Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Received from local host 127.0.0.1 ???????

28 Mar 2011   #1
joecrash

Win 7 HP 64 bit
 
 
Received from local host 127.0.0.1 ???????

I've been plauged by trojans and worms in spoofed emails with forged headers. So, I now at least look at the email headers now, even if I do not understand all of it - I had this in the header of 2 emails today:

"from localhost ([127.0.0.1] helo=sfs-ml-2.v29.ch3.sourceforge.com) by sfs-ml-2.v29.ch3.sourceforge.com with esmtp (Exim 4.74) (envelope-from <sleuthkit-users-bounces@lists.sourceforge.net>) id 1Q47OU-00008s-Gd; Mon, 28 Mar 2011 08:01:46 +0000"

What does this mean? Is this a spoofed email header?

Thanks in advance for your help!


My System SpecsSystem Spec
.
29 Mar 2011   #2
Bill2

Windows 7 x64 pro/ Windows 7 x86 Pro/ XP SP3 x86
 
 

Sleuthkit is a collection of open source forensic tools. Did you at any time download those or subscribe to their mailing lists?

Old Nabble - The Sleuth Kit forum

The Sleuth Kit | Download The Sleuth Kit software for free at SourceForge.net

You could just block mail from that sender.
My System SpecsSystem Spec
29 Mar 2011   #3
joecrash

Win 7 HP 64 bit
 
 
I didn't look further than the "received from" IP

Yes, I did subscribe to the Sleuthkit mailings. I didn't look past the "local host" part -

So, even if the "received from" portion of the header says "from local host 127.0.0.1"

this by itself doesn't indicate mal/spy ware? I'd just never seen that before, and just assumed it had to be incorrect.

I'm paranoid now because of all the forged emails I've had in the past with trojans in them.
My System SpecsSystem Spec
.

29 Mar 2011   #4
Bill2

Windows 7 x64 pro/ Windows 7 x86 Pro/ XP SP3 x86
 
 

The "from localhost" is a common issue, has to do something with the way the mail is relayed and how the hosts file is setup and what software is used. But AFAIK, it doesnt indicate any malware. If you want to get into the details, post in the networking subforum.
My System SpecsSystem Spec
29 Mar 2011   #5
Clinkz

Windows 7 Professional x64 Backtrack 4 R2
 
 

Quote   Quote: Originally Posted by joecrash View Post
"from localhost ([127.0.0.1] helo=sfs-ml-2.v29.ch3.sourceforge.com) by sfs-ml-2.v29.ch3.sourceforge.com with esmtp (Exim 4.74) (envelope-from <sleuthkit-users-bounces@lists.sourceforge.net>) id 1Q47OU-00008s-Gd; Mon, 28 Mar 2011 08:01:46 +0000"
!
I really wouldn't be concerned, if you take a closer look you can see what its doing.

When it says localhost ([127.0.0.1] it is talking about the loopback address on your machine.

by sfs-ml-2.v29.ch3.sourceforge.com with esmtp this is the mail server address which uses esmtp (a mail protocol) to send it.

(Exim 4.74) is the mail server which sent the mail

sleuthkit-users-bounces@lists.sourceforge.net is the email adress it sent from

Mon, 28 Mar 2011 08:01:46 is just your date/time stamp for the email.

Nothing out of the ordinary here, all this text is in every email, you just normally cant see it.
My System SpecsSystem Spec
29 Mar 2011   #6
joecrash

Win 7 HP 64 bit
 
 
Thank you

Thanks for looking at that, it lessens my paranoia a bit!

I'll have to research email headers and forging them to be able to pick the bad ones out in the future, but at least I know I'm OK for now.
Thanks Again.
My System SpecsSystem Spec
29 Mar 2011   #7
Clinkz

Windows 7 Professional x64 Backtrack 4 R2
 
 

Glad i could be of some assistance.
My System SpecsSystem Spec
Reply

 Received from local host 127.0.0.1 ???????




Thread Tools




Similar help and support threads
Thread Forum
How can you print to local printer in RDP from the local PC?
I have a user is on his personal Win 7 home PC with his Canon printer plugged in via USB. From his home PC, he VPN's and RDP's into his Win 7 box here at the office. The question is that he would like to print files within the RDP session from his local printer connected to his local home PC. Is...
Hardware & Devices
Received a BSOD! - Please help
Hello everyone and Greetings from Down Under!, Recently I've installed Windows 7 as a dual boot to Windows XP (Windows XP was first) . Windows 7 works fine while I am using it, but after leaving it for a while, ie it sits idle or I go away from the computer for a bit, I come back and I get a...
BSOD Help and Support
See all reps given and received ?
Hi all, I know you can see the latest reps given and received in User CP. But is it possible to see all the reps given and received and also the amount of rep given or received ?
Chillout Room
Local Host runs so slow on Windows 7
Hi I switched from Xp to Windows 7 Pro. Since then I noticed when I run my website(asp.net mvc) in local host it goes so so slow(I mean like 10 to 20seconds per page). This should not be. I then tested it with sloppy to mimic a user of 256kb and it loads up alot faster(maybe 2-3seconds at...
Network & Sharing


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 05:07.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App