Getting back to the problem, I think you should use Outlook to look at the Internet headers of one of the messages that had its attachment stripped. You should be able to see in there the ip address of the sending PC.
-Peter -----Original Message----- From: Fioon [mailto:[EMAIL PROTECTED]] Sent: Wednesday, May 15, 2002 17:58 To: Exchange Discussions Subject: RE: Virus Attack ?? Hi all.. I'm using Exchange 5.5. It's multiple users. Email auto generate by multiple user. For e.g. My address book have [EMAIL PROTECTED],and etc. Even thought this user (abc) did not switch on the pc, there was still have mail from his mailbox send to other people. But i have scanned this user pc, no virus detected. Below is e.g. of the mssg is normal alert generate by Exchange to all the administrator. I cant found any clues from the msg, i have ask the Victor :- user whether did he send mail..but he said no. Sender of the infected attachment: Victor_Hoon Recipient of the infected attachment: Ho Ping Ping\Inbox Subject of the message: Powered by One or more attachments were deleted. Attachment color.exe was Deleted for the following reasons: Virus UNAUTHORIZED FILE was found. This msg is generated because we had blocked the *.exe HELP -----Original Message----- From: Durkee, Peter [mailto:[EMAIL PROTECTED]] Sent: Thursday, May 16, 2002 12:55 AM To: Exchange Discussions Subject: RE: Virus Attack ?? It might be the klez virus, which likes to spoof messages from postmaster. Usually these spoofed messages come from outside and don't indicate an infection inside the domain. Look at the headers of the messages to get an idea of where they are really coming from -Peter -----Original Message----- From: Soysal, Serdar [mailto:[EMAIL PROTECTED]] Sent: Wednesday, May 15, 2002 7:33 To: Exchange Discussions Subject: RE: Virus Attack ?? One user or multiple users? Serdar Soysal -----Original Message----- From: Fioon [mailto:[EMAIL PROTECTED]] Sent: Friday, May 10, 2002 2:50 AM To: Exchange Discussions Subject: Virus Attack ?? Hi Recently my exchange server (email=postmaster@domain) keep on auto generate mail to the user inside the address book. I have scanned ! I have tried everything ! But it still happening ! PLS HELP Fioon _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] ______________________________________________ This message is private or privileged. If you are not the person for whom this message is intended, please delete it and notify me immediately, and please do not copy or send this message to anyone else. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] ATTENTION! The information contained in this E-mail may be CONFIDENTIAL and PRIVILEGED. It is intended for individual or entity named above. If you are not the intended recipient, please be notified that any use, review, distribution or copying of this E-mail is strictly prohibited. If you have received this E-mail by error, please delete it and notify the sender immediately. Thank you. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] ______________________________________________ This message is private or privileged. If you are not the person for whom this message is intended, please delete it and notify me immediately, and please do not copy or send this message to anyone else. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
