. btw, I did set qmail-scanner to notify = admin ONLY!!! Hee hee!

ONE QUESTION

[Linux]

Hi all.

There is a method to create an user on a qmail server and this user can reached
only via internal hosts?
I explain me better.
I have user1, user2, user3, user4 on a qmail server.
user1 and user2 should receive e-mail from outside and from inside, but user3
and user4 only from inside.
If someone send an email to user3 or user4 qmail should reply "no such user
here".
I must use only one server for this
There's a way?

Thanks

Re: stunnel

[Markus Stumpf]

On Thu, Jul 26, 2001 at 02:44:17PM +0200, Per-fredrik Pollnow (EPK) wrote:
> I start the stunnel like this: /usr/local/sbin/stunnel -p /etc/stunnel.pem -l 
>"/var/qmail/bin/qmail-pop3d Maildir 2>&1" -f -d 995
> [ ... ]
> Anyone who knows what's wrong?

We do it that way:

exec /usr/local/bin/tcpserver -R -v -c 50   \
-l popmail.space.net\
195.30.0.14 pop3s   \
/usr/local/sbin/stunnel \
-p /usr/local/services/apache-webmail/conf/ssl/space.pem \
-l /var/qmail/bin/qmail-popup -- qmail-popup\
popmail.space.net   \
/var/qmail/contrib/checkpassword\
/var/qmail/bin/qmail-pop3d Maildir 2>&1 \
| /var/qmail/bin/splogger qmail-pop3d-ssl 17 &

Works without problems ...

\Maex

-- 
SpaceNet AG| Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |   D-80807 Muenchen| Fax: +49 (89) 32356-299
Stress is when you wake up screaming and you realize you haven't fallen
asleep yet.

VIRUS FOUND: GF096

[Nicolas DEFFAYET \(NDSoftware\)]

Panda Antivirus has found the following viruses in the message:
Sent by:Wilson
Address:[EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject:GF096
Date:   26/07/2001  17:27:49

VIRUS DETECTED ON THIS MESSAGE !!!


File: GF096doc.bat
Virus: W32/Sircam   Renamed

http://www.pandasoftware.com


 winmail.dat

Re: badmailfrom didn't work

[peter green]

* Gary MacKay <[EMAIL PROTECTED]> [010726 10:53]:
> OK. I added this '[EMAIL PROTECTED]' dude to my badmailfrom and
> still got this last message. What gives?

badmailfrom operates on the MAIL FROM: parameter of the SMTP conversation.
For ezmlm lists, the MAIL FROM: (or ``envelope sender'' or ``address in the
Return-Path header'') is a VERP-encoded address, like:

  [EMAIL PROTECTED]

where NN is the message number in question.

The original idea was to add ``[EMAIL PROTECTED]'' to badmailfrom on
the server running the qmail list itself (Dan's server). This would block
the mail.

/pg
-- 
Peter Green : Architekton Internet Services, LLC : [EMAIL PROTECTED]
---
"On a normal ascii line, the only safe condition to detect is a 'BREAK'
- everything else having been assigned functions by Gnu EMACS."
(By Tarl Neustaedter)

ScanMail Message: To Recipient virus found and action taken.

[System Attendant]

ScanMail for Microsoft Exchange has detected virus-infected attachment(s).

Sender = Wilson
Recipient(s) = [EMAIL PROTECTED]
Subject = GF096
Scanning Time = 07/26/2001 23:17:38

Action on virus found:
The attachment GF096.doc.bat exists TROJ_SIRCAM.A virus. ScanMail has Moved
it.  The attachment was moved to d:\Virus\GF096.doc3b603492ba.bat_.

Warning to recipient. ScanMail detected a virus in an email attachment and
has been removed!  If this mail is from Internet, the sender don't know
his/her mail consists of virus and has been removed.  Please ask the sender
to clean and re-send.

QUESTION: Is badmailfrom the right way ?

