strange qmail actions

From: Gerrit Scherpenzeel (n.scherpenzeelat_private)
Date: Tue Jun 12 2001 - 01:16:57 PDT


Hi,

I'm seeing strange things happening with our qmail server.
All the time it sends failure notices.

I tried to deliver a bounce message to this address, but the bounce bounced!

[..

<^=z^=l^x03x^=^x9cE^=:v^x06^=R@^=9^=sS^=E%^=C^=H^=3S^=H^x05^=U^=PA^=D^x0c.^=
V^=6Y>:
Sorry, I couldn't find any host named
^=9^=sS^=E%^=C^=H^=3S^=H^x05^=U^=PA^=D^x0c.^=V^=6Y. (#5.1.2)

--- Below this line is the original bounce.

Return-Path: <>
Received: (qmail 16858 invoked by uid 8); 12 Jul 1996 08:50:28 -0000
Date: 12 Jul 1996 08:50:28 -0000
Message-ID: <19960712085028.16857.qmailat_private>
From: anonymousat_private
Cc: recipient list not shown: ;
Received: from pc-00004.kramer.ath.cx (10.0.0.4, claiming to be "lo")
by gateway.kramer.ath.cx with SMTP id smtpdwsiFM3; Fri, 12 Jul 1996 04:50:21
EDT
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="--VEHAROPAJO1A7KLYBGXUN8H"

----VEHAROPAJO1A7KLYBGXUN8H
Content-Type: text/plain; charset="us-ascii"



----VEHAROPAJO1A7KLYBGXUN8H
Content-Type: application/octet-stream; name="MLJAJCML.EXE"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="MLJAJCML.EXE"

..]

Or something like this.

Sounds like a outlook virus to me, but why these strange mail adresses?

Gerrit



----------------------------------------------------------------------------


This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see:

http://aris.securityfocus.com



This archive was generated by hypermail 2b30 : Thu Jul 12 2001 - 11:24:24 PDT