uvscan doesn't extract out MIME attachments but amavis does. You have to
have a whole lot of un archivers on the system for that reason.

Dave
On Tue, 2002-07-30 at 22:13, Christopher Kings-Lynne wrote:
> Hmmm - I'm pretty sure that uvscan won't automatically extract out MIME
> attachements.  You need to scan normal files.
> 
> We use inflex on our mail servers to extract all our emails before
> scanning...
> 
> Chris
> 
> > -----Original Message-----
> > From: Marc G. Fournier [mailto:scrappy@hub.org]
> > Sent: Tuesday, 30 July 2002 10:47 PM
> > To: Larry Rosenman
> > Cc: Christopher Kings-Lynne; pgsql-hackers@postgresql.org
> > Subject: Re: [HACKERS] Virus Emails
> >
> >
> >
> >
> > Okay, am playing with this on one of my 'none-critical' servers right now
> > ... tried to use uvscan from teh command line, and it didn't appear to
> > pick up any of the Klez stuff, even though I know I have a few in my
> > mailbox ...
> >
> > What options should I be running as?  I'm using the following:
> >
> > uvscan --analyse --recursive --mime --summary --program /var/spool/mail
> >
> > On 28 Jul 2002, Larry Rosenman wrote:
> >
> > > On Sun, 2002-07-28 at 20:10, Marc G. Fournier wrote:
> > > >
> > > > God, I go through 200+ of those almost daily as moderator ...
> > imagine if
> > > > we had the lists open? :)
> > > I picked up a copy of McAfee's vscan for FreeBSD from one of my contract
> > > people, and have amavisd-milter running to prevent them from even
> > > getting in the door.
> > >
> > > Mayhaps pgsql.org should do the same?
> > >
> > >
> > > >
> > > >
> > > > On Sat, 27 Jul 2002, Christopher Kings-Lynne wrote:
> > > >
> > > > > Hi guys,
> > > > >
> > > > > I seem to be getting virus emails that pretend to be one of
> > your guys.  eg.
> > > > > I get them from T.Ishii and N.Conway, etc.  Anyone out
> > there on the list who
> > > > > should perhaps scan their computer? :)
> > > > >
> > > > > Chris
> > > > >
> > > > >
> > > > >
> > > > > ---------------------------(end of
> > broadcast)---------------------------
> > > > > TIP 5: Have you checked our extensive FAQ?
> > > > >
> > > > > http://www.postgresql.org/users-lounge/docs/faq.html
> > > > >
> > > >
> > > >
> > > > ---------------------------(end of
> > broadcast)---------------------------
> > > > TIP 3: if posting/reading through Usenet, please send an appropriate
> > > > subscribe-nomail command to majordomo@postgresql.org so that your
> > > > message can get through to the mailing list cleanly
> > > >
> > > --
> > > Larry Rosenman                     http://www.lerctr.org/~ler
> > > Phone: +1 972-414-9812                 E-Mail: ler@lerctr.org
> > > US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749
> > >
> > >
> >
> 
> 
> ---------------------------(end of broadcast)---------------------------
> TIP 3: if posting/reading through Usenet, please send an appropriate
> subscribe-nomail command to majordomo@postgresql.org so that your
> message can get through to the mailing list cleanly
> 
> 




20 Jul 2001 22:33:48 -0400
Dave Cramer <dave@fastcrypt.com>
Re: Virus Emails
Hi guys,

I seem to be getting virus emails that pretend to be one of your guys.  eg.
I get them from T.Ishii and N.Conway, etc.  Anyone out there on the list who
should perhaps scan their computer? :)

Chris



Sat, 27 Jul 2002 10:26:44 +0800
"Christopher Kings-Lynne" <chriskl@familyhealth.com.au>
Virus Emails
"Christopher Kings-Lynne" <chriskl@familyhealth.com.au> writes:
> I seem to be getting virus emails that pretend to be one of your guys.  eg.
> I get them from T.Ishii and N.Conway, etc.  Anyone out there on the list who
> should perhaps scan their computer? :)

One of the nastier aspects of the Klez virus is that it searches
accessible files and webpages for email addresses.  It doesn't just spam
all the addresses it can find --- it spams each address with a false
"From:" that's a found-nearby address.  So mail-list archives are a
gold mine for it: it can spam you with a false "From:" that you will
probably recognize.

However, even a trivial look at the detail mail headers (Received: etc)
will convince you that the spam did not originate from the claimed
"From:" address.  If you care to post a few sets of complete headers,
we can probably triangulate pretty quickly on the virus-infected loser
who's originating these messages.

			regards, tom lane

Sat, 27 Jul 2002 02:35:36 -0400
Tom Lane <tgl@sss.pgh.pa.us>
Re: Virus Emails 
On Sat, 27 Jul 2002, Tom Lane wrote:

> One of the nastier aspects of the Klez virus....
>
> However, even a trivial look at the detail mail headers (Received: etc)
> will convince you that the spam did not originate from the claimed
> "From:" address.  If you care to post a few sets of complete headers,
> we can probably triangulate pretty quickly on the virus-infected loser
> who's originating these messages.

