Re: [Declude.Virus] about Imail1.exe security issue
Hi, Pv Does Imail give the answer for it? Thanks Regards Brian - Original Message - From: Mailing Lists [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Wednesday, November 24, 2004 10:57 PM Subject: Re: [Declude.Virus] about Imail1.exe security issue We had same issue, then mysteriously got fixed. Imail was aware of it as we had opened ticket. Everytime this would happen, the affected domain registry entry would have some weird users and entries (dont recall exactly but if you search the archives you will find the post). PV - Original Message - From: Mike Wiegers [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Wednesday, November 24, 2004 9:09 AM Subject: RE: [Declude.Virus] about Imail1.exe security issue This is odd, odd because my server has this problem also and I called Ipswitch about it and they said that my server was the only one having the problems. It had it several months ago (and called) and then started again (and called). Those are the only calls to tech support in the past several years for my SA. I will read the posts to find out more about this. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Wednesday, November 24, 2004 7:05 AM To: Declude.Virus@declude.com Subject: Re: [Declude.Virus] about Imail1.exe security issue we had the same issue few month ago i suspected problem from declude because the addresses that appear in the open imail1 window looked like ones that would be generated by declude notifications (or maybe imail gses ?) anyway, rebooting the server resolved the issue back then Unfortunatly, since upgrading to 8.13 (or 8.14, can't tell exactly, because i did both in less than 48 hours) the problem is coming again, and rebooting did not help this time. if you find a solution, let me know - Original Message - From: Crejob.com [EMAIL PROTECTED] To: Declude.Virus@declude.com Sent: Wednesday, November 24, 2004 10:05 AM Subject: [Declude.Virus] about Imail1.exe security issue My Imail server keep pop up a Create Mail Message, it's seems that Imail1.exe is exploit by someone to try send out spam. I try to limit the imail1.exe user permission, but this will result the webmail can not send out email. Any advice on how to solve this problem? Regards Brian --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] about Imail1.exe security issue
IPSwitch tech-support reply me that they are still investigating this issue. I am very sure it's caused by a mass mail worm outside my server, just don't know how can it cause a pop up windows in my server desktop. - Original Message - From: Mike Wiegers [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 30, 2004 1:21 AM Subject: RE: [Declude.Virus] about Imail1.exe security issue Has anyone found out anymore about this issue? Is it related to Imail and Declude users only? Thanks, Mike --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] about Imail1.exe security issue
Has anyone found out anymore about this issue? Is it related to Imail and Declude users only? Thanks, Mike --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] about Imail1.exe security issue
Has anyone found out anymore about this issue? Is it related to Imail and Declude users only? There is no indication that the issue affects Declude users (aside from the fact that all Declude users are currently using IMail). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] about Imail1.exe security issue
My Imail server keep pop up a Create Mail Message, it's seems that Imail1.exe is exploit by someone to try send out spam. I try to limit the imail1.exe user permission, but this will result the webmail can not send out email. Any advice on how to solve this problem? Regards Brian --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] about Imail1.exe security issue
Any advice on how to solve this problem? This has been discussed on the Imail forum in the recent past. See a direct search of the archives with many posts about this at: http://www.mail-archive.com/cgi-bin/htsearch?config=imail_forum_list_ipswitch_comrestrict=exclude=words=imail1.exe+hacked If you have problems with the above long link try: http://tinyurl.com/6xd5u Additional help can be gained by subscribing and posting to the Imail list at: http://www.ipswitch.com/support/mailing-lists.html Be sure to read all the posts in the archive before posting to the Imail list as some of the list denizens don't suffer fools too well. (meaning they occasionally get tired of answering the same old questions over and over again and can be a bit rude to new list members, but don't be deterred, as there is a lot of knowledge there) also, hit the new forum for Imail at(which didn't find anything when I searched): http://www.ipswitch.com/forums/messages.aspx?ForumID=10 Hope this leads to some help, Good luck, Doug Traylor PS. You might also want to research the Blackice server software firewall(~$200 at some reseller--mentioned on the list). That has been discussed a bunch lately on the list as a useful tool to block dictionary attacks. I don't have it yet, but I think the traffic analysis and logging would help you track down any unusual behavior. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] about Imail1.exe security issue
