January 26, 2004

Latest rash of spam

The following should go into mime_header_checks.regexp assuming you're running Postfix. Which you should be.

/filename=\"?body.zip\"/ DISCARD Virus spam discarded (W32.Novarg.A@mm)

No point REJECTing it, since you'd just be sending it back to an already-infected victim.


OK, it turns out that the filename varies. For the moment, I'm dropping everything with a .zip attachment. I've gotten a HUGE surge in inbound email in the last 2 or 3 hours, MOST of it consisting of this virus message, and almost all of it is coming from two addresses: and I don't know who this is, but they are making dozens of connections per second to deliver mail. Or at least, they were, until I told the firewall about them.

I hope they stop soon.

Posted by rbowen at January 26, 2004 06:38 PM | TrackBack

CO_USA is ~postmaste@ (John Doe), if you're on IRC right now.

Posted by: Richard Soderberg on March 2, 2004 09:54 AM

Those are Kinkos IP addresses.

Kinkos, Inc. FON-1067749632866191 (NET-63-164-145-0-1) -

OrgName: Kinkos, Inc.
Address: 255 West Stanley Avenue
City: Ventura
StateProv: CA
PostalCode: 93002-8000
Country: US

NetRange: -
NetName: FON-1067749632866191
NetHandle: NET-63-164-145-0-1
Parent: NET-63-160-0-0-1
NetType: Reassigned
RegDate: 2002-04-11
Updated: 2002-08-08

TechHandle: IK81-ARIN
TechName: Kinkos, InfoSec
TechPhone: +1-805-652-4000
TechEmail: information.security@kinkos.com

They've probably fixed them by now, but it's still worth knowing for next time.

Posted by: Richard Soderberg on March 2, 2004 09:58 AM
Post a comment