Sudbury Computer Repair Blog

Your email has been hacked. An E-mail worm is an infection that uses your system to send out mass mailings.  It will generally grab your address book and send an email to everyone you know. They expect that your colleagues will open mail if it comes from you.

The new generation of E-mail worms are getting trickier and using address spoofing to help hide the worm.  When a system gets infected, the worm sends out an infected E-mail to everyone in the address book.  The difference is that it uses a random address in the address book as the from address.  This makes it look like the infected mail came from someone totally different that may have a clean system.  This person generally gets blamed by everyone for sending out the infected E-mail when they actually had nothing to do with it thus making it more difficult to track down the actual infected system.

If you are accused of-, or think you may have an infected computer system, take these steps.

1. Run a virus scanner and a malware scanner to make sure that your system is actually clean.
2. Look at the headers of the E-mail to see where it actually originated from as this can help convince people that you are not the one who is infected.  Here is a good site to help you interpret E-mail headers.  http://www.mxtoolbox.com/emailheaders.aspx
3. Send a link to this article to your accuser so they can better understand how Worms and Spoofing work.

For more information or assistance, contact Sudbury Computer.

You will want to have reliable email security in place to protect your business network. If you are hosting email in house, you have a few options.  Use software on your mail server, use a device on your network to scan your mail before it hits your mail server or use a cloud based solution.

Using software on your mail server can be effective but it puts a lot of extra stress on your mail server as well as your network.  It also is not the best idea to allow infected mail to hit your mail server before dealing with it, although there are several decent products on the market that handle this fairly well.  This can be a fairly inexpensive solution up front with reasonable ongoing support/maintenance costs.

Using a hardware filtering appliance is a nicer solution although the upfront costs may be prohibitive.  You will also have ongoing support/maintenance costs with this solution.  The hardware appliance will scan all of the mail after it arrives on your network and will only hand it off to the mail server once it is certified virus/SPAM free.  One downside is that mail is still coming into your network stressing your routers, switches, etc.

Cloud based solutions check all of your mail on their servers, forwarding to your mail server after mail has been certified clean.  They will block infected email and SPAM before it hits your network keeping the load off of your routers, switches and mail server.  The online solution will prevent you from using extra bandwidth and unnecessary storage.  You will pay a monthly fee per user.  This is the preferred method of Sudbury Computer because with the massive amounts of SPAM coming in these days, this traffic can  be overwhelming to a network.

With any of these email security solutions you will have a method of scanning through blocked mail to see if anything was identified that wasn't SPAM (false positives) and will have the ability to release it.  You will also have the ability to create white lists for people that you always want mail to be allowed from.

For more information on email security options, contact Sudbury Computer.