One of our clients is receiving backscatter spam. Someone in .LT is sending emails on pretending to be them (e.g. helo=myclient.co.nz) and using offoce@myclient.co.nz as the from / return email address. As a result my client is getting bombed with a lot of bounced back scatter.
To make matters worse the content contains Kryptik virus,
Our NOD32 antivirus on the PC is catching the virus and removing it but there are two things I want to do:
1 - Figure out why clam isn't catching the virus at the server
2 - Ban all emails coming in for office@myclient.co.nz where the header contains or content of the returned email contains:
Received: from client-87-247-113-185.inturbo.lt ([87.247.113.185]:11498 helo=myclientco.nz)
if there an easy way to do this server wide or do I have to set up filters per email address?
Cheers
shane
