Virus Emails are Getting out of Hand

[stevenriz]

Help! I believe someone here has a virus either locally or some others connect to our system via VPN and use their personal computers to run Outlook and attach to the Exchange server here in the office. Here's the deal and it is slowly getting worse. There are arbitrary emails being sent by users who say they aren't sending them. For instance I was just asked if I sent an email with the Subject of "Honey" to someone in the office here and I did not but I noticed the IP address and domain of the sender was someone on adelphia.net who I think is someone working from home via broadband and VPN. I know it sounds confusing but is there any central way I can stop or at least slow down these emails? We do have McAfee on the server itself and it is up to date. Suggestions?

 

[epohl]

This particular Virus was probably Klez.H. Unfortunately it will search the infected computer for email addresses and randomly choose one as the from address. So unfortunately this email was not from you and did not pass through your email server. So basically you have no control over it. However I would definitely make sure all your remote users have current virus definitons before allowing them to connect to your network through VPN.

 

[stevenriz]

makes sense. thank you I will check all remote computers asap!!

 

[techjulie]

I've found Norton Anti-virus for MS Exchange to be invaluable in cutting down the amount of viruses our users have the opportunity to open. It's available as Norton Anti-virus Corporate Edition on the Virus Protection for Gateways, Firewalls and Groupware CD. It enables us to block attachments (by registry - no interface) by type so the files get blocked before the users have an opportunity to open them.
-JN

 

[stevenriz]

Thank you all, I actually found a couple computer culprits that had Klez and no virus protection. I viewed options of the emails and tracked the virus to be coming from two separate computers (two IP addresses). One IP address was of a company we do business with. We notified them. The other was a remotely VPN connected computer with an IP address from our scheme and DNS of her internet provider. I thoroughly cleaned her computer and gave it back to her. Thanks for all your help!