your are right about the virus always change the PC name, but its very strange, that sending to different domains on our imail!? like Dictionary Attacks trough webmail...
At 17:25 24.11.2004, you wrote:
>Sorry, i don't get your meaning, why you think it's not by a client PC
>virus?
>virus always change the PC name if using it's own SMTP engine, also, the
>IP maybe a broadband shared in a network, and several PCs in the
>network maybe all infected.
>
>In my case, I just found that IP is infected by
>http://securityresponse.symantec.com/avcenter/venc/data/[EMAIL PROTECTED]
>http://vil.mcafeesecurity.com/vil/content/v_130130.htm
>
>
>
>----- Original Message -----
>From: "marc" <[EMAIL PROTECTED]>
>To: <[EMAIL PROTECTED]>
>Sent: Thursday, November 25, 2004 12:01 AM
>Subject: Re: [Declude.Virus] about Imail1.exe security issue
>
>
>>
>> i think thats not by a clients PC virus. i got just right the ip using the
>> imail1.exe to existing and no existing users (217.255.255.100) searching
>> the log*.txt
>> itsd using different pc names ....
>>
>> sorry about this post, because this is not a declude issue....
>>
>> marc
>>
>>
>> At 16:45 24.11.2004, you wrote:
>> >I'm now quite sure that it is caused by a clients PC virus,
>> >I use the specific email string to search the sys*.txt log,
>> >and found it come from 1 IP,
>> >I block this IP in my firewall, then this problem dispear,
>> >but the problem is from the IP I can not identify the
>> >clients PC name, because virus using forged PC name,
>> >and the IP is a ISP dynamic PC
>> >so I also can not find out who infected by which virus,
>> >but this virus should be a big headache to IMAIL users.
>> >
>> >
>> >
>> >
>> >----- Original Message -----
>> >From: "Mailing Lists" <[EMAIL PROTECTED]>
>> >To: <[EMAIL PROTECTED]>
>> >Sent: Wednesday, November 24, 2004 10:57 PM
>> >Subject: Re: [Declude.Virus] about Imail1.exe security issue
>> >
>> >
>> >> We had same issue, then mysteriously got fixed.
>> >>
>> >> Imail was aware of it as we had opened ticket.
>> >>
>> >> Everytime this would happen, the affected domain registry entry would
>have
>> >> some weird users and entries (dont recall exactly but if you search
>the
>> >> archives you will find the post).
>> >>
>> >> PV
>> >>
>> >> ----- Original Message -----
>> >> From: "Mike Wiegers" <[EMAIL PROTECTED]>
>> >> To: <[EMAIL PROTECTED]>
>> >> Sent: Wednesday, November 24, 2004 9:09 AM
>> >> Subject: RE: [Declude.Virus] about Imail1.exe security issue
>> >>
>> >>
>> >> > This is odd, odd because my server has this problem also and I
>called
>> >> > Ipswitch about it and they said that my server was the only one
>having
>> >the
>> >> > problems. It had it several months ago (and called) and then started
>> >again
>> >> > (and called). Those are the only calls to tech support in the past
>> >several
>> >> > years for my SA. I will read the posts to find out more about this.
>> >> >
>> >> > -----Original Message-----
>> >> > From: [EMAIL PROTECTED]
>> >> > [mailto:[EMAIL PROTECTED] On Behalf Of Serge
>> >> > Sent: Wednesday, November 24, 2004 7:05 AM
>> >> > To: [EMAIL PROTECTED]
>> >> > Subject: Re: [Declude.Virus] about Imail1.exe security issue
>> >> >
>> >> > we had the same issue few month ago
>> >> > i suspected problem from declude because the addresses that appear
>in
>> >the
>> >> > open imail1 window looked like ones that would be generated by
>declude
>> >> > notifications (or maybe imail gses ?)
>> >> > anyway, rebooting the server resolved the issue back then
>> >> > Unfortunatly, since upgrading to 8.13 (or 8.14, can't tell exactly,
>> >> > because
>> >> > i did both in less than 48 hours) the problem is coming again, and
>> >> > rebooting
>> >> > did not help this time.
>> >> > if you find a solution, let me know
>> >> >
>> >> >
>> >> > ----- Original Message -----
>> >> > From: "Crejob.com" <[EMAIL PROTECTED]>
>> >> > To: <[EMAIL PROTECTED]>
>> >> > Sent: Wednesday, November 24, 2004 10:05 AM
>> >> > Subject: [Declude.Virus] about Imail1.exe security issue
>> >> >
>> >> >
>> >> >> My Imail server keep pop up a "Create Mail Message", it's
>> >> >> seems that Imail1.exe is exploit by someone to try send
>> >> >> out spam.
>> >> >> I try to limit the imail1.exe user permission, but this will
>> >> >> result the webmail can not send out email.
>> >> >> Any advice on how to solve this problem?
>> >> >>
>> >> >> Regards
>> >> >> Brian
>> >> >>
>> >> >> ---
>> >> >> [This E-mail was scanned for viruses by Declude Virus
>> >> > (http://www.declude.com)]
>> >> >>
>> >> >> ---
>> >> >> This E-mail came from the Declude.Virus mailing list. To
>> >> >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> >> >> type "unsubscribe Declude.Virus". The archives can be found
>> >> >> at http://www.mail-archive.com.
>> >> >>
>> >> >
>> >> >
>> >> > ---
>> >> > [This E-mail was scanned for viruses by Declude Virus
>> >> > (http://www.declude.com)]
>> >> >
>> >> > ---
>> >> > This E-mail came from the Declude.Virus mailing list. To
>> >> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> >> > type "unsubscribe Declude.Virus". The archives can be found
>> >> > at http://www.mail-archive.com.
>> >> >
>> >> >
>> >> > ---
>> >> > [This E-mail was scanned for viruses by Declude Virus
>> >> > (http://www.declude.com)]
>> >> >
>> >> > ---
>> >> > This E-mail came from the Declude.Virus mailing list. To
>> >> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> >> > type "unsubscribe Declude.Virus". The archives can be found
>> >> > at http://www.mail-archive.com.
>> >>
>> >>
>> >> ---
>> >> [This E-mail was scanned for viruses by Declude Virus
>> >(http://www.declude.com)]
>> >>
>> >> ---
>> >> This E-mail came from the Declude.Virus mailing list. To
>> >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> >> type "unsubscribe Declude.Virus". The archives can be found
>> >> at http://www.mail-archive.com.
>> >>
>> >
>> >---
>> >[This E-mail was scanned for viruses by Declude Virus
>> (http://www.declude.com)]
>> >
>> >---
>> >This E-mail came from the Declude.Virus mailing list. To
>> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> >type "unsubscribe Declude.Virus". The archives can be found
>> >at http://www.mail-archive.com.
>> >
>> >[Scanned for viruses by Declude Virus]
>>
>>
>> [Scanned for viruses by Declude Virus]
>>
>> ---
>> [This E-mail was scanned for viruses by Declude Virus
>(http://www.declude.com)]
>>
>> ---
>> This E-mail came from the Declude.Virus mailing list. To
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> type "unsubscribe Declude.Virus". The archives can be found
>> at http://www.mail-archive.com.
>>
>
>---
>[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
>
>---
>This E-mail came from the Declude.Virus mailing list. To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.Virus". The archives can be found
>at http://www.mail-archive.com.
>
>[Scanned for viruses by Declude Virus]
[Scanned for viruses by Declude Virus]
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
