since I did install the pagefault antivirus package with the service panel - I am quite happy with though as usually one gets wanting more.
the current virus trend is like this:
the virus infects the system takes 2 addresses from the
adressbook and propogates itself from "address 1" to "address 2".
The important point is that
1. the infected user usually does not know that there is an infection
2. "commercial" antivirus packages in a manner like advertising send a warning to "address 1" that it "has sent a virus in the mail to address 2"
neither a1 nor a2 are infected (or if they are they has nothing to do with the original sender)
- as an admin I am getting around 30 a day saying that user "james" has sent a virus
3. all these viruses that are sent to users that are under my servers are pulled in quarantine - and they are quite a bunch a day - the second (the other) antivirus panel has a good option of deleting them all - hope the pagefaults' get one soon.
now there is a bunch of data that could be used for a good cause:
isolate / identify the original viral sender (it's there - the ip of senders system)
as a drastic measure let spamasassin (or whatever) deny mails from the IP automatically
let's collect these ip's - if I am in one's addressbook it usually does mean that I have something to do with that person (associate, friend etc) and that means that I am at least a bit interested to help a friend get rid of viruses - if not let's cut him off.
0 Replies
1227 Views