Re: [IMail Forum] reading syslog

[Rob Weij/QPlus]

Bonno,   I think HELO is your mailserver and EHLO is the other end (=sender). So no impersonating. The Lentin virus is very very active the last couple of days, but gladly we have Declude to protect out clients (and there clients as well).   Rob Weij   QPlus Business Internet www.qplus.net ----- Original Message ----- From: Bonno Bloksma To: [EMAIL PROTECTED] Sent: Monday, June 24, 2002 8:22 PM Subject: [IMail Forum] reading syslog Hi,   This is a snippet from my log file. This session dropped a virus, f-prot calls it the Lentin.F virus, others seem to call it the yaha virus. I'm trying to track down the machine/person that has been sending us this virus for the last couple of days.   What I need to know is wheter the HELO packet here is the name of my mail server, correct, or the name of the server on the other side. If the latter then (s)he is impersonating our mailserver and I'm starting to doubt whether this is accidental. The ip number is for a dial-up connection on the freesurf.nl domain, (Name:    hmm-dca-ap03-d11-081.dial.freesurf.nl Address:  62.100.10.81).   20020624 160346 127.0.0.1       SMTPD (00240266) [213.53.199.208] connect 62.100.10.81 port 2982 20020624 160346 127.0.0.1       SMTPD (00240266) [62.100.10.81] HELO mail.tio.nl 20020624 160347 127.0.0.1       SMTPD (00240266) [62.100.10.81] MAIL FROM:<[EMAIL PROTECTED]> 20020624 160347 127.0.0.1       SMTPD (00240266) [62.100.10.81] RCPT TO:<[EMAIL PROTECTED]> 20020624 160358 127.0.0.1       SMTPD (00240266) [62.100.10.81] C:\IMail\spool\D26c3266.SMD 43136      Groetjes,   Bonno Bloksma