we had the same issue few month ago i suspected problem from declude because the addresses that appear in the open imail1 window looked like ones that would be generated by declude notifications (or maybe imail gses ?) anyway, rebooting the server resolved the issue back then Unfortunatly, since upgrading to 8.13 (or 8.14, can't tell exactly, because i did both in less than 48 hours) the problem is coming again, and rebooting did not help this time. if you find a solution, let me know - Original Message - From: Crejob.com [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 10:05 AM Subject: [Declude.Virus] about Imail1.exe security issue My Imail server keep pop up a Create Mail Message, it's seems that Imail1.exe is exploit by someone to try send out spam. I try to limit the imail1.exe user permission, but this will result the webmail can not send out email. Any advice on how to solve this problem? Regards Brian --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] about Imail1.exe security issue
This is odd, odd because my server has this problem also and I called Ipswitch about it and they said that my server was the only one having the problems. It had it several months ago (and called) and then started again (and called). Those are the only calls to tech support in the past several years for my SA. I will read the posts to find out more about this. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Wednesday, November 24, 2004 7:05 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] about Imail1.exe security issue we had the same issue few month ago i suspected problem from declude because the addresses that appear in the open imail1 window looked like ones that would be generated by declude notifications (or maybe imail gses ?) anyway, rebooting the server resolved the issue back then Unfortunatly, since upgrading to 8.13 (or 8.14, can't tell exactly, because i did both in less than 48 hours) the problem is coming again, and rebooting did not help this time. if you find a solution, let me know - Original Message - From: Crejob.com [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 10:05 AM Subject: [Declude.Virus] about Imail1.exe security issue My Imail server keep pop up a Create Mail Message, it's seems that Imail1.exe is exploit by someone to try send out spam. I try to limit the imail1.exe user permission, but this will result the webmail can not send out email. Any advice on how to solve this problem? Regards Brian --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] about Imail1.exe security issue
We had same issue, then mysteriously got fixed. Imail was aware of it as we had opened ticket. Everytime this would happen, the affected domain registry entry would have some weird users and entries (dont recall exactly but if you search the archives you will find the post). PV - Original Message - From: Mike Wiegers [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 9:09 AM Subject: RE: [Declude.Virus] about Imail1.exe security issue This is odd, odd because my server has this problem also and I called Ipswitch about it and they said that my server was the only one having the problems. It had it several months ago (and called) and then started again (and called). Those are the only calls to tech support in the past several years for my SA. I will read the posts to find out more about this. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Wednesday, November 24, 2004 7:05 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] about Imail1.exe security issue we had the same issue few month ago i suspected problem from declude because the addresses that appear in the open imail1 window looked like ones that would be generated by declude notifications (or maybe imail gses ?) anyway, rebooting the server resolved the issue back then Unfortunatly, since upgrading to 8.13 (or 8.14, can't tell exactly, because i did both in less than 48 hours) the problem is coming again, and rebooting did not help this time. if you find a solution, let me know - Original Message - From: Crejob.com [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 10:05 AM Subject: [Declude.Virus] about Imail1.exe security issue My Imail server keep pop up a Create Mail Message, it's seems that Imail1.exe is exploit by someone to try send out spam. I try to limit the imail1.exe user permission, but this will result the webmail can not send out email. Any advice on how to solve this problem? Regards Brian --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] about Imail1.exe security issue
same here after the update to 8.14 and hf1 marc At 15:57 24.11.2004, you wrote: We had same issue, then mysteriously got fixed. Imail was aware of it as we had opened ticket. Everytime this would happen, the affected domain registry entry would have some weird users and entries (dont recall exactly but if you search the archives you will find the post). PV - Original Message - From: Mike Wiegers [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 9:09 AM Subject: RE: [Declude.Virus] about Imail1.exe security issue This is odd, odd because my server has this problem also and I called Ipswitch about it and they said that my server was the only one having the problems. It had it several months ago (and called) and then started again (and called). Those are the only calls to tech support in the past several years for my SA. I will read the posts to find out more about this. