Solved

Beagle.AG help

Posted on 2004-09-16
2
207 Views
Last Modified: 2010-04-11
The problem:
a user (the CEO) brought an infected laptop onto our network. It was mostly infected with BeagleAG.  There was no blatant noticable affect to our network, no slowness nothing bogged down, even the PC itself was not running too bad...


1. the virus definitions had not been updated since 21 July. He was running SAV 8.1. Live Update appeared to have been disabled.  updated to SAV 9.0, same def. date. completely removed SAV and reinstalled 9.0 updated to current definitions.  

2. SAV found 250 infected fles and quarantined them all.  Ran removal tools, and a full system scan. Also ran full system scan in safe mode. the removal tools and scans found nothing else.  System restore had been disabled before scanning.

3. The other executives began getting emails 'from' other execs with the BeagleAG virus.  None of these other PC's are infected.  No one outside of the Sr Mgt group is recievng the messages.  All viruses are being detected and quarantined.
 
My question:
Why is the message still being sent to other Execs?? And if the message is being decteted and quarantined why/how is it still getting forwarded?

keep in mind that we are talking about 5 out of 100 users and that the messages are only being sent to this specific group.  No one else in the company is getting these messages from these or any other users.

OS is WinXPSp1 on all clients.  SAV9.0, Exchange 5.5

Thanks for the help
0
Comment
Question by:Clamsy
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 1

Accepted Solution

by:
Keravi earned 500 total points
ID: 12075888
I would check for the presence of Internet headers on any of the infected emails to see if they are coming from the outside, unless you know that your AV solution would stop these before getting to Exchange, or, your AV is cleaning the infected attachment but allowing the message to continue on to the clients. My bet is that one of the  Execs' home computers or even corporate laptops that haven't been inside for cleaning yet is perpetuating this problem, and that would explain why only certain members (execs) are still getting this. I would also check the exchange logs to try to correlate to any hosts that are sending this out.
0
 
LVL 2

Author Comment

by:Clamsy
ID: 12076444
Thank you!
I never tought to check the mail headers.  The messages were from an external source.  I have blocked the domain from Exchange.  I am just glad they are from n internal source.

The AV is cleaning the attachment but is also sending along the infected message to other users, only one at a time.  It is not a situation where my 70 users are slammed with junk.  I am talking about two to three messages a day and only to these 5 users.

Thank you again, points  awarded.
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
Most MSPs worth their salt are already offering cybersecurity to their customers. But cybersecurity as a service is wide encompassing and can mean many things.  So where are MSPs falling in this spectrum?
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question