On Sun, 29 Jul 2001 15:55:46 PDT, "James P. Salsman" said:
How do you feel about filtering winsock connections to TCP port 25 in
a way such as would allow the user to confirm that a particular program
could always do so, but would be asked to approve the connection when
programs without prior approval do so? That would take care of the
SirCam strain.
A patch has been available that would fix SirCam *and* most other
address-book viruses for a *year*, and we're still getting hosed by it.
Certainly doesn't bode well for when CodeRed wakes up in about 47 hours
and 30 minutes - I'll bet most of the 300K machines that got hacked are
still unpatched and still infected.
It's gonna be a LONG week guys.
Valdis Kletnieks
Operating Systems Analyst
Virginia Tech