Tons of 1.txt messages

Drew Marshall drew at THEMARSHALLS.CO.UK
Fri Jul 22 21:30:28 IST 2005

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Michael Baird wrote:

>Seeing the here as well
>Michael Baird
>>We are suddenly (within the past hour) seeing dozens of reports from
>>users about messages coming in with an attachment 1.txt (wich is 80b
>>and empty).  There is always a 1 in the body and nothing else.  The
>>source address is always forged and most of them seem to be coming
>>from large ISP user IP pools.  
>>Here is a sample header:
>>Received: from ( [x.x.x.x]) by
>> with SMTP (x) 
>>        id PKVMXV6N; Fri, 22 Jul 2005 13:53:18 -0400 
>>Received: from (
>>        by (8.12.10/8.12.10) with SMTP id
>>        for <mg at>; Fri, 22 Jul 2005 13:48:55 -0400 
>>Date: Fri, 22 Jul 2005 19:59:41 +0100 
>>To: "Mg" <mg at> 
>>From: "Mg" <mg at> 
>>Subject: 1 
>>Message-ID: <tmzgclxpkjdscxevsvp at> 
>>MIME-Version: 1.0 
>>Content-Type: multipart/mixed; 
>>        boundary="--------elrddgzjoshelqmabgkc" 
>>X-SAMS-Information: Please contact the ISP for more information 
>>X-SAMS: Found to be clean 
>>X-SAMS-SpamCheck: not spam, SpamAssassin (score=-4.48, required 4.4, 
>>        BAYES_00 -4.90, HTML_MESSAGE 0.10, MIME_HTML_ONLY 0.32) 
>>X-MailScanner-From: mg at
>>Content-Type: text/html; charset="us-ascii" 
>>Content-Transfer-Encoding: 7bit
>>Content-Type: application/octet-stream; name="1.txt" 
>>Content-Transfer-Encoding: base64 
>>Content-Disposition: attachment; filename="1.txt"
So what are they? I guess they are Spam as they are unsolicited but I 
guess they are not a virus (Or are they the outcasting from a virus)? I 
don't remember reading any reports about this type of file.


In line with our policy, this message has 
been scanned for viruses and dangerous 
content by MailScanner, and is believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki ( and
the archives (

Support MailScanner development - buy the book off the website!

More information about the MailScanner mailing list