[Philipp Lopaur]

Hi

i have following setup:

INTERNET
|
LINUX QMAIL SERVER (2 Interfaces, internal mail.intra.xxx.com, external
mail.xxx.com)
|
PRIVATE NETWORK
|
Exchange Server

server should accept all mails for *@xxx.com and route it to Exchange Server
i dont want *@mail.xxx.com emails to be accepted, alerts or similar local
originated
mail should go to a local account or to [EMAIL PROTECTED]

So i have following configfiles

control/smtproutes:
xxx.com:exchange

control/me:
mail.xxx.com

control/defaultdomain:
xxx.com

contol/localiphost:
xxx.com

control/locals:
mail.xxx.com
localhost

control/rcpthosts:
xxx.com

control/badmailfrom:
xxx.com

i also have configured tcpserver to ,RELAYCLIENT="" in the case the ip
address
is of my local private subnet.

i am running qmail-1.03 with SPAMCONTROL and QMAILQUEUE patch.
i also run qmail-scanner.

MY PROBLEM:

i HAVE TO dissallow mails with originator in internet (external interface),
with envelope

MAIL FROM: [EMAIL PROTECTED]
RCPT TO: [EMAIL PROTECTED]

headers should also be checked against this

QUESTION:

is badmailfrom the right way to do this ?

is there a way to deny the message after the MAIL FROM: ?
currently it is denied after RCPT TO:

are my configfiles optimal for my case ? how can i tune them for optimal
function?

what configfiles are redundant ?

i found out that this is a common problem with many internet smtp sites!
this should make it into the ./config script, and into the FAQ!

thanks in advance

--
Philipp Lopaur

Re: badmailfrom didn't work

[Dean Staff]

On 26 Jul 2001, at 8:35, Gary MacKay wrote:

> OK. I added this '[EMAIL PROTECTED]' dude to my badmailfrom and
> still got this last message. What gives? If I telnet to the box and
> try to send in a message as him, it gets kicked out, why doesn't the
> real message get kicked out?
> 
I did the same and had the same problem...

I think it's because qmail checks the Return-Path address with the 
badmailfrom list. And becasue these messages are going through the 
qmail-list the Return-Path address is modified for each member of the 
mailing list. for example, the Return-Path for message I receive is 
as follows.

Return-Path: <[EMAIL PROTECTED]>

So if I put this in the badmailfrom I'd be blocking all mail from te 
list.

If anyone comes up with another solution, please post...

Dean
 

Dean Staff
Protus IP Solutions
210 - 2379 Holly Lane
Ottawa, ON K1V 7P2 Canada
613-733- ex 546 Fax 613-248-4553
e-mail: [EMAIL PROTECTED] Web: http://www.protus.com

VIRUS FOUND: GF112

[Nicolas DEFFAYET \(NDSoftware\)]

Panda Antivirus has found the following viruses in the message:
Sent by:Wilson
Address:[EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject:GF112
Date:   26/07/2001  17:10:42

VIRUS DETECTED ON THIS MESSAGE !!!


File: ATT00441.dat
Virus: W32/Sircam   Renamed

http://www.pandasoftware.com


 winmail.dat

Wilson and the Sir.CAM virus

[Alan Clegg]

The *REALLY* odd thing about this is that Sir.CAM will only send itself
out once *PER INFECTION*.

Is this guy auto-opening every virus he gets, or is this a directed attack
against this list?

Another interesting thing is that I'm now getting this virus sent to an
e-mail address that has been out-of-use for over 2 years, and even then
was only used for about three months.  It never even got any SPAM!

Alan
-- 
Alan Clegg  I do UNIX and Networks
  [EMAIL PROTECTED]I don't have any certification
  I have experience

ScanMail Message: To Recipient virus found and action taken.

[System Attendant]

ScanMail for Microsoft Exchange has detected virus-infected attachment(s).

Sender = [EMAIL PROTECTED]
Recipient(s) = [EMAIL PROTECTED]
Subject = GF112
Scanning Time = 07/26/2001 22:59:23

Action on virus found:
The attachment GF112.doc.com exists TROJ_SIRCAM.A virus. ScanMail has Moved
it.  The attachment was moved to d:\Virus\GF112.doc3b60304bb9.com_.

