User ID Stolen by spammer

Have you checked the header information to verify that the e-mails are actually coming from your server? It's very easy to fake an outbound e-mail address, but the header info is a little harder.

Sounds an awful like the W32.Klez.H@mm virus. Go to the following web site and follow the instructions for clearing out the virus:
http://www.symantec.com/avcenter/venc/data/w32.klez.h@mm.html

Good luck. Hope this helps.

Agree with the second answer it is the KLEZ.H worm that is the culprit. But I doubt that you are affected.

The KLEZ.H worm will impersonate at random a email address it finds in a message or address book at the system which is infected with the worm. Which means a customer, client, contact, partner, etc of yours could be effected and the worm has built a list of address to use as return addresses and hit (send to) from them. This makes the worm very difficult to find and eliminate, because you don't know where its 'really' coming from.

Best recommendation for your office, if using Outlook 2000 and IE 5.5/6.0 apply all secuirty patches available. Some of the patches are strict - but they will stop an accidental outbreak of this worm.Also there is a May '02 patch for IE, using this patch with the Security Updates with Outlook will prevent the WORM from killing your own enterprise.

Installing these patches will place strict requirements on how attachments, addressing and the use of 3rd party software is used with Outlook. You should also install the Security Admin kit which will allow you to control the security measures of each Outlook client from the server.

Another key - have your FIREWALL port 25 directed to only accept outbound pass-through from your internal SMTP server and to decline all others. The KLEZ worm will use its own SMTP code to send outgoing messages.

Good luck.

This question was closed by the author