It appears to me that the envelope sender is not forged by Klez.H,
assuming that that's the virus I'm getting all the time. So you
could check for the "Return-Path:" header, or maybe "From " (note:
no colon) if you're using a Berkeley-mailbox style system, and find
out the e-mail address of the real sender.

cjs
-- 
Curt Sampson  <cjs@cynic.net>   +81 90 7737 2974   http://www.netbsd.org
    Don't you know, in this new Dark Age, we're all light.  --XTC



Sun, 28 Jul 2002 18:06:12 +0900 (JST)
Curt Sampson <cjs@cynic.net>
Re: Virus Emails 
That may be true with some variants.
However my mail server has rejected the relay of several mails sent pretending 
to be from me (envelope sender) to other parties and I think these could be 
klez variants or another such virus.  Since my server rejected them I cannot 
be sure of the contents.

On Sunday 28 July 2002 04:06 am, Curt Sampson wrote:
> On Sat, 27 Jul 2002, Tom Lane wrote:
> > One of the nastier aspects of the Klez virus....
> >
> > However, even a trivial look at the detail mail headers (Received: etc)
> > will convince you that the spam did not originate from the claimed
> > "From:" address.  If you care to post a few sets of complete headers,
> > we can probably triangulate pretty quickly on the virus-infected loser
> > who's originating these messages.
>
> It appears to me that the envelope sender is not forged by Klez.H,
> assuming that that's the virus I'm getting all the time. So you
> could check for the "Return-Path:" header, or maybe "From " (note:
> no colon) if you're using a Berkeley-mailbox style system, and find
> out the e-mail address of the real sender.
>
> cjs


Sun, 28 Jul 2002 13:57:30 -0500
David Walker <pgsql@grax.com>
Re: Virus Emails

God, I go through 200+ of those almost daily as moderator ... imagine if
we had the lists open? :)


On Sat, 27 Jul 2002, Christopher Kings-Lynne wrote:

> Hi guys,
>
> I seem to be getting virus emails that pretend to be one of your guys.  eg.
> I get them from T.Ishii and N.Conway, etc.  Anyone out there on the list who
> should perhaps scan their computer? :)
>
> Chris
>
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 5: Have you checked our extensive FAQ?
>
> http://www.postgresql.org/users-lounge/docs/faq.html
>


Sun, 28 Jul 2002 22:10:42 -0300 (ADT)
"Marc G. Fournier" <scrappy@hub.org>
Re: Virus Emails
On Sun, 2002-07-28 at 20:10, Marc G. Fournier wrote:
> 
> God, I go through 200+ of those almost daily as moderator ... imagine if
> we had the lists open? :)
I picked up a copy of McAfee's vscan for FreeBSD from one of my contract
people, and have amavisd-milter running to prevent them from even
getting in the door. 

Mayhaps pgsql.org should do the same? 


> 
> 
> On Sat, 27 Jul 2002, Christopher Kings-Lynne wrote:
> 
> > Hi guys,
> >
> > I seem to be getting virus emails that pretend to be one of your guys.  eg.
> > I get them from T.Ishii and N.Conway, etc.  Anyone out there on the list who
> > should perhaps scan their computer? :)
> >
> > Chris
> >
> >
> >
> > ---------------------------(end of broadcast)---------------------------
> > TIP 5: Have you checked our extensive FAQ?
> >
> > http://www.postgresql.org/users-lounge/docs/faq.html
> >
> 
> 
> ---------------------------(end of broadcast)---------------------------
> TIP 3: if posting/reading through Usenet, please send an appropriate
> subscribe-nomail command to majordomo@postgresql.org so that your
> message can get through to the mailing list cleanly
> 
-- 
Larry Rosenman                     http://www.lerctr.org/~ler
Phone: +1 972-414-9812                 E-Mail: ler@lerctr.org
US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749


28 Jul 2002 20:14:13 -0500
Larry Rosenman <ler@lerctr.org>
Re: Virus Emails
Marc G. Fournier wrote:
> 
> God, I go through 200+ of those almost daily as moderator ... imagine if
> we had the lists open? :)
> 

How do you prevent virus emails from coming in that look like they are
from the intended person?  Does the filter check only the envelope from
and not the From: line?

-- 
  Bruce Momjian                        |  http://candle.pha.pa.us
  pgman@candle.pha.pa.us               |  (610) 853-3000
  +  If your life is a hard drive,     |  830 Blythe Avenue
  +  Christ can be your backup.        |  Drexel Hill, Pennsylvania 19026

Sun, 28 Jul 2002 21:45:39 -0400 (EDT)
Bruce Momjian <pgman@candle.pha.pa.us>
Re: Virus Emails
On 28 Jul 2002, Larry Rosenman wrote:

> On Sun, 2002-07-28 at 20:10, Marc G. Fournier wrote:
> >
> > God, I go through 200+ of those almost daily as moderator ... imagine if
> > we had the lists open? :)
> I picked up a copy of McAfee's vscan for FreeBSD from one of my contract
> people, and have amavisd-milter running to prevent them from even
> getting in the door.
>
> Mayhaps pgsql.org should do the same?

One of the many things on my list to do ... how do you find the vscan
stuff?  do you find it slows down email noticeably?


