Bad Filename Detected

[Martin Hepworth]

Hi

the ip-address is that of the sending machine.

most modern viruses and spam fake the from and to addresses in order to
try and get the recipient to open the email.

so in this case they use your domain in the from and to. Nothing new,
don't worry unless you want to trace the ip-address of the sending
machine and inform their ISP/admins.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


SRW wrote:
> I received this message from mailscanner. My confusion begins with the fact
> the message is from my own domain to a one of my users. I tried to do a DNS
> lookup on the IP , which indicated there was no record. I am not sure where
> to begin to investigate?
>
> Thanks in advance!
>
>
> the following e-mails were found to have: Bad Filename Detected : Virus Detected
>
>     Sender: postmaster at MYCOMPANY.net
> IP Address: 68.21.243.17
>  Recipient: cathyp at MYCOMPANY.net
>    Subject: Mail System Error - Returned Mail
>  MessageID: j24KJ7K08923
>     Report: document.txt  .exe was infected: Worm.Mydoom.M-unp
>             Very long filenames are good signs of attacks against Microsoft
> e-mail packages (document.txt  .exe)
>     Report: document.zip was infected: Worm.Mydoom.M-unp
>             document.txt  .exe was infected: Worm.Mydoom.M-unp
>             Very long filenames are good signs of attacks against Microsoft
> e-mail packages (document.txt  .exe)
>
>
> --
> MailScanner
> Email Virus Scanner
> www.mailscanner.info
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!