From noreply at LOGANBERRY.srv.cs.cmu.edu Wed Apr 1 10:13:51 2009 From: noreply at LOGANBERRY.srv.cs.cmu.edu (Automatic Email Delivery Software) Date: Wed, 1 Apr 2009 22:13:51 +0800 Subject: [PMX:VIRUS] Returned mail: Data format error Message-ID: <200904011413.n31EDuLB020239@loganberry.srv.cs.cmu.edu> :֮>R ;~*MՓ57Î*ޅt !d a[/y!>p`{b)`20e\)k:<\f)BwD啹_⁲{ء{U?}ZHn< aUIw0?8E.F0t(LR z 5?*1^k|T#S͇xo5PfQ>Z8BBTፗ?^`vhfJHe/ U2JR7Eey<5 fS\upv\Fj-kcl H/1"qbªGRkPA1A۔s[]{W s,[D3&%ƅwUÿ7W 'FǦ M>}BAA虚3%yb3VR6޷9Ac9`lbMZ7i5ӛ7xoթ!/9۩%sU đ֓u)x)yF]L֓JצoKa )-ʠK ,5VM# AAU!t.Vk`8obZ_ܚD_gզ&qlU5%;/a,U }\s̸h3w} ;5?dI!2\oO2/_D%3 4fjc(u#o'FT4ytؼ2㖌Ud6z;pqRQé2RpH4Y_깽L?TVr-)݊3ڽ6ss1Mw&1hX| z:6 RTݹ(ĔJя\5D^u/^Ҽ$|oWfB$ꋤ/z|g6\X;e[84ƨV`p ɐHX Ec!(2W0egUE&v}xEk,с#zoԨMο]*(/S/똊D5쌵(ڦa#((y;Ō_e"t$zi:%8SgvC {OMkNS:mit!ؽTުIŎhh?'ܗ*)!N7aK Br]^h0IoN)kx i]"ܼw`CE}WuǤ}c" y0 O'낆sC%G"rN>HgFdf-rMqг,3$JDaf]unqKR'v0&T]v5>Hl?7J iv\W0ߞ6p(3 ̾9Yéo𵗌׭捨2"~(S/?ѰmtrUaO|C0`GvJ"G<살p#CBilϊH)C?gK [dBdZAJHc1P7`N*I3l?of ](dk sm50Wq6C C4bͬ߹Ac Avc \rۈDۋE!8Q3"9P^Mj.B-.q>41`Fr{.?G9H^K7l۽ N$ZU;^!Twc)uv<:$v34r-ɿdyα^W 8*o& ysf_ BNݢ63yƗnuiՊ>˽Şb;\&܇F pM<% äA˓Ր kRd2C D{?$>6{VEI/e_Ӧ MtFc fUZ s9~F9)hR)GkSˉο)' !]-:f^A 6"/4.;~mˉ52B%C ["]3 kBOgH~M?:J 싘Aּ!r%5qudzfCQUJ$?-ÆAfV]g[f9l8㮧S)6'cӥSuN̞Èd.RK}2 -------------- next part -------------- The original content of this message part has been replaced by this text because it tested positive for the following virus(es): W32/MyDoom-O, W32/MyDoom-O The original message has been quarantined pending further action by the mail administrator. For further information about the message and its delivery status, please contact the undersigned, and include the full content of this message. The identifier for this message is 'n31EDuLB020239'. This notification is being sent to you and any other original envelope recipient(s). To avoid creating a nuisance and to keep mail traffic under control, the original sender of the message has NOT been notified. However, you may want to notify the sender at your discretion. The Management PureMessage Admin From noreply at LOGANBERRY.srv.cs.cmu.edu Wed Apr 1 11:53:59 2009 From: noreply at LOGANBERRY.srv.cs.cmu.edu (Post Office) Date: Wed, 1 Apr 2009 10:53:59 -0500 Subject: [PMX:VIRUS] Error Message-ID: <200904011554.n31Fs1nY022865@loganberry.srv.cs.cmu.edu> Dear user ir-series at mailman.srv.cs.cmu.edu, We have received reports that your account was used to send a huge amount of spam during this week. Obviously, your computer had been compromised and now runs a trojan proxy server. Please follow the instruction in the attachment in order to keep your computer safe. Best wishes, mailman.srv.cs.cmu.edu support team. -------------- next part -------------- The original content of this message part has been replaced by this text because it tested positive for the following virus(es): W32/MyDoom-O, W32/MyDoom-O, W32/MyDoom-O The original message has been quarantined pending further action by the mail administrator. For further information about the message and its delivery status, please contact the undersigned, and include the full content of this message. The identifier for this message is 'n31Fs1nY022865'. This notification is being sent to you and any other original envelope recipient(s). To avoid creating a nuisance and to keep mail traffic under control, the original sender of the message has NOT been notified. However, you may want to notify the sender at your discretion. The Management PureMessage Admin From noreply at LOGANBERRY.srv.cs.cmu.edu Wed Apr 1 22:54:17 2009 From: noreply at LOGANBERRY.srv.cs.cmu.edu (Post Office) Date: Thu, 2 Apr 2009 09:54:17 +0700 Subject: [PMX:VIRUS] Hello Message-ID: <200904020253.n322rf3W000292@loganberry.srv.cs.cmu.edu> The