Thank you! I figured it as such. Now it's a question of who's computer is infected.
Troy D. Hilton SofWerks LLC. [EMAIL PROTECTED] -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Friday, June 18, 2004 9:13 AM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] Slightly OT: need help stopping "German-ish" emails It's the work of a trojan. http://www.symantec.com/avcenter/venc/data/trojan.ascetic.a.html Troy D. Hilton wrote: > Hello All, > > I've got a couple client's that recently have been flooded with this > German-looking spam. Here's some of the header info: > > Received: from SMTP32-FWD by registermeonline.net > (SMTP32) id A00000F9C; Thu, 17 Jun 2004 15:30:18 -0400 > Received: from SMTP32-FWD by asert-llc.com > (SMTP32) id A00000EB8; Thu, 17 Jun 2004 15:30:17 -0400 > Received: from iittyk.com [24.107.202.33] by twinstar.com > (SMTPD32-7.15) id A13FA840340; Thu, 17 Jun 2004 15:30:07 -0400 > From: [EMAIL PROTECTED] > To: [EMAIL PROTECTED] > Date: Thu, 17 Jun 2004 18:38:27 GMT > MIME-Version: 1.0 > Subject: Geschrieben von Margrit am 07. April 2004 :Id:4138: > Importance: Normal > X-Priority: 3 (Normal) > Message-ID: <[EMAIL PROTECTED]> > Content-Transfer-Encoding: 7bit > Content-Type: text/plain; charset="us-ascii" > X-RBL-Warning: HELOBOGUS: Domain iittyk.com has no MX or A records > [0301]. [2-8-4000] > X-Declude-Sender: [EMAIL PROTECTED] [24.107.202.33] > X-Note: This E-mail was scanned by Declude JunkMail (_www.declude.com_ > <file://www.declude.com>) for spam. > X-Spam-Tests-Failed: HELOBOGUS > Status: U > X-UIDL: 383254604 > > Now, the email this was sent to, "JANETGREEN5005" is bogus but > asert-llc.com is legit. Has anyone else seen this? Any suggestions on > blocking this? My thinking is that some's system is infected somewhere > and his name is on their mailing list, but I have no proof. > > Troy D. Hilton > *SofWerks LLC.* > [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> > 302-529-1961 > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ -------------- [This E-mail scanned for viruses by Declude Virus] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
