Re: [cobalt-users] [RaQ3i] spam-relay!?

["Brian Curtis" <admin@xxxxxxxxxxx>]

> Hey folks,
>
> I'm getting a report from one of my client subdomains on my server that
> he's receiving weird emails from somebody, with my server's main
> domain-name tacked on ala:
>
> From: "Hahaha" <hahaha@xxxxxxxxxxxxxxxxxxxxxxxx>
<mailto:hahaha@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
> What could be going on here?  I looked through the maillog for the day
> in question when this was sent/recieved, but couldn't dredge up any
> "sexyfun.net" domain from all the lines...
>
> How can I best tell if I am being used as a spam relay?
>
> Thanks much all,
>
> ~ Theo


Have your client forward you the entire message including all headers and
take a look.  Chances are that it's just a spoofed "From:" address to make
it look like it's originating from your server.

On another note, **DO NOT** open the attachment included with the message.
It's the W32.Hybris virus.

Just to be safe, I'd run a virus check on all your WIN32 based workstations
which send/receive email on your server just to make sure one of them is not
infected.

--
Brian Curtis