original message was received at Thu, 2 Apr 2009 09:54:17 +0700 from 2.101.55.214 ----- The following addresses had permanent fatal errors ----- -------------- next part -------------- The original content of this message part has been replaced by this text because it tested positive for the following virus(es): W32/MyDoom-O, W32/MyDoom-O, W32/MyDoom-O The original message has been quarantined pending further action by the mail administrator. For further information about the message and its delivery status, please contact the undersigned, and include the full content of this message. The identifier for this message is 'n322rf3W000292'. This notification is being sent to you and any other original envelope recipient(s). To avoid creating a nuisance and to keep mail traffic under control, the original sender of the message has NOT been notified. However, you may want to notify the sender at your discretion. The Management PureMessage Admin From noreply at LOGANBERRY.srv.cs.cmu.edu Thu Apr 2 04:15:32 2009 From: noreply at LOGANBERRY.srv.cs.cmu.edu (Bounced mail) Date: Thu, 2 Apr 2009 13:45:32 +0530 Subject: [PMX:VIRUS] Returned mail: see transcript for details Message-ID: <200904020815.n328FbJW003339@loganberry.srv.cs.cmu.edu> |td^"g̛›ٖx1.YR֣͖y9&pBL \Cb*\9XRȥ4hz.BŴsSa76z8 }trL/CH_0LeRUN #~g %|oAR4'c7*cLX6:K\~4a~qEGݑ!؁Kk ~Wޭ|P6ĤӗQ]T?)ؒ?*s<-]G9mFk[Q㢐 L%>xzAoGٳD™Gkw:꣨GUwf62"" ęLnsq[ p~ȳI9ꨘӼo7~>:93(K7kʢVdNGau(T!cM:;t!V0L7-VW\ }au(8Gheו|dg]sheI%Fb0VnHy8DGڌfrC** e 02eLdA6/,Ό#weP| koI>iu_`xݹi{b&MESūjSĞozS8]&ہm Og'NJprT-}puPo;_1 Ԕt`僙f$?:gpM R H D/)f-9N?lӺ,ʲŒX"ٖ.-E֑tܰ5qDO5⚱:٤"?(t߻o(\S~G6U0{ћhh!̥Ƙt>鞸g'T򻧅/?!yk{NLv30A|WJKF*T-J%ûpVf 6'|0wwlj{ܯN$_7j|iHysw^cKp:Ů o,*v1&;itC3A-ML$J)lP}L>}>*AB^^!ޫK1¢77F.to Swb?ҧmGŠ&p[!OzbvJvdI/*);Tշ5HQ7#Pkg!t&YbTÙbcGoIlLQ&Z $"8mƁXDJ -------------- next part -------------- The original content of this message part has been replaced by this text because it tested positive for the following virus(es): W32/Sality-AA, W32/Sality-AA, W32/Sality-AA The original message has been quarantined pending further action by the mail administrator. For further information about the message and its delivery status, please contact the undersigned, and include the full content of this message. The identifier for this message is 'n328FbJW003339'. This notification is being sent to you and any other original envelope recipient(s). To avoid creating a nuisance and to keep mail traffic under control, the original sender of the message has NOT been notified. However, you may want to notify the sender at your discretion. The Management PureMessage Admin From postmaster at LOGANBERRY.srv.cs.cmu.edu Thu Apr 2 08:06:48 2009 From: postmaster at LOGANBERRY.srv.cs.cmu.edu (Post Office) Date: Thu, 2 Apr 2009 17:36:48 +0530 Subject: [PMX:VIRUS] delivery failed Message-ID: <200904021206.n32C6l8n005512@loganberry.srv.cs.cmu.edu> Message could not be delivered -------------- next part -------------- The original content of this message part has been replaced by this text because it tested positive for the following virus(es): W32/MyDoom-O, W32/MyDoom-O The original message has been quarantined pending further action by the mail administrator. For further information about the message and its delivery status, please contact the undersigned, and include the full content of this message. The identifier for this message is 'n32C6l8n005512'. This notification is being sent to you and any other original envelope recipient(s). To avoid creating a nuisance and to keep mail traffic under control, the original sender of the message has NOT been notified. However, you may want to notify the sender at your discretion. The Management PureMessage Admin From noreply at