Koozali.org: home of the SME Server

infected emails

Carsten

infected emails
« on: August 20, 2003, 12:14:57 PM »
Hey

Can somebody please tell me what to do.


I have run SME 6.0 beta3 for 3 weeks now
and get this email serval times with different names (bhnbgkwg)
my Norton Virus stop the mail and give me this

"Norton AntiVirus removed the attachment: message.zip.
The attachment was infected with the W32.Mimail.A@mm virus."

It says the mail sender is admin@mydomain.dk and sends to another
in my domain.

The mail text is:

Hello there,

I would like to inform you about important information regarding your
email address. This email address will be expiring.
Please read attachment for details.

---
Best regards, Administrator
bhnbgkwg

Kelvin

Re: infected emails
« Reply #1 on: August 20, 2003, 03:11:57 PM »
Hi,

That's how the Mimail virus works.

You can't stop people sending you viruses. You just need to keep your AV software up to date to keep them at bay. Alternatively, install an AV software at the server to filter the mails before they get to your desktop.

The virus is NOT coming from your server. The Mimail virus always appears to be coming from the admin of your domain.

Kelvin

Bill Talcott

Re: infected emails
« Reply #2 on: August 21, 2003, 02:34:12 AM »
Kelvin wrote:
>
> The virus is NOT coming from your server. The Mimail virus
> always appears to be coming from the admin of your domain.

Kelvin's right. The "from" address is spoofed. It always says it's from "admin@yourdomain.com".

http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100523

Mike

Re: infected emails
« Reply #3 on: August 22, 2003, 06:11:11 AM »
try ClamD and Amavis antivirus, www.pagefault.org

Joop

Re: infected emails
« Reply #4 on: August 23, 2003, 12:16:39 PM »
Is this package confirmed worling with the 6b2?