Different message, but same thing. (User had deleted other message) 09/05/2003 15:07:55 Q5ccb2890a00 Warning: Could not find IP3 end on first line of datafile (bound)? 09/05/2003 15:07:55 Q5ccb2890a00 Incoming from 127.0.0.1: OK.
Yep, that is the full headers: Date: Fri, 5 Sep 2003 15:07:55 -0700 Message-Id: <[EMAIL PROTECTED]> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii From: "Postmaster" <[EMAIL PROTECTED]> Reply-To: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: WARNING: WE BLOCKED A VIRUS SENT TO YOU! X-Mailer: <IMail v8.02> X-Declude-Sender: [EMAIL PROTECTED] [127.0.0.1] X-Declude-Spoolname: D5ccb2890a00.GSC X-RBL-Warning: Total weight: -28 X-Tests-Failed: HELOBOGUS, IPNOTINMX, HOSTEDDOMAINS, SPAMCHECK X-Note: This E-mail was sent from ([127.0.0.1]). X-Note: This e-mail was scanned by eServices For You for Viruses and SPAM. X-Note: To report any issues, please contact [EMAIL PROTECTED] Status: U X-UIDL: 362788298 John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) > Sent: Friday, September 05, 2003 10:40 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Warnings in HJ log > > I will contact the user and get the full headers. > > John Tolmachoff MCSE CSSA > Engineer/Consultant > eServices For You > www.eservicesforyou.com > > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > > Sent: Friday, September 05, 2003 9:53 AM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.JunkMail] Warnings in HJ log > > > > Are those the full headers? They do not include any Received: headers. > > -Scott > > > > At 12:46 PM 9/5/2003, John Tolmachoff \(Lists\) wrote: > > >Here is the header: (Retrieved from the Exchange log of the recipient) > > > > > >Date: Fri, 5 Sep 2003 00:09:47 -0700 > > >Message-Id: <[EMAIL PROTECTED]> > > >Mime-Version: 1.0 > > >Content-Type: text/plain; charset=us-ascii > > >From: "Postmaster" <[EMAIL PROTECTED]> > > >Reply-To: <[EMAIL PROTECTED]> > > >To: <[EMAIL PROTECTED]> > > >Subject: WARNING: WE BLOCKED A VIRUS SENT TO YOU! > > >X-Mailer: <IMail v8.02> > > >X-Declude-Sender: [EMAIL PROTECTED] [127.0.0.1] > > >X-Declude-Spoolname: D2967f2315dc.GSC > > >X-RBL-Warning: Total weight: -28 > > >X-Tests-Failed: HELOBOGUS, IPNOTINMX, HOSTEDDOMAINS, > SPAMCHECK > > >X-Note: This E-mail was sent from ([127.0.0.1]). > > >X-Note: This e-mail was scanned by eServices For You for Viruses and > SPAM. > > >X-Note: To report any issues, please contact [EMAIL PROTECTED] > > > > > >John Tolmachoff MCSE CSSA > > >Engineer/Consultant > > >eServices For You > > >www.eservicesforyou.com > > > > > > > > > > -----Original Message----- > > > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > > > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > > > > Sent: Friday, September 05, 2003 9:24 AM > > > > To: [EMAIL PROTECTED] > > > > Subject: Re: [Declude.JunkMail] Warnings in HJ log > > > > > > > > > > > > >I am seeing this warning on messages that Declude creates using the > > > > >postmaster.eml file for virus notifications. > > > > > > > > > >Is this do to the message ID problem with IMail's mail1.exe? > > > > > > > > > >09/05/2003 00:09:47 Q2967f2315dc Warning: Could not find IP3 end on > first > > > > >line of datafile (bound)? > > > > > > > > That's an odd one that I haven't seen before. That will occur if > there is > > > > an IP that doesn't exist -- for example, "Received: from > > > > hostname.example.com []" or "Received: from hostname.example.com [not > an > > >IP > > > > in here]". > > > > > > > > If you were able to get the full headers of this E-mail, that would > > >provide > > > > a big clue as to what happened. > > > > > > > > The only problem this will cause is that the Declude will assume that > the > > > > E-mail is coming from 127.0.0.1. > > > > > > > > -Scott > > > > --- > > > > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers. > > > > Declude Virus: Catches known viruses and is the leader in mailserver > > > > vulnerability detection. > > > > Find out what you have been missing: Ask for a free 30-day evaluation. > > > > > > > > --- > > > > [This E-mail was scanned for viruses by Declude Virus > > >(http://www.declude.com)] > > > > > > > > --- > > > > This E-mail came from the Declude.JunkMail mailing list. To > > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > > at http://www.mail-archive.com. > > > > > >--- > > >[This E-mail was scanned for viruses by Declude Virus > > >(http://www.declude.com)] > > > > > >--- > > >This E-mail came from the Declude.JunkMail mailing list. To > > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > >type "unsubscribe Declude.JunkMail". The archives can be found > > >at http://www.mail-archive.com. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