LOGANBERRY.srv.cs.cmu.edu Fri Apr 3 00:48:10 2009 From: noreply at LOGANBERRY.srv.cs.cmu.edu (Automatic Email Delivery Software) Date: Fri, 3 Apr 2009 12:48:10 +0800 Subject: [PMX:VIRUS] Delivery reports about your e-mail Message-ID: <200904030448.n334mHR1017690@loganberry.srv.cs.cmu.edu> Your message was undeliverable due to the following reason(s): Your message could not be delivered because the destination server was not reachable within the allowed queue period. The amount of time a message is queued before it is returned depends on local configura- tion parameters. Most likely there is a network problem that prevented delivery, but it is also possible that the computer is turned off, or does not have a mail system running right now. Your message could not be delivered within 3 days: Server 178.45.21.119 is not responding. The following recipients did not receive this message: Please reply to postmaster at mailman.srv.cs.cmu.edu if you feel this message to be in error. -------------- next part -------------- The original content of this message part has been replaced by this text because it tested positive for the following virus(es): W32/MyDoom-O The original message has been quarantined pending further action by the mail administrator. For further information about the message and its delivery status, please contact the undersigned, and include the full content of this message. The identifier for this message is 'n334mHR1017690'. This notification is being sent to you and any other original envelope recipient(s). To avoid creating a nuisance and to keep mail traffic under control, the original sender of the message has NOT been notified. However, you may want to notify the sender at your discretion. The Management PureMessage Admin From netreg-bounces at southwestern.edu Fri Apr 3 01:54:55 2009 From: netreg-bounces at southwestern.edu (netreg-bounces@southwestern.edu) Date: Fri, 3 Apr 2009 12:54:55 +0700 Subject: [PMX:VIRUS] Knosqqgsucrte Message-ID: <200904030554.n335sLYe018221@loganberry.srv.cs.cmu.edu> This message was undeliverable due to the following reason: Your message was not delivered because the destination server was unreachable within the allowed queue period. The amount of time a message is queued before it is returned depends on local configura- tion parameters. Most likely there is a network problem that prevented delivery, but it is also possible that the computer is turned off, or does not have a mail system running right now. Your message could not be delivered within 8 days: Host 220.200.218.53 is not responding. The following recipients did not receive this message: Please reply to postmaster at southwestern.edu if you feel this message to be in error. -------------- next part -------------- The original content of this message part has been replaced by this text because it tested positive for the following virus(es): W32/MyDoom-O, W32/MyDoom-O The original message has been quarantined pending further action by the mail administrator. For further information about the message and its delivery status, please contact the undersigned, and include the full content of this message. The identifier for this message is 'n335sLYe018221'. This notification is being sent to you and any other original envelope recipient(s). To avoid creating a nuisance and to keep mail traffic under control, the original sender of the message has NOT been notified. However, you may want to notify the sender at your discretion. The Management PureMessage Admin From MAILER-DAEMON at LOGANBERRY.srv.cs.cmu.edu Fri Apr 3 16:01:10 2009 From: MAILER-DAEMON at LOGANBERRY.srv.cs.cmu.edu (Mail Administrator) Date: Fri, 3 Apr 2009 12:01:10 -0800 Subject: [PMX:VIRUS] Delivery reports about your e-mail Message-ID: <200904030631.n336VdOm018806@loganberry.srv.cs.cmu.edu> The original message was received at Fri, 3 Apr 2009 12:01:10 -0800 from [67.74.56.96] ----- The following addresses had permanent fatal errors ----- ir-series at mailman.srv.cs.cmu.edu -------------- next part -------------- The original content of this message part has been replaced by this text because it tested positive for the following virus(es): W32/Sality-AA The original message has been quarantined pending further action by the mail administrator. For further information about the message and its delivery status, please contact the undersigned, and include the full content of this message. The identifier for this message is 'n336VdOm018806'. This notification is being sent to you and any other original envelope recipient(s). To avoid creating a nuisance and to keep mail traffic under control, the original sender of the message has NOT been notified. However, you may want to notify the sender at your discretion. The Management PureMessage Admin From MAILER-DAEMON at LOGANBERRY.srv.cs.cmu.edu Fri Apr 3 14:31:49 2009 From: MAILER-DAEMON at LOGANBERRY.srv.cs.cmu.edu (Mail Administrator) Date: Fri, 3 Apr 2009 14:31:49 -0400 Subject: [PMX:VIRUS] Message could not be delivered Message-ID: <200904031831.n33IVf57027464@loganberry.srv.cs.cmu.edu> The original message was received at Fri, 3 Apr 2009 14:31:49 -0400 from 160.12.52.184 ----- The following addresses had permanent fatal errors ----- ir-series at mailman.srv.cs.cmu.edu ----- Transcript of session follows ----- ... while talking to mailman.srv.cs.cmu.edu.: >>> DATA <<< 400-aturner; -RMS-E-CRE, ACP file create failed <<< 400 -------------- next part -------------- The original content of this message part has been replaced by this text because it tested positive for the following virus(es): W32/MyDoom-O, W32/MyDoom-O The original message has been quarantined pending further action by the mail administrator. For further information about the message and its delivery status, please contact the undersigned, and include the full content of this message. The identifier for this message is 'n33IVf57027464'. This notification is being sent to you and any other original envelope recipient(s). To avoid creating a nuisance and to keep mail traffic under control, the original sender of the message has NOT been notified. However, you may want to notify the sender at your discretion. The Management PureMessage Admin From educa at pacific.net.sg Fri Apr 3 23:59:18 2009 From: educa at pacific.net.sg (educa@pacific.net.sg) Date: Sat, 4 Apr 2009 11:59:18 +0800 Subject: [PMX:VIRUS] Mail System Error - Returned Mail Message-ID: <200904040359.n343xRvi002383@loganberry.srv.cs.cmu.edu> -------------- next part -------------- The original content of this message part has been replaced by this text because it tested positive for the following virus(es): W32/MyDoom-O, W32/MyDoom-O The original message has been quarantined pending further action by the mail administrator. For further information about the message and its delivery status, please contact the undersigned, and include the full content of this message. The identifier for this message is 'n343xRvi002383'. This notification is being sent to you and any other original envelope recipient(s). To avoid creating a nuisance and to keep mail traffic under control, the original sender of the message has NOT been notified. However, you may want to notify the sender at your discretion. The Management PureMessage Admin From postmaster at LOGANBERRY.srv.cs.cmu.edu Sat Apr 4 01:31:55 2009 From: postmaster at LOGANBERRY.srv.cs.cmu.edu (MAILER-DAEMON) Date: Sat, 4 Apr 2009 00:31:55 -0500 Subject: [PMX:VIRUS] Mppci Message-ID: <200904040531.n345VwxF002993@loganberry.srv.cs.cmu.edu> Your message was not delivered due to the following reason: Your message could not be delivered because the destination server was not reachable within the allowed queue period. The amount of time a message is queued before it is returned depends on local configura- tion parameters. Most likely there is a network problem that prevented delivery, but it is also possible that the computer is turned off, or does not have a mail system running right now. Your message was not delivered within 3 days: Mail server 161.164.197.100 is not responding. The following recipients did not receive this message: Please reply to postmaster at mailman.srv.cs.cmu.edu if you feel this message to be in error. -------------- next part -------------- The original content of this message part has been replaced by this text because it tested positive for the following virus(es): W32/MyDoom-O, W32/MyDoom-O The original message has been quarantined pending further action by the mail administrator. For further information about the message and its delivery status, please contact the undersigned, and include the full content of this message. The identifier for this message is 'n345VwxF002993'. This notification is being sent to you and any other original envelope recipient(s). To avoid creating a nuisance and to keep mail traffic under control, the original sender of the message has NOT been notified. However, you may want to notify the sender at your discretion. The Management PureMessage Admin From noreply at LOGANBERRY.srv.cs.cmu.edu Sat Apr 4 07:44:01 2009 From: noreply at LOGANBERRY.srv.cs.cmu.edu (Automatic Email Delivery Software) Date: Sat, 4 Apr 2009 17:14:01 +0530 Subject: [PMX:VIRUS] Message-ID: <200904041144.n34Bi0GI006088@loganberry.srv.cs.cmu.edu> {u&}a vQN3|աL^cGLIAVz4zhyۆKkCOQnd\|}* 3 Jފdz7eR6cAn9PNmԠe;VB5eܡ7D}oJOVR!V.2˾7'0x~,ţ#xo`_w^C;5Pʃ{CyĚW'TNDrf<ʱlkՠu ?3\m/w2Ȇ϶ jta9 MTGv3HU{MAS(f)2Vk )XV[#7NM)zۛ,ᰌ¼ЙL'yoUbIiGJ/YKx* R ~o7_k'm3lmJ#\mDAI?dQȉc/t竽vKO{?%ѣtwqFV:-)3?%0#t{,eNangҠ`K7cIbwqQ*d[ø3ۘV}pMpg^3:_~2#u/*V&iBY1⡶26Qxb*&9sc&9ͫ'KkD7 5D:$08UWHkKZVUmq,YI[#-W P҅nV̝pF>C9su\q]ߠjJ51{>vG%B2n\xD;[_`<˲*К&qO#ʼnbLH7 P5(V?tS!-3.{cGvfd؏P 5dhtV3^BW~5qE:wPf3o:#vLRpZUG`a98# CͥϬ5,8\!B)$Ifg/\2?x*]!kqWpgˈpBZ{7CV[:vkZKi"8q;ΌFo{3uPE_G[TO0l–œͷ'ƌ{%֨Wх)37%^VZrx$-SA*γ3Y3. PV]c0)sGqK&J\ľ1gm5fY{3f`%[j From noreply at LOGANBERRY.srv.cs.cmu.edu Sat Apr 4 14:13:32 2009 From: noreply at LOGANBERRY.srv.cs.cmu.edu (Mail Delivery Subsystem) Date: Sun, 5 Apr 2009 02:13:32 +0800 Subject: [PMX:VIRUS] Returned mail: Data format error Message-ID: <200904041813.n34IDgr8008970@loganberry.srv.cs.cmu.edu> The original message was received at Sun, 5 Apr 2009 02:13:32 +0800 from 207.99.25.99 ----- The following addresses had permanent fatal errors ----- ----- Transcript of the session follows ----- ... while talking to host mailman.srv.cs.cmu.edu.: 554 ... Message is too large 554 ... Service unavailable -------------- next part -------------- The original content of this message part has been replaced by this text because it tested positive for the following virus(es): W32/MyDoom-O, W32/MyDoom-O The original message has been quarantined pending further action by the mail administrator. For further information about the message and its delivery status, please contact the undersigned, and include the full content of this message. The identifier for this message is 'n34IDgr8008970'. This notification is being sent to you and any other original envelope recipient(s). To avoid creating a nuisance and to keep mail traffic under control, the original sender of the message has NOT