Email tracing and possible virus 1

[thegirlofsteel]

Hi all. I am an IT Manager for my company. I had this strange incident that one of our employees has a personal web based email account. He checks it everyday, sends and retrieves. Now the big ?????

On our server, we use GFI Mail Security to block viruses and GFI Spam filter. My Mail Security caught an email coming from a person on his personal web based address book. Mind you, he doesn't send his personal email through our company exchange server.

How did it hijack the personal email addresses. Now one thing that might lead me to believe it got to our system is he sends ecards to people in the agency and that ecard program has its own email address list. Is it possible it came from there.

Another weird thing is it was of a very personal nature (a mistress' email) and GFI caught it and marked it for quarantine. It bounced back and sent a message along with the text to people in that address list which includes his boss!

 

[eyec]

looking at the header info (IP addresses) and message ID line you might be able to narrow it down to the ISP that originated the email & they could possibly aid you from there.

 

[thegirlofsteel]

The real big problem is it sent a message that is very personal in nature and which included photos. Is there a way, that I, the network administrator can locate that email on the other employees exchange mailbox? Like I stated above, it went not only to the recepient but also to others on that hijacked list including his boss.

 

[eyec]

if it originally went out to all reciepients in a single email then search your mail server using the message id line.

if it came into your server on individual emails then search for the sender's name.

however, it may be a moot point if it already arrived and people have already seen it.

i would think your concern would be how this applies to company policy not that it may embarass someone - you cannot save people from themselves!

review company policies on use of web-based email & the sending of it during work hours or from company computers.