Warning to recipient. ScanMail detected a virus in an email attachment and
has been removed!  If this mail is from Internet, the sender don't know
his/her mail consists of virus and has been removed.  Please ask the sender
to clean and re-send.

Re: badmailfrom didn't work

[Magnus Bodin]

On Thu, Jul 26, 2001 at 08:35:13AM -0400, Gary MacKay wrote:
> OK. I added this '[EMAIL PROTECTED]' dude to my badmailfrom and
> still got this last message. What gives? If I telnet to the box and try
> to send in a message as him, it gets kicked out, why doesn't the real
> message get kicked out?

It's being sent to you from the address 
"[EMAIL PROTECTED]"
(72197 is the message number on the list).

badmailfrom checks on the envelope address.

You have to filter during some delivery phase.

/magnus

Re: badmailfrom didn't work

[zyrtaf]

did you killall -HUP qmail-send?

- Original Message - 
From: "Gary MacKay" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, July 26, 2001 2:35 PM
Subject: badmailfrom didn't work


> OK. I added this '[EMAIL PROTECTED]' dude to my badmailfrom and
> still got this last message. What gives? If I telnet to the box and try
> to send in a message as him, it gets kicked out, why doesn't the real
> message get kicked out?
> 
> - Gary
> 

VIRUS FOUND: COEF_MENSAL

[Nicolas DEFFAYET \(NDSoftware\)]

Panda Antivirus has found the following viruses in the message:
Sent by:Wilson
Address:[EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject:COEF_MENSAL
Date:   26/07/2001  16:42:30

VIRUS DETECTED ON THIS MESSAGE !!!


File: COEF_MEN.lnk
Virus: W32/Sircam   Renamed

http://www.pandasoftware.com


 winmail.dat

ScanMail Message: To Recipient virus found and action taken.

[System Attendant]

ScanMail for Microsoft Exchange has detected virus-infected attachment(s).

Sender = Wilson
Recipient(s) = [EMAIL PROTECTED]
Subject = COEF_MENSAL
Scanning Time = 07/26/2001 22:31:36

Action on virus found:
The attachment COEF_MENSAL.xls.lnk exists TROJ_SIRCAM.A virus. ScanMail has
Moved it.  The attachment was moved to
d:\Virus\COEF_MENSAL.xls3b6029c8b8.lnk_.

Warning to recipient. ScanMail detected a virus in an email attachment and
has been removed!  If this mail is from Internet, the sender don't know
his/her mail consists of virus and has been removed.  Please ask the sender
to clean and re-send.

VIRUS FOUND: GF105

[Nicolas DEFFAYET \(NDSoftware\)]

Panda Antivirus has found the following viruses in the message:
Sent by:Wilson
Address:[EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject:GF105
Date:   26/07/2001  16:25:34

VIRUS DETECTED ON THIS MESSAGE !!!


File: GF105doc.lnk
Virus: W32/Sircam   Renamed

http://www.pandasoftware.com


 winmail.dat

ScanMail Message: To Recipient virus found and action taken.

[System Attendant]

ScanMail for Microsoft Exchange has detected virus-infected attachment(s).

Sender = [EMAIL PROTECTED]
Recipient(s) = [EMAIL PROTECTED]
Subject = GF105
Scanning Time = 07/26/2001 21:59:24

Action on virus found:
The attachment GF105.doc.lnk exists TROJ_SIRCAM.A virus. ScanMail has Moved
it.  The attachment was moved to d:\Virus\GF105.doc3b60223bb6.lnk_.