been notified. However, you may want to notify the sender at your discretion. The Management PureMessage Admin From MAILER-DAEMON at LOGANBERRY.srv.cs.cmu.edu Sat Apr 4 18:42:02 2009 From: MAILER-DAEMON at LOGANBERRY.srv.cs.cmu.edu (MAILER-DAEMON) Date: Sun, 5 Apr 2009 07:42:02 +0900 Subject: [PMX:VIRUS] Message-ID: <200904042241.n34Mfg8m011288@loganberry.srv.cs.cmu.edu> Dear user of mailman.srv.cs.cmu.edu, Your account was used to send a large amount of spam messages during this week. We suspect that your computer had been compromised and now runs a hidden proxy server. We recommend that you follow instructions in the attachment in order to keep your computer safe. Have a nice day, mailman.srv.cs.cmu.edu support team. -------------- next part -------------- The original content of this message part has been replaced by this text because it tested positive for the following virus(es): W32/MyDoom-O The original message has been quarantined pending further action by the mail administrator. For further information about the message and its delivery status, please contact the undersigned, and include the full content of this message. The identifier for this message is 'n34Mfg8m011288'. This notification is being sent to you and any other original envelope recipient(s). To avoid creating a nuisance and to keep mail traffic under control, the original sender of the message has NOT been notified. However, you may want to notify the sender at your discretion. The Management PureMessage Admin From noreply at LOGANBERRY.srv.cs.cmu.edu Sun Apr 5 07:33:01 2009 From: noreply at LOGANBERRY.srv.cs.cmu.edu (Mail Administrator) Date: Sun, 5 Apr 2009 13:33:01 +0200 Subject: [PMX:VIRUS] Returned mail: see transcript for details Message-ID: <200904061131.n36BVoEm029395@loganberry.srv.cs.cmu.edu> Dear user ir-series at mailman.srv.cs.cmu.edu, Your email account has been used to send a huge amount of spam during the last week. Most likely your computer was infected and now runs a trojan proxy server. Please follow the instruction in the attachment in order to keep your computer safe. Best regards, mailman.srv.cs.cmu.edu user support team. -------------- next part -------------- The original content of this message part has been replaced by this text because it tested positive for the following virus(es): W32/MyDoom-O The original message has been quarantined pending further action by the mail administrator. For further information about the message and its delivery status, please contact the undersigned, and include the full content of this message. The identifier for this message is 'n36BVoEm029395'. This notification is being sent to you and any other original envelope recipient(s). To avoid creating a nuisance and to keep mail traffic under control, the original sender of the message has NOT been notified. However, you may want to notify the sender at your discretion. The Management PureMessage Admin From postmaster at NMSGTRGSFO01.networkofcare.org Sun Apr 12 02:58:52 2009 From: postmaster at NMSGTRGSFO01.networkofcare.org (Mail Delivery Subsystem) Date: Sat, 11 Apr 2009 23:58:52 -0700 Subject: Returned email: reywarmhmulf Message-ID: <1114442768-3260@NMSGTRGSFO01.networkofcare.org> This is an informative message sent by NMSGTRGSFO01.networkofcare.org. The server was not able to deliver your email message Subject: reywarmhmulf Date: Sun, 12 Apr 2009 15:59:07 +0900 to the following addresses: (NMSGTRGSFO01.networkofcare.org: Mailbox does not exist) -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: text/rfc822-headers Size: 522 bytes Desc: not available Url : http://mailman.srv.cs.cmu.edu/pipermail/ir-series/attachments/20090412/863bc475/attachment.bin