Re: Sircam Virus and AS/400 -- MIDRANGE-L

You'd think, but check this out from a friend...

Chuck

<Some spammer out there was using our AS/400 40S mail server. For about 3 weeks
our CPU was pegged at 100+ percent.
Could not figure it out. I did not realize this but our 40S could be used to
relay E-Mail with out authentication. I tried it myself. I sent an E-Mail to one
of my outside accounts through our 40S without user name and password. It took 
it
and sent it to my outside account. A slut server!  Someone out on the Internet
was sending probably thousands of spam e-mails using our server. I talked to
XXXXXX (our software support people)  until they were about ready to send me a
bill. They could not figure it out. At the end of our conversation, he suggested
that someone was using our server on the Internet. I said I did not think that
was possible with out authentication. He said it was and that I needed PTF's and
configuration to shut it down. I downloaded the PTF's and went through the 10
pages on instructions. My CPU usage went from 100+ percent to 7 percent(normal).
UNBELIEVABLE!!! Turns out that IBM did not have a fix for this until last April.
FURTHERMORE, someone reported our 40S as a spam server to www.mail-abuse.org and
they put us on their spam server list. Lots of ISP's use this list to not accept
E-Mail from spam servers. After I fixed our 40S, I was testing it with 2 of my
outside accounts and my mail was being returned because my ISP's use this list. 
I
had to go to www.mail-abuse.org and fill out a form saying
that our server had been fixed, they then test it and if it works, then  they
will take your server off the list. This took about 2 hours. That was one hell 
of
a day. >

MacWheel99@aol.com wrote:

> In the latest August 2001 issue of News/400 which is getting so slim,
> opposite the start of the article on V5R1 Security enhancements was an Ad
> from Trend Micro for ScanMail for AS/400, claiming to have been the first
> anti-virus solution for the AS/400.  I imagine that even with AS/400 being
> natively quite secure, whatever e-mail is put on it might have more in common
> with MS fragility than good IBM engineering.
>
> MacWheel99@aol.com (Alister Wm Macintyre) (Al Mac)
>
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator: david@midrange.com
> +---

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---