From owner-freebsd-hackers@FreeBSD.ORG  Thu Feb 21 16:22:14 2013
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by hub.freebsd.org (Postfix) with ESMTP id C02611BA
 for <freebsd-hackers@freebsd.org>; Thu, 21 Feb 2013 16:22:14 +0000 (UTC)
 (envelope-from wojtek@wojtek.tensor.gdynia.pl)
Received: from wojtek.tensor.gdynia.pl (wojtek.tensor.gdynia.pl
 [188.252.31.196]) by mx1.freebsd.org (Postfix) with ESMTP id 3250B254
 for <freebsd-hackers@freebsd.org>; Thu, 21 Feb 2013 16:22:13 +0000 (UTC)
Received: from wojtek.tensor.gdynia.pl (localhost [127.0.0.1])
 by wojtek.tensor.gdynia.pl (8.14.6/8.14.5) with ESMTP id r1LGM2Pe067902
 for <freebsd-hackers@freebsd.org>; Thu, 21 Feb 2013 17:22:02 +0100 (CET)
 (envelope-from wojtek@wojtek.tensor.gdynia.pl)
Received: from localhost (wojtek@localhost)
 by wojtek.tensor.gdynia.pl (8.14.6/8.14.5/Submit) with ESMTP id r1LGM2XE067899
 for <freebsd-hackers@freebsd.org>; Thu, 21 Feb 2013 17:22:02 +0100 (CET)
 (envelope-from wojtek@wojtek.tensor.gdynia.pl)
Date: Thu, 21 Feb 2013 17:22:02 +0100 (CET)
From: Wojciech Puchar <wojtek@wojtek.tensor.gdynia.pl>
To: freebsd-hackers@freebsd.org
Subject: blocking teamviewer trojan
Message-ID: <alpine.BSF.2.00.1302211719320.67298@wojtek.tensor.gdynia.pl>
User-Agent: Alpine 2.00 (BSF 1167 2008-08-23)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.2.7
 (wojtek.tensor.gdynia.pl [127.0.0.1]); Thu, 21 Feb 2013 17:22:02 +0100 (CET)
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
 <freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-hackers>, 
 <mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
 <mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 21 Feb 2013 16:22:14 -0000

anyone have tested method on doing this?

tried blocking port 5938 as well as teamviewer.com domain in squid (and 
all port 80 traffic is already forwarded to squid).

Still doesn't work.

thanks for any help.