Using SF to help block MyDoom/Novarg virus |
Post Reply 
|
| Author | |
JimMeredith 
Guest Group 
|
 Post Options
 Thanks(0)
 Quote Reply
 Topic: Using SF to help block MyDoom/Novarg virusPosted: 27 January 2004 at 2:38am |
|
We're all getting blasted with the MyDoom/Novarg mass mailer worm right now. While SpamFilter is designed for just that purpose -- filtering spam -- we're finding that it can also be used to filter SOME messages that are created by mass-mailer worms of this type. Even if you've got an email virus scanner or filtering application (you really should), there may be a performance benefit to eliminating as much traffic as possible at the gateway, before it reaches these downstream servers. The following method seems to be providing a performance benefit for us. Anyone using the "Authorized TO" whitelists filter, or choosing to "tag & deliver" rather than disconnecting or quarantining messages... this doesn't apply to you. Likewise, anyone running a mail system where the users can pick their own names can stop reading this post now -- this idea won't be of much benefit to you. But for the rest of us, this might prove useful. The MyDoom/Novarg worm attempts to spread itself to users in the customary ways that these worms usually work (address books, P2P file sharing systems, etc.) but also has a "address guess" function that attempts to create emails addresses. It does so by attaching the following names to whatever domain names it can find in the infected user's address book(s): adam Thus, your SpamFilter logs might be showing a lot of traffic to john@yourdomain.com, ted@yourdomain.com, maria@yourdomain.com, and other non-existent user names from the list above. If none of these names are valid accounts on your mail system, you have the option of adding these names to your "TO Emails" blacklist filter. You can specify the domain when listing them in the TO Emails blacklist... examples: john@yourdomain.com -- or if you have multiple domains, use a wildcard to cover all of them -- This will effectively stop SpamFilter from forwarding MyDoom/Novarg-generated messages addressed to these bogus users... your destination server. This procedure is most beneficial if the "Do not quarantine rejected emails from this blacklist" is checked (enabled) on the "TO Emails" blacklist filter. But even if you are quarantining these messages, there might be a performance benefit to stopping them at the quarantine and not continuing to pass these infected messages downstream to your virus scanner, mail server, etc. To reiterate... be careful -- do NOT list any of the above names that correspond to valid users on your email domains! Email system setups vary dramatically, and this will not work for everyone. It's just an idea for using a tool at your disposal to tackle a problem we're all facing. This will NOT stop the MyDoom/Novarg virus altogether -- it's not intended to do that -- it just uses SpamFilter to cut down on some of the junk virus traffic at the front-end gateway, which may improve the overall performance of the downstream mail system. |
|
 |
|
|
Brian Lewis
Guest Group
|
Post Options
Thanks(0)
Quote Reply
Posted: 27 January 2004 at 4:13pm |
|
Does Spamfilter ISP 2.0 beta block attachments? My server and users are just getting hammered and I need to get something put in place, we are talking thousands of virus messages every hour!! Groupwise doesn't like it that much :(
|
|
|
|
|
kspare
Senior Member 
Joined: 26 January 2005 Location: Canada Status: Offline Points: 334 |
Post Options
Thanks(0)
Quote Reply
Posted: 27 January 2004 at 4:43pm |
|
put the following in your blacklist keywords file and it should take care of most of the latest virus's
Test =) |
|
|
|
|
JimMeredith
Guest Group
|
Post Options
Thanks(0)
Quote Reply
Posted: 27 January 2004 at 5:09pm |
|
I had to discontinue our evaluation of the 2.0 beta a few weeks ago, but as of the last beta I evaluated, no capability for attachment filtering had yet been included. Roberto did mention that they would consider adding it into a future release -- see this thread: http://www.logsat.com/spamfilter/forums/showmessage.asp?messageID=2340 We were being hit hard by this virus as well. Our SpamFilter is now rejecting several of the invalid messages created by the "address guess" capability of MyDoom/Novarg (my earlier post). You can also utilize the keyword filter to trap the body text content generated by this worm, as outlined in Kevin Pare's post. This will block a few more of the messages... it may also block messages from anti-virus vendors describing the characteristics of this virus, but that's a small price to pay. Roberto had even mentioned running a virus scanner program on the SpamFilter machine itself in earlier posts. We are doing this, but the results have been mixed, and I wouldn't feel comfortable relying on this as my ONLY defense against viruses. Unfortunately, even after doing all of this, some messages will still get through. Hopefully, taking these steps will at least cut down on some of the volume and make Groupwise (and your users) a little happier. The bottom line is that SpamFilter can reduce some of the load, but until attachment type filtering is worked into SpamFilter, it will remain the job of downstream servers to handle worms and viruses. |
|
|
|
|
Brian Lewis
Guest Group
|
Post Options
Thanks(0)
Quote Reply
Posted: 27 January 2004 at 6:26pm |
|
Thats what I was afraid of :( I wish they had attachment filtering, not all email servers (Groupwise 5.5.5 included) have attachment filtering so I must rely on the Spamfilter or some other product to block this junk before it reaches the desktops in the corporation! Logsat PLEASE!! |
|
|
|
|
LogSat
Admin Group 
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 27 January 2004 at 10:45pm |
|
We have just released a new beta that introduces attachment filtering. Roberto F. |
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 27 January 2004 at 10:46pm |
|
Jim, We have just released a new beta that introduces attachment filtering. Roberto F. |
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 27 January 2004 at 10:46pm |
|
Brian, We have just released a new beta that introduces attachment filtering. Roberto F. |
|
|
|
|
kspare
Senior Member
Joined: 26 January 2005 Location: Canada Status: Offline Points: 334 |
Post Options
Thanks(0)
Quote Reply
Posted: 29 January 2004 at 9:05am |
|
Does anyone have a reliable list of attachments to block the mydoom?
|
|
|
|
Topic Options|
Post Reply
|
|
Tweet
|
| Forum Jump | Forum Permissions You cannot post new topics in this forum You cannot reply to topics in this forum You cannot delete your posts in this forum You cannot edit your posts in this forum You cannot create polls in this forum You cannot vote in polls in this forum |
This page was generated in 0.164 seconds.