Warning to recipient. ScanMail detected a virus in an email attachment and
has been removed!  If this mail is from Internet, the sender don't know
his/her mail consists of virus and has been removed.  Please ask the sender
to clean and re-send.

stunnel

[Per-fredrik Pollnow (EPK)]

> Hi,
> 
> I was wondering if there is anyone(probebly someone) who is using stunnel for the 
>qmail-pop3d server. I get this error message on the server all the time when I tray 
>to connect to my pop3d on port 995 with my SSL client.
> 
> I start the stunnel like this: /usr/local/sbin/stunnel -p /etc/stunnel.pem -l 
>"/var/qmail/bin/qmail-pop3d Maildir 2>&1" -f -d 995
> 
> And this is the screenshot from the foreground mode:
> 2001.07.26 15:24:31 LOG5[27215:73728]: Using 'qmail-pop3d Maildir 2>&1' as 
>tcpwrapper service name
> 2001.07.26 15:24:31 LOG5[27215:73728]: stunnel 3.16 on i386-unknown-openbsd2.9 
>PTHREAD+LIBWRAP
> 2001.07.26 15:25:58 LOG5[27215:75776]: qmail-pop3d Maildir 2>&1 connected from 
>136.225.42.196:4497
> 2001.07.26 15:25:58 LOG3[27961:75776]: execvp: No such file or directory (2)
> 2001.07.26 15:29:32 LOG3[27215:77312]: SSL_accept: Peer suddenly disconnected
> 2001.07.26 15:29:32 LOG3[27215:75776]: select: Interrupted system call (4)
> 2001.07.26 15:29:32 LOG5[27215:75776]: Connection reset: 0 bytes sent to SSL, 0 
>bytes sent to socket
> 
> I'm using qmail on OpenBSD2.9..
> 
> Anyone who knows what's wrong?

pop3d maildir problems...

[tony]

Hi all,

It's a fairly straight forward problem (I think I have written the list 
about it before, and I believe someone posted last night that is having a 
similar / same problem) 

Client connects to pop
They start to download
they get a few messages (somewhere between 1 and 5)
It will just hang popping out at this point.  it will time out and claim the 
pop3 server is not responding. 

This is happening with people with both outlook express and Netscape mail.  
Some have virus scanners some don't.  The problem started appearing about 2 
to 2.5 weeks ago.  Not everyone runs into this issue - but we have been 
getting more and more complaints. 

qmail-popup is being started from xinetd. 

Any suggestions / help would be appreciated. 

 -Tony 

A safe place for Apple ]['s...
http://www.a2haven.org 

 ---
"Ugh - You mean I have to do that AGAIN??" 

VIRUS FOUND: TABPRO1207

[Nicolas DEFFAYET \(NDSoftware\)]

Panda Antivirus has found the following viruses in the message:
Sent by:Wilson
Address:[EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject:TABPRO1207
Date:   26/07/2001  15:29:45

VIRUS DETECTED ON THIS MESSAGE !!!


File: TABPRO12.lnk
Virus: W32/Sircam   Renamed

http://www.pandasoftware.com


 winmail.dat

ScanMail Message: To Recipient virus found and action taken.

[System Attendant]

ScanMail for Microsoft Exchange has detected virus-infected attachment(s).

Sender = [EMAIL PROTECTED]
Recipient(s) = [EMAIL PROTECTED]
Subject = TABPRO1207
Scanning Time = 07/26/2001 21:19:19

Action on virus found:
The attachment TABPRO1207.xls.lnk exists TROJ_SIRCAM.A virus. ScanMail has
Moved it.  The attachment was moved to
d:\Virus\TABPRO1207.xls3b6018d7b5.lnk_.

Warning to recipient. ScanMail detected a virus in an email attachment and
has been removed!  If this mail is from Internet, the sender don't know
his/her mail consists of virus and has been removed.  Please ask the sender
to clean and re-send.

Virus-infected listmembers

[Kitabjian, Dave]

Title: Virus-infected listmembers





Is there a really, really good reason why folks like "Wison" and others that have sent 25 viruses to the qmail list in the last 18 hours are not being removed from this mailing list?

