Yep.. That would be my analysis also.. I have seen tons of these caught out on my mailgateway box.. The A/V out there is rounding em up and moving them out to the deleted bin... Makes for much nicer smoother running Exchange Box...
Bryce -----Original Message----- From: Aaron Brasslett [mailto:[EMAIL PROTECTED] Sent: Wednesday, May 26, 2004 11:20 AM To: Exchange Discussions Subject: RE: [EMAIL PROTECTED] These are likely NDRs to messages sent by the Win32.Sober.G worm with an address on your system that has forged the reply-to or from address of the message. -----Original Message----- From: Fred [mailto:[EMAIL PROTECTED] Sent: Wednesday, May 26, 2004 11:55 AM To: Exchange Discussions Subject: [EMAIL PROTECTED] Something freaky going on in my exchange org. We have "3D" attached to the front of valid email addresses. When I first saw it, I was not too heavily concerned, but at I dug through my mail logs, I see hundreds almost thousands a day coming in and going out. E5.5 on NT sp6 (patched and updated), not relaying, SA on front of Exchange, Trend is scanning. It looks like just a bunch of spam, and I kind of verified that when I searched google on it. Any suggestions on what this might be and how to put it to a halt? Anyone else experience this? I also researched a little on the Trend site to try and locate a worm that would do this but no luck. Thanks in advance, --Fred _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe send a blank email to %%email.unsub%% Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe send a blank email to %%email.unsub%% Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
