Getting replys from emails that haven't been sent???

[fumper]

Hi All,

I am new to Exchange 2000 administration so please be kind...

Some, but not all of my users are getting replys from that the email they have sent contains a virus or the mail was undeliverable. My users tell me that they are not sending the emails, and I do believe them.

For example, jsmith@mycompany.com is getting emails from administrator@anothercompany.com that jsmith's email has viruses attached or saying the mail is undeliverable. The problem is that jsmith never sent an email to anyone at anothercompany.com.
I have run anti virus scans, (CA inoculate it, and also micro trend virus wall), but it does not find anything.

One of the VP's received a ton of these messages and now wants answers...

Can anyone please help?

Thanks in advance.

 

[Claudek]

In Basic terms, someone gets infected with a virus. The Virus looks through that person's Address Book and begins to send out random emails using the email addresses in the Address Book. It randomly uses the email addresses in the From Field.
So this means that someone may get a virus which appears to have been sent by a user in your company. This does not mean it is your user who sent the email, simply someone who had that user's email address in their Address Book and got infected by a virus.



Claudius (What certifications??)

http://www.iteq.com.au

 

[xmsre]

Sounds very much like one of the mass-mailer virii that appeared late last year. Mimail or sobig would use common aliases like jsmith@targetdomain.com in the spoofed from address.

 

[2cornot2c]

Simply send the VP a link to Symantec's website and have him read some of the newest threats. Almost all of the new viruses are using random From and To addresses found in documents and addressbooks of an infected computer.

Make sure that no one on your network is infected with any virus or trojans. Is your Exchange server behind your firewall. If so, to be safe you should monitor your firewall for outgoing traffic when everyone is off the system. Look for any mail being sent out from your network and verify if is lagit. If you see emails being sent out when no one is working and there is no explanation, check for viruses and trojans on your servers. Make sure that your exchange box isn't being used as a relay.