>
>
> >
> >
> > On Sat, 27 Jul 2002, Christopher Kings-Lynne wrote:
> >
> > > Hi guys,
> > >
> > > I seem to be getting virus emails that pretend to be one of your guys.  eg.
> > > I get them from T.Ishii and N.Conway, etc.  Anyone out there on the list who
> > > should perhaps scan their computer? :)
> > >
> > > Chris
> > >
> > >
> > >
> > > ---------------------------(end of broadcast)---------------------------
> > > TIP 5: Have you checked our extensive FAQ?
> > >
> > > http://www.postgresql.org/users-lounge/docs/faq.html
> > >
> >
> >
> > ---------------------------(end of broadcast)---------------------------
> > TIP 3: if posting/reading through Usenet, please send an appropriate
> > subscribe-nomail command to majordomo@postgresql.org so that your
> > message can get through to the mailing list cleanly
> >
> --
> Larry Rosenman                     http://www.lerctr.org/~ler
> Phone: +1 972-414-9812                 E-Mail: ler@lerctr.org
> US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749
>
>


Sun, 28 Jul 2002 23:44:50 -0300 (ADT)
"Marc G. Fournier" <scrappy@hub.org>
Re: Virus Emails
On Sun, 2002-07-28 at 21:44, Marc G. Fournier wrote:
> On 28 Jul 2002, Larry Rosenman wrote:
> 
> > On Sun, 2002-07-28 at 20:10, Marc G. Fournier wrote:
> > >
> > > God, I go through 200+ of those almost daily as moderator ... imagine if
> > > we had the lists open? :)
> > I picked up a copy of McAfee's vscan for FreeBSD from one of my contract
> > people, and have amavisd-milter running to prevent them from even
> > getting in the door.
> >
> > Mayhaps pgsql.org should do the same?
> 
> One of the many things on my list to do ... how do you find the vscan
> stuff?  do you find it slows down email noticeably?
SpamAssassin slows it down much more.  The vscan stuff is FAST, and
running as a Milter prevents it from even getting in the door. 

Since most of my large mail is generally klez and friends, this speeds
up the SpamAssassin stuff by design. 


I like the vscan stuff, and McAfee updates the DAT files at least
weekly, although I have the update_dat script from ports try every day
to get new ones. 


-- 
Larry Rosenman                     http://www.lerctr.org/~ler
Phone: +1 972-414-9812                 E-Mail: ler@lerctr.org
US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749


28 Jul 2002 21:47:40 -0500
Larry Rosenman <ler@lerctr.org>
Re: Virus Emails
> > I picked up a copy of McAfee's vscan for FreeBSD from one of my contract
> > people, and have amavisd-milter running to prevent them from even
> > getting in the door.
> >
> > Mayhaps pgsql.org should do the same?
>
> One of the many things on my list to do ... how do you find the vscan
> stuff?  do you find it slows down email noticeably?

We actually use the McAfee vscan at work, but it's not blocking these
viruses.  If you're on a freebsd box, install /usr/ports/security/vscan and
/usr/ports/security/uvscan-dat.  it will then automatically update your DAT
files.

Chris


Mon, 29 Jul 2002 10:55:55 +0800
"Christopher Kings-Lynne" <chriskl@familyhealth.com.au>
Re: Virus Emails
On Sun, 2002-07-28 at 21:55, Christopher Kings-Lynne wrote:
> > > I picked up a copy of McAfee's vscan for FreeBSD from one of my contract
> > > people, and have amavisd-milter running to prevent them from even
> > > getting in the door.
> > >
> > > Mayhaps pgsql.org should do the same?
> >
> > One of the many things on my list to do ... how do you find the vscan
> > stuff?  do you find it slows down email noticeably?
> 
> We actually use the McAfee vscan at work, but it's not blocking these
> viruses.  
Why isn't it ?  Klez is caught by it... 


> 
> Chris
-- 
Larry Rosenman                     http://www.lerctr.org/~ler
Phone: +1 972-414-9812                 E-Mail: ler@lerctr.org
US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749


28 Jul 2002 21:58:46 -0500
Larry Rosenman <ler@lerctr.org>
Re: Virus Emails
On Sun, 28 Jul 2002, Bruce Momjian wrote:

> Marc G. Fournier wrote:
> >
> > God, I go through 200+ of those almost daily as moderator ... imagine if
> > we had the lists open? :)
> >
>
> How do you prevent virus emails from coming in that look like they are
> from the intended person?  Does the filter check only the envelope from
> and not the From: line?

Don't filter, scan for viruses.  McAfee finds it just fine.

Vince.
-- 
==========================================================================
Vince Vielhaber -- KA8CSH    email: vev@michvhf.com    http://www.pop4.net
         56K Nationwide Dialup from $16.00/mo at Pop4 Networking
        Online Campground Directory    http://www.camping-usa.com
       Online Giftshop Superstore    http://www.cloudninegifts.com
==========================================================================




Mon, 29 Jul 2002 06:01:19 -0400 (EDT)
Vince Vielhaber <vev@michvhf.com>
Re: Virus Emails
On Sun, 28 Jul 2002, Marc G. Fournier wrote:

> On 28 Jul 2002, Larry Rosenman wrote:
>
> > On Sun, 2002-07-28 at 20:10, Marc G. Fournier wrote:
> > >
> > > God, I go through 200+ of those almost daily as moderator ... imagine if
> > > we had the lists open? :)
> > I picked up a copy of McAfee's vscan for FreeBSD from one of my contract
> > people, and have amavisd-milter running to prevent them from even
> > getting in the door.
> >
> > Mayhaps pgsql.org should do the same?
>
> One of the many things on my list to do ... how do you find the vscan
> stuff?  do you find it slows down email noticeably?

pop4 doesn't even break a sweat and a ton of mail goes thru there every
day.

