Recent enhancements to the Account Manager.

    Auto responders.
    Transfer statistics per account and per domain.
    Improved spam scoring policy navigation.

There are many Sobig infected machines that are sending thousands of infected emails to the same recipients. These emails were being discarded based on header pattern matches but thousands of 100KB emails add up. We are now blocking known infected IP addresses at the border routers.

Analysis shows that at 1900 UTC, 1500 EDT, the Sobig-F worm will attempt to download and execute code on the compromised machines. The new code could launch another virus or just become an open proxy for spammers to use as some of the other worms in the Sobig series have done.

To guard against what may come from the infected machines, we are rejecting email from all IP addresses that we know are or were infected with the Sobig-F worm.

Reject reports updated to include rejections for header and body patterns matching the Sobig-F worm.

After wading through thousands of bounce messages and notifications from broken virus scanners to sender addresses forged by the Sobig-F worm, we are rejecting email containing the subject and body signatures used by the worm.

The Allow/Deny list entries now have an option to use the entry at the MX server when email is received. Matching Allow entries bypass all MX restrictions. Matching Deny entries reject the email.

Indications are that the W32/Mimail-A email worm is spreading. Our Sophos virus scanner is detecting the worm and infected email is discarded. The current variant of this worm always arrives with an admin@yourdomain envelope sender address. To eliminate the noisy virus detected messages, an entry has been added to the virus reject list for admin@ each domain that we handle email for. If you are sending email with an admin@ envelope sender address from outside of this system, contact your account administrator to have the entry for your domain(s) removed.