verify_user problem

John Rowan <[email protected]> Mon, 14 Aug 2006 13:00:58 -0400
Newsgroups gmane.mail.imap.cyrus.announce
Message-ID <[email protected]>
I'm running Sendmail version 8.13.1, config V10/Berkeley on a CentOS 
Linux 4.3 server.  Today I noticed there were 7000 plus messages in the 
outbound queue.  They are the result of rejections of verifying user 
attempts.

Does anyone know if this is a new virus/worm or Trojan?


Aug 14 08:02:51 softtail sendmail[4553]: k7EC2esr004553: from=<>, 
size=6877, class=0, nrcpts=1, 
msgid=<[email protected]>, proto=SMTP, 
daemon=MTA, relay=extsmtp3.localnet.com [207.251.201.55]
Aug 14 08:02:51 softtail lmtpunix[4519]: accepted connection
Aug 14 08:02:51 softtail lmtpunix[4519]: lmtp connection preauth'd as 
postman
Aug 14 08:02:51 softtail lmtpunix[4519]: verify_user(user.p.holland) 
failed: Mailbox does not exist
Aug 14 08:02:51 softtail sendmail[4559]: k7EC2esr004553: 
to=<[email protected]>, delay=00:00:00, xdelay=00:00:00, mailer=cyrusv2, 
pri=126877, relay=localhost, dsn=5.1.1, stat=User unknown
Aug 14 08:02:51 softtail sendmail[4559]: k7EC2esr004553: k7EC2psr004559: 
postmaster notify: User unknown


Aug 14 08:02:57 softtail sendmail[4533]: k7EC2Y7A004533: 
from=<[email protected]>, size=2037, class=0, nrcpts=1, 
msgid=<000001c6bf99$7fd5d720$d61ca8c0@hgr94>, proto=SMTP, daemon=MTA, 
relay=AStDenis-105-1-6-150.w81-248.abo.wanadoo.fr [81.248.193.150]
Aug 14 08:02:57 softtail lmtpunix[4515]: accepted connection
Aug 14 08:02:57 softtail lmtpunix[4515]: lmtp connection preauth'd as 
postman
Aug 14 08:02:57 softtail lmtpunix[4519]: accepted connection
Aug 14 08:02:57 softtail lmtpunix[4519]: lmtp connection preauth'd as 
postman
Aug 14 08:02:57 softtail master[4567]: about to exec 
/usr/lib/cyrus-imapd/lmtpd
Aug 14 08:02:57 softtail lmtpunix[4519]: verify_user(user.vxp-hatcher) 
failed: Mailbox does not exist
Aug 14 08:02:57 softtail sendmail[4566]: k7EC2Y7A004533: 
to=<[email protected]>, delay=00:00:01, xdelay=00:00:00, mailer=cyrusv2, 
pri=122037, relay=localhost, dsn=5.1.1, stat=User unknown
Aug 14 08:02:57 softtail lmtpunix[4567]: executed
Aug 14 08:02:57 softtail sendmail[4566]: k7EC2Y7A004533: k7EC2v7A004566: 
DSN: User unknown
rowan.vcf (text/x-vcard, 235 B)
begin:vcard
fn:John Rowan
n:Rowan;John
org:Rownetco, Inc.
adr;dom:;;10 Pulaski Drive;Oak Ridge;N.J.;07438-9322
email;internet:[email protected]
tel;work:9732295742
tel;fax:9736974443
url:http://www.rownetco.com
version:2.1
end:vcard