Exchange Server Forums

Virus? SMTP (Exchange Server 2003)

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [Microsoft Exchange 2003] >> Server Security >> Virus? SMTP (Exchange Server 2003)

Page: [1]

Message

<< Older Topic Newer Topic >>

Limited time MSExchange.org offer! -- 1.Sep.2008 1:00:00 PM

TechGenix and SolarWinds have partnered to provide free copies of SolarWinds Exchange Monitor to all visitors who join the MSExchange.org Forums. SolarWinds Exchange Monitor is a handy desktop dashboard that continuously monitors Microsoft Exchange to deliver real-time insight into Exchange services, mail queue sizes, and host server health. Learn more about Exchange Monitor and the free offer!

Virus? SMTP (Exchange Server 2003) - 21.Jun.2005 10:02:00 AM

aharris23

Posts: 10
Joined: 19.Nov.2004
From: Canada
Status: offline

Hello,

Just recently my Symantec Mail Security has been picking up the following:

quote:

The message "You have successfully updated your password" located in SMTP has violated the following policy settings:
Policy: Standard
SubPolicy: Virus SubPolicy
Rule: Mass-Mailer Virus Rule
The following actions were taken on it:
The message "You have successfully updated your password" was marked for Deletion for the following reason(s):
Virus W32.Mytob.EE@mm was found in updated-password.htm .pif.

The autoprotect log for last virus shows the following:

quote:

Virus:W32.Mytob.EE@mm
Location: SMTP (SERVER1-{9ABAE96B-51BF-4BD0-98FE-25BB912CE92E})/NON_IPM_SUBTREE/TempTable%231/%234

My Windows 2003 server is completely up to date with the latest patches and security updates. I went through the W32.Mytob.EE@mm document at Symantec and neither the server or my own PCs that I administrate it with have the signs of this virus. I also ran the removal tool and it did not pickup any signs of the virus.

Has anyone had any problems with this? Is this a virus on my server or is someone exploiting my SMTP server remotely somehow and e-mailing out? Or perhaps one of my users has this virus? This is very concerning as I can't seem to find the cause of the problem!

Thanks,

Andrew Harris

Post #: 1

Featured Links*

RE: Virus? SMTP (Exchange Server 2003) - 21.Jun.2005 11:36:00 AM

galbicka

Posts: 29
Joined: 11.Jun.2005
From: Florida
Status: offline

This looks like normal notification that incoming email with this virus was intercepted and marked for deletion. Confirm that it did not get through to the recipient. I don't use this specific product so I am responding based on how mine works.

(in reply to aharris23)

Post #: 2

RE: Virus? SMTP (Exchange Server 2003) - 21.Jun.2005 12:55:00 PM

aharris23

Posts: 10
Joined: 19.Nov.2004
From: Canada
Status: offline

Right now the policy sends an e-mail saying that it was stripped of the attachment. I was just worried that they weren't originating from the server.

Thanks for your reply.

(in reply to aharris23)

Post #: 3