You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Dale Haman <dh...@umary.edu> on 2004/05/20 18:19:00 UTC
RE: How to interpret rejected message[Scanned by University of Mary Virus Scanner]
Here is the complete header information that I have. I believe it is
Postfix that is creating this because of the file attached to the
message. Midco.net is a local ISP to me so if I can help clean this
stuff off their network maybe it would improve the service quality I
have at home.
thread-index: AcQ+bDCUSQODkGLGSMyQ4OyPvzTytw==
Received: from rhspam.umary.edu ([10.10.32.29]) by mail.umary.edu with
Microsoft SMTPSVC(5.0.2195.6713); Thu, 20 May 2004 08:13:06 -0500
Received: from localhost (localhost.localdomain [127.0.0.1]) by
rhspam.umary.edu (Postfix) with ESMTP id 5041D7353D for
<vi...@umary.edu>; Thu, 20 May 2004 08:13:06 -0500 (CDT)
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409
Content-Type: text/plain;
charset="iso-8859-1"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
Date: Thu, 20 May 2004 08:13:06 -0500 (CDT)
From: <vi...@umary.edu>
Subject: BANNED NAME (.exe) FROM <In...@hotmail.com>[Scanned by
University of Mary Virus Scanner]
To: <vi...@umary.edu>
Message-ID: <VA...@rhspam.umary.edu>
Return-Path: <vi...@umary.edu>
X-OriginalArrivalTime: 20 May 2004 13:13:06.0489 (UTC)
FILETIME=[3088FA90:01C43E6C]
No viruses were found.
A banned name (.exe) was found.
The mail originated from: <In...@hotmail.com>
According to the 'Received:' trace, the message originated at:
info.com (host-77-27-220-24.midco.net [24.220.27.77])
The message WAS NOT delivered to:
<3D...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<Ga...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<JA...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<JS...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<Oh...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<Sp...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<To...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<ag...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<au...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<av...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<ca...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<ca...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<ce...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<da...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<dg...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<fr...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<gr...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<ho...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<in...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<ja...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<ja...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<jc...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<jo...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<kd...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<ke...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<la...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<le...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<ma...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<ne...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<re...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<re...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<re...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<re...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<re...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<re...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<re...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<re...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<re...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<re...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<re...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<re...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<re...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<ro...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<te...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<to...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<vi...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<we...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<we...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<wo...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
<xo...@umary.edu>:
550 5.7.1 Message content rejected, id=08719-01 - BANNED: .exe
The message has been quarantined as:
/var/virusmails/virus-20040520-081306-08719-01
------------------------- BEGIN HEADERS -----------------------------
Return-Path: <In...@hotmail.com>
Received: from info.com (host-77-27-220-24.midco.net [24.220.27.77])
by rhspam.umary.edu (Postfix) with SMTP id 7A71973523;
Thu, 20 May 2004 08:12:59 -0500 (CDT)
From: Info@hotmail.com
To: Mailing-Boxes@umary.edu
Date: Thu, 20 May 2004 12:39:59 UTC
Subject: FwD: Mailing Error (3291)
Importance: Normal
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
Message-ID: <97...@hotmail.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="======f4a54824ef4b.5e238"
Content-Transfer-Encoding: 7bit
-------------------------- END HEADERS ------------------------------
Dale
-----Original Message-----
From: Kevin Peuhkurinen [mailto:kevin.peuhkurinen@hepcoe.com]
Sent: Thursday, May 20, 2004 9:39 AM
To: Dale Haman
Cc: spamassassin-users@incubator.apache.org
Subject: Re: How to interpret rejected message[Scanned by University of
Mary Virus Scanner]
The only recieved headers you can trust are the ones that say that they
were recieved by a machine that is in your control. Any others can be
forged. You also want to believe only the IP address and possibly the
reverse DNS lookup provided by your mail server as the name provided in
the HELO can be forged as well.
Although you haven't provided entire header lines here, in your example
it looks like the mail originated from 24.220.xx.xx which has the
reverse DNS name of host-xx-xx-220-24.midco.net which is a dynamic
address hosted by the ISP midco.net.
Dale Haman wrote:
>Forgive me if this is not the right list for this. I am fairly new to
SA
>and linux email in general. My question is how to interpret a rejected
>message like this section for instance:
>
>The mail originated from: <In...@hotmail.com>
>
>According to the 'Received:' trace, the message originated at:
> info.com (host-XX-XX-220-24.midco.net [24.220.XX.XX])
>
>Which one did it actually come from? Hotmail or Midco.net? I have
>received many of these with several different " The mail originated
>from:" but the " According to the 'Received:' trace" is from the same
>address. Do I believe the originated from or the trace?
>
>I am running the configuration from this site:
>http://www.geocities.com/scottlhenderson/spamfilter.html
>
>postfix
>amavisd-new
>SpamAssassin (aka "SA")
>Razor
>
>
>Thanks for your help.
>Dale
>
>
>
Re: How to interpret rejected message[Scanned by University of Mary Virus Scanner]
Posted by Dan Wilder <da...@ssc.com>.
On Thu, May 20, 2004 at 11:19:00AM -0500, Dale Haman wrote:
> Here is the complete header information that I have. I believe it is
> Postfix that is creating this because of the file attached to the
> message. Midco.net is a local ISP to me so if I can help clean this
> stuff off their network maybe it would improve the service quality I
> have at home.
[ snip ]
These are the headers that need to be looked at.
> ------------------------- BEGIN HEADERS -----------------------------
Don't believe the following. It was inferred from other headers
by rhspam.umary.edu. Like all machine inferences, it is suspect.
> Return-Path: <In...@hotmail.com>
Believe the following. If you trust rhspam.umary.edu, which I presume
you do. "info.com" is who the host that sent the mail claimed to be.
Ihe IP number the mail was seen by rhspam.umary.edu to be coming from,
was 24.220.27.77. rhspam.umary.edu looked up a hostname for that
IP number in the DNS, yielding a listing of host-77-27-220-24.midco.net,
presumably a dynamic IP.
> Received: from info.com (host-77-27-220-24.midco.net [24.220.27.77])
> by rhspam.umary.edu (Postfix) with SMTP id 7A71973523;
> Thu, 20 May 2004 08:12:59 -0500 (CDT)
Don't believe the following. This was added by the host of origin
and is merely being passed on. It's the easiest sort of thing
to forge.
> From: Info@hotmail.com
Likewise, be sceptical about the following. Think of this one
as who the addressee is at the top of a business letter. It's
not necessarily who the letter was delivered to; that is set
by what's on the outside of the envelope. Sometimes the
so-called "envelope-sender" is preserved in a "Received:" header,
but not this time.
> To: Mailing-Boxes@umary.edu
> Date: Thu, 20 May 2004 12:39:59 UTC
> Subject: FwD: Mailing Error (3291)
> Importance: Normal
> X-Priority: 3 (Normal)
> X-MSMail-Priority: Normal
> Message-ID: <97...@hotmail.com>
> MIME-Version: 1.0
> Content-Type: multipart/mixed;
> boundary="======f4a54824ef4b.5e238"
> Content-Transfer-Encoding: 7bit
> -------------------------- END HEADERS ------------------------------
--
Dan Wilder