Tracing Netsky virus emails

[meby]

My network of over 250 computers keeps getting infected with Netsky.P viruses. It's usually 2-3 computers that bring the network/Internet to a crawl. Is there any way that I can look at the badmail folder and determine the origination of the email. That'd save a lot of time have to check each and every machine on the network. Unfortunately my superior doesn't want to invest in enterprise wide anti-virus software.

Thanks

 

[rtichnor]

Check the connections at the firewall. That will give you the IP addresses right away.

Good Luck !!!

 

[meby]

Firewall? We don't have a firewall hooked up. It's sad but we are wide open. The only protection we have it our router and that isn't protection at all. In about a month we'll have a firewall in place as well as virus protection via another company that is going to be handling our email. However, in the meantime we need to be able to search and destroy as quickly as possible.

We are running Exchange 2000 on a Windows 2k box. The systems on our network range from Windows 95 to Windows XP SP2.

 

[Marcs41]

250 computers and No firewall? No Antivirus?

Pull out the cable NOW I would say.
That is totally irresponsible these days.

Whoever is in charge of budget needs to write a check immediately to get that in place.

Those mails are just going to keep coming in, as as long as you are not stopping them, you r are in an endlessloop, with total failure as a result!

Users will click on anything they see, you know that. If using Outlook, with preview pane ON, they don't even have to click...

You are in a scary situation, and I cannot stress enough the importance of acting NOW, not in a Month!
Especially the anti-virus.

While you are at it, check for relaying too ...

Marc
_{If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all. Please specify details.
Free Tip: The F1 Key does NOT destroy your PC!
How Do You Get Great Answers To my Tek-Tips Questions?} See faq222-2244

 

[rtichnor]

I agree with with marcs41, but don't you have someone there who can limit the problem by configuring your router to block communications that are dangerous?
If you don't have a fire-wall, then check your connections at the router. You should see the IP addresses of the infected systems.

How many people do you have in your IT department?
Do you host your e-mail locally?

 

[meby]

We currently have 3 people in our IT department. Myself and 2 technicians. I am a converted technican and am having to learn networking and stuff on the fly. It's rough and quite stressful. However, I just have to try to glean as much information off of people who actually know what they are doing like you guys.

Thanks for all the help.

Mark

 

[rtichnor]

I feel your pain.

Now, try to look at the connections from your router. That will help you very quickly. What router do you have?

 

[meby]

I have a Cisco 3640 handling all of our P2P T1s to the various schools and a 2640 connected that is the Internet gateway and connected with to the 3640 via the Fast Ethernet card. We are hoping to get a Netscreen 25 Firewall in place to go between the 2640 and 3640 soon.

Mark

 

[bytehd]

Yo,
whats a used Linksys....
$5...

http://www.insyncva.com