The problem of the disconnecting email has returned today…I’m going to first see if it happens on my computer, then find the exact email and analyse the headers line by line. I really want to get this one sorted!
UPDATE: Ok, I can’t replicate it on my computer atm, but here is the entire message source:
Return-Path: <oleabaens@mail.zp.ua>
Received: from cm-24-196-163-013.ash.nc.charter.com (24.196.163.13) by mk-cpfrontend.uk.tiscali.com(7.0.024.3-1)
id 4059BFE801A267C6; Sat, 3 Apr 2004 11:42:01 +0000
Sender: oleabaens@mail.zp.ua (derived from envelope by postmaster@uk.tiscali.com)
Date: Sat, 3 Apr 2004 11:42:01 +0000 (added by postmaster@uk.tiscali.com)
Message-ID: <4059BFE801A267C6@mk-cpfrontend-10.mail.uk.tiscali.com> (added by postmaster@uk.tiscali.com)
X-Message-Info: O[4
How the hell is this getting anywhere? Do you think it could be infected with a virus, which is then being stripped by Norton, but half the headers are getting removed too?
-----


-----
X-Message-Info: O[4
^^^^^^^^^^^^^^ is Spam Assassin running on their mail servers????
And if so, is it breaking????
Is X-Message-Info a SpamAssassin header? I’m trying to find out about it, but not having much luck atm
Well I thought that it was since I’m running NAV, and on my SpamAssassin (I am pretty sure it is SapmAssassin) protected emails, I get loads of extra headers
From - Sun Apr 04 14:38:35 2004
X-UIDL: UID1990-1070046922
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Delivery-date: Sun, 04 Apr 2004 06:38:14 -0700
Received: from [216.148.213.132] (helo=smtp.mailix.net)
by mx.mailix.net with esmtp (Exim 4.24-GA)
id 1BA7pE-0003l2-QN
for email@email.email; Sun, 04 Apr 2004 06:38:12 -0700
Received: from [212.56.110.225] (helo=edbateman.com)
by smtp.mailix.net with asmtp (Exim 4.24-H)
id 1BA7p6-00064A-E3
for email; Sun, 04 Apr 2004 06:38:04 -0700
Message-ID:
Date: Sun, 04 Apr 2004 14:37:40 +0100
From: emailemail
User-Agent: Mozilla Thunderbird 0.5 (Windows/20040207)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: email@email.email
X-uvscan-result: clean (1BA7p6-00064A-E3)
X-SA-Exim-Mail-From: email@email.email
Subject: (no subject)
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on
westvirginia.backend
X-Spam-Report:
X-Spam-Status: No, hits=0.0 required=10.0 tests=none autolearn=no version=2.61
X-Spam-Level:
X-SA-Exim-Version: 3.1 (built Thu Oct 23 13:26:47 PDT 2003)
X-SA-Exim-Scanned: Yes
X-uvscan-result: clean (1BA7pE-0003l2-QN)
(my emails are also virus scanned too at the mail server!)
Actually, I want to change my mind. (sorry)
SpamAssassin adds extra fields in, but it doesn’t mention that it adds the X-Message-Info. I think that some servers, when sending emails on copy the Message-Info old message info to a new X-Message-Info, and then replace the Message-Info.
I will do a search through all my emails and see if any have these headers
After mucho searching on the web and emails, I’ve concluded that I’m at a loss.
The only emails that have those headers are from hotmail emails, and the email headers continue on after the X-Message-Info headers.
Perhaps you might want to:
a) check whether the mail.zp.ua is a blacklisted web server
b) check what Tiscali thinks about the problem?
It might be a: ‘It is a feature, not a bug’.
Sorry to have been no more help.
No problem, thanks very much for looking! I’ll do some investigating of the IP etc as you suggest
I’m not sure if there are legitimate uses of X-Message-Info, but the ones you quote are consistent with certain spam software.
The clipped message is in all likelyhood also caused by the spamware. My hypothesis is that they use an unreliable protocol to talk to the (virus/worm) infected machine, and therefore only manage to send parts of the spam out when the network connection of the victim in between gets overloaded.
—