_M,
Thanks a lot! This helps.
Best Regards,
Remz
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Madscientist
Sent: Wednesday, February 21, 2001 11:06 AM
To: [EMAIL PROTECTED]
Subject: RE: [IMail Forum] What is this, spam?
Nobody mined email addresses for this one... it's a worm...
It was sent right too you from someone who has you in their address book...
That someone has the virus in their system.
Solutions include filtering and virus scanning at the server... we
accomplish these using our IMFilter utility for filtering and Declude for
virus scanning (using WebShield) and spam filtering.
It is also recommended that you use some kind of virus protection software
on your workstation(s).
Hope this helps,
_M
| -----Original Message-----
| From: [EMAIL PROTECTED]
| [mailto:[EMAIL PROTECTED]]On Behalf Of Remzon P.
| Mascardo
| Sent: Tuesday, February 20, 2001 9:11 PM
| To: [EMAIL PROTECTED]
| Subject: RE: [IMail Forum] What is this, spam?
|
|
| Me too, how can we filter this kind of un-noticed mail from unknown user.
|
| Thanks,
| Remz
|
| -----Original Message-----
| From: [EMAIL PROTECTED]
| [mailto:[EMAIL PROTECTED]]On Behalf Of T. Bradley Dean
| Sent: Wednesday, February 21, 2001 9:56 AM
| To: [EMAIL PROTECTED]
| Subject: RE: [IMail Forum] What is this, spam?
|
|
| I too received an email from [EMAIL PROTECTED] last night. It had an
| attachment "dwarf4u.exe". I did not open the attachment.
|
| What's odd was that it was sent directly to me. Could this guy be
| harvesting
| names from the iMail list?
|
| T. Bradley Dean
| (800) 793-8171 Ext. 336
| [EMAIL PROTECTED]
|
| -----Original Message-----
| From: [EMAIL PROTECTED]
| [mailto:[EMAIL PROTECTED]]On Behalf Of Michael Varre
| Sent: Tuesday, February 20, 2001 8:46 PM
| To: [EMAIL PROTECTED]
| Subject: [IMail Forum] What is this, spam?
|
|
|
| I think someone is doing something afoul. Yesterday right after i sent an
| email to all the members i recieved an email from the list server saying
| that [EMAIL PROTECTED] tried posting a msg to the list (it was rejected).
| Then I had an email sent to support that looks like a virus.
| Then later in
| the night I saw he sent me an email from the same address with what I also
| believe is a virus. Both emails appeared to come from [EMAIL PROTECTED]
| Any help would be appreciated.
|
| I looked at the headers of the email he sent and they are like this:
|
| Received: from jamesweeks [63.20.138.248] by gochatplus.com
| (SMTPD32-6.05) id AEABED301A8; Tue, 20 Feb 2001 17:49:31 -0800
| Subject: Snowhite and the Seven Dwarfs - The REAL story!
| MIME-Version: 1.0
| Content-Type: multipart/mixed;
| boundary="--VE30HMJSLEJSPERKHMNK16BOT2JSDERSH"
| Message-Id: <20010220174962.SM00217@jamesweeks>
| X-RCPT-TO: <[EMAIL PROTECTED]>
| Date: Tue, 20 Feb 2001 17:49:43 -0800
| X-UIDL: 261612363
| Status: U
|
| Notice the first line. Then I looked in the log file for anything odd
| connected to that username. Here are excerpts from the log file:
|
| 20010220 174917 127.0.0.1 SMTPD (0B97015A) [204.168.155.100] connect
| 63.20.138.248 port 1072
| 20010220 174918 127.0.0.1 SMTPD (0B97015A) [63.20.138.248] HELO
| jamesweeks
| 20010220 174918 127.0.0.1 SMTPD (0B97015A) [63.20.138.248]
| MAIL FROM:
| <>
| 20010220 174918 127.0.0.1 SMTPD (0B97015A) [63.20.138.248] RCPT TO:
| < #$¥�@§}!P.é³Â>
| 20010220 174918 127.0.0.1 SMTPD (0B97015A) [63.20.138.248] ERR
| gochatplus.com invalid user < #$¥�@§}!P.é³Â
| 20010220 174919 127.0.0.1 SMTPD (0B9C015A) [204.168.155.100] connect
| 63.20.138.248 port 1075
| 20010220 174919 127.0.0.1 SMTPD (0B9C015A) [63.20.138.248] HELO
| jamesweeks
| 20010220 174920 127.0.0.1 SMTPD (0B9C015A) [63.20.138.248]
| MAIL FROM:
| <>
| 20010220 174920 127.0.0.1 SMTPD (0B9C015A) [63.20.138.248] RCPT TO:
| <[EMAIL PROTECTED]>
|
| Then again:
|
| 20010220 180453 127.0.0.1 SMTPD (0BCD0198) [63.20.138.248] HELO
| jamesweeks
| 20010220 180453 127.0.0.1 POP3D PASS xxxxxxxx
| 20010220 180454 127.0.0.1 SMTPD (0BCD0198) [63.20.138.248]
| MAIL FROM:
| <>
| 20010220 180454 127.0.0.1 SMTPD (0BCD0198) [63.20.138.248] RCPT TO:
| <ýÒ å1ê�Ù@>
| 20010220 180454 127.0.0.1 SMTPD (0BCD0198) [63.20.138.248] ERR
| gochatplus.com invalid user <ýÒ å1ê�Ù@>
|
|
|
| Some sort of spam attempt?
|
|
| Please visit http://www.ipswitch.com/support/mailing-lists.html
| to be removed from this list.
|
| An Archive of this list is available at:
| http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
|
|
| Please visit http://www.ipswitch.com/support/mailing-lists.html
| to be removed from this list.
|
| An Archive of this list is available at:
| http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
|
|
| Please visit http://www.ipswitch.com/support/mailing-lists.html
| to be removed from this list.
|
| An Archive of this list is available at:
| http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
|
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
