Infected mails from mydomain
Chris Boyd
Chris.Boyd at USIT.IE
Wed Jan 4 17:10:02 GMT 2006
Am i getting these messages sent to my admin alias (ie admin at mydomain.ie) because someone is spoofing my email address and sending out infected attachments?
Here's the header:
TIA
Return-path: <grammateia at comsys.gr>
Received: from smtp.mydomain.ie
([10.133.1.49])
by 10.133.1.50; Thu, 22 Dec 2005 13:11:18 +0000
Received: from exchange2.comsys.gr (exchange2.comsys.gr [194.219.54.100])
by smtp.mydomain.ie (Postfix) with SMTP id DA2ABA3B1B
for <Admin at mydomain.ie>; Thu, 22 Dec 2005 13:14:00 +0000 (GMT)
Subject: {Spam?} Virus Found in message "Mail_delivery_failed"
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----_=_NextPart_001_01C606F9.9D62A1EF"
Date: Thu, 22 Dec 2005 15:14:18 +0200
Message-ID: <4096695D89BC47478DEB397E37BC43B8010ED9 at exchange2.comsys.gr>
Content-class: urn:content-classes:message
X-MimeOLE: Produced By Microsoft Exchange V6.5
X-MS-Has-Attach:
X-MS-TNEF-Correlator: <4096695D89BC47478DEB397E37BC43B8010ED9 at exchange2.comsys.gr>
Thread-Topic: Virus Found in message "Mail_delivery_failed"
Thread-Index: AcYG+Z1isZIWGUALQdyv5DhTa2cEPg==
From: =?iso-8859-7?B?w/Hh7Ozh9OXf4Q==?= <Grammateia at comsys.gr>
To: <Admin at mydomain.ie>
X-USIT-MailScanner-OpenProtect-Information: Please contact the ISP for more information
X-USIT-MailScanner-OpenProtect: Found to be clean
X-USIT-MailScanner-OpenProtect-MCPCheck:
X-USIT-MailScanner-OpenProtect-SpamCheck: spam, SpamAssassin (score=15.601,
required 3, ALL_TRUSTED -3.30, BAYES_00 -2.60, VIRUS_WARNING188 1.50,
VIRUS_WARNING59 20.00)
X-USIT-MailScanner-OpenProtect-SpamScore: 15
X-USIT-MailScanner-OpenProtect-From: grammateia at comsys.gr
This is a multi-part message in MIME format.
------_=_NextPart_001_01C606F9.9D62A1EF
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Symantec AntiVirus found a virus in an attachment you (Admin at mydomain.ie
<Admin at mydomain.ie>) sent to priv-mail at comsys.gr.
To ensure the recipient(s) are able to use the files you sent, perform a
virus scan on your computer, clean any infected files, then resend this
attachment.
Attachment: mail.zip
Virus name: W32.Sober.X at mm!zip
Action taken: Quarantine succeeded :
File status: Infected
------_=_NextPart_001_01C606F9.9D62A1EF
Content-Type: application/ms-tnef;
name="winmail.dat"
Content-Transfer-Encoding: base64
-----------------------------------------------------------------
This email message is intended only for the addressee(s)
and contains information that may be confidential and/or
copyrighted. If you are not the intended recipient please
notify the sender by reply email and immediately delete
this email. Use, disclosure or reproduction of this email
by anyone other than the intended recipient(s) is strictly
prohibited. USIT has scanned this email for viruses and
dangerous content and believes it to be clean. However,
virus scanning is ultimately the responsibility of the recipient.
-----------------------------------------------------------------
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!
More information about the MailScanner
mailing list