Vince.
-- 
==========================================================================
Vince Vielhaber -- KA8CSH    email: vev@michvhf.com    http://www.pop4.net
         56K Nationwide Dialup from $16.00/mo at Pop4 Networking
        Online Campground Directory    http://www.camping-usa.com
       Online Giftshop Superstore    http://www.cloudninegifts.com
==========================================================================




Mon, 29 Jul 2002 06:10:17 -0400 (EDT)
Vince Vielhaber <vev@michvhf.com>
Re: Virus Emails


Okay, am playing with this on one of my 'none-critical' servers right now
... tried to use uvscan from teh command line, and it didn't appear to
pick up any of the Klez stuff, even though I know I have a few in my
mailbox ...

What options should I be running as?  I'm using the following:

uvscan --analyse --recursive --mime --summary --program /var/spool/mail

On 28 Jul 2002, Larry Rosenman wrote:

> On Sun, 2002-07-28 at 20:10, Marc G. Fournier wrote:
> >
> > God, I go through 200+ of those almost daily as moderator ... imagine if
> > we had the lists open? :)
> I picked up a copy of McAfee's vscan for FreeBSD from one of my contract
> people, and have amavisd-milter running to prevent them from even
> getting in the door.
>
> Mayhaps pgsql.org should do the same?
>
>
> >
> >
> > On Sat, 27 Jul 2002, Christopher Kings-Lynne wrote:
> >
> > > Hi guys,
> > >
> > > I seem to be getting virus emails that pretend to be one of your guys.  eg.
> > > I get them from T.Ishii and N.Conway, etc.  Anyone out there on the list who
> > > should perhaps scan their computer? :)
> > >
> > > Chris
> > >
> > >
> > >
> > > ---------------------------(end of broadcast)---------------------------
> > > TIP 5: Have you checked our extensive FAQ?
> > >
> > > http://www.postgresql.org/users-lounge/docs/faq.html
> > >
> >
> >
> > ---------------------------(end of broadcast)---------------------------
> > TIP 3: if posting/reading through Usenet, please send an appropriate
> > subscribe-nomail command to majordomo@postgresql.org so that your
> > message can get through to the mailing list cleanly
> >
> --
> Larry Rosenman                     http://www.lerctr.org/~ler
> Phone: +1 972-414-9812                 E-Mail: ler@lerctr.org
> US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749
>
>


Tue, 30 Jul 2002 11:47:28 -0300 (ADT)
"Marc G. Fournier" <scrappy@hub.org>
Re: Virus Emails

figured it out ... uvscan isn't looking where ports installed the newer
.dat files ... fixed that and it finds 63 virii infected files instead of
just 5 :)

one step closer ...

On Tue, 30 Jul 2002, Marc G. Fournier wrote:

>
>
> Okay, am playing with this on one of my 'none-critical' servers right now
> ... tried to use uvscan from teh command line, and it didn't appear to
> pick up any of the Klez stuff, even though I know I have a few in my
> mailbox ...
>
> What options should I be running as?  I'm using the following:
>
> uvscan --analyse --recursive --mime --summary --program /var/spool/mail
>
> On 28 Jul 2002, Larry Rosenman wrote:
>
> > On Sun, 2002-07-28 at 20:10, Marc G. Fournier wrote:
> > >
> > > God, I go through 200+ of those almost daily as moderator ... imagine if
> > > we had the lists open? :)
> > I picked up a copy of McAfee's vscan for FreeBSD from one of my contract
> > people, and have amavisd-milter running to prevent them from even
> > getting in the door.
> >
> > Mayhaps pgsql.org should do the same?
> >
> >
> > >
> > >
> > > On Sat, 27 Jul 2002, Christopher Kings-Lynne wrote:
> > >
> > > > Hi guys,
> > > >
> > > > I seem to be getting virus emails that pretend to be one of your guys.  eg.
> > > > I get them from T.Ishii and N.Conway, etc.  Anyone out there on the list who
> > > > should perhaps scan their computer? :)
> > > >
> > > > Chris
> > > >
> > > >
> > > >
> > > > ---------------------------(end of broadcast)---------------------------
> > > > TIP 5: Have you checked our extensive FAQ?
> > > >
> > > > http://www.postgresql.org/users-lounge/docs/faq.html
> > > >
> > >
> > >
> > > ---------------------------(end of broadcast)---------------------------
> > > TIP 3: if posting/reading through Usenet, please send an appropriate
> > > subscribe-nomail command to majordomo@postgresql.org so that your
> > > message can get through to the mailing list cleanly
> > >
> > --
> > Larry Rosenman                     http://www.lerctr.org/~ler
> > Phone: +1 972-414-9812                 E-Mail: ler@lerctr.org
> > US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749
> >
> >
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 3: if posting/reading through Usenet, please send an appropriate
> subscribe-nomail command to majordomo@postgresql.org so that your
> message can get through to the mailing list cleanly
>


Tue, 30 Jul 2002 13:26:46 -0300 (ADT)
"Marc G. Fournier" <scrappy@hub.org>
Re: Virus Emails

Okay, this is sweet ... but can someone tell me where I 'Buy' a copy of
uvscan?  I've searched McAfee, but can't seem to find it in their eStore
anywhere ...


