This is similar to something I complained about on the Declude JM list last week. When I get these e-mails there is an attachment with an end user's IP. The problem is RR is ignoring the problem that one of their users is infected and sending e-mail through their server. I have repeatedly sent these e-mails to them and they continue to claim that it isn't their problem and I can't get past level 1 support. This leaves me no legitimate way to block this e-mail without running the risk of blocking legitimate undeliverables or all e-mail from RR servers.
This was the reply I got from Andrew Colbeck: Not all viruses use their own SMTP engine; this was likely one of the recent MyTob variants that tries to use the SMTP server of the current user. The virus can do this with some success because many ISPs use routing or firewalls to allow their users to use their servers as an open relay, because a) that buys them close relay status to the Internet, and b) it's easier than authentication. Also, many ISPs don't do outbound virus scanning on the basis of "we don't want a false positive to even possibly interfere with our customers' communications". Here's a writeup on one of the recent viruses that uses the ISP's mail server: http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=43250 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Tuesday, July 19, 2005 7:10 AM To: [email protected] Subject: Re: [IMail Forum] Suspicious Domain *> **ms-smtp-03.rdc-kc.rr.com* [24.94.166.129] > Does anyone have any info on this domain ? rr.com is RoadRunner, a very popular ISP (cable) in the United States. A good trick when you don't know about a domain is to go to the website. In this case, the main domain is "rr.com" (if you aren't sure where the domain starts, you can try websites from the top ("www.com") down until you hit a website). Going to http://www.DNSstuff.com and entering 24.94.166.129 there shows that *ms-smtp-03.rdc-kc.rr.com really is the hostname of the computer that sent you the E-mail. That IP address isn't in any real spam databases. The "smtp" in the hostname implies that this is a RoadRunner mailserver -- and going to the SMTP port on that IP confirms that it is. Going to your subject, we see the original subject was: * Subject: Returned mail: see transcript for details That means that you just received a bounce message. It is probably a joe-job (a spammer sent out spam using your E-mail address). Unfortunately, since these were not intended to be delivered to you as spam and they come from a legitimate mailserver, it is very difficult for anti-spam software to catch such spam. Looking closer, I see the name "brenda" there -- I believe there is a common virus that is sending out copies of itself using "brenda" as a username. So someone probably got infected, tried sending out the virus a "brenda" account at your cool xyz.com domain (good work on getting that one!), and sent the spam to someone at RoadRunner. RoadRunner doesn't have that good of a mailserver, so instead of rejecting the E-mail, it accepted it and then later bounced it. But the bounce went to you, since it is your domain that was used. If their mailserver passed on the virus, your mailserver should of course block the E-mail. But usually they do not include the virus (or include only part of it, that prevents it from working), in which case the AV software has done its job. -Scott To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
