ProperCharlie

hello,

wonder if anyone can shed any light on this:

some users at work are getting dodgy emails from known email addresses. they say things like "your accounts" or "looks like you" and have .pif or .exe attachments.

are these likely to be coming from someone external or within our network? we have up-to-date sophos AV. we run our own mail server. Sophos is not deleting the attachments for some reason. no harm appears to have been done so far, although obviously no-one has attempted to open one of the attachments.

tia.

Cold Turkey

Hi PC

Your IT team should be able to tell whether they are coming in from outside the Company. Check your virus definitions are upto date on the mail server. You can pretty much ignore who the mail comes from as most viruses re-send themselves using random addresses from the users (outlook) address book.

cheers

ProperCharlie

thanks

virus definitions are up-to-date (automatically updates every night). i'll ask the geek to find out if they are coming from outside or not.

BlkKnight

Unless you are explicitly running sophos's mail sweeper (forgot name) it will not touch attachments.

It should intercept them as the user trys to run or save the attachment to disk.

I'm guessing you are using outlook 2000? from service pack 2 onwards outlook stops users getting to "potentially damaging" files - it's well worth the upgrade (although it can be a PITA in some situations).

J

Kieran_Burns

iTrader: (1)

"Ask the geek" <sigh>

Presumably you are using Outlook - you can look at the mail header yourself - View, Options. The mail header will be in the window at the bottom.

Look at the LAST entries as this will be where it started from... if you only see your own Servers or NO servers at all then be worried.

I'd recommend you invest in some decent Mail AV software such as McAfee Groupshield for your Servers and Mail scanning software such as Clearswift Mailsweep.

Oh, and turn on the mail scanning settings for your desktop p.c.'s - Sophos is really naff for this. (we only use it on Mailsweep as it integrates better than most)

Figment

We use Sophos with FTGateOffice mail server and it works well.