AOL doesn't send spamMaybe AOL doesn't send any spam any more but this is just as bad.
Yes, it's a Sober.AG backscatter bounce from our friends at AOL.
Adding insult to injury, the reason text given in the eventual * 554 response was:
TRANSACTION FAILED - Unrepairable Virus Detected. Your mail has not been sent.
Aside to AOL: My mail? My mail? Go away now and don't come back until you understand spoofing.
Of course, being a delayed bounce the message has a null sender envelope. And it comes from an AOL IP which is whitelisted (our users seem to want email from AOL as a rule). So not much to work with so far as blocking or filtering are concerned.
I guess there's always Taj May's technique for handling bogus bounces by examining the X-Mailer header (if it's not Lotus Notes, we didn't send it in the first place), though we currently have that turned off. Why? Because a number of remote systems seem to remove the X-Mailer header, occasionally substituting their own.
And guess what. Most if not all of those seem to be Exchange shops.
Another hit for "I hate Exchange", Ed.
Update: These just keep rolling in. We've turned on the Taj May rule and it is working like a charm, sidelining the two or three delayed bounces from AOL (plus occasional others) we are seeing every hour. The most recent AOL sample announces that "my" mail was not delivered to no fewer than (count them) 65 individual AOL users and helpfully lists every one of their email addresses.
* "eventual" because had they issued a hard rejection at the time the message was delivered to them, it would have died there and then - they evidently chose to accept and bounce later
Category: Viruses and Worms
Technorati: Viruses and Worms
1. Ed Brill30/11/2005 16:17:49
Homepage: http://www.edbrill.com
huh. microsoft claims that Exchange and Outlook addressed all their virus issues years ago.
2. Chris Linfoot30/11/2005 16:30:36
Oh yes?
In another bizarre Sober related twist, an external business partner of ours has managed to get their own Exchange server infected with Sober and it is spewing Sober.AG in every direction - has been for days and I can't get them to stop. The administrator must have received that FBI email and actually opened the attachment on the server itself!
The problem isn't solely the software, it's the users too.
3. yomi09/11/2007 15:12:45
i am having this error too 554 transaction failed but just from a particular domain.
Unable to post a comment? Please read this for a possible explanation...
- 