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Wednesday, November 24, 2004 7:05 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] about Imail1.exe security issue we had the same issue few month ago i suspected problem from declude because the addresses that appear in the open imail1 window looked like ones that would be generated by declude notifications (or maybe imail gses ?) anyway, rebooting the server resolved the issue back then Unfortunatly, since upgrading to 8.13 (or 8.14, can't tell exactly, because i did both in less than 48 hours) the problem is coming again, and rebooting did not help this time. if you find a solution, let me know - Original Message - From: Crejob.com [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 10:05 AM Subject: [Declude.Virus] about Imail1.exe security issue My Imail server keep pop up a Create Mail Message, it's seems that Imail1.exe is exploit by someone to try send out spam. I try to limit the imail1.exe user permission, but this will result the webmail can not send out email. Any advice on how to solve this problem? Regards Brian --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. [Scanned for viruses by Declude Virus] [Scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] about Imail1.exe security issue
I'm now quite sure that it is caused by a clients PC virus, I use the specific email string to search the sys*.txt log, and found it come from 1 IP, I block this IP in my firewall, then this problem dispear, but the problem is from the IP I can not identify the clients PC name, because virus using forged PC name, and the IP is a ISP dynamic PC so I also can not find out who infected by which virus, but this virus should be a big headache to IMAIL users. - Original Message - From: Mailing Lists [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 10:57 PM Subject: Re: [Declude.Virus] about Imail1.exe security issue We had same issue, then mysteriously got fixed. Imail was aware of it as we had opened ticket. Everytime this would happen, the affected domain registry entry would have some weird users and entries (dont recall exactly but if you search the archives you will find the post). PV - Original Message - From: Mike Wiegers [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 9:09 AM Subject: RE: [Declude.Virus] about Imail1.exe security issue This is odd, odd because my server has this problem also and I called Ipswitch about it and they said that my server was the only one having the problems. It had it several months ago (and called) and then started again (and called). Those are the only calls to tech support in the past several years for my SA. I will read the posts to find out more about this. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Wednesday, November 24, 2004 7:05 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] about Imail1.exe security issue we had the same issue few month ago i suspected problem from declude because the addresses that appear in the open imail1 window looked like ones that would be generated by declude notifications (or maybe imail gses ?) anyway, rebooting the server resolved the issue back then Unfortunatly, since upgrading to 8.13 (or 8.14, can't tell exactly, because i did both in less than 48 hours) the problem is coming again, and rebooting did not help this time. if you find a solution, let me know - Original Message - From: Crejob.com [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 10:05 AM Subject: [Declude.Virus] about Imail1.exe security issue My Imail server keep pop up a Create Mail Message, it's seems that Imail1.exe is exploit by someone to try send out spam. I try to limit the imail1.exe user permission, but this will result the webmail can not send out email. Any advice on how to solve this problem? Regards Brian --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] about Imail1.exe security issue
I am still 8.13, got the problem, should not be the new problem of 8.14, I think it's problem of new virus - Original Message - From: marc [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 11:22 PM Subject: Re: [Declude.Virus] about Imail1.exe security issue same here after the update to 8.14 and hf1 marc At 15:57 24.11.2004, you wrote: We had same issue, then mysteriously got fixed. Imail was aware of it as we had opened ticket. Everytime this would happen, the affected domain registry entry would have some weird users and entries (dont recall exactly but if you search the archives you will find the post). PV - Original Message - From: Mike Wiegers [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 9:09 AM Subject: RE: [Declude.Virus] about Imail1.exe security issue This is odd, odd because my server has this problem also and I called Ipswitch about it and they said that my server was the only one having the problems. It had it several months ago (and called) and then started again (and called). Those are the only calls to tech support in the past several years for my SA. I will read the posts to find out more about this. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Wednesday, November 24, 2004 7:05 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] about Imail1.exe security issue we had the same issue few month ago i suspected problem from declude because the addresses that appear in the open imail1 window looked like ones that would be generated by declude notifications (or maybe imail gses ?) anyway, rebooting the server resolved the issue back then Unfortunatly, since upgrading to 8.13 (or 8.14, can't tell exactly, because i did both in less than 48 hours) the problem is coming again, and rebooting did not help this time. if you find a solution, let me know - Original Message - From: Crejob.com [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 10:05 AM Subject: [Declude.Virus] about Imail1.exe security issue My Imail server keep pop up a Create Mail Message, it's seems that Imail1.exe is exploit by someone to try send out spam. I try to limit the imail1.exe user permission, but this will result the webmail can not send out email. Any advice on how to solve this problem? Regards Brian --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. [Scanned for viruses by Declude Virus] [Scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] about Imail1.exe security issue
