It's the work of a trojan.
http://www.symantec.com/avcenter/venc/data/trojan.ascetic.a.html
Troy D. Hilton wrote:
Hello All,
I've got a couple client's that recently have been flooded with this German-looking spam. Here's some of the header info:
Received: from SMTP32-FWD by registermeonline.net
(SMTP32) id A00000F9C; Thu, 17 Jun 2004 15:30:18 -0400
Received: from SMTP32-FWD by asert-llc.com
(SMTP32) id A00000EB8; Thu, 17 Jun 2004 15:30:17 -0400
Received: from iittyk.com [24.107.202.33] by twinstar.com
(SMTPD32-7.15) id A13FA840340; Thu, 17 Jun 2004 15:30:07 -0400
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Date: Thu, 17 Jun 2004 18:38:27 GMT
MIME-Version: 1.0
Subject: Geschrieben von Margrit am 07. April 2004 :Id:4138:
Importance: Normal
X-Priority: 3 (Normal)
Message-ID: <[EMAIL PROTECTED]>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"
X-RBL-Warning: HELOBOGUS: Domain iittyk.com has no MX or A records [0301]. [2-8-4000]
X-Declude-Sender: [EMAIL PROTECTED] [24.107.202.33]
X-Note: This E-mail was scanned by Declude JunkMail (_www.declude.com_ <file://www.declude.com>) for spam.
X-Spam-Tests-Failed: HELOBOGUS
Status: U
X-UIDL: 383254604
Now, the email this was sent to, "JANETGREEN5005" is bogus but asert-llc.com is legit. Has anyone else seen this? Any suggestions on blocking this? My thinking is that some's system is infected somewhere and his name is on their mailing list, but I have no proof.
Troy D. Hilton *SofWerks LLC.* [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> 302-529-1961
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
