i think thats not by a clients PC virus. i got just right the ip using the imail1.exe to existing and no existing users (217.255.255.100) searching the log*.txt
itsd using different pc names ....
sorry about this post, because this is not a declude issue....
marc
At 16:45 24.11.2004, you wrote:
>I'm now quite sure that it is caused by a clients PC virus,
>I use the specific email string to search the sys*.txt log,
>and found it come from 1 IP,
>I block this IP in my firewall, then this problem dispear,
>but the problem is from the IP I can not identify the
>clients PC name, because virus using forged PC name,
>and the IP is a ISP dynamic PC
>so I also can not find out who infected by which virus,
>but this virus should be a big headache to IMAIL users.
>
>
>
>
>----- Original Message -----
>From: "Mailing Lists" <[EMAIL PROTECTED]>
>To: <[EMAIL PROTECTED]>
>Sent: Wednesday, November 24, 2004 10:57 PM
>Subject: Re: [Declude.Virus] about Imail1.exe security issue
>
>
>> We had same issue, then mysteriously got fixed.
>>
>> Imail was aware of it as we had opened ticket.
>>
>> Everytime this would happen, the affected domain registry entry would have
>> some weird users and entries (dont recall exactly but if you search the
>> archives you will find the post).
>>
>> PV
>>
>> ----- Original Message -----
>> From: "Mike Wiegers" <[EMAIL PROTECTED]>
>> To: <[EMAIL PROTECTED]>
>> Sent: Wednesday, November 24, 2004 9:09 AM
>> Subject: RE: [Declude.Virus] about Imail1.exe security issue
>>
>>
>> > This is odd, odd because my server has this problem also and I called
>> > Ipswitch about it and they said that my server was the only one having
>the
>> > problems. It had it several months ago (and called) and then started
>again
>> > (and called). Those are the only calls to tech support in the past
>several
>> > years for my SA. I will read the posts to find out more about this.
>> >
>> > -----Original Message-----
>> > From: [EMAIL PROTECTED]
>> > [mailto:[EMAIL PROTECTED] On Behalf Of Serge
>> > Sent: Wednesday, November 24, 2004 7:05 AM
>> > To: [EMAIL PROTECTED]
>> > Subject: Re: [Declude.Virus] about Imail1.exe security issue
>> >
>> > we had the same issue few month ago
>> > i suspected problem from declude because the addresses that appear in
>the
>> > open imail1 window looked like ones that would be generated by declude
>> > notifications (or maybe imail gses ?)
>> > anyway, rebooting the server resolved the issue back then
>> > Unfortunatly, since upgrading to 8.13 (or 8.14, can't tell exactly,
>> > because
>> > i did both in less than 48 hours) the problem is coming again, and
>> > rebooting
>> > did not help this time.
>> > if you find a solution, let me know
>> >
>> >
>> > ----- Original Message -----
>> > From: "Crejob.com" <[EMAIL PROTECTED]>
>> > To: <[EMAIL PROTECTED]>
>> > Sent: Wednesday, November 24, 2004 10:05 AM
>> > Subject: [Declude.Virus] about Imail1.exe security issue
>> >
>> >
>> >> My Imail server keep pop up a "Create Mail Message", it's
>> >> seems that Imail1.exe is exploit by someone to try send
>> >> out spam.
>> >> I try to limit the imail1.exe user permission, but this will
>> >> result the webmail can not send out email.
>> >> Any advice on how to solve this problem?
>> >>
>> >> Regards
>> >> Brian
>> >>
>> >> ---
>> >> [This E-mail was scanned for viruses by Declude Virus
>> > (http://www.declude.com)]
>> >>
>> >> ---
>> >> This E-mail came from the Declude.Virus mailing list. To
>> >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> >> type "unsubscribe Declude.Virus". The archives can be found
>> >> at http://www.mail-archive.com.
>> >>
>> >
>> >
>> > ---
>> > [This E-mail was scanned for viruses by Declude Virus
>> > (http://www.declude.com)]
>> >
>> > ---
>> > This E-mail came from the Declude.Virus mailing list. To
>> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> > type "unsubscribe Declude.Virus". The archives can be found
>> > at http://www.mail-archive.com.
>> >
>> >
>> > ---
>> > [This E-mail was scanned for viruses by Declude Virus
>> > (http://www.declude.com)]
>> >
>> > ---
>> > This E-mail came from the Declude.Virus mailing list. To
>> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> > type "unsubscribe Declude.Virus". The archives can be found
>> > at http://www.mail-archive.com.
>>
>>
>> ---
>> [This E-mail was scanned for viruses by Declude Virus
>(http://www.declude.com)]
>>
>> ---
>> This E-mail came from the Declude.Virus mailing list. To
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> type "unsubscribe Declude.Virus". The archives can be found
>> at http://www.mail-archive.com.
>>
>
>---
>[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
>
>---
>This E-mail came from the Declude.Virus mailing list. To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.Virus". The archives can be found
>at http://www.mail-archive.com.
>
>[Scanned for viruses by Declude Virus]
[Scanned for viruses by Declude Virus]
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
