Very strange, possibly virus

[MattWray]

I got a message forwarded to me that is soemthing I have not seen before, please review and see what everyone thinks:

-----Original Message-----
From: System Administrator
Sent: Sunday, May 16, 2004 11:43 AM
To: jrr+AEA-sss-steel.com+ADs- jsaponari+AEA-sss-steel.com+ADs- juliebj+AEA-sss-steel.com+ADs- kamarlabs+AEA-sss-steel.com+ADs- laurendvm+AEA-sss-steel.com+ADs- lazyw+AEA-sss-steel.com+ADs- ldgstn+AEA-sss-steel.com+ADs- libertycreeklabs+AEA-sss-steel.com+ADs- licmvega+AEA-sss-steel.com+ADs- lkvwlabs+AEA-sss-steel.com+ADs- M.Wende+AEA-sss-steel.com+ADs- mcclintonrandy+AEA-sss-steel.com+ADs- md.varner+AEA-sss-steel.com+ADs- mfordlabs+AEA-sss-steel.com+ADs- mmcpherson+AEA-sss-steel.com+ADs- momo-69+AEA-sss-steel.com+ADs- Mrsjerick+AEA-sss-steel.com+ADs- mypawpaw+AEA-sss-steel.com+ADs- nelson+AEA-sss-steel.com+ADs- nikki+AF8-98+AF8-90+AEA-sss-steel.com+ADs- normaoren+AEA-sss-steel.com+ADs- oldaker+AEA-sss-steel.com+ADs- p2+AEA-sss-steel.com+ADs- p2rn+AEA-sss-steel.com+ADs- paradisefarms+AEA-sss-steel.com+ADs- peewee+AEA-sss-steel.com+ADs- pejuchika+AEA-sss-steel.com+ADs- pennylee073+AEA-sss-steel.com+ADs- photogal+AEA-sss-steel.com+ADs- pyflab+AEA-sss-steel.com+ADs- redhotphyre+AEA-sss-steel.com+ADs- reichertsk+AEA-sss-steel.com+ADs- rwlindy+AEA-sss-steel.com+ADs- satcu+AEA-sss-steel.com+ADs- skysblueboy+AEA-sss-steel.com+ADs- slabret+AEA-sss-steel.com+ADs- teking3+AEA-sss-steel.com+ADs- THTS+AEA-sss-steel.com+ADs- tkocurek+AEA-sss-steel.com+ADs- werenot+AEA-sss-steel.com+ADs- zwright+AEA-sss-steel.com+ADs- lanier+AEA-sss-steel.com+ADs- Brookeerick+AEA-sss-steel.com+ADs- jpircher+AEA-sss-steel.com+ADs- bskthunter+AEA-sss-steel.com+ADs- juliebrenner2002+AEA-sss-steel.com+ADs- ghostdancer+AEA-sss-steel.com+ADs- zipit+AEA-sss-steel.com+ADs- acctg+AEA-sss-steel.com+ADs- pat+AEA-sss-steel.com
Subject: Undeliverable: Sorry, that's your mail

Your message did not reach some or all of the intended recipients.

Subject: Sorry, that's your mail
Sent: 5/16/2004 11:43 AM

The following recipient(s) could not be reached:

jrr@sss-steel.com on 5/16/2004 11:43 AM
The e-mail account does not exist at the organization this message was sent to. Check the e-mail address, or contact the recipient directly to find out the correct address.
<houex01.SSS-STEEL.COM #5.1.1>

jsaponari@sss-steel.com on 5/16/2004 11:43 AM
The e-mail account does not exist at the organization this message was sent to. Check the e-mail address, or contact the recipient directly to find out the correct address.
<houex01.SSS-STEEL.COM #5.1.1>


I scanned the client in question, and verified the registry but nothing out of the ordinary showed up...

Thoughts?



Thanks,

Matt Wray

GFH

http://www.sss-steel.com

 

[dlmorgan92]

Does your emal server allow relay? It looks to me like someone may be relaying through your server.

 

[lgarner]

Either that or someone who's infected has you in their address book and is send messages with your return address. The original may not even have come from your server.

 

[Matrixa]

Yes, It look like you are being used as a spam relay.

I can only show the door, your the one that has to open it !

 

[Crazyfitz]

The original email was probably generated by the Sober.C worm and spoofed your domain in the From field, and you have recieved the DNR from the invalid recipients at the "SSS-STEEL.COM" domain.

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SOBER.C&VSect=T

George
MCSA +Messaging (Win2k) A+, Net +

 

[MattWray]

Thanks all. I am not relaying, I know this for a fact. I thought it might be a virus spoofing the From field, but the way the "To" addresses looked was so strange I figured I should get some more opinions. I appreciate it!

Thanks,

Matt Wray

GFH

http://www.sss-steel.com