But there is no user called "info" it is strictly a local group name. As far as I knew, No one is able to send on behalf of that group name. Even though I am as proactive and diligent as I can be, should I assume that someone on my network has a virus, and that is the cause?
No. Anyone on the Internet can send mail with a return address of "[EMAIL PROTECTED]" (at least until SPF starts to take off).
So that means that it could be a virus, it could be a spammer (many spammers use a return address on your domain, hoping that you made a mistake and whitelisted your domain), it could be a hacker, or even someone who accidentally used your address (perhaps a typo). It doesn't matter whether the "info" account is an alias, user, or local group -- that doesn't affect who can send mail with that address as a return address (just as you can put someone else's address or even a made-up address on the return address of a real envelope).
If you know the name of the virus, you can find out if it is a forging virus or not. If it is not, one of your users probably did send out the virus. If it is a forging virus, most likely it was not one of your users.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
