Re: [Exim] Weird bit-flipping in sender address..

On Wed, 22 Aug 2001, Dave C. wrote:

>
> I'm not sure if this is an exim problem, an os/library problem, a
> hardware problem, or some sort of new and deranged Outlook Express
> virus/worm.
>
> RedHat 5.x (Yes I know its ancient),
>
> exim was 3.15, just upgraded to 3.33 to try and solve this problem - but
> it still occurs..
>
> The server we provide for 'outgoing' SMTP relay for our customers is
> configured to verify sender address when its in one of our local
> domains.
>
> Lately I have been seeing quite a few instances of the second character
> of the senders address, getting bit-flipped, in the _envelope_ only.
> This of course causes exim to reject the message assuming the
> bit-flipped address is not valid. Its always the second character, and
> it always is one higher than the correct character (which is still
> visible in the From: header email addres)
>
> I'm not sure if the client MUA is bitflipping the address, or if exim
> (or some underlying system component on the server) is..
>
> I'm wondering if anyone else with a similar configuration is seeing
> anything like this - if so, then I will suspect a MUA worm or virus and
> will quit tearing my hair out as to why my server has suddenly gone
> mad..
>
That's a sure sign of the "Magistr" virus.

Quite nasty since the bounces from amavis never reaches the sender of the
virus.

/Andreas