RE: [qmailtoaster] plague caused by virus

2013-11-08 Thread Nicholas Chua
Many thanks Brent! Regards nic Date: Thu, 7 Nov 2013 11:32:07 -0700 From: bgardnermailingli...@gmail.com To: qmailtoaster-list@qmailtoaster.com Subject: Re: [qmailtoaster] plague caused by virus On 11/06/2013 07:56 PM, Nicholas Chua wrote: Hi

Re: [qmailtoaster] plague caused by virus

2013-11-08 Thread LHTek
Very nice script Dan. Thanks!! From: Dan McAllister q...@it4soho.com To: qmailtoaster-list@qmailtoaster.com Sent: Wednesday, November 6, 2013 4:22 PM Subject: Re: [qmailtoaster] plague caused by virus Sure -- happy to share... it's pretty brute force

Re: [qmailtoaster] plague caused by virus

2013-11-07 Thread Brent Gardner
On 11/06/2013 07:56 PM, Nicholas Chua wrote: Hi Brent You might take a look at the SaneSecurity Foxhole signatures for ClamAV: http://sanesecurity.com/foxhole-databases/ These are designed to hit on any executable in an archive file. Regards, Brent Gardner Are you able to teach me

Re: [qmailtoaster] plague caused by virus

2013-11-06 Thread Dan McAllister
:* Dan McAllister q...@it4soho.com *To:* qmailtoaster-list@qmailtoaster.com *Sent:* Monday, November 4, 2013 5:27 PM *Subject:* Re: [qmailtoaster] plague caused by virus On 11/4/2013 3:27 PM, Nicholas Chua wrote: Hi, I am receiving an average of 13 new virus each day. Due

RE: [qmailtoaster] plague caused by virus

2013-11-06 Thread Nicholas Chua
Sure -- happy to share... it's pretty brute force, but I don't have a lot of time for clean development! Remember: I reset the name of my mtrack command to qmtrack... (Bolding the non-commented lines is just my way of making them stand out) #! /bin/bash # $0 (or

RE: [qmailtoaster] plague caused by virus

2013-11-06 Thread Nicholas Chua
HiĀ  Brent You might take a look at the SaneSecurity Foxhole signatures for ClamAV: http://sanesecurity.com/foxhole-databases/ These are designed to hit on any executable in an archive file. Regards, Brent Gardner Are you able to teach me how do i use foxhole only? Thanks nic

[qmailtoaster] plague caused by virus

2013-11-04 Thread Nicholas Chua
Hi, I am receiving an average of 13 new virus each day. Due to these virus, email accounts passwords are stolen and caused massive spams from the server. Valuable time is wasted to delist our IP and to maintain a private list of a virus database which till date 100+ virus are still not

Re: [qmailtoaster] plague caused by virus

2013-11-04 Thread Dan McAllister
On 11/4/2013 3:27 PM, Nicholas Chua wrote: Hi, I am receiving an average of 13 new virus each day. Due to these virus, email accounts passwords are stolen and caused massive spams from the server. Valuable time is wasted to delist our IP and to maintain a private list of a virus database

RE: [qmailtoaster] plague caused by virus

2013-11-04 Thread Nicholas Chua
snip I hope this points you in the right direction... Actually i am more interested in blocking out the virus, the root of the problem regards nic

Re: [qmailtoaster] plague caused by virus

2013-11-04 Thread Brent Gardner
On 11/04/2013 04:37 PM, Nicholas Chua wrote: snip I hope this points you in the right direction... Actually i am more interested in blocking out the virus, the root of the problem regards nic We block lots of virus-prone

RE: [qmailtoaster] plague caused by virus

2013-11-04 Thread Nicholas Chua
snip We block lots of virus-prone attachments using entries in /var/qmail/control/simcontrol: - executables (.exe, .js, .bat, etc.) - office docs (.doc, .docx, .pdf, etc.) - archive files (.zip, .rar, .7z, etc.) If you're seeing emails come in with links that download viruses, you can

Re: [qmailtoaster] plague caused by virus

2013-11-04 Thread LHTek
] plague caused by virus On 11/4/2013 3:27 PM, Nicholas Chua wrote: Hi, I am receiving an average of 13 new virus each day. Due to these virus, email accounts passwords are stolen and caused massive spams from the server. Valuable time is wasted to delist our IP

Re: [qmailtoaster] plague caused by virus

2013-11-04 Thread Brent Gardner
On 11/04/2013 04:58 PM, Nicholas Chua wrote: snip We block lots of virus-prone attachments using entries in /var/qmail/control/simcontrol: - executables (.exe, .js, .bat, etc.) - office docs (.doc, .docx, .pdf, etc.) - archive files (.zip, .rar, .7z, etc.) If you're seeing emails come in

RE: [qmailtoaster] plague caused by virus

2013-11-04 Thread Nicholas Chua
snip We block lots of virus-prone attachments using entries in /var/qmail/control/simcontrol: - executables (.exe, .js, .bat, etc.) - office docs (.doc, .docx, .pdf, etc.) - archive files (.zip, .rar, .7z, etc.) If you're seeing emails come in with links that download viruses,