>That is a Virus! Could you help and be more specific. I run anti-virus for smtp and locally and have gotten the same type of message with out detection of a viri.
AV Software: Sophos SMTP (server) , McAfee Netshield for NT / 2000 (locally). ----- Original Message ----- From: "John Tolmachoff" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, November 08, 2001 6:54 PM Subject: RE: [IMail Forum] Weird e-mail/spam or virus That is a Virus! John Tolmachoff, Network Engineer 211 E. Imperial Hwy., Suite 106 Fullerton, CA 92835 714-578-7999, ext. 104 [EMAIL PROTECTED] [EMAIL PROTECTED] www.reliancesoft.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Thursday, November 08, 2001 12:13 PM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] Weird e-mail/spam or virus >I have received the enclosed e-mail a couple of times. I have several >rules to catch e-mails and for some reason this one gets caught...but I >cannot tell why. Is this a virus or spammer? If it is a spammer why would >they send the Message? First question, why did it get caught: That I can't answer without knowing what your rules are. Second question: Likely a spammer. "wantme69" sounds like a spammer's address, plus the "kwfdca" in the subject (a short string of random characters) is a common "signature" of spammers. Third question: If it is a spammer, it could simply be that they are harvesting E-mail addresses on your server using a poorly designed harvesting program; check the logs to see if there are huge amounts of "RCPT TO:"'s without many actual deliveries. >Received: from mail.stevenstransport.com [xx.xxx.x.xx] by >mail.stevenstransport.com >(SMTPD32-6.00) id AE949B033C; Mon, 05 Nov 2001 12:46:44 -0600 >Received: FROM ns2.ehostingtime.com BY mail.stevenstransport.com ; Mon Nov >05 12:46:42 2001 -0600 It sounds like the spam is coming from one of your servers, if you're blocking the IP address! -Scott --- Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for IMail. http://www.declude.com Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
