Koozali.org: home of the SME Server

Legacy Forums => General Discussion (Legacy) => Topic started by: Carsten on August 20, 2003, 12:14:57 PM

Title: infected emails
Post by: Carsten on August 20, 2003, 12:14:57 PM

Hey

Can somebody please tell me what to do.


I have run SME 6.0 beta3 for 3 weeks now
and get this email serval times with different names (bhnbgkwg)
my Norton Virus stop the mail and give me this

"Norton AntiVirus removed the attachment: message.zip.
The attachment was infected with the W32.Mimail.A@mm virus."

It says the mail sender is admin@mydomain.dk and sends to another
in my domain.

The mail text is:

Hello there,

I would like to inform you about important information regarding your
email address. This email address will be expiring.
Please read attachment for details.

---
Best regards, Administrator
bhnbgkwg

Title: Re: infected emails
Post by: Kelvin on August 20, 2003, 03:11:57 PM

Hi,

That's how the Mimail virus works.

You can't stop people sending you viruses. You just need to keep your AV software up to date to keep them at bay. Alternatively, install an AV software at the server to filter the mails before they get to your desktop.

The virus is NOT coming from your server. The Mimail virus always appears to be coming from the admin of your domain.

Kelvin

Title: Re: infected emails
Post by: Bill Talcott on August 21, 2003, 02:34:12 AM

Kelvin wrote:
>
> The virus is NOT coming from your server. The Mimail virus
> always appears to be coming from the admin of your domain.

Kelvin's right. The "from" address is spoofed. It always says it's from "admin@yourdomain.com".

http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100523

Title: Re: infected emails
Post by: Mike on August 22, 2003, 06:11:11 AM

try ClamD and Amavis antivirus, www.pagefault.org

Title: Re: infected emails
Post by: Joop on August 23, 2003, 12:16:39 PM

Is this package confirmed worling with the 6b2?