Virus scanning

NetHosted Customer Joined: 01 Sep 2005 Posts: 16

What is the setup with regard to virus scanning ? Ive been getting a slew of infected emails over the last 36hrs infected with the Sober virus, which is pretty old now.

Return-path: <Hostmaster@gmx.net>
Received: from [71.68.255.141] (helo=taiptuyk.net)
by neptune.solardns.com with smtp (Exim 4.63)
(envelope-from <Hostmaster@gmx.net>)
id 1HjMIV-0004CV-AW; Wed, 02 May 2007 22:23:42 +0100

They are all originating from that IP as the first SMTP, some of them actually had a header in the email identifying the xmailer as SoberTestEngine.

Ive added all the From addresses its used to both the email filtering and to the auto-discard list of the mailing list getting most of the messages (as it seems the email filtering either isnt working or is not applied to emails bound for a mailing list? Only a few emails came to my personal addreses, on a different domain hosted on same server. That seems to be helping, but only as the From addresses seem to be hardcoded to a small list of choices.

Ive had a look in cpanel and dont see anything else i can configure.

NetHosted Staff Joined: 22 Mar 2004 Posts: 5684

Hi,

We have to keep the virus scanning very minimal to prevent false positives. As the way we have it setup it disregards any positive matches. This is why it wont be picking up on this. I have now blocked that IP at the server level.

Thanks,

Andrew

NetHosted Customer Joined: 01 Sep 2005 Posts: 16

Ok

I was reluctant to ask for a complete block as i can only believe it is the computer of someone who i know in some way(but i dont know who, the IP is in South Carolina), or they couldnt possibly have both of the addresses they do as they are completley unrelated and yet totally related to a select group of people

Is it blocking their IP from establishing an SMTP connection to neptune? As that would be fine, stop the virus's SMTP server but let them use theirs....but if its scanning the emails to determine whether to block it, that would mean they couldnt send a legitimate email here through a 3rd party SMTP server.

NetHosted Staff Joined: 22 Mar 2004 Posts: 5684

Well initially it was a complete ban on the IP but I've changed it to a port 25 ban for you

Thanks,

Andrew

NetHosted Customer Joined: 01 Sep 2005 Posts: 16

Thanks..just incase its someone important

Client Support	Community	Server Status	Contact Us	Client Login
Email Hosting	Website Hosting	Reseller Hosting	VPS Hosting	Dedicated Servers