We get tonnes of calls at work about this exact problem. People receiving emails saying they sent an email to someone else but it was rejected because of an attached virus.
It’s the doing of one of the latest windows viruses I believe.
It’s a mass mailer which uses addresses in the hosts address book to spread it self and mask it self as coming from someone else.
I wouldn’t worry too much about the emails, but I’d be worried if you have your smtp configured to relay.
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
Sent: Friday, 30 April 2004 11:32 AM
To: Slug List
Subject: [SLUG] Server being used to relay emails
Hi -
Got a little problem. =)
We are getting reports back from other servers on the net saying our message from something like [EMAIL PROTECTED] was rejected because of an attached virus.
Our server is running Linux 7.3 and it has only started happening in the last few months.
Our other workstations use our server as an outgoing mail server, but all workstations use 'VirusBuster II' which updates itself automatically at intervals as close as every 15 mins (usually once every couple days on average though) - workstations are running WindowsXP
Has anyone got ANY idea on what could be happening? Has our linux server got a virus? (!?!!?!!) Is someone using our machine as an open relay? (I did take steps to stop that, and abuse.net reports our server as fine) Are our WinXP machines infected regardless of our anti-virus software?
Can someone please help?
I need to find some angles of attack to solve the problem. I guess it's not really urgent, but the sooner we fix it, the better! =)
I will appreciate all help.
If you have a good idea on what the problem may be, please email me directly (as well?) because sometimes I seem to miss some messages from the SLUG list... want to make sure I get it =)
Thanks again!
Jared Pritchard
[EMAIL PROTECTED]
<< File: ATT00026.txt >>
-- SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/ Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
