NetSky And Bagle spoofing sender's email address problem

Hi,
I got a problem with these two worms. Though, we manage to stop and reduce the worm and virus from entering our network - our mailboxes are bombed with emails alerts or emails generated by these two worms.

The problem is though we had scan and confirmed via the email header, that these emails does not originate from our users - it is difficult to explain to the management.

We are wondering whether anyone else is having the same problem, and how is this solved?

Thanks.

p.s: Any ideas is welcome, thanks

 

You're not alone on this one. The whole world experiences these side effects and there is no way you can stop it right now.

Best way to communicate is to perhaps point to the information pages of your AV-supplier. Most have decent info about the distribution side of these virusses and worms.
Make sure that you update signatures at least once per day. Inform all your end users in your organization. They will have the same problem at home as the organization.

That's all you can do. It will keep you busy

 

There are several corporate solutions too; depends on where you're located and what the wishes are and budget of course, and how far the people agree the company can go with the email privacy.
If you like you can IM me.

 

Hi,
I'm interested to know more about this.

Thanks.

 

Hi Tiza,
I just IM-ed you a very little bit.

In general there is a lot of software around to scan and filter all email.
For corporates there are of course privacy laws for email.
So it is about clear on whole internet the end-users solutions with filtering and scanning software are not really sufficient and heavier measures are to be taken.
So there are special steps /servers/ filters / scanners possible via which all email is lead before it enters your company's mailserver at all.
One can think of filtering out al kinds of infections, but also to use the special intelligent filtering for spam and setting up rules what to do with it in case this or case that.
Those anti-spam services (let me give it this name for now) can be placed before the company's own system, or in central data centers elsewhere for a relative small amount or even on own servers there, and without too much time loss even.
Of course this saves companies lots of problems, time and money so there is lot of interest in these services.
In fact all corporations should install or subscribe on such services.


EDIT:
Tiza, i sent you an IM: if you look in upper right corner of the forum under your name, click "messages" to go to your mailbox and read/reply to your message(s) please. Thanks!