i'm not quite sure what's causing this. i have a message filter that
filters on a worm signature (originally made for nimda, but seems to
catch a lot of whatever is common today). from the filter, i both save
the message (in bsmtp format) and fail it.
two questions: i don't know if it's of any importance, but i'd like to
change the "message filter@???" to something that doesn't have
spaces in. second, please note the underscore in the address above;
i'm quite sure it's not there 'normally', the address is valid without
the underscore, but not with it. question is: is this rewrite done by
exim, or is it coming as such from the worm ?
actually the real problem is that "fail" in the filter causes the
message to bounce, but instead being sent to the original sender, i'm
getting it (it has a "to: mailer-daemon@???" in the mail, and that
happens to be aliased to me). i don't seem to be able to track the
problem down, but i suspect it's because of that underscore.
anyone experienced this ? is it coming from exim, or the worm ? (if
the latter, then i'm stuck, which basically is fine afterall, it's
more my curiosity than my annoyance of getting 50 worm-infected mails
a day:)
