<html>
At 20:18 21/06/2002, you wrote:<br>
<blockquote type=cite class=cite cite><font face="arial" size=2 color="#0000FF">ps</font><br>
<font face="arial" size=2 color="#0000FF">HOw the heck could it be
hijacked?!! weird</font></blockquote><br>
Very easily. Your dialup ISP has a proxy server which redirects all port
25 traffic to their own SMTP server. <br><br>
FreeServe in the UK do exactly this. It doesn't matter what SMTP server
you configure in your software, you always use theirs, which avoids their
tech support people having to deal with mail relaying problems.<br><br>
So what do your Received: headers say? What you expect?<br>
<blockquote type=cite class=cite cite>
<dl><font face="tahoma" size=2>
<dd>-----Original Message-----
<dd>From:</b> Ray Healy (Data Net Services)
[<a href="mailto:ray@MATRIX-DATANET.CO.UK" eudora="autourl">mailto:ray@MATRIX-DATANET.CO.UK</a>]
<dd>Sent:</b> Friday, June 21, 2002 4:06 PM
<dd>To:</b> MAILSCANNER@JISCMAIL.AC.UK
<dd>Subject:</b> Re: sending a virus from mailscanner's domain is
undetectedbutincoming mail from either our domain or others is
detected<br><br>
</font><font face="arial" size=2>
<dd>I am probably wrong in your situation but I thought I would mention
this</font>
<dd> <font face="arial" size=2>
<dd>I had a similar situation where emails were not being scanned by
MailScanner when sent through my RAQ but incomming messages where scanned
OK if sent to my RAQ by someone else.</font>
<dd> <font face="arial" size=2>
<dd>This was due to the email message being hijacked by the ISP I was
connecting to and putting the message through their own mail server and
not mine even though in the properties I had stated the address of my
mail server. </font><font face="arial" size=2>
<dd>I do not know whether this is of any help or am I toytally off
track</font>
<dd> <font face="arial" size=2>
<dd>Ray</font>
<dd>
<dd>
<dd>
<dd>----- Original Message -----
<dd>From:</b> <a href="mailto:mailscanner@ECS.SOTON.AC.UK">Julian
Field</a>
<dd>To:</b>
<a href="mailto:MAILSCANNER@JISCMAIL.AC.UK">MAILSCANNER@JISCMAIL.AC.UK</a>
<dd>Sent:</b> Friday, June 21, 2002 6:56 PM
<dd>Subject:</b> Re: sending a virus from mailscanner's domain is undetected butincoming mail from either our domain or others is detected<br><br>
<dd>At 18:45 21/06/2002, you wrote:<blockquote type=cite class=cite cite><font face="arial" size=2 color="#0000FF">
<dd>Hello,</font><font face="arial" size=2 color="#0000FF">
<dd>No not on the machine running mailscanner, but outlook 2000 on a workstation sent an email to an outside domain with a virus to test and the outside domain received it with the virus in tact.. Its the test virus you referred me earlier to use.. when I reply (from the outside domain) and its incoming to mailscanner, it will pick it up then. only incoming scanning is taken place not outgoing.</font><font face="arial" size=2 color="#0000FF">
<dd>Thanks!</font></blockquote>
<dd>Did it get any X-MailScanner: header at all?
<dd>If not, then it probably didn't go via the MailScanner server.
<dd>If it did, then what did the header say? What is in your mailscanner.conf file?<br><br>
<dd>Unless it is told to, MailScanner doesn't care what addresses are in the email message.<blockquote type=cite class=cite cite><font face="tahoma" size=2>
<dd>-----Original Message-----
<dd>From: Julian Field [<a href="mailto:mailscanner@ECS.SOTON.AC.UK" eudora="autourl">mailto:mailscanner@ECS.SOTON.AC.UK</a>]
<dd>Sent: Friday, June 21, 2002 2:40 PM
<dd>To: MAILSCANNER@JISCMAIL.AC.UK
<dd>Subject: Re: sending a virus from mailscanner's domain is undetected butincoming mail from either our domain or others is detected<br><br>
</font>
<dd>At 17:36 21/06/2002, you wrote:
<dd>>Sending a virus from mailscanner's domain to another is undetected, but
<dd>>incoming mail from either our domain or others, is detected.
<dd>>Is this normal? <br><br>
<dd>Did you run the email client program on the machine that is running
<dd>MailScanner, by any chance? If so, did you make the email program talk SMTP
<dd>to localhost:25 or did it invoke sendmail directly? <br><br>
<dd>MailScanner (when running with sendmail) can only scan mail coming in the
<dd>SMTP port. There is no way (with sendmail) of scanning mail poked directly
<dd>at the sendmail binary.
<dd>--
<dd>Julian Field Teaching Systems Manager
<dd>jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science
<dd>Tel. 023 8059 2817 University of Southampton
<dd>Southampton SO17 1BJ
</dl></blockquote><br>
--<br>
Julian Field Teaching Systems Manager<br>
jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science<br>
Tel. 023 8059 2817 University of Southampton<br>
Southampton SO17 1BJ <br>
</blockquote><br>
<div>--</div>
<div>Julian Field Teaching Systems Manager</div>
<div>jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science</div>
<div>Tel. 023 8059 2817 University of Southampton</div>
Southampton SO17 1BJ
</html>