strange mail asking for details avast russian? and english.

Hello i received 2 strange mails in my inbox regarding avast.
1 in english en 1 (i think) russian.
I removed http and @ in the links.

01.02.10, 12:22, “Александр Хасин” <aleksander_khasin rambler.ru>:

я не владею английским программа у меня заработала благодарю
с уважением!


Александр Хасин.


Скачай новую ICQ 7.0 ://icq.rambler.ru/


Iavs-info mailing list
Iavs-info lists.avast.com
://caracal.avast.com/mailman/listinfo/iavs-info


Здесь спама нет ://mail.yandex.ru/nospam/sign


Iavs-info mailing list
Iavs-info lists.avast.com
://caracal.avast.com/mailman/listinfo/iavs-info

Whats up with these ?

daaf :wink:

Me too. ???

I also recieved 3 strange mails like this… very strange. Any info from Alwil about that ?

i deleted them. they were classified as junk by windows live mail.

I also received them and deleted them. I also had a Email sent with a title for me not to send them emails.
But checking the email address it was not mine, which i also deleted.

Me too. A woman said for me to not to be sending her update emails because the link didn’t work and to reply in English. I only use the free home Avast. I have no mailing lists. I also got the emails in a few languages. I wonder what is going on.

Hi lordtec
That is exactly what happened to me, you have explained perfectly, not like me.
I use Avast Pro

I didn’t get anything so far…but yeah that’s a bit worrying, as if the forum database got hacked; this exactly happened on Compiz forums a few weeks ago, all members received spam mails. Hope it’s not that…happened to Compiz on smf…anyway, let’s wait and see…

edit: OK, the thing is I have email notifications disabled constantly, and if hackers use the forum, ie didn’t simply stole a list of members’ email addresses, this would explain why I didn’t get anything.

edit: these are just speculations on my side, nothing more atm…

edit: could also come from a hijacked registration process, from the UI…

edit: also, Avast UI makes an incredible amount of connections, worth mentioning may be, but I don’t think that could be related to the issue of the current thread… http://forum.avast.com/index.php?topic=54828.msg463899#msg463899

I speak russian. This is:

"I dont speak english. Program work fine. Thank You! regards: Alexander Hasin Download new ICQ 7.0 ://icq.rambler.ru/ .... .....

I guess some feedback from Avast would be appreciated… this isn’t a usual situation, so…

This seems to be a focused attack, as they are using specific things related to avast!

Iavs-info is the subscription service, but that looks different…and the emails here are also from a .ru domain…

Is there a common link somewhere, i.e. the email provider?

It is quite odd though, and needs investigating…

I’m getting this as well!

Details…

Iavs-info mailing list
Iavs-info@lists.avast.com
http://caracal.avast.com/mailman/listinfo/iavs-info

Please do not send me any emails about updates as youtr link on the page doesn’t work and please send reply in ENGLISH Thank You