i think thats not by a clients PC virus. i got just right the ip using the imail1.exe to existing and no existing users (217.255.255.100) searching the log*.txt itsd using different pc names sorry about this post, because this is not a declude issue marc At 16:45 24.11.2004, you wrote: I'm now quite sure that it is caused by a clients PC virus, I use the specific email string to search the sys*.txt log, and found it come from 1 IP, I block this IP in my firewall, then this problem dispear, but the problem is from the IP I can not identify the clients PC name, because virus using forged PC name, and the IP is a ISP dynamic PC so I also can not find out who infected by which virus, but this virus should be a big headache to IMAIL users. - Original Message - From: Mailing Lists [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 10:57 PM Subject: Re: [Declude.Virus] about Imail1.exe security issue We had same issue, then mysteriously got fixed. Imail was aware of it as we had opened ticket. Everytime this would happen, the affected domain registry entry would have some weird users and entries (dont recall exactly but if you search the archives you will find the post). PV - Original Message - From: Mike Wiegers [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 9:09 AM Subject: RE: [Declude.Virus] about Imail1.exe security issue This is odd, odd because my server has this problem also and I called Ipswitch about it and they said that my server was the only one having the problems. It had it several months ago (and called) and then started again (and called). Those are the only calls to tech support in the past several years for my SA. I will read the posts to find out more about this. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Wednesday, November 24, 2004 7:05 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] about Imail1.exe security issue we had the same issue few month ago i suspected problem from declude because the addresses that appear in the open imail1 window looked like ones that would be generated by declude notifications (or maybe imail gses ?) anyway, rebooting the server resolved the issue back then Unfortunatly, since upgrading to 8.13 (or 8.14, can't tell exactly, because i did both in less than 48 hours) the problem is coming again, and rebooting did not help this time. if you find a solution, let me know - Original Message - From: Crejob.com [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 10:05 AM Subject: [Declude.Virus] about Imail1.exe security issue My Imail server keep pop up a Create Mail Message, it's seems that Imail1.exe is exploit by someone to try send out spam. I try to limit the imail1.exe user permission, but this will result the webmail can not send out email. Any advice on how to solve this problem? Regards Brian --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. [Scanned for viruses by Declude Virus] [Scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http
Re: [Declude.Virus] about Imail1.exe security issue
Sorry, i don't get your meaning, why you think it's not by a client PC virus? virus always change the PC name if using it's own SMTP engine, also, the IP maybe a broadband shared in a network, and several PCs in the network maybe all infected. In my case, I just found that IP is infected by http://securityresponse.symantec.com/avcenter/venc/data/[EMAIL PROTECTED] http://vil.mcafeesecurity.com/vil/content/v_130130.htm - Original Message - From: marc [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 25, 2004 12:01 AM Subject: Re: [Declude.Virus] about Imail1.exe security issue i think thats not by a clients PC virus. i got just right the ip using the imail1.exe to existing and no existing users (217.255.255.100) searching the log*.txt itsd using different pc names sorry about this post, because this is not a declude issue marc At 16:45 24.11.2004, you wrote: I'm now quite sure that it is caused by a clients PC virus, I use the specific email string to search the sys*.txt log, and found it come from 1 IP, I block this IP in my firewall, then this problem dispear, but the problem is from the IP I can not identify the clients PC name, because virus using forged PC name, and the IP is a ISP dynamic PC so I also can not find out who infected by which virus, but this virus should be a big headache to IMAIL users. - Original Message - From: Mailing Lists [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 10:57 PM Subject: Re: [Declude.Virus] about Imail1.exe security issue We had same issue, then mysteriously got fixed. Imail was aware of it as we had opened ticket. Everytime this would happen, the affected domain registry entry would have some weird users and entries (dont recall exactly but if you search the archives you will find the post). PV - Original Message - From: Mike Wiegers [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 9:09 AM Subject: RE: [Declude.Virus] about Imail1.exe security issue This is odd, odd because my server has this problem also and I called Ipswitch about it and they said that my server was the only one having the problems. It had it several months ago (and called) and then started again (and called). Those are the only calls to tech support in the past several years for my SA. I will read the posts to find out more about this. