OT: Sobig

[Florian Weimer]

Kelley Cook <kcook34@ford.com> writes:

> It then connects to the default SMTP server

Small nitpick: Sobig comes with its own MTA which sends a
syntactically invalid HELO argument (it's _syntactically_ invalid, so
may reject the message without violating a requirement in RFC 2821
8-).  If you refuse HELO commands whose argument does not contain a
".", you can evade most Sobig traffic.

Of course, you may have to disable the "." for your internal
network. 8-/