RE: [cobalt-users] Help Needed - RaQ4 & Spam/Virus Outbreak!

["Phil Beynon" <phil@xxxxxxxxxxxxxxxxxxxxxxxxx>]

> Hello, I've been a cobalt-users lurker for the past several months. I have
> a lightly-used RaQ 4 that hosts mail and websites for about a dozen
> domains. Over the past 5 days, the amount of spam and "latest microsoft
> patch" virus emails has skyrocketed. A few users on the machine have gone
> from about 5 such emails a day to about 500 a day! My personal email
> account gets about 300 junkmails a day, most with 100-200 KB attachments.
> A week ago, I rarely got more than 10 pieces of junkmail a day.
>
> I have been reading about the various mail filter options, but would like
> to get some real-world opinions, suggestions, and maybe even some detailed
> instructions from those that have already been in the trenches fighting
> this deluge of junkmail.
>
> Ideally, I would like to block the following:
> 1) Messages with a certain text string in the subject (most of the virus
> emails I get have the exact same subject, usually something with
> "Microsoft" or "Windows Patch").
>
> 2) Messages with a certain text string in the "from" line (I get a lot of
> junk from someone@xxxxxxxxxxxxxxxxxx or something along those lines).
>
> This would cut down on the garbage that's pouring in right now.
> Eventually, I would like to add additional countermeasures to reduce the
> amount of "new spam".
>
> Please let me know what options would best fit my immediate needs. If you
> have gone through this with your own RaQ 4, please let me know what steps
> you took. I'm a total spam newbie and don't have time to hose my server...
> but at the same time, I can't handle this tidalwave of junk anymore
> either.
>
> Thanks in advance! I'll owe y'all a couple beers!
>
> Colin

Colin,
In mailscanner you can tell it to quietly destroy the viruses and not bother
to tell the users. This for me works well, I just then filter the "virus
detected" message into its own folder to keep track of the quantity
received.
The combination of mailscanner and spamassasin seems to be the most
favoured.
There is an issue with deleting spam that you could kill a valid business
critical email by accident though.

Phil


** http://www.diygear.com THE Online DIY Toolstore For DIY & Business
** Infolink Electronic Systems Ltd. http://www.infolinkelectronics.co.uk
** Professional Web Design & Cobalt Hosting Solutions
** Sun Cobalt iForce Reseller - Canon Silver Reseller
** Contact: Sales@xxxxxxxxxxxxxxxxxxxxxxxxx
** Tel / Fax 0121 458 4894 (office) 0121 441 3558 (home)