> On Monday 14 June 2004 04:18 pm, R. Scott Perry wrote:
> > Do you have a way to get the full headers of the E-mail that gets through
> > (such as accessing the .mbx file directly), which would let us see the
> > exact headers you are getting?
> >
> > -Scott
>
Here's the message pulled directly from the mbx file.. I modified the
attachment so that it's no longer really eicar since it appears that it was
blocked when I sent it before.
From <[EMAIL PROTECTED]> Tue Jun 15 05:55:12 2004
Received: from web.trhs.org [128.128.15.20] by trhs.org with ESMTP
(SMTPD32-7.15) id A3A06540140; Tue, 15 Jun 2004 05:55:12 -0600
Received: from mail01.excedent.us (crc2.excedent.us [12.5.19.157])
by web.trhs.org (Postfix) with ESMTP id E73B6A055E
for <[EMAIL PROTECTED]>; Tue, 15 Jun 2004 07:55:45 -0400 (EDT)
X-Originating-Ip: 207.225.37.66
Message-Id: <[EMAIL PROTECTED]>
Date: Tue, 15 Jun 2004 07:55:32 -0500
From: "TESTVIRUS.org" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: Virus Scanner Test #22
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary="=====================_804689079==_"
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 376546492
--=====================_804689079==_
Content-Type: text/plain; charset="us-ascii"; format=flowed
This message was sent to you because you or someone you know is testing your
mail server's virus scanner at: http://www.testvirus.org
This test message contains:
Test #22: Eicar virus within zip file hidden using the "MIME Continuation
Vulnerability"
If your mail server's virus scanner did not detect this email, it allows some
viruses through! Please note: This test message uses the EICAR test virus,
which is completely benign and contains no viral code. For more information
see: http://www.eicar.org
This free test has been provided to you by Excedent Technologies
(http://www.excedent.com) and Webmail.us (http://www.webmail.us)
--=====================_804689079==_
name="nolongereicar.zip";
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="nolongereicar.zip"
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAEQAAAAJAAAARUlDQVIuQ09NWDVPIVAlQEFQWzRcUFpYNTQo
UF4pN0NDKTd9JEVJQ0FSLVNUQU5AAAAAAAAAAAAAAAAAAAAAAAAAAAAJTEUhJEgrSCpQSwECFAAK
AAAAAABmRqYsPM9RaEQAAABEAAAACQAAAAAAAAABACAAAAAAAAAARUAAAAAAAAAAAAsFBgAAAAAB
AAEANwAAAGsAAAAAAA==
--=====================_804689079==_--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
