Re: Is swen back?

[Alvin Oga <aoga@ns.Linux-Consulting.com>]

hi ya 

On Mon, 19 Jan 2004, Lou Losee wrote:

> * Alphonse Ogulla <ogulla@uonbi.ac.ke> [2004-01-19 08:01]:
> > Got 200 plus mail bombs in my pop3 account this morning. Luckily I used Kmail 
> > and filtered (deleted) every incoming message of size greater than 40Kb. Just 
> > wondering, is swen back from holiday? How you people managing?
> > 
> I have been getting hit again too.  I assumed it was people that
> received computers for the holiday and were quickly infected.

i used to get several hundred a day ... now i get few-a-day for my
daily dose and the amt hasnt changed in weeks ( since Nov 26 timeframe)... 

	any that gets thru goes into /etc/mail/access

	http://www.Linux-Sec.net/Mail/SpamVirus/Sven/

	( sven comes from the same mis-managed servers )

	- i/client wanted to know where its coming from .. vs just
	dropping um

on the one email acct that sven liked:
	root# grep -i "microsoft" /var/log/maillog* | wc -l
	    353
	root# grep -i "microsoft" /var/log.2003_Dec/maillog* | wc -l
	    421
	root# grep -i "microsoft" /var/log.2003_Nov/maillog* | wc -l
	    803
	root# grep -i "microsoft" /var/log.2003_Oct/maillog* | wc -l
	   2237
	root# grep -i "microsoft" /var/log.2003_Sep/maillog* | wc -l
	    459

	- its tolerable compared to the thousands of other real mail ..

c ya
alvin