How Well are Your Servers Handling MyDoom?

whosyourgeekdaddy asks: "A co-worker was showing me some of the usage stats for a clients exchange server: its averaging 630 users, and 300,000 emails per day, for the last 4 days. This made me want to ask how heavy is the workload for your 'average' Exchange server? Is this typical? MyDoom has upped the usage some, but not a lot. This client is a real estate company, so e-mail is frequently used." Of course, Exchange servers aren't the only ones feeling MyDoom. What kind of statistics have you been seeing from MyDoom, both as a user and as an administrator?

Comments

Not a Problem

[Neon Spiral Injector]

grep "X-Infected: W32/Mydoom.A@mm" rejectlog* | wc -l
11096

All rejected at SMTP time, not mindlessly bounced after the fact.

My server isn't even feeling it.

Sounds similar

[Chemical Serenity]

Unfortunately I was caught working on another project, and the serious inflow came between 'freshclam' updates... inside that 12 hour spam we ended up with about 40,000 of the things clogging up the works and god only knows how many untold thousands dropped on the front end. After getting the update in and cleaning out the garbage we're getting several thousand an hour, but the server barely notices it.

One trick which helped ease the burden is that the majority of the emails are coming in with very specific topics: "hi", "hello", "test", "status" and "server report". Added this line to my postfix spamfilter rules and it eased a LOT of the burden immediately:

/Subject:.*(hi|hello|test|status|server report)$/ REJECT 550 Your email has the subject of an Worm.SCO.A viral message. Change your
subject and resend.

If you're an administrator out there reading this, for the love of whatever god you hold dear TURN OFF YOUR BLOODY VIRUS BOUNCE MESSAGES! I've had as many 'replies' to faked From: headers as virus mails. You're making the problem far worse than it otherwise would be!