Email in inbox from unknown user apparently in my company????! Relay??

[Cat1]

Hi,

I got in this morning and there was an email in my inbox - no content & blank subject, however the 'from' was apparently from a user in my company - but it wasn't!

Below is the email header:

Is someone relaying to our email server from the outside????

Microsoft Mail Internet Headers Version 2.0
Received: from ISP server ([x.x.x.x]) by email server.domain.mydomain.com with Microsoft SMTPSVC(5.0.2195.6713);
Wed, 5 Nov 2003 09:25:31 +0000
Received: from [137.69.221.141] (helo=localhost)
by ISP server with smtp (Exim 4.24)
id 1AHJsx-0005LI-A6
for me@mydomain.com; Wed, 05 Nov 2003 09:23:34 +0000
From: james@mydomain.com
To: me <me@mydomain.com>
Reply-To: james@mydomain.com
Date: Wed, 05 Nov 2003 09:23:34 +0000
Return-Path: james@mydomain.com
X-OriginalArrivalTime: 05 Nov 2003 09:25:31.0921 (UTC) FILETIME=[C2668010:01C3A37E]

 

[paulha]

Mimail virus

see

http://theregister.co.uk/content/56/33721.html

Cheers

Paul

 

[Cat1]

Ah.

Nice.

Does that mean me or someone in my company is infected? or has our domain name been harvested from someone elses computer?

 

[paulha]

erm, not sure at the moment, we have the same problem here, Im busy looking into it (apart from doing 50 000 other things !)

Will keep you posted

Paul

 

[paulha]

http://www3.ca.com/virusinfo/virus.aspx?ID=37439

http://www3.ca.com/virusinfo/virus.aspx?ID=37466

http://www3.ca.com/virusinfo/virus.aspx?ID=37467

Not sure yet if it is a compromised pc within the domain, but the above seem to indicate not.

We also had a blank content and no subject email, have not been able to find any info on this variant yet.

 

[dpflkr]

Here is some information on that virus:

http://securityresponse.symantec.com/avcenter/venc/data/w32.mimail.c@mm.html

 

[baubaloo]

Do you know if it is possible to block the SMTP engine from sending email to the exchange server? By authentication or other means?

I'm going nuts because someone on my domain has the virus...

 

[xmsre]

Microsoft Mail Internet Headers Version 2.0
Received: from ISP server ([x.x.x.x]) by email server.domain.mydomain.com with Microsoft SMTPSVC(5.0.2195.6713);
Wed, 5 Nov 2003 09:25:31 +0000
Received: from [137.69.221.141] (helo=localhost)
by ISP server with smtp (Exim 4.24)
id 1AHJsx-0005LI-A6
for me@mydomain.com; Wed, 05 Nov 2003 09:23:34 +0000


Looks like it went from 137.69.221.141 to ISP server to server.domain.mydomain.com.

Is 137.69.221.141 on you local network?