<html>
<head>
<meta http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<meta name=Generator content="Microsoft Word 11 (filtered)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:#606420;
text-decoration:underline;}
pre
{margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
tt
{font-family:"Courier New";}
span.EmailStyle17
{font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink="#606420">
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>A virus on a users machine from an outside domain keeps
sending email to a user on my domain. MailScanner is detecting the virus and
removing it. But the problem is that I get these emails atleast once an hour.
It always comes from the same place. It disguises itself as though the email
comes from my domain, but the full headers shows it comes from another domain.
For example:</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>
<pre><tt><font size=2 face="Courier New"><span style='font-size:10.0pt'>Full headers are:</span></font></tt></pre><pre><tt><font
size=2 face="Courier New"><span style='font-size:10.0pt'> </span></font></tt></pre><pre><tt><font
size=2 face="Courier New"><span style='font-size:10.0pt'> Return-Path: <g></span></font></tt></pre><pre><tt><font
size=2 face="Courier New"><span style='font-size:10.0pt'> Received: from test-domain.com (cpe-24-170-49-168.stx.res.rr.com </span></font></tt></pre><pre><tt><font
size=2 face="Courier New"><span style='font-size:10.0pt'>[24.170.49.168])</span></font></tt></pre>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>My domain is named test-domain.com. I am not on RoadRunner
so the rr.com address above is where its originating from. </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>What’s the best way to go about blocking this domain
or sub-domain so that I stop receiving the notices of detected virus emails
from MailScanner. </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Thanks.</span></font></p>
</div>
</body>
</html>