🚀 go-pugleaf

Jeg er lidt i tvivl, om jeg tolker nedenst�ende mails fra 
Mailer-Demon korrekt. Er der tale om et Joe Job, eller er 
computeren inficeret?

Som jeg forst�r det, s� er spammene fors�gt afsendt fra 
solow.pil.dk, som min bekendte bruger bruger. Han har f�et 
en lille h�ndfuld beskeder (5-10) hver dag de seneste dage - 
langt fra som ved et normalt Joe Job. Jeg har maskeret min 
bekendtes navn/mail-adresse med **** i nedenst�ende.

I den f�rste mail er denne  header inkluderet som v�rende 
den originale header i en besked fra modtagerens mailserver :
-------------------------------------------------------
niksuhay@nozar.es
#550 5.1.1 RESOLVER.ADR.RecipNotFound; not found ##

Encabezados de mensajes originales:

Received: from correo.nozar.es (172.16.2.21) by 
hub02.nozar.local (10.0.99.22)
  with Microsoft SMTP Server (TLS) id 8.1.278.0; Wed, 1 Oct 
2008 14:16:57 +0200
Received: from mail160-wa4-R.bigfish.com (172.16.1.253) by 
correo.nozar.es
  (172.16.2.121) with Microsoft SMTP Server id 8.1.291.1; 
Wed, 1 Oct 2008
  14:21:12 +0200
Received: from mail160-wa4 (localhost.localdomain 
[127.0.0.1])	by
  mail160-wa4-R.bigfish.com (Postfix) with ESMTP id 
2AC30D7951E	for
  <niksuhay@nozar.es>; Wed,  1 Oct 2008 12:21:12 +0000 (UTC)
X-BigFish: vps13(zcb8kz936eQ8c8ajzzzzz2dh6bh6di89ih34h62h)
X-Spam-TCS-SCL: 1:0
X-FB-SS: 5,
Received: by mail160-wa4 (MessageSwitch) id 
1222863670649310_25583; Wed,  1
  Oct 2008 12:21:10 +0000 (UCT)
Received: from solow.pil.dk (relay.pil.dk [195.41.47.164])	by
  mail160-wa4.bigfish.com (Postfix) with ESMTP id 
75E1FEF8061	for
  <niksuhay@nozar.es>; Wed,  1 Oct 2008 12:21:10 +0000 (UTC)
Received: from **** (unknown [213.150.61.221])	by 
solow.pil.dk (Postfix) with
  ESMTPA id 60D4C1CC121	for <niksuhay@nozar.es>; Wed,  1 Oct 
2008 14:21:09
  +0200 (CEST)
From: ****
To: <niksuhay@nozar.es>
Subject: 
=?Windows-1252?Q?Ikke_l=E6st:_Find_your_love_stick_gain_here.?=
Date: Wed, 1 Oct 2008 14:21:17 +0200
----------------------------------



I den nedenst�ende mail fra Mailer-Demon er den oprindelige 
header ikke inkluderet, men ogs� her fremg�r det, at den 
oprindelige afsender er solow.pil.dl:
-----------------------------------
Fra: postmaster@faelce.com.br [mailto:postmaster@faelce.com.br]
Sendt: 1. oktober 2008 14:23
Til: ****
Emne: Delivery Status Notification (Failure)

This is an automatically generated Delivery Status Notification.

Delivery to the following recipients failed.

        basner@FAELCE.COM.BR


Reporting-MTA: dns;faelce18.faelce.com.br
Received-From-MTA: dns;solow.pil.dk
Arrival-Date: Wed, 1 Oct 2008 09:23:01 -0300

Original-Recipient: rfc822;basner@FAELCE.COM.BR
Final-Recipient: rfc822;basner@FAELCE.COM.BR
Action: failed
Status: 5.1.1
---------------------------------------------


Hvis det var et Joe Job, burde solow.pil.dk vel ikke fremg� 
i mailene?

-- 
Mvh. Kim Ludvigsen
Nemmere, hurtigere og mere sikkert internet med Firefox.
http://kimludvigsen.dk