That would be my guess. Since it is claiming to be the MAILER-DAEMON account at your domain, it is either a virus or other malicious E-mail (assuming that you do not have such an account set up that would bounce mail). Also, given the poorly designed headers, it looks like it was an actual virus pretending to be a bounce message.There are a few viruses that apparently pretend to send bounce messages. "MAILER-DAEMON" is a term primarily used by Unix mailservers to refer to the process that bounces E-mails.Since the ip mentioned in the warnings is not part of my WAN, and since my Declude is warning me of an *outgoing* virus, I'm guessing the cause would be your first possibility. In which case he must be using a home computer which now needs to be scanned. If the cause was your second possibility, then (in my case) Declude would not notify me of an outgoing virus, but an incoming one.
Another possibility is that someone sent out a virus with your user's return address, addressed to a non-existent user. The mail then may have legitimately bounced, and gone to your user.
Am I understanding you correctly?
-Scott
---
Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for IMail. http://www.declude.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
