>First, you say "You received an E-mail that originated at
>193.23.186.174. That is a server
>of yours, but doesn't seem to be an IMail server."
>
>this is not one of my servers, I'm only on 64.110.76....
Sorry -- in that case, your mailserver received the E-mail from
195.27.160.2, relay.amadeus.net.
>I don't understand, I am relaying for 193.23.184.174? Or is the other
>way around?
The IP is actually 195.27.160.2 (the 193.23.184.174 IP would only be
trusted if 195.27.160.2 was your IP). Neither of you is relaying for the
other -- they are sending E-mail to [EMAIL PROTECTED], so your
mailserver is just accepting incoming mail as it should.
>And the bottom line, the possible Klez which was anyway my first idea of
>cause) is sending from [EMAIL PROTECTED]? or is originated from who
>knows where and it simply having my postmaster email as the return
>address? I've checked anyway for viruses inside all my systems that
>could send email from [EMAIL PROTECTED] nothing there.
Unfortunately, the people at Amadeus aren't running a virus scanner, so it
is impossible to tell what is happening over there (whether they detected a
virus, legitimate mail with a bad attachment, someone gone wrong on their
end, etc.). Klez usually forges the return address of the E-mails that it
sends, so it is very likely that someone else is sending viruses with
"[EMAIL PROTECTED]" as the return address. The only thing you could
do to track it down is contact Amadeus, and ask them for the headers of the
original E-mail (or just ask them to stop sending you the notices).
-Scott
---
Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for
IMail. http://www.declude.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
