I'm now quite sure that it is caused by a clients PC virus, I use the specific email string to search the sys*.txt log, and found it come from 1 IP, I block this IP in my firewall, then this problem dispear, but the problem is from the IP I can not identify the clients PC name, because virus using forged PC name, and the IP is a ISP dynamic PC so I also can not find out who infected by which virus, but this virus should be a big headache to IMAIL users.
----- Original Message ----- From: "Mailing Lists" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, November 24, 2004 10:57 PM Subject: Re: [Declude.Virus] about Imail1.exe security issue > We had same issue, then mysteriously got fixed. > > Imail was aware of it as we had opened ticket. > > Everytime this would happen, the affected domain registry entry would have > some weird users and entries (dont recall exactly but if you search the > archives you will find the post). > > PV > > ----- Original Message ----- > From: "Mike Wiegers" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Wednesday, November 24, 2004 9:09 AM > Subject: RE: [Declude.Virus] about Imail1.exe security issue > > > > This is odd, odd because my server has this problem also and I called > > Ipswitch about it and they said that my server was the only one having the > > problems. It had it several months ago (and called) and then started again > > (and called). Those are the only calls to tech support in the past several > > years for my SA. I will read the posts to find out more about this. > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Serge > > Sent: Wednesday, November 24, 2004 7:05 AM > > To: [EMAIL PROTECTED] > > Subject: Re: [Declude.Virus] about Imail1.exe security issue > > > > we had the same issue few month ago > > i suspected problem from declude because the addresses that appear in the > > open imail1 window looked like ones that would be generated by declude > > notifications (or maybe imail gses ?) > > anyway, rebooting the server resolved the issue back then > > Unfortunatly, since upgrading to 8.13 (or 8.14, can't tell exactly, > > because > > i did both in less than 48 hours) the problem is coming again, and > > rebooting > > did not help this time. > > if you find a solution, let me know > > > > > > ----- Original Message ----- > > From: "Crejob.com" <[EMAIL PROTECTED]> > > To: <[EMAIL PROTECTED]> > > Sent: Wednesday, November 24, 2004 10:05 AM > > Subject: [Declude.Virus] about Imail1.exe security issue > > > > > >> My Imail server keep pop up a "Create Mail Message", it's > >> seems that Imail1.exe is exploit by someone to try send > >> out spam. > >> I try to limit the imail1.exe user permission, but this will > >> result the webmail can not send out email. > >> Any advice on how to solve this problem? > >> > >> Regards > >> Brian > >> > >> --- > >> [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > >> > >> --- > >> This E-mail came from the Declude.Virus mailing list. To > >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >> type "unsubscribe Declude.Virus". The archives can be found > >> at http://www.mail-archive.com. > >> > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
