The FBI virus

[Oreo]

I swear this thing is intentionally going to my backup MX record.
I have 2 inbound servers and I'd say easily 90% are going to my secondary server.

Most seem to be coming from roadrunner accounts.
I'm getting tired of blocking computers from my gateway!

[daleanime]

1. I hear you...

Thank goodness I've got good anti-virus protect. I have roadrunner and not a day goes by with some virus trying it out.

[Oreo]

2. Unfortunately not many do

I've worked on so many home PC's that have virus protection but old virus signatures. There are thousands of zombie pc's emailing this crap right now.

I'm sure quite a few people here are working on computers that are sending out viruses right now.

[sinkingfeeling]

3. This is sober.y ?

[Oreo]

4. It's some kind of sober variant

Not sure which as I strip the attachments on my server before they get to the client.

As for going to the second MX record... I realized it happened because I blocked them on my primary gateway :P

[LoKnLoD]

5. sober.x

my symantec client security hardware firewall is blocking around 40 per hour.

[mrdmk]

6. I have both Cox and Earthlink e-mail accounts

They both have two ways of dealing with these, "Robo Computers".

Cox:
<snip>
In April 2004, Cox will launch a new email virus protection service to help defend Cox High Speed Internet customers from receiving hazardous computer viruses via email. This free service is automatically activated, and does not need to be installed. Customers do not need to contact Cox in order to benefit from this service.

It works as follows:

* Messages sent to Cox Customers' email accounts on the cox.net domain (i.e. ending with '@cox.net') will be checked for viruses before being delivered to the customers' in-box or Webmail. Click here for latest updates.
* If a known virus is detected the service will delete the entire email message and send a notification to you explaining the email has been removed. The email notification message will be sent from Cox Virus Monitor. Update: Starting in July, Cox will no longer be sending virus notification messages. This service improvement is based on customer feedback regarding messages of this nature and is part of our continuing efforts to provide the best security and overall customer experience. Most email software can be setup to automatically delete these notifications, this done by setting up specific rules within your email software. For instructions on setting up rules to delete these message Click Here.
* Please note that Cox does not read the content (text) of your email messages. This automated solution only detects known viruses.

Although the new Cox anti-virus solution will provide protection against viruses transmitted via email, we still recommend the use of anti-virus software on your PC, which will protect you from viruses transmitted through Web sites, Internet downloads, diskettes, portable drives, etc. The new email virus protection service will not prevent downloading of virus-infected files, nor will it remove viruses already present on a customers' computer.
<end of snip>

Earthlink
<snip>
EarthLink's outgoing mail servers are now using authenticated SMTP (ASMTP) to help fight spam. As a result, you must update your email settings to continue sending mail from our servers. ASMTP requires you to enter your email password before sending email. This simple step blocks unauthorized outgoing messages and helps reduce the distribution of spam.
<end of snip>

Of course the Cox method just blocks e-mails, it does not protect one from the Internet or an infected removable media.

The Earthlink method stops an infected computer from sending e-mails though their SMTP Server, hence the Roadrunner problem.

Some people are idiots when it comes to computers; you asked them a simple question such as, "Have updated your computers OS and virus definitions"? Of course you are told, "I keep everything updated". I do not know what they are thinking, first thing when fixing somebodies computer problems, 1) Update virus defs, 2) Check for updates for OS, especially security updates. 9 times out of 10 this has not been done.

If anybody has a questions what-so-ever, please ask!