On 28 Jul 2002, Larry Rosenman wrote:

> On Sun, 2002-07-28 at 20:10, Marc G. Fournier wrote:
> >
> > God, I go through 200+ of those almost daily as moderator ... imagine if
> > we had the lists open? :)
> I picked up a copy of McAfee's vscan for FreeBSD from one of my contract
> people, and have amavisd-milter running to prevent them from even
> getting in the door.
>
> Mayhaps pgsql.org should do the same?
>
>
> >
> >
> > On Sat, 27 Jul 2002, Christopher Kings-Lynne wrote:
> >
> > > Hi guys,
> > >
> > > I seem to be getting virus emails that pretend to be one of your guys.  eg.
> > > I get them from T.Ishii and N.Conway, etc.  Anyone out there on the list who
> > > should perhaps scan their computer? :)
> > >
> > > Chris
> > >
> > >
> > >
> > > ---------------------------(end of broadcast)---------------------------
> > > TIP 5: Have you checked our extensive FAQ?
> > >
> > > http://www.postgresql.org/users-lounge/docs/faq.html
> > >
> >
> >
> > ---------------------------(end of broadcast)---------------------------
> > TIP 3: if posting/reading through Usenet, please send an appropriate
> > subscribe-nomail command to majordomo@postgresql.org so that your
> > message can get through to the mailing list cleanly
> >
> --
> Larry Rosenman                     http://www.lerctr.org/~ler
> Phone: +1 972-414-9812                 E-Mail: ler@lerctr.org
> US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749
>
>


Tue, 30 Jul 2002 15:20:11 -0300 (ADT)
"Marc G. Fournier" <scrappy@hub.org>
Re: Virus Emails
Try their corporate sales droids....

If you can't find one, I'll ask my contract client....

LER

On Tue, 2002-07-30 at 13:20, Marc G. Fournier wrote:
> 
> Okay, this is sweet ... but can someone tell me where I 'Buy' a copy of
> uvscan?  I've searched McAfee, but can't seem to find it in their eStore
> anywhere ...
> 
> 
> On 28 Jul 2002, Larry Rosenman wrote:
> 
> > On Sun, 2002-07-28 at 20:10, Marc G. Fournier wrote:
> > >
> > > God, I go through 200+ of those almost daily as moderator ... imagine if
> > > we had the lists open? :)
> > I picked up a copy of McAfee's vscan for FreeBSD from one of my contract
> > people, and have amavisd-milter running to prevent them from even
> > getting in the door.
> >
> > Mayhaps pgsql.org should do the same?
> >
> >
> > >
> > >
> > > On Sat, 27 Jul 2002, Christopher Kings-Lynne wrote:
> > >
> > > > Hi guys,
> > > >
> > > > I seem to be getting virus emails that pretend to be one of your guys.  eg.
> > > > I get them from T.Ishii and N.Conway, etc.  Anyone out there on the list who
> > > > should perhaps scan their computer? :)
> > > >
> > > > Chris
> > > >
> > > >
> > > >
> > > > ---------------------------(end of broadcast)---------------------------
> > > > TIP 5: Have you checked our extensive FAQ?
> > > >
> > > > http://www.postgresql.org/users-lounge/docs/faq.html
> > > >
> > >
> > >
> > > ---------------------------(end of broadcast)---------------------------
> > > TIP 3: if posting/reading through Usenet, please send an appropriate
> > > subscribe-nomail command to majordomo@postgresql.org so that your
> > > message can get through to the mailing list cleanly
> > >
> > --
> > Larry Rosenman                     http://www.lerctr.org/~ler
> > Phone: +1 972-414-9812                 E-Mail: ler@lerctr.org
> > US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749
> >
> >
-- 
Larry Rosenman                     http://www.lerctr.org/~ler
Phone: +1 972-414-9812                 E-Mail: ler@lerctr.org
US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749


30 Jul 2002 13:25:37 -0500
Larry Rosenman <ler@lerctr.org>
Re: Virus Emails
Hmmm - I'm pretty sure that uvscan won't automatically extract out MIME
attachements.  You need to scan normal files.

We use inflex on our mail servers to extract all our emails before
scanning...

