How Well are Your Servers Handling MyDoom?

whosyourgeekdaddy asks: "A co-worker was showing me some of the usage stats for a clients exchange server: its averaging 630 users, and 300,000 emails per day, for the last 4 days. This made me want to ask how heavy is the workload for your 'average' Exchange server? Is this typical? MyDoom has upped the usage some, but not a lot. This client is a real estate company, so e-mail is frequently used." Of course, Exchange servers aren't the only ones feeling MyDoom. What kind of statistics have you been seeing from MyDoom, both as a user and as an administrator?

Comments

Not a Problem

[Neon Spiral Injector]

grep "X-Infected: W32/Mydoom.A@mm" rejectlog* | wc -l
11096

All rejected at SMTP time, not mindlessly bounced after the fact.

My server isn't even feeling it.

For the record

[jeffasselin]

We have about 50 users, we got around 200 viruses in the first 18 hours.

Thanks guys.

[reaper20]

Spamassassin, postfix, and procmail developers - I sit here at home with a beer whilst my Exchange colleagues want to kill themselves right about now.

Thanks.

well...

[drakaan]

since I don't allow in attachments that end in .pif .exe .scr .com or .bat (including zipped ones...thank you antigen), there have been precisely zero delivered to anybody's inboxes.

Report...

[eyeball]

"How Well are Your Servers Handling MyDoom?" Pretty well. We're thinking of adding another cluster.

Just kidding, lawyers.

Nothing compared to spam

[hords]

I'm a mail/systems administrator at a small/medium sized ISP. This virus is nothing compared to the onslaught of spam we get. >2 million total messages a day and blocking >1.6 million due to spam. Our virus filter is taking them out no problem, and no we aren't bouncing it =)

im still waiting

[CptChipJew]

For MyDoom 3, and its starting to feel like its never going to come out.

Sounds similar

[Chemical Serenity]

Unfortunately I was caught working on another project, and the serious inflow came between 'freshclam' updates... inside that 12 hour spam we ended up with about 40,000 of the things clogging up the works and god only knows how many untold thousands dropped on the front end. After getting the update in and cleaning out the garbage we're getting several thousand an hour, but the server barely notices it.

One trick which helped ease the burden is that the majority of the emails are coming in with very specific topics: "hi", "hello", "test", "status" and "server report". Added this line to my postfix spamfilter rules and it eased a LOT of the burden immediately:

/Subject:.*(hi|hello|test|status|server report)$/ REJECT 550 Your email has the subject of an Worm.SCO.A viral message. Change your
subject and resend.

If you're an administrator out there reading this, for the love of whatever god you hold dear TURN OFF YOUR BLOODY VIRUS BOUNCE MESSAGES! I've had as many 'replies' to faked From: headers as virus mails. You're making the problem far worse than it otherwise would be!