Mail Header…

Return-Path: iavs-info-bounces@lists.avast.com
Received: from caracal.avast.com (mx2.avast.com [91.213.143.6])
by mx2.avast.com (Postfix) with ESMTP id 4691D344DD4;
Mon, 1 Feb 2010 11:33:01 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=avast.com; s=default;
t=1265020381; bh=lRtdAWnHGsES7QWE/fgESpNFHzmEeliNVWsQo6ojrfk=;
h=MIME-Version:Date:Message-ID:From:To:Subject:List-Id:
List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe:
Content-Type:Sender;
b=hiFgPmluoqGTxYy4NeXvI1Ct+4y8VBv1Y7/znFXnCpLFqcuTeqRymd/OwYAUTnwfu
fEhGSUBjtkHJzbRd6CqvV24VP/m6dJDQ9X4av5/Fs/2sIdUok+QjT+k7N9EyWkSfO6
vpAW521EVJbQtmUDyDWOiM3z9iknPF/UvAlgvypU=
Received-SPF: pass (googlemail.com … _spf.google.com: 72.14.220.159 is
authorized to use ‘%%%%%%%%@googlemail.com’ in ‘mfrom’
identity (mechanism ‘ip4:72.14.192.0/18’ matched))
receiver=caracal.avast.com; identity=mailfrom;
envelope-from=“%%%%%%%%@googlemail.com”;
helo=fg-out-1718.google.com; client-ip=72.14.220.159
X-policyd-weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_SPAMCOP=-1.5
NOT_IN_BL_NJABL=-1.5 CL_IP_EQ_HELO_IP=-2 (check from:
.googlemail. - helo: .fg-out-1718.google. - helo-domain:
.google.) FROM/MX_MATCHES_HELO(DOMAIN)=-2 IN_PM_RFCI=0.1;
rate: -8.4
Received: from fg-out-1718.google.com (fg-out-1718.google.com [72.14.220.159])
by mx2.avast.com (Postfix) with ESMTP id 69612341976
for Iavs-info@lists.avast.com; Mon, 1 Feb 2010 11:28:17 +0100 (CET)
Received: by fg-out-1718.google.com with SMTP id 19so718706fgg.17
for Iavs-info@lists.avast.com; Mon, 01 Feb 2010 02:29:02 -0800 (PST)
MIME-Version: 1.0
Received: by 10.87.46.12 with SMTP id y12mr7197203fgj.47.1265020142749; Mon,
01 Feb 2010 02:29:02 -0800 (PST)
Date: Mon, 1 Feb 2010 10:29:02 +0000
Message-ID: 158d38e81002010229i6515e50amb33c6adeff9b5f5a@mail.gmail.com
From: shirley dalton %%%%%%%%@googlemail.com
To: Iavs-info@lists.avast.com
Subject: [Iavs-info] emails
X-BeenThere: iavs-info@lists.avast.com
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: “This mailing list is for announcements of new versions of VPS files
via iAVS.” <iavs-info.lists.avast.com>
List-Unsubscribe: http://caracal.avast.com/mailman/listinfo/iavs-info,
mailto:iavs-info-request@lists.avast.com?subject=unsubscribe
List-Archive: http://caracal.avast.com/pipermail/iavs-info
List-Post: mailto:iavs-info@lists.avast.com
List-Help: mailto:iavs-info-request@lists.avast.com?subject=help
List-Subscribe: http://caracal.avast.com/mailman/listinfo/iavs-info,
mailto:iavs-info-request@lists.avast.com?subject=subscribe
Content-Type: multipart/mixed; boundary=“===============4688676635660544934==”
Sender: iavs-info-bounces@lists.avast.com
Errors-To: iavs-info-bounces@lists.avast.com
X-Mlf-KeyWords: emails,page,please_send,reply
X-Mlf-Language-Detected: NoLanguageFilter_english
X-Mlf-Connecting-IP: 91.213.143.6
X-Mlf-Country-Code: CZ
X-Mlf-Threat: nothreat
X-Mlf-Threat-Detailed: nothreat;none;none;none
X-Mlf-UniqueId: i201002011146070015418

I don’t think it is from ALWIL, the genuine iAVS update info is different, I know as I get it:

Delivered-To: xxxxxxxxxxxxxxx
Received: by 10.216.178.12 with SMTP id e12cs132498wem;
        Fri, 29 Jan 2010 18:13:14 -0800 (PST)
Received: by 10.87.42.33 with SMTP id u33mr3196839fgj.8.1264817580400;
        Fri, 29 Jan 2010 18:13:00 -0800 (PST)
Return-Path: <iavs-info-owner@lion.avast.com>
Received: from lion.avast.com (lion.avast.com [91.213.143.55])
        by mx.google.com with ESMTP id d6si3239530fga.9.2010.01.29.18.12.57;
        Fri, 29 Jan 2010 18:13:00 -0800 (PST)
Received-SPF: pass (google.com: domain of iavs-info-owner@lion.avast.com designates 91.213.143.55 as permitted sender) client-ip=91.213.143.55;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of iavs-info-owner@lion.avast.com designates 91.213.143.55 as permitted sender) smtp.mail=iavs-info-owner@lion.avast.com
Received: from lion.avast.com (lion.avast.com [127.0.0.1])
	by lion.avast.com (8.13.1/8.13.1) with ESMTP id o0U2Bv4d028682;
	Sat, 30 Jan 2010 03:11:57 +0100
Received: from localhost (mail@localhost)
	by lion.avast.com (8.13.1/8.13.1/Submit) with SMTP id o0U2AqCW027897;
	Sat, 30 Jan 2010 03:10:52 +0100
X-Authentication-Warning: lion.avast.com: mail owned process doing -bs
Received: by lion.avast.com (bulk_mailer v1.13); Sat, 30 Jan 2010 02:44:27 +0100
Received: from lion.avast.com (lion.avast.com [127.0.0.1])
	by lion.avast.com (8.13.1/8.13.1) with ESMTP id o0U1iQir004063;
	Sat, 30 Jan 2010 02:44:26 +0100
Received: (from majordomo@localhost)
	by lion.avast.com (8.13.1/8.13.1/Submit) id o0U1iQ1O004058;
	Sat, 30 Jan 2010 02:44:26 +0100
Received: from POLLUX.asw.cz ([192.168.1.9])
	by lion.avast.com (8.13.1/8.13.1) with ESMTP id o0U1iPIu004039
	for <iavs-info@asw.cz>; Sat, 30 Jan 2010 02:44:25 +0100
Message-Id: <201001300144.o0U1iPIu004039@lion.avast.com>
X-Mailer: avast! PushMail v1.0 (00095) (c)2003-2006 Jindrich Kubec, ALWIL Software
Subject: New iAVS update released
To: iavs-info@asw.cz
From: avast! support team <support@asw.cz>
Date: Sat, 30 Jan 2010 02:43:56 +0100
X-iAVS4-Push_2.0: vpsm-10013000-740F68DA026437808160B2340D92EB708BCF20D1A64889E7ACCAE9EA9E8968F6C601902FDC297BE7
X-iAVS4-Push_2: vpsm-10013000-740F68DA026437808160B2340D92EB708BCF20D1A64889E7ACCAE9EA9E8968F6C601902FDC297BE7
Sender: owner-iavs-info@asw.cz
X-Antivirus: avast! (VPS 100201-0, 02/01/2010), Inbound message
X-Antivirus-Status: Clean

New iAVS update (VPS 100130-0) for avast! program has been released recently.
Related information could be also found on our web site.
Note: This is a standard update


                                      avast! support team
****************************************************************************
 ALWIL Software a.s., Budejovicka 1518/13a, Praha 4, 140 00, Czech Republic
 e-mail: support@avast.com                               web: www.avast.com
****************************************************************************

<*> To unsubscribe this service use the following link:
    http://www.avast.com/eng/avast-subscription-service.html




---
avast! Antivirus: Inbound message clean.
Virus Database (VPS): 100201-0, 02/01/2010
Tested on: 2/1/2010 3:28:51 PM
avast! - copyright (c) 1988-2010 ALWIL Software.
http://www.avast.com

I am very sorry, it was configuration issue on our new mail server.

When you subscribe for the virus database update notifications on our website, you are basically subscribed to the mailing list to which we are sending the notification. Unfortunately during migration of this mailing list to the new server we made a mistake in the configuration, so an confirmation e-mail with option to opt-out was sent. Additionally it was possible to reply to this e-mail and the reply was posted back to the iavs info subscribers. Very sorry for this.

OK, I prefer to hear this :wink:

That is good to hear…thanks for letting us know.

I suppose then that I wasn’t part of that migration :wink:

Yes it is good hear, I also like to thank you for letting us know. :wink:

Ok, thanks for the feedback , much appreciated !

daaf :wink: