Re: FN-FORUM: [ot]Ganda Virus

date posted 4th August 2003 12:22

> Is there anything such as a startup folder for Outlook so when it runs it
> launches something?
Not really, just the preview pane. Anyway, if you are running Exchange,
Outlook doesn't initiate anything. It just attaches to the server-based
mailbox for the user. The SMTP connector (and POP3 connector possibly if you
are using SBS) in Exchange does the work of sending and receiving external
mail.

Several of my friends are Exchange MVPs and one works for MS PSS, so if you
are able to send me the server details off list (ip address and domain
name), I can get one of them to check it out for you and see if there are
any other ways in. If there is a trojan-type script on IIS, it could be the
culprit. Also, send SMTP logs and IIS logs for Sat and Sun and I'll see if
there are any clues.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Kathy
http://www.vendetta.co.uk
+44(0)7005 982 261
DNRC Minister for Useful but Irritating Information and Trivia
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

----- Original Message -----
From: "Mark Chappell" [EMAIL REMOVED]
To: [EMAIL REMOVED]
Sent: Monday, August 04, 2003 12:31 PM
Subject: Re: FN-FORUM: [ot]Ganda Virus


>
> Kathy,
>
> Thanks for the top information. I checked and it's not running an open
> relay and the passwords are using strong password protection settings (as
in
> NT).
>
> Did notice thought that a few viruses of different sorts were found on the
> IIS server in the c:\inetpub\scripts directory but they seem to be
> unrelated.
>
> Checked in on saturday and only 15 "undeliverable messages" were in so I
> thought I had cracked it. Logged in this morning and there were another
90.
> Is there anything such as a startup folder for Outlook so when it runs it
> launches something?
>
> Mark
>
>
> ==========
> fido.net are pleased to sponsor these Freelancers messages. For all
> your web hosting needs check out http://www.fido.net/ with hosting
> packages starting from just £46.95 a year including VAT.
> Free 0871 Fax2Email numbers also available online!
> http://www.fido.net/ - the internet made simple! - 0800 1072 666
>
> To advertise here: http://www.freelancers.net/advertising.html
>
>