Dodgy returned e-mails

[DAVE BRENNAND]

In the last couple of days I've recieved probably 200 e-mails headlined Delivery Failure or Returned Mail or Postmaster Undeliverable Mail all adressed to someone I've never heard of.
Is this a scam or is it anything to do with my outgoing e-mail system?

Help for the thick PC user please!

[meeja]

Someone spoofing your email address for spamming purposes, and you get the failed delivery reports at a guess.

If you post up the entire contents of one of the reports, after replacing any possible sensitive text with XXXX or similar, I'm sure someone with a little more knowledge about this stuff than me will give a definitive answer.....

[docevi1]

Meeja will be right there. Spammers generally spoof someone elses address so when an email fails/is rejected you see the mail delivery report. In theory it shouldn't go on for much longer.

[zumbruk]

It's a worm. They aren't actually returned emails - the header info is forged. The attachment you're asked to look at is a zipped executeable containing the worm payload.

I've had 2 or 3 hundred of them the last few weeks, but it doesn't work too well on a Sun Unix box.

[DAVE BRENNAND]

Meeja and all, thanks here is the content in full of just one of them, they're all different.


-----

This message was created automatically by mail delivery software (Exim).

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

[e-mail]
unknown local-part "wagner" in domain "cyberec.com"

------ This is a copy of the message, including all the headers. ------

Return-path: <[e-mail]>
Received: from localhost ([127.0.0.1] helo=netra2.cyberec.com)
by netra2.cyberec.com with esmtp (Exim 3.36 #1)
id 1EAPPZ-0001il-00
for [e-mail]; Wed, 31 Aug 2005 18:01:41 +0800
Received: from [220.74.177.244] (helo=d-comm.com)
by netra2.cyberec.com with smtp (Exim 3.36 #1)
id 1EAPPY-0001ii-00
for [e-mail]; Wed, 31 Aug 2005 18:01:41 +0800
From: "Brandie Chase" <[e-mail]>
To: "Samira Sedillo" <[e-mail]>
Subject: =?iso-8859-1?Q?Re:_wq8_My_New_Life_V=CFAGRRA?=
Date: Wed, 31 Aug 2005 05:01:39 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_005F_01C5ADE9.11F23B80"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Autobahn qm 5.10
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Message-Id: <[e-mail]>
X-CyberAntiVirus-MailScanner-Information: Please contact the ISP for more information
X-CyberAntiVirus-MailScanner: Found to be clean

This is a multi-part message in MIME format.

------=_NextPart_000_005F_01C5ADE9.11F23B80
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

suffered for so long, and saw in the blazing window Natashas face distorted =
Behemoth, brandished it, tore the foreigners hat off with his left hand, =
`Good heavens, the procurator exclaimed, smiling, `theres no more their place =
on Sadovaya. He set about this analysing in a rather strange manner - namely, =
by with outstretched arms. saying, not found in the Gospels, is of great =
thematic importance for the efficient, quick, and there is no service she =
cannot render. shouted, and his cracked voice carried over thousands of =
heads: bearing the image of an unknown saint pinned to the breast of it with =
a around him had vanished altogether. The hated city died, and he alone is =
time you swore by it, since its hanging by a hair, I can tell you. Rimsky =
suddenly reached out and, as if mechanically, tapping his market-place a long =
citizen in a checkered suit, and with him a big black This was all very good, =
but the more terrible was the hegemons 7. Frieda: Her story is reminiscent of =
that of Gretchen in Faust. B. V.

------=_NextPart_000_005F_01C5ADE9.11F23B80
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2800.1106" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV> </DIV><DIV><FONT face=3DArial><TABLE cellPadding=3D0 border=3D0 =
cellSpacing=3D0><TR vAlign=3Dbottom><TD rowSpan=3D2>Good day, Welcome to The =
One Of</TD><TD></TD><TD rowSpan=3D2>armaceutical s</TD><TD></TD></TR><TR>=
<TD> The Leadi<FONT face=3DArial color=3D#ffffff>.</FONT>ng onIine =
ph</TD><TD>hops</TD></TR></TABLE></FONT></DIV><DIV> </DIV><DIV><FONT =
face=3DArial><TABLE cellPadding=3D0 border=3D0 cellSpacing=3D0><TR =
vAlign=3Dbottom><TD rowSpan=3D2>SA</TD><TD></TD><TD rowSpan=3D2>er =
60</TD><TD></TD><TD rowSpan=3D2>our pharmac</TD><TD></TD><TD rowSpan=3D2>=
 Sh</TD><TD></TD></TR><TR><TD>VE Ov</TD><TD>% on y</TD><TD>y with <A =
href=3D"www.tfegil.com.asiprisurge.com"><FONT face=3DArial =
color=3D#ffffff>d</FONT>Pharrmaccy By Ma.iI<FONT face=3DArial =
color=3D#ffffff>o</FONT></A></TD><TD>op</TD></TR></TABLE></FONT></DIV><DI=
V> </DIV><DIV><FONT face=3DArial><TABLE cellSpacing=3D0 border=3D0 =
cellPadding=3D0><TR vAlign=3Dbottom><TD rowSpan=3D2>VALlU</TD><TD></TD><TD =
rowSpan=3D2>lS VlAG</TD><TD></TD><TD rowSpan=3D2>any other me</TD><TD>=
</TD></TR><TR><TD>M ClAL</TD><TD>RA and m</TD><TD>ddications</TD></TR><=
/TABLE></FONT></DIV></BODY></HTML>

------=_NextPart_000_005F_01C5ADE9.11F23B80--

[Size Nine Elm]

Yup, its another 'get your pharmaceuticals here' spam been sent out using your domain as a return address, so all the bounced emails come back to you - I had that happen to me a few months ago, but luckily no fallout.

Just delete and ignore...

[zumbruk]

What he said - it isn't a worm... (What happened to my original posting, he asks?)

[DAVE BRENNAND]

DAVE BRENNAND said:

In the last couple of days I've recieved probably 200 e-mails headlined Delivery Failure or Returned Mail or Postmaster Undeliverable Mail all adressed to someone I've never heard of. Is this a scam or is it anything to do with my outgoing e-mail system? Help for the thick PC user please!

Me again,
I'm now getting around 1200 of these bloody things a day.
Who do I kill to stop them coming thro??????????????

[.Flyer]

Sadly, I have exactly the same problem, as posted here. Real pain in the arse

[zumbruk]

Other than running a good spam filter that can filter them out, there's very little you can do about this, other than wait until it stops.

[fish]

If you run your own mail server just reject unknown users and they will not be downloaded.