Would the typical mass mailing worm leave the outgoing messages in the Sent Items folder or would it clean up after itself? Symantec detected Beagle.X on one of our systems, but it looks like it cleaned it out of an incoming e-mail, not removing an installed virus. We had complaints of porn related mailings coming from it's mailbox, but I suspect it's an outside computer spoofing the address of our users (one of the mail accounts involved is on a PC that isn't plugged in).

How can you test your traffic to see if a virus has opened a back door into your system? I.E, the latest MyDoom drops Zindos.A and tells the virus creator that your system is open. Of course, AV software should remove both. For the sake of arguement, how would you detect an infection without AV software (short of verifying every process against sysinfo.org), remove it, and be assured it was gone. Is there anything one can do but but your fate in the hands of McAfee, Symantec, et all?

If you ever do get a virus, here is a list of 73 removal tools for different viruses. Each one will run from an A:\ disk. I keep them all on CD for customer housecalls.

http://securityresponse.symantec.com/avcenter/tools.list.html

The mass mailing worms will clean up after themselves very nicely.

As far as what you have already? TrendMicro has a good online scanner that can identify existing infections. Then DL the appropriate removal tool from Symantic.

If I had a system that was highly suspect:

1. Look at the Processes in your Task Manager and learn what they are.
2. TrendMicro online scanner.
3. Run HiJackThis and learn how to read the report.

_________________________
The internet is no longer a toy, it's a COMBAT ZONE!

beagle uses its own SMTP engine to send email. Outlook or OE never sees the email.

A good firewall should block beagle email. Personal firewalls should be set to prompt before allowing outbound access. Look at the log occasionally for unusual activity.

http://securityresponse.symantec.com/avcenter/venc/data/w32.beagle.b@mm.html

Thanks for the feedback, guys.