Topic: Help! I've been hacked!

[zook]

I've been using sme-server since version 4, and am currently on 6.01-01.  Even though I've been using if for a while, my technical expertise is not that great - I still consider myself a newbie.

With that being said, it appears that someone has hacked into our system.  We currently have 41,000 messages in the mail queue.  I have turned off PPTP access and remote access to email.  My question is, can I get to these messages in the queue and delete them?

Thanks in advance for you help.

[cc_skavenger]

hacked or does one of your workstations have a virus?

[jackl]

My bet is Marco is right, there is an rpm to manage mailQ at

http://no.longer.valid/mylinks/singlelink.php?cid=81&lid=294

Regards
Jack

[zook]

Thanks for the replies.  As it turns out, you're right.  One of my machines had WORM_SOBER.S

What a PITA!  I've wasted the whole day.

Thanks again.

[raem]

zook

> I have turned off PPTP access and remote access to email.

Are you using remote access to pop ?
It is not secure.
You should only use https webmail or secure pop/smtp using Damiens contrib.

Is the smtp proxy still enabled ie did you disable it to allow direct access to external pop accounts from workstations ?
If enabled it will prevent viruses from sending messages directly to the Internet as they must go through your smtp server, that maybe is what happened.

Do you have "pattern matching" configured (?) as you will get very few infected email attachments if you are using it.

Also do you have Jesers antivirus filter installed and configured to scan incoming as well as outgoing messages (as an additional layer of virus protection) ?

Do you have RBL lists enabled & configured (?), they will also reject a lot of virus infected messages as a side product of their usage.

Do you have regularly updated virus scanner on your workstations running daily scans eg AVG or similar (?), at least if configured to scan outgoing messages will add additional layer of virus security to stop the spread of infected messages.

Just thought the above suggestions might be of use now that you have had the pain of tracking down a nasty workstation infection ie NEVER AGAIN !

[CharlieBrady]

Thanks for the replies.  As it turns out, you're right.  One of my machines had WORM_SOBER.S

Please edit the subject of your original post - "I've been hacked" was never accurate, and is misleading.