Paul Howarth wrote:
Mike McCarty wrote:Paul Howarth wrote:It's probably just clueless anti-virus software sending mail to the forged sender address used by the virus.Quite possibly. But some of it has the virus in it as well. I'd like some help reading the forged headers and trying to clean or shut down whoever is doing this.How about posting the headers from one of the mails and we can take a look at them?Paul.
Ok, here's an example. I turned on all headers. The actual message in this case is one that my ISP caught, and clobbered the attachment which the ISP claims contains a copy of a virus. In cases like this, the attachment is 0 bytes long. The message sent to me purports to be a delivery failure. I know for a fact that I did not send any such message. As pointed out by others, this may be the results of yet another party who is infected, and who is unknowingly spoofing my e-mail address. It has been more than a year since I last booted Windows XP on my machine, and when I do boot it I am never connected to the net. I have never set up XP on this machine to be able to send or receive email. -M-E-S-S-A-G-E---B-E-G-I-N-S-Your AT&T Yahoo! Mail Virus Protection detected the virus 'W32.Mydoom.M@mm' in the file 'Document.pif', attached to the enclosed email message. We scanned the file using Norton AntiVirus but were unable to clean it. Therefore, we removed the content of the attachment from the message. Please contact the message sender if you want to receive the attachment. They must clean the file and resend it before we can deliver it to you safely.
AT&T Yahoo! Mail successfully cleans most infected attachments, which protects you from viruses.
Subject: Delivery reports about your e-mail From: "Mail Administrator" <MAILER-DAEMON@xxxxxxxxxxxxx> Date: Wed, 13 Sep 2006 14:23:40 +0000 To: mike.mccarty@xxxxxxxxxxxxxX-Apparently-To: mike.mccarty@xxxxxxxxxxxxx via 216.252.101.37; Wed, 13 Sep 2006 11:07:33 -0700
X-Originating-IP: [162.39.117.147] Authentication-Results:mta101.sbc.mail.mud.yahoo.com from=sbcglobal.net; domainkeys=neutral (no sig) Received: from 207.115.57.79 (EHLO ylpvm48.prodigy.net) (207.115.57.79) by mta101.sbc.mail.mud.yahoo.com with SMTP; Wed, 13 Sep 2006 11:07:33 -0700
X-Originating-IP: [162.39.117.147]Received: from sbcglobal.net (h147.117.39.162.ip.alltel.net [162.39.117.147]) by ylpvm48.prodigy.net (8.13.6 inb/8.13.6) with ESMTP id k8DI7NKK019802 for <mike.mccarty@xxxxxxxxxxxxx>; Wed, 13 Sep 2006 14:07:31 -0400
Message-ID: <200609131807.k8DI7NKK019802@xxxxxxxxxxxxxxxxxxx> MIME-Version: 1.0Content-Type: multipart/mixed; boundary="----=_NextPart_000_0006_7AAB0288.C52F82A9"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
This message was undeliverable due to the following reason(s):
Your message could not be delivered because the destination server was
not reachable within the allowed queue period. The amount of time
a message is queued before it is returned depends on local configura-
tion parameters.
Most likely there is a network problem that prevented delivery, but
it is also possible that the computer is turned off, or does not
have a mail system running right now.
Your message could not be delivered within 8 days:
Host 130.19.41.21 is not responding.
The following recipients could not receive this message:
<mike.mccarty@xxxxxxxxxxxxx>
Please reply to postmaster@xxxxxxxxxxxxx
if you feel this message to be in error.
-M-E-S-S-A-G-E---E-N-D-S-
Thanks for any help.
Mike
--
p="p=%c%s%c;main(){printf(p,34,p,34);}";main(){printf(p,34,p,34);}
This message made from 100% recycled bits.
You have found the bank of Larn.
I can explain it for you, but I can't understand it for you.
I speak only for myself, and I am unanimous in that!
--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
