Possible E-Mail Virus

[RSA2000]

Hello,

I've got a wierd problem . . . yesterday someone noticed their e-mail not being delivered to its destination. Once the server was checked it was determined that hundreds of e-mails were being sent out every minute which was delaying the official e-mail from being delivered. My first thought was NIMDA! Of course the latest anti-virus signature files were updated and each station was checked for viruses. Two anti-viral programs were used and no viruses were found. Secondly, a NIMDA anti-removal tool was ran on each workstation which yielded no results as well. What the heck is this? I checked for any other viruses out there, but can't find anything. Any ideas?

 

[paulwood]

May be Sircam check for Symptoms
- Presence of SCam32.exe in the WINDOWS SYSTEM directory
- Presence of Run32.exe in the WINDOWS directory
or Magistr check for Symptoms
- Icons on the desktop move when the mouse cursor passes over them
- Increase in size in .EXE files (adds 24Kb or more)
- Infected files use a modified access date of the time of the infection
- Presence of a newly created .DAT file containing email addresses (representing those users which were sent the virus)

Otherwise it may be a memory resident virus/worm which regular virus checkers have difficulty with, or a spammer using your email server to mass email. Do you have any sort of firewall?

 

[RSA2000]

Thanks Paul,

Yes, we have a firewall and we are using NAT. I'll check to see if there are any workstations with the files as you indicated. I guess a spammer can get in if our ISP is infected with a virus . . . I guess?

 

[paulwood]

Mostly spammers work with programs specifically written, and unfortunately available on the internet, to access mail servers so they don't need an infection as such although a back door trojan would be helpful to them.

As a matter of interest, can you track the email addresses being sent to, and do they have any attachments?

 

[RSA2000]

The e-mail messages that are non-deliverable I can view and see that they are using our serving to send all of their spam mail out. I spoke with Novell today and installed the latest GWIA patch which fixes the relaying on the server and that worked for 20 minutes and then the bastards were back! It is causing me grey hairs!

 

[paulwood]

Bad news! Sounds like they are using an email flooder program, if the patches don't work, maybe changing the name of your smtp server would do it as a last resort. I know this is a real nuisanse for your users, but the spammers test servers by trying smtp.whatever.com until they find a server that is open. Either that, or Novell will have to try a little harder!

Just in case, I assume you have checked for a back door trojan on the system?