RE: FW: [MailServer Notification]To Sender file blocking settings matched and action taken.
- From: "John Tolmachoff \(Lists\)" <johnlist@xxxxxxxxxxxxxxxxxxx>
- To: "'[ISAserver.org Discussion List]'" <isalist@xxxxxxxxxxxxx>
- Date: Fri, 15 Apr 2005 14:50:08 -0700
It's acting like a Bagle variant, like the one that came out yesterday.
I have not received any notice yet from Sophos or Symantec.
John T
eServices For You
> -----Original Message-----
> From: Steve Moffat [mailto:steve@xxxxxxxxxx]
> Sent: Friday, April 15, 2005 2:44 PM
> To: [ISAserver.org Discussion List]
> Subject: [isalist] RE: FW: [MailServer Notification]To Sender file
blocking settings
> matched and action taken.
>
> http://www.ISAserver.org
>
> Anyone named it yet??
>
> -----Original Message-----
> From: John Tolmachoff (Lists) [mailto:johnlist@xxxxxxxxxxxxxxxxxxx]
> Sent: Friday, April 15, 2005 6:41 PM
> To: ISA Mailing List
> Subject: [isalist] RE: FW: [MailServer Notification]To Sender file
> blocking settings matched and action taken.
>
> http://www.ISAserver.org
>
> To all, please note:
>
> There is a new fast spreading virus apparently out within the last 2
> hours.
> It is forging the from address (as normal) and a lot of systems are
> bouncing back to that forged from address.
>
> John T
> eServices For You
>
>
> > -----Original Message-----
> > From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx]
> > Sent: Friday, April 15, 2005 2:20 PM
> > To: [ISAserver.org Discussion List]
> > Cc: administrator@xxxxxxxxxxxxxxxxx
> > Subject: [isalist] FW: [MailServer Notification]To Sender file
> > blocking
> settings
> > matched and action taken.
> >
> > http://www.ISAserver.org
> >
> > OK - whoever uses operates from smoothrunning.ca better get their sh^t
>
> > together before I block that IP.
> > I now have 65 of these in my junk mail.
> >
> > Headers:
> > Microsoft Mail Internet Headers Version 2.0
> > Received: from exchange.smoothrunnings.ca ([69.159.202.158]) by
> > mail.jalojash.org with Microsoft SMTPSVC(6.0.3790.211);
> > Fri, 15 Apr 2005 13:57:15 -0700
> > Received: from mail pickup service by exchange.smoothrunnings.ca with
> > Microsoft SMTPSVC;
> > Fri, 15 Apr 2005 16:59:08 -0400
> > thread-index: AcVB/fd6+UYtc6CgQi+PRJgJRjcbdw==
> > Thread-Topic: [MailServer Notification]To Sender file blocking
> > settings matched and action taken.
> > From: <Administrator>
> > Sender: <Administrator>
> > To: <Jim@xxxxxxxxxxxx>
> > Subject: [MailServer Notification]To Sender file blocking settings
> > matched and action taken.
> > Date: Fri, 15 Apr 2005 16:59:08 -0400
> > Message-ID: <006201c541fd$f77aaaf0$0301a8c0@xxxxxxxxxxxxxxxxx>
> > MIME-Version: 1.0
> > Content-Type: text/plain;
> > charset="utf-8"
> > Content-Transfer-Encoding: 7bit
> > X-Mailer: Microsoft CDO for Exchange 2000
> > Content-Class: urn:content-classes:message
> > Importance: normal
> > Priority: normal
> > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
> > X-OriginalArrivalTime: 15 Apr 2005 20:59:08.0462 (UTC)
> > FILETIME=[F77CF4E0:01C541FD]
> > Return-Path: Administrator@xxxxxxxxxxxxxxxxx
> >
> > -------------------------------------------------------
> > Jim Harrison
> > MCP(NT4, W2K), A+, Network+, PCG
> > http://isaserver.org/Jim_Harrison/
> > http://isatools.org
> > Read the help / books / articles!
> > -------------------------------------------------------
> >
> >
> > -----Original Message-----
> > From: Administrator [mailto:Administrator]
> > Sent: Friday, April 15, 2005 13:59
> > To: Jim Harrison
> > Subject: [MailServer Notification]To Sender file blocking settings
> > matched and action taken.
> >
> > ScanMail for Microsoft Exchange has blocked an attachment.
> >
> > Sender = Jim Harrison
> > Recipient(s) = [ISAserver.org Discussion List] Subject = ISA Server
> > 2000 SP2 and Windows 2003 SP1 VPN issues Scanning time = 15/04/2005
> > 4:59:08 PM
> >
> > Action on file blocking:
> > The attachment ATT00385.txt matches the file blocking settings.
> > ScanMail has Quarantined it. The attachment was quarantined to
> > C:\Program Files\Trend\Smex\Alert\ATT0038542602b1ca4.txt_.
> >
> > Warning to Sender: Action taken by attachment blocking.
> >
> > All mail to and from this domain is GFI-scanned.
> >
> >
> > ------------------------------------------------------
> > List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
> > ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> > ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
> > ------------------------------------------------------
> > Other Internet Software Marketing Sites:
> > World of Windows Networking: http://www.windowsnetworking.com Leading
> > Network Software Directory: http://www.serverfiles.com
> > No.1 Exchange Server Resource Site: http://www.msexchange.org Windows
> > Security Resource Site: http://www.windowsecurity.com/ Network
> > Security Library: http://www.secinf.net/ Windows 2000/NT Fax
> > Solutions: http://www.ntfaxfaq.com
> > ------------------------------------------------------
> > You are currently subscribed to this ISAserver.org Discussion List as:
> > johnlist@xxxxxxxxxxxxxxxxxxx
> > To unsubscribe visit
> > http://www.webelists.com/cgi/lyris.pl?enter=isalist
> > Report abuse to listadmin@xxxxxxxxxxxxx
>
>
> ------------------------------------------------------
> List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
> ------------------------------------------------------
> Other Internet Software Marketing Sites:
> World of Windows Networking: http://www.windowsnetworking.com Leading
> Network Software Directory: http://www.serverfiles.com
> No.1 Exchange Server Resource Site: http://www.msexchange.org Windows
> Security Resource Site: http://www.windowsecurity.com/ Network Security
> Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions:
> http://www.ntfaxfaq.com
> ------------------------------------------------------
> You are currently subscribed to this ISAserver.org Discussion List as:
> isalist@xxxxxxxxxx To unsubscribe visit
> http://www.webelists.com/cgi/lyris.pl?enter=isalist
> Report abuse to listadmin@xxxxxxxxxxxxx
>
> The haggis is unusual in that it is neither consistently nocturnal nor
diurnal, but
> instead is active at dawn and dusk (crepuscular), with occasional forays
forth during
> the day and night.
>
>
>
> ------------------------------------------------------
> List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
> ------------------------------------------------------
> Other Internet Software Marketing Sites:
> World of Windows Networking: http://www.windowsnetworking.com
> Leading Network Software Directory: http://www.serverfiles.com
> No.1 Exchange Server Resource Site: http://www.msexchange.org
> Windows Security Resource Site: http://www.windowsecurity.com/
> Network Security Library: http://www.secinf.net/
> Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
> ------------------------------------------------------
> You are currently subscribed to this ISAserver.org Discussion List as:
> johnlist@xxxxxxxxxxxxxxxxxxx
> To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist
> Report abuse to listadmin@xxxxxxxxxxxxx
Other related posts:
