🚀 go-pugleaf

Znają IP nadawcy wirusa, wiedzą, że sender address may be forged a mimo to 
ładują powiadomienia:
==========
>From filter@mailserv3.cps.pl  Mon Mar  8 09:24:14 2004
Return-Path: <filter@mailserv3.cps.pl>
Received: from mailserv3.cps.pl (mailserv3.cps.pl [195.116.244.12])
        by xxxxxxx (8.12.10/8.12.10) with SMTP id i288OEi7008308
        for <root@xxxxxxxxx>; Mon, 8 Mar 2004 09:24:14 +0100
Received: (qmail 2288 invoked by uid 89); 8 Mar 2004 08:23:47 -0000
Date: 8 Mar 2004 08:23:46 -0000
Message-ID: <20040308082346.2276.qmail@mailserv3.cps.pl>
From: "DrWeb-DAEMON" <filter@mailserv3.cps.pl>
To: root@xxxxxxxxxx
Subject: Undelivered mail:  Re: Your bill
Content-Type: multipart/mixed;
 boundary="001-DrWeb-MailFilter-Notification"
MIME-Version: 1.0
X-IMAPbase: 1078738258 1
Status: RO
X-Status: A
X-Keywords:
X-UID: 1

Dear User,

the message with following attributes has not been delivered,
because contains an infected object.

Sender = root@xxxxxxxxx (may be forged)
Recipients = transport(adres_niewinny)intrasped.pl
Subject =  Re: Your bill
Message-ID = [unknown-id]

Antivirus filter report:
--- Dr.Web report ---
Following virus(es) has been found:
infected with Win32.HLLM.Netsky.based

Dr.Web detailed report:
drweb.tmp.Tz2215/[text/plain] - Ok
drweb.tmp.Tz2215/your_bill.pif infected with Win32.HLLM.Netsky.based

Dr.Web scanning statistic:
Infected : 1

--001-DrWeb-MailFilter-Notification
Content-Type: text/plain

Received: from unknown (HELO intrasped.pl) (80.55.238.114)
  by 0 with SMTP; 8 Mar 2004 08:23:40 -0000
From: root@xxxxxxxxxx
To: transport(adres_niewinny)intrasped.pl
Subject: Re: Your bill
Date: Mon, 8 Mar 2004 09:24:06 +0100
MIME-Version: 1.0
Content-Type: multipart/mixed;
        boundary="----=_NextPart_000_0001_00003B2F.00007FFF"
X-Priority: 3
X-MSMail-Priority: Normal

--001-DrWeb-MailFilter-Notification--