Chris

> -----Original Message-----
> From: Marc G. Fournier [mailto:scrappy@hub.org]
> Sent: Tuesday, 30 July 2002 10:47 PM
> To: Larry Rosenman
> Cc: Christopher Kings-Lynne; pgsql-hackers@postgresql.org
> Subject: Re: [HACKERS] Virus Emails
>
>
>
>
> Okay, am playing with this on one of my 'none-critical' servers right now
> ... tried to use uvscan from teh command line, and it didn't appear to
> pick up any of the Klez stuff, even though I know I have a few in my
> mailbox ...
>
> What options should I be running as?  I'm using the following:
>
> uvscan --analyse --recursive --mime --summary --program /var/spool/mail
>
> On 28 Jul 2002, Larry Rosenman wrote:
>
> > On Sun, 2002-07-28 at 20:10, Marc G. Fournier wrote:
> > >
> > > God, I go through 200+ of those almost daily as moderator ...
> imagine if
> > > we had the lists open? :)
> > I picked up a copy of McAfee's vscan for FreeBSD from one of my contract
> > people, and have amavisd-milter running to prevent them from even
> > getting in the door.
> >
> > Mayhaps pgsql.org should do the same?
> >
> >
> > >
> > >
> > > On Sat, 27 Jul 2002, Christopher Kings-Lynne wrote:
> > >
> > > > Hi guys,
> > > >
> > > > I seem to be getting virus emails that pretend to be one of
> your guys.  eg.
> > > > I get them from T.Ishii and N.Conway, etc.  Anyone out
> there on the list who
> > > > should perhaps scan their computer? :)
> > > >
> > > > Chris
> > > >
> > > >
> > > >
> > > > ---------------------------(end of
> broadcast)---------------------------
> > > > TIP 5: Have you checked our extensive FAQ?
> > > >
> > > > http://www.postgresql.org/users-lounge/docs/faq.html
> > > >
> > >
> > >
> > > ---------------------------(end of
> broadcast)---------------------------
> > > TIP 3: if posting/reading through Usenet, please send an appropriate
> > > subscribe-nomail command to majordomo@postgresql.org so that your
> > > message can get through to the mailing list cleanly
> > >
> > --
> > Larry Rosenman                     http://www.lerctr.org/~ler
> > Phone: +1 972-414-9812                 E-Mail: ler@lerctr.org
> > US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749
> >
> >
>


Wed, 31 Jul 2002 10:13:00 +0800
"Christopher Kings-Lynne" <chriskl@familyhealth.com.au>
Re: Virus Emails
I would also like to know this!  They don't mention it anywhere on their
site!

Chris

> -----Original Message-----
> From: pgsql-hackers-owner@postgresql.org
> [mailto:pgsql-hackers-owner@postgresql.org]On Behalf Of Marc G. Fournier
> Sent: Wednesday, 31 July 2002 2:20 AM
> To: Larry Rosenman
> Cc: Christopher Kings-Lynne; pgsql-hackers@postgresql.org
> Subject: Re: [HACKERS] Virus Emails
>
>
>
> Okay, this is sweet ... but can someone tell me where I 'Buy' a copy of
> uvscan?  I've searched McAfee, but can't seem to find it in their eStore
> anywhere ...
>
>
> On 28 Jul 2002, Larry Rosenman wrote:
>
> > On Sun, 2002-07-28 at 20:10, Marc G. Fournier wrote:
> > >
> > > God, I go through 200+ of those almost daily as moderator ...
> imagine if
> > > we had the lists open? :)
> > I picked up a copy of McAfee's vscan for FreeBSD from one of my contract
> > people, and have amavisd-milter running to prevent them from even
> > getting in the door.
> >
> > Mayhaps pgsql.org should do the same?
> >
> >
> > >
> > >
> > > On Sat, 27 Jul 2002, Christopher Kings-Lynne wrote:
> > >
> > > > Hi guys,
> > > >
> > > > I seem to be getting virus emails that pretend to be one of
> your guys.  eg.
> > > > I get them from T.Ishii and N.Conway, etc.  Anyone out
> there on the list who
> > > > should perhaps scan their computer? :)
> > > >
> > > > Chris
> > > >
> > > >
> > > >
> > > > ---------------------------(end of
> broadcast)---------------------------
> > > > TIP 5: Have you checked our extensive FAQ?
> > > >
> > > > http://www.postgresql.org/users-lounge/docs/faq.html
> > > >
> > >
> > >
> > > ---------------------------(end of
> broadcast)---------------------------
> > > TIP 3: if posting/reading through Usenet, please send an appropriate
> > > subscribe-nomail command to majordomo@postgresql.org so that your
> > > message can get through to the mailing list cleanly
> > >
> > --
> > Larry Rosenman                     http://www.lerctr.org/~ler
> > Phone: +1 972-414-9812                 E-Mail: ler@lerctr.org
> > US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749
> >
> >
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 5: Have you checked our extensive FAQ?
>
> http://www.postgresql.org/users-lounge/docs/faq.html
>


Wed, 31 Jul 2002 10:24:16 +0800
"Christopher Kings-Lynne" <chriskl@familyhealth.com.au>
Re: Virus Emails

the only thing I've found so far (I've email'd their sales guy, but
haven't heard back yet) on their site is a 'calculator' that depends on
number of users ... for the University I work out, I believe the cost came
out to something like $99kUS, and I went low on my figures for # of users
:)

Thank god there is more then just McAfee out there .. unless those #'s are
wrong, am definitely going to be looking at alternatives ...