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Wednesday, November 24, 2004 7:05 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] about Imail1.exe security issue we had the same issue few month ago i suspected problem from declude because the addresses that appear in the open imail1 window looked like ones that would be generated by declude notifications (or maybe imail gses ?) anyway, rebooting the server resolved the issue back then Unfortunatly, since upgrading to 8.13 (or 8.14, can't tell exactly, because i did both in less than 48 hours) the problem is coming again, and rebooting did not help this time. if you find a solution, let me know - Original Message - From: Crejob.com [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 10:05 AM Subject: [Declude.Virus] about Imail1.exe security issue My Imail server keep pop up a Create Mail Message, it's seems that Imail1.exe is exploit by someone to try send out spam. I try to limit the imail1.exe user permission, but this will result the webmail can not send out email. Any advice on how to solve this problem? Regards Brian --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com
Re: [Declude.Virus] about Imail1.exe security issue
your are right about the virus always change the PC name, but its very strange, that sending to different domains on our imail!? like Dictionary Attacks trough webmail... At 17:25 24.11.2004, you wrote: Sorry, i don't get your meaning, why you think it's not by a client PC virus? virus always change the PC name if using it's own SMTP engine, also, the IP maybe a broadband shared in a network, and several PCs in the network maybe all infected. In my case, I just found that IP is infected by http://securityresponse.symantec.com/avcenter/venc/data/[EMAIL PROTECTED] http://vil.mcafeesecurity.com/vil/content/v_130130.htm - Original Message - From: marc [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 25, 2004 12:01 AM Subject: Re: [Declude.Virus] about Imail1.exe security issue i think thats not by a clients PC virus. i got just right the ip using the imail1.exe to existing and no existing users (217.255.255.100) searching the log*.txt itsd using different pc names sorry about this post, because this is not a declude issue marc At 16:45 24.11.2004, you wrote: I'm now quite sure that it is caused by a clients PC virus, I use the specific email string to search the sys*.txt log, and found it come from 1 IP, I block this IP in my firewall, then this problem dispear, but the problem is from the IP I can not identify the clients PC name, because virus using forged PC name, and the IP is a ISP dynamic PC so I also can not find out who infected by which virus, but this virus should be a big headache to IMAIL users. - Original Message - From: Mailing Lists [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 10:57 PM Subject: Re: [Declude.Virus] about Imail1.exe security issue We had same issue, then mysteriously got fixed. Imail was aware of it as we had opened ticket. Everytime this would happen, the affected domain registry entry would have some weird users and entries (dont recall exactly but if you search the archives you will find the post). PV - Original Message - From: Mike Wiegers [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 9:09 AM Subject: RE: [Declude.Virus] about Imail1.exe security issue This is odd, odd because my server has this problem also and I called Ipswitch about it and they said that my server was the only one having the problems. It had it several months ago (and called) and then started again (and called). Those are the only calls to tech support in the past several years for my SA. I will read the posts to find out more about this. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Wednesday, November 24, 2004 7:05 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] about Imail1.exe security issue we had the same issue few month ago i suspected problem from declude because the addresses that appear in the open imail1 window looked like ones that would be generated by declude notifications (or maybe imail gses ?) anyway, rebooting the server resolved the issue back then Unfortunatly, since upgrading to 8.13 (or 8.14, can't tell exactly, because i did both in less than 48 hours) the problem is coming again, and rebooting did not help this time. if you find a solution, let me know - Original Message - From: Crejob.com [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 24, 2004 10:05 AM Subject: [Declude.Virus] about Imail1.exe security issue My Imail server keep pop up a Create Mail Message, it's seems that Imail1.exe is exploit by someone to try send out spam. I try to limit the imail1.exe user permission, but this will result the webmail can not send out email. Any advice on how to solve this problem? Regards Brian --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
