Re: w32.mimail.a@mm Question

Most of these worms are not complex enough to spoof the senders IP as well. Although if you do try and trace it the likelihood is that you will stumble across an IP address that is assigned to an ISP and therefore will never really find the location of the email origin.

If the email you received from admin@<your domain> and came through the gateway then I am extremely confident that the worm has not infected your internal network.

On 05/08/2003 19:15:16 Daan van de Linde wrote:

>-----BEGIN PGP SIGNED MESSAGE-----

>
>You can attempt to find the source Ip through the email headers,
I
>> might be a good target and sent me an email from admin@<my domain>
>>
>> now my question, is someone on my network infected or could this be an
>> external source trying to infect us?
>>
>> I have added the string "admin@jhbchev.co.za REJECT" in the
>> /etc/mail/access file to try to stop this email from being passed on to
the
>> account holder in the "To" field.
>> Will the above work?
>>
>> I am also busy running "tail -f /var/log/maillog |grep
admin@jhbchev.co.za"
>> to try to monitor if & when it tries again.
>>
>> Kind regards
>>
>> Colin van Niekerk

>>
>>
>>
>-----BEGIN PGP SIGNATURE-----

>----------------------------------------------------------------------------

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

>

--
Matthew Barrow, Technical Support Assistant, Sophos Anti-Virus
Email: support@sophos.com, Tel: 01235 559933, Web: www.sophos.com
Add live virus info to your website: 
http://www.sophos.com/link/vfeed



---------------------------------------------------------------------------
----------------------------------------------------------------------------