relaying? virus?

[parker309]

I have an Exchange 2000 server that is running Trend-Micro ScanMail. I have tested the server for open relay and have had no probelms with it for the last year. The last couple days ScanMail has blocked 12 different messages containing one of the many popular viruses. Normally this would not alarm me, however the sender of some of the messages "appear" to be sent from an internal account that doesn't exist, staff@companyname.com. There is no user or delivery mailbox setup for staff.

Has someone in the organization been infected or has someone from outside been able to relay off my server? Thanks in advance.

 

[Davetoo]

Sounds like one of the Beagle viruses..read up on what it does and you'll see it probably matches what you're seeing.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[ErikU19]

They could be spoofed. I use trend micro server protect and office scan...i run into these emails when new viru's come out...undeliverable's are norm too...

 

[jbead]

it is probably spoofed - I am getting alot lately

JBead

 

[parker309]

Does this mean I have a problem or will it clear out as the influx of the virus dies down?

Thanks again.

 

[Davetoo]

It'll just have to run its course, nothing you can do about it other than notify your users of the issue so they don't respond to the spoofed emails.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.