Software

Ask something
Discussion Locked

How to stop emails from unknown sources

0 helpful
3 replies

by angiec

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Several users on our network are receiving emails from unknown sources on a daily basis. Does this mean that our system is being hacked, or is this a virus? We did recently get hit with the W32Klez worm, however we deleted all the files associatedwith the worm and repaired the affected Windows registries. It's possible that something was missed. What can we do to stop this?

3 replies

by dmiles

Was the system taken off the NEtwork when cleaning the virus?

It may have migrated to other computers,run the anti-virus on individual workstations
You may still have remnants of the virus,that could be generated through the email

Use logic,if the source is not known donot open file and try to determine where the email is originating from

Use Find,File or Folders and check the system for unknown Folders that has a large quanity of files listed in folder,then you may be able to track the folder to determine if it was leftd over from the virus.

by angiec

We seem to have strange things going on that i'm not sure if the two instances are related. First, the PDC wasn't taken off the network during the virus cleaning. However, it was scanned and the worm was found. The pc's that are still receiving the emails have been scanned, and no viruses have been detected. The users have been instructed not to open any emails from unknown sources. Before deleting, I examine the email properties, etc.

Secondly, it seems as if someone is using our mailserver to send outgoing messages to Korean adult web sites. We've blocked the web site from coming into our mail server, but haven't figured out how it was penetrated in the first place.
Could these two issues be related? What should we do?

by [_rick_>

If you are using Exchange 5.5 as your email system then you wan to make sure that you have ALL of the patches installed. A recent find and one that is being used by spammers is the relaying from the SMTP or IMC. If this patch is not installed your Exchange 5.5 server can be used as a relay.

If you are using Outlook 98 or 2000 recommend updating with the security patches provided by Microsoft. these patches will help block attachments at the client level and will also alert the user if an unknown thread is attempting to gain access to their address book via Outlook.

With the KLEZ worm, it uses its own SMTP code and will bypass what ever you have setup as a SMTP gateway. To prevent this from going outside your environment place strictpolicies on the Firewall to only except outbound port 25 calls from your SMTP server and not from any other IP address.

Use a filtering/virus scanning utility against all inbound messages to your environment. Preferred to have it on the firewall,then server and finally client. Having these in place will go far in helping to prevent attacks from worms, viruses and other malicious code.

Good luck
Rick

This discussion is closed to new replies.