Milter-greylist

On Wed, 26 May 2004, Cyril Guibourg wrote:
> Jacques Beigbeder <jacques.beigbeder@...> writes:
> > May 19 20:28:20 nef milter-greylist: i4JISIFi019762: addr 217.174.203.201
> > from <> rcpt <Webmaster@...>: autowhitelisted for 720:00:00
> > This is W32/Sober.g@MM.
> How do you tell this *is* a virus and *not* some MTA trying to deliver some
> infected message ?
> $ telnet vserver-raccourci.nexen.net 25
> Trying 217.174.203.201...
> Connected to vserver-raccourci.nexen.net.
> Escape character is '^]'.
> 220 mail.raccourci.fr ESMTP

most viruses don't have a listener on 25/tcp.

-Dan