Re: [squid-users] Re: *** VIRUS *** [squid-users] Server Report

Hi neil.

On Thu, 5 Jul 2007, Neil A. Hillard wrote:

> Hi,
>
> Manoj_Rajkarnikar wrote:
>>
>> On Tue, 1 Jan 2002, hno@squid-cache.org wrote:
>>
>>> WARNING: This e-mail has been altered by MIMEDefang. Following this
>>> paragraph are indications of the actual changes made. For more
>>> information about your site's MIMEDefang policy, contact
>>> Vianet System Administrator <postmaster@vianet.com.np>. For more
>>> information about MIMEDefang, see:
>>>
>>> http://www.roaringpenguin.com/mimedefang/enduser.php3
>>>
>>> Dropped document.scr (application/octet-stream) containing virus
>>> Worm.SCO.A-1.
>>>
>>
>> Please do something about it. found worm in a message...
>
> I seriously doubt Henrik sent out a worm and in any case, why are you
> reporting something that happened over 5 years ago?

I too don't believe its Henrik. But it made it here from the list and it
came yesterday not 5 years ago.

FYI, here's the log entries for that mail.

Jul 4 08:21:26 dns1 sendmail[19416]: l642XwNU019416:
from=<squid-users-return-74603-manoj=vianet.com.np@squid-cache.org>,
size=33846, class=0, nrcpts=1, msgi
d=<20070704021650.67098.qmail@squid-cache.org>, proto=SMTP, daemon=MTA,
relay=squid-cache.org [12.160.37.9]
Jul 4 08:21:26 dns1 mimedefang.pl[17467]: Found Worm.SCO.A-1 from
12.160.37.9
Jul 4 08:21:26 dns1 clamd[23763]:
/var/spool/MIMEDefang/mdefang-l642XwNU019416/Work/msg-17467-48.scr:
Worm.SCO.A-1 FOUND
Jul 4 08:21:26 dns1 clamd[23763]:
/var/spool/MIMEDefang/mdefang-l642XwNU019416/Work/msg-17467-48.scr:
Worm.SCO.A-1 FOUND
Jul 4 08:21:26 dns1 mimedefang.pl[17467]:
MDLOG,l642XwNU019416,mail_in,,,<squid-users-return-74603-manoj=vianet.com.np@squid-cache.org>,<manoj@vianet.com.np>
,[squid-users] Server Report
Jul 4 08:21:27 dns1 mimedefang.pl[17467]: filter: l642XwNU019416:
drop_with_warning=1
Jul 4 08:21:26 dns1 sendmail[19416]: l642XwNU019416: Milter change:
header Subject: from [squid-users] Server Report to *** VIRUS ***
[squid-users] Server R
eport

Please disregard if this doesn't concern anyone. I wrote to the list
because when a virus/worm is sent out the mailing list, its not one or ten
or hundred users thats effected, its thousands or tens of thousands.

Manoj.

--