Virus on Email Server itself?

[Julian Field]

This is all fallout of the Klez virus. This virus fakes the "From" and the
"To" addresses, so don't take much notice of infection reports about it.
Recent versions of MailScanner take this into account and do not send out
warnings to the supposed senders of such messages.

At 07:23 16/09/2002, you wrote:
>Good Day
>Im just wondering why do our MAILER-DEAMON sends a virus infected email.
>Here's a sample email sent by Mailscanner. Is it possible that anti-virus
>engine doesn't clean that infected email?
>**START OF EMAIL******
>Subject: Warning: E-mail viruses detected   View Full Header
>View Printable Version
>From: "STII Mail Scanner" <postmaster at stii.dost.gov.ph>
>Date: Sat, September 14, 2002 5:36 pm
>To: <MAILER-DAEMON at stii.dost.gov.ph>
>Priority:  Normal
>
>Our virus detector has just been triggered by a message you sent:-
>   To: <mar at stii.dost.gov.ph>
>   Subject: Undelivered Mail Returned to Sender -New Text Document
>   Date: Sat Sep 14 17:36:13 2002
>Any infected parts of the message have not been delivered.
>
>This message is simply to warn you that your computer system may have a
>virus present and should be checked.
>
>The virus detector said this about the message:
>Report: >>> Virus 'W32/Yaha-E' found in file ./g8E9YlCZ019838/New Text
>Document.jpg.pifShortcuts to MS-Dos programs are very dangerous in email
>(New Text
>Document.jpg.pif)
>
>-------------------------------------
>STII E-mail Virus Protection Service
>postmaster at stii.dost.gov.ph
>
>**END OF EMAIL******
>
>Thanks and more power to Mailscanner.
>
>Domingo Genaro P. Tamayo
>SRS-I
>(STII-DOST PH)

--
Julian Field                Teaching Systems Manager
jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                             Southampton SO17 1BJ