So if a forged user from my domain sends a message to another IMAIL machine to a user that doesn't exist and then their Imail Machine rejects the message. I'm assuming that postmaster gets the entire message (virus included) based upon the forged domain. So I would get the message, even though no one on my domain sent it and Declude would stop the virus (that seems to be what it happening). And then the user won't get the message returned, right? But my users are getting occasional "undeliverables" and I'm assuming that these are generated by other mail servers.
I just want to make sure that my server isn't returning messages to the forged users that contain the virus. Forgive me if this seems a bit circuitous as my brain feels like tapioca this Monday morning.... -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Sunday, August 24, 2003 12:40 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] No wonder viruses spread >But since the subject that you are receiving is "undeliverable : RE: >Details" isn't that his server is just returning the message Unless the >virus has more subjects then the list of subjects that I am aware of. Comparing it to the headers generated by the copies of Sobig.F we've looked at, it appears that it was indeed a bounce message. However, the fact remains that there was a virus in the bounce message, so they were spreading the virus. Fortunately, IMail won't do this. If an E-mail is sent to an address that doesn't exist, IMail will reject the E-mail. It would then be up to the remote mailserver to generate the bounce message. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