On Wed, 31 Jul 2002, Christopher Kings-Lynne wrote:

> I would also like to know this!  They don't mention it anywhere on their
> site!
>
> Chris
>
> > -----Original Message-----
> > From: pgsql-hackers-owner@postgresql.org
> > [mailto:pgsql-hackers-owner@postgresql.org]On Behalf Of Marc G. Fournier
> > Sent: Wednesday, 31 July 2002 2:20 AM
> > To: Larry Rosenman
> > Cc: Christopher Kings-Lynne; pgsql-hackers@postgresql.org
> > Subject: Re: [HACKERS] Virus Emails
> >
> >
> >
> > Okay, this is sweet ... but can someone tell me where I 'Buy' a copy of
> > uvscan?  I've searched McAfee, but can't seem to find it in their eStore
> > anywhere ...
> >
> >
> > On 28 Jul 2002, Larry Rosenman wrote:
> >
> > > On Sun, 2002-07-28 at 20:10, Marc G. Fournier wrote:
> > > >
> > > > God, I go through 200+ of those almost daily as moderator ...
> > imagine if
> > > > we had the lists open? :)
> > > I picked up a copy of McAfee's vscan for FreeBSD from one of my contract
> > > people, and have amavisd-milter running to prevent them from even
> > > getting in the door.
> > >
> > > Mayhaps pgsql.org should do the same?
> > >
> > >
> > > >
> > > >
> > > > On Sat, 27 Jul 2002, Christopher Kings-Lynne wrote:
> > > >
> > > > > Hi guys,
> > > > >
> > > > > I seem to be getting virus emails that pretend to be one of
> > your guys.  eg.
> > > > > I get them from T.Ishii and N.Conway, etc.  Anyone out
> > there on the list who
> > > > > should perhaps scan their computer? :)
> > > > >
> > > > > Chris
> > > > >
> > > > >
> > > > >
> > > > > ---------------------------(end of
> > broadcast)---------------------------
> > > > > TIP 5: Have you checked our extensive FAQ?
> > > > >
> > > > > http://www.postgresql.org/users-lounge/docs/faq.html
> > > > >
> > > >
> > > >
> > > > ---------------------------(end of
> > broadcast)---------------------------
> > > > TIP 3: if posting/reading through Usenet, please send an appropriate
> > > > subscribe-nomail command to majordomo@postgresql.org so that your
> > > > message can get through to the mailing list cleanly
> > > >
> > > --
> > > Larry Rosenman                     http://www.lerctr.org/~ler
> > > Phone: +1 972-414-9812                 E-Mail: ler@lerctr.org
> > > US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749
> > >
> > >
> >
> >
> > ---------------------------(end of broadcast)---------------------------
> > TIP 5: Have you checked our extensive FAQ?
> >
> > http://www.postgresql.org/users-lounge/docs/faq.html
> >
>
>


Wed, 31 Jul 2002 02:00:56 -0300 (ADT)
"Marc G. Fournier" <scrappy@hub.org>
Re: Virus Emails
I'll ask my contract what they paid....



On Wed, 2002-07-31 at 00:00, Marc G. Fournier wrote:
> 
> the only thing I've found so far (I've email'd their sales guy, but
> haven't heard back yet) on their site is a 'calculator' that depends on
> number of users ... for the University I work out, I believe the cost came
> out to something like $99kUS, and I went low on my figures for # of users
> :)
> 
> Thank god there is more then just McAfee out there .. unless those #'s are
> wrong, am definitely going to be looking at alternatives ...
> 
> On Wed, 31 Jul 2002, Christopher Kings-Lynne wrote:
> 
> > I would also like to know this!  They don't mention it anywhere on their
> > site!
> >
> > Chris
> >
> > > -----Original Message-----
> > > From: pgsql-hackers-owner@postgresql.org
> > > [mailto:pgsql-hackers-owner@postgresql.org]On Behalf Of Marc G. Fournier
> > > Sent: Wednesday, 31 July 2002 2:20 AM
> > > To: Larry Rosenman
> > > Cc: Christopher Kings-Lynne; pgsql-hackers@postgresql.org
> > > Subject: Re: [HACKERS] Virus Emails
> > >
> > >
> > >
> > > Okay, this is sweet ... but can someone tell me where I 'Buy' a copy of
> > > uvscan?  I've searched McAfee, but can't seem to find it in their eStore
> > > anywhere ...
> > >
> > >
> > > On 28 Jul 2002, Larry Rosenman wrote:
> > >
> > > > On Sun, 2002-07-28 at 20:10, Marc G. Fournier wrote:
> > > > >
> > > > > God, I go through 200+ of those almost daily as moderator ...
> > > imagine if
> > > > > we had the lists open? :)
> > > > I picked up a copy of McAfee's vscan for FreeBSD from one of my contract
> > > > people, and have amavisd-milter running to prevent them from even
> > > > getting in the door.
> > > >
> > > > Mayhaps pgsql.org should do the same?
> > > >
> > > >
> > > > >
> > > > >
> > > > > On Sat, 27 Jul 2002, Christopher Kings-Lynne wrote:
> > > > >
> > > > > > Hi guys,
> > > > > >
> > > > > > I seem to be getting virus emails that pretend to be one of
> > > your guys.  eg.
> > > > > > I get them from T.Ishii and N.Conway, etc.  Anyone out
> > > there on the list who
> > > > > > should perhaps scan their computer? :)
> > > > > >
> > > > > > Chris
> > > > > >
> > > > > >
> > > > > >
> > > > > > ---------------------------(end of
> > > broadcast)---------------------------
> > > > > > TIP 5: Have you checked our extensive FAQ?
> > > > > >
> > > > > > http://www.postgresql.org/users-lounge/docs/faq.html
> > > > > >
> > > > >
> > > > >
> > > > > ---------------------------(end of
> > > broadcast)---------------------------
> > > > > TIP 3: if posting/reading through Usenet, please send an appropriate
> > > > > subscribe-nomail command to majordomo@postgresql.org so that your
> > > > > message can get through to the mailing list cleanly
> > > > >
> > > > --
> > > > Larry Rosenman                     http://www.lerctr.org/~ler
> > > > Phone: +1 972-414-9812                 E-Mail: ler@lerctr.org
> > > > US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749
> > > >
> > > >
> > >
> > >
> > > ---------------------------(end of broadcast)---------------------------
> > > TIP 5: Have you checked our extensive FAQ?
> > >
> > > http://www.postgresql.org/users-lounge/docs/faq.html
> > >
> >
> >
-- 
Larry Rosenman                     http://www.lerctr.org/~ler
Phone: +1 972-414-9812                 E-Mail: ler@lerctr.org
US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749