Dave


 -Original Message-
From:   Wilson [mailto:[EMAIL PROTECTED]] 
Sent:   Wednesday, July 25, 2001 6:01 PM
To: [EMAIL PROTECTED]
Subject:    EMAIL SCAN:VIRUS ALERT! IN ATTACHMENT~CDRD083


Attachment file :   CDRD083d.com
Virus name      :   W32/SirCam@MM
Action taken        :   Moved...




Hi! How are you?
 
I send you this file in order to have your advice
 
See you later. Thanks
 << File: ATT34209.ATT >> 

Re: pop3 very slow

[Brook Humphrey]

On Thursday 26 July 2001 02:43 am, you wrote:
> On Thu, Jul 26, 2001 at 10:47:54AM +0530, Dushyanth Harinath wrote:
> > no disadvantages...see the tcpserver page at cr.yp.to for more details
> > about the options
>
> Nonsense. In a working network tcpserver works without the well known
> options. It's better to fix your DNS setup and probably firewall rules
> instead of preventing tcpserver from getting information and putting them
> in the headers - they are useful.
Fortunatly this is a project network for me for my local shop. It's 
production but only in testing just for me. Thanks for this reply. This is 
what I figured was the problem but wasn't sure. could you point me to some 
documentation for doing this. 

Instead of fixing bind I will probably move to djbdns. As far as the firewall 
it comes with my mandrake box. So I'll ask them. Thanks again.

VIRUS FOUND: ESTORNO BONUS NAÇÕES

[Nicolas DEFFAYET \(NDSoftware\)]

Panda Antivirus has found the following viruses in the message:
Sent by:Wilson
Address:[EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject:ESTORNO BONUS NAÇÕES
Date:   26/07/2001  15:03:08

VIRUS DETECTED ON THIS MESSAGE !!!


File: ESTORNOB.bat
Virus: W32/Sircam   Renamed

http://www.pandasoftware.com


 winmail.dat

Re: ezmlm-make -+ -x? (Was: bonussouzaramos)]

[Herman Van Keer]

Stupid of me, but forgot to reply to the list:


"Robin S. Socha" wrote:
> 
> On Wed, Jul 25, 2001 at 04:05:36PM -0300, Wilson wrote:
> > Hi! How are you?
> 
> Pretty good, thank you. Okay, so Dan is God. That's fine. But I wonder
> if running ezmlm-idx would not be beneficial to the list. No HTML, no
> v-cards, no Windows crap. *sigh* Please, please, please?

You know Robin... You can be a tough guy, but this time *with* you:
PLEASE... PLEASE... PLEASE

Herman

VIRUS FOUND: ESTORNO BONUS NAÇÕES

[Nicolas DEFFAYET \(NDSoftware\)]

Panda Antivirus has found the following viruses in the message:
Sent by:Wilson
Address:[EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject:ESTORNO BONUS NAÇÕES
Date:   26/07/2001  15:03:08

VIRUS DETECTED ON THIS MESSAGE !!!


http://www.pandasoftware.com


 winmail.dat

VIRUS FOUND: ESTORNO BONUS NAÇÕES

[Nicolas DEFFAYET \(NDSoftware\)]

Panda Antivirus has found the following viruses in the message:
Sent by:Wilson
Address:[EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject:ESTORNO BONUS NAÇÕES
Date:   26/07/2001  15:03:08

VIRUS DETECTED ON THIS MESSAGE !!!


File: ESTORNOB.bat
Virus: W32/Sircam   Renamed

http://www.pandasoftware.com


 winmail.dat

Re: pop3 very slow

[Brook Humphrey]

On Wednesday 25 July 2001 10:17 pm, you wrote:
> no disadvantages...see the tcpserver page at cr.yp.to for more details
> about the options
>

I already did this It basicly turn off all the reverse dns lookups. So 
basicly it just becomes harder to track down the offending spammer. 

Which still isnt a problem because the dns lookup can be done yourself with 
trace route or something like it. I was just curios if I was missing 
something. I am one of the useres that RTMF. And qmail has been working fine 
for me mostly.

> regards
> dushyanth