It is probably not Klez. Your sever is the one that sent the alert so it couldn't have come from the outside. If it were a klez infection on your internal network you would be seeing alot more of these from probably most of your users.
Sounds more like a spammer or an open relay issue. - Peter O. -----Original Message----- From: Robert Moir [mailto:[EMAIL PROTECTED]] Sent: Thursday, September 19, 2002 8:36 AM To: Exchange Discussions Subject: RE: Exchange Security Breach???? You could start by reading a description of what klez actually does, paying special attention to the bit about forging emails from totally innocent people who have nothing to do with the virus infection. -----Original Message----- From: Rama Arumugam [mailto:[EMAIL PROTECTED]] Sent: Thu 19/09/2002 16:22 To: Exchange Discussions Cc: Subject: RE: Exchange Security Breach???? What do you mean don't worry about? By the way we have NetShield and GroupShield both running on our exchange server and we do block most of the extensions (.exe,.vbs, etc.) from coming in. Rama Arumugam Network Administrator Wire DynamiX.com (253) 395-4527 -----Original Message----- From: Tom Meunier [mailto:[EMAIL PROTECTED]] Sent: Thursday, September 19, 2002 8:20 AM To: Exchange Discussions Subject: RE: Exchange Security Breach???? It's Klez. Don't worry about it. > -----Original Message----- > From: Rama Arumugam [mailto:[EMAIL PROTECTED]] > Posted At: Thursday, September 19, 2002 09:28 AM > Posted To: MSExchange Mailing List > Conversation: Exchange Security Breach???? > Subject: Exchange Security Breach???? > > > Hello everyone, > One of my users (unfortunately it's my Supervisor) got an > alert from Group Shield saying that his attachment (.exe) was > blocked. But he swears that he didn't send out any emails. > Couldn't argue with that. Not only that, we were unable to > find anything on his Sent Items folder either. Here is what > he received on his inbox from Postmaster > **************************************************** > -----Original Message----- > From: postmaster [mailto:[EMAIL PROTECTED]] > <mailto:[mailto:[EMAIL PROTECTED]]> > Sent: Friday, September 13, 2002 2:55 PM > To: [EMAIL PROTECTED] > Subject: Undeliverable mail--"Helvetica" > The following mail can't be sent to [EMAIL PROTECTED]: > > From: [EMAIL PROTECTED] > To: [EMAIL PROTECTED] > Subject: Helvetica > The attachment is the original mail > ************************************************************** > ************** > ***** > I just can't seem to find any information on this on the > internet. "Helvetica" is a font. That's all I've got so for. > Could this be a Security breach? Is someone using my exchange > server? Has anyone received any messages like this before? > Please help. Any input is welcome! > > Thanks everyone! > rama > > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] .+--xm ,)じr(��� \b飽!鯶 0 집&zǚ쫱r,:.˛ m隊[hy汧\z[,じ)r퉄ZZvhཧ+-i٢2뀞G( _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