31 Jul 2002 00:05:07 -0500
Larry Rosenman <ler@lerctr.org>
Re: Virus Emails
On Wed, 31 Jul 2002, Christopher Kings-Lynne wrote:

> I would also like to know this!  They don't mention it anywhere on their
> site!

The FreeBSD command line version comes on the CD along with the windoze
versions.


>
> Chris
>
> > -----Original Message-----
> > From: pgsql-hackers-owner@postgresql.org
> > [mailto:pgsql-hackers-owner@postgresql.org]On Behalf Of Marc G. Fournier
> > Sent: Wednesday, 31 July 2002 2:20 AM
> > To: Larry Rosenman
> > Cc: Christopher Kings-Lynne; pgsql-hackers@postgresql.org
> > Subject: Re: [HACKERS] Virus Emails
> >
> >
> >
> > Okay, this is sweet ... but can someone tell me where I 'Buy' a copy of
> > uvscan?  I've searched McAfee, but can't seem to find it in their eStore
> > anywhere ...
> >
> >
> > On 28 Jul 2002, Larry Rosenman wrote:
> >
> > > On Sun, 2002-07-28 at 20:10, Marc G. Fournier wrote:
> > > >
> > > > God, I go through 200+ of those almost daily as moderator ...
> > imagine if
> > > > we had the lists open? :)
> > > I picked up a copy of McAfee's vscan for FreeBSD from one of my contract
> > > people, and have amavisd-milter running to prevent them from even
> > > getting in the door.
> > >
> > > Mayhaps pgsql.org should do the same?
> > >
> > >
> > > >
> > > >
> > > > On Sat, 27 Jul 2002, Christopher Kings-Lynne wrote:
> > > >
> > > > > Hi guys,
> > > > >
> > > > > I seem to be getting virus emails that pretend to be one of
> > your guys.  eg.
> > > > > I get them from T.Ishii and N.Conway, etc.  Anyone out
> > there on the list who
> > > > > should perhaps scan their computer? :)
> > > > >
> > > > > Chris
> > > > >
> > > > >
> > > > >
> > > > > ---------------------------(end of
> > broadcast)---------------------------
> > > > > TIP 5: Have you checked our extensive FAQ?
> > > > >
> > > > > http://www.postgresql.org/users-lounge/docs/faq.html
> > > > >
> > > >
> > > >
> > > > ---------------------------(end of
> > broadcast)---------------------------
> > > > TIP 3: if posting/reading through Usenet, please send an appropriate
> > > > subscribe-nomail command to majordomo@postgresql.org so that your
> > > > message can get through to the mailing list cleanly
> > > >
> > > --
> > > Larry Rosenman                     http://www.lerctr.org/~ler
> > > Phone: +1 972-414-9812                 E-Mail: ler@lerctr.org
> > > US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749
> > >
> > >
> >
> >
> > ---------------------------(end of broadcast)---------------------------
> > TIP 5: Have you checked our extensive FAQ?
> >
> > http://www.postgresql.org/users-lounge/docs/faq.html
> >
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 5: Have you checked our extensive FAQ?
>
> http://www.postgresql.org/users-lounge/docs/faq.html
>


Vince.
-- 
==========================================================================
Vince Vielhaber -- KA8CSH    email: vev@michvhf.com    http://www.pop4.net
         56K Nationwide Dialup from $16.00/mo at Pop4 Networking
        Online Campground Directory    http://www.camping-usa.com
       Online Giftshop Superstore    http://www.cloudninegifts.com
==========================================================================




Wed, 31 Jul 2002 06:06:27 -0400 (EDT)
Vince Vielhaber <vev@michvhf.com>
Re: Virus Emails