txs
>>> "Tara vNiekerk" <TvNiekerk@wc.sahra.org.za> 2012/10/30 08:56 AM >>>
Hi Nancy,
I received your email.
Regards,
Tara
>>> "NANCY CLOETE" <NCLOETE@sahra.org.za> 10/30/12 8:55 AM >>>
Hi Tara,
1. Did you get the email I sent to all staff about IT HelpDesk??
2. Can you please look at the list below and see if these are all people at the Castle office? Is anyone
left out or anyone on there that should not be there?
txs Nancy
>>> <Mailer-Daemon@sahrawc.wc.sahra.org.za> 2012/10/18 09:48 AM >>>
The original message was received at Thu, 18 Oct 2012 09:47:35 +0200
from sahraho.sahra.org.za
--- The following addresses had successful delivery notifications ---
ddavids@wc.sahra.org.za (successfully delivered to mailbox)
GOntong@wc.sahra.org.za (successfully delivered to mailbox)
Gsipoyo@wc.sahra.org.za (successfully delivered to mailbox)
HWares@wc.sahra.org.za (successfully delivered to mailbox)
JSharfman@wc.sahra.org.za (successfully delivered to mailbox)
mkleynhans@wc.sahra.org.za (successfully delivered to mailbox)
SBERRY@wc.sahra.org.za (successfully delivered to mailbox)
swinton@wc.sahra.org.za (successfully delivered to mailbox)
TvNiekerk@wc.sahra.org.za (successfully delivered to mailbox)
>>> <Mailer-Daemon@sahrawc.wc.sahra.org.za> 2012/10/18 09:48 AM >>>
The original message was received at Thu, 18 Oct 2012 09:47:35 +0200
from sahraho.sahra.org.za
--- The following addresses had successful delivery notifications ---
ddavids@wc.sahra.org.za (successfully delivered to mailbox)
GOntong@wc.sahra.org.za (successfully delivered to mailbox)
Gsipoyo@wc.sahra.org.za (successfully delivered to mailbox)
HWares@wc.sahra.org.za (successfully delivered to mailbox)
JSharfman@wc.sahra.org.za (successfully delivered to mailbox)
mkleynhans@wc.sahra.org.za (successfully delivered to mailbox)
SBERRY@wc.sahra.org.za (successfully delivered to mailbox)
swinton@wc.sahra.org.za (successfully delivered to mailbox)
TvNiekerk@wc.sahra.org.za (successfully delivered to mailbox)
Hi Nancy,
We are still having issues with our email, all our mail to head office is still coming back as undeliverable as well as other addresses like before. I tried to send you my virus scan results but I see that it has not gone through. My pc was clean and the software up to date. The others are still having the same problems as well.
| From: | Tara vNiekerk | Tuesday - October 30, 2012 10:58 AM |
| To: | NCLOETE@sahra.org.za | |
| Subject: | Re: UPDATE on GWise problem at Castle Office | |
| Attachments: | Full scan results - Panda Endpoint Protection Tara PC.pdf (3947 bytes) | [View] [Open] [Save As] |
Hi Nancy,
My Panda is updated and attached is my scan results.
Regards,
Tara
>>> "NANCY CLOETE" <NCLOETE@sahra.org.za> 10/30/12 9:57 AM >>>
** High Priority **
Dear Colleagues!
Background
1. A week ago your GroupWise PostOffice (which is located on the server) corrupted and crashed. This could be caused by any number of things, e.g. spikes in electrical current, damage to hardware, dust, dirt etc.)
2. Lateral Dynamics engineer worked for a number of hours rebuilding the post office. Although he managed to get it back up, it unfortunately not without loss of email data for some users.
REMINDER: Email data which is important (attachments, letters etc.) should be saved on the server
3. After the rebuild, the groupwise postoffice was tested and working, however, some users could not access it via the GWise icon on their desktops.
4. These users have to connect via the web link : http://192.168.1.1/gw/webacc
5. Normal web access (from outside your office) remains the same as always : http://wcmail.wc.sahra.org.za
6. Yesterday I was informed that you cannot send or received any emails - although you could access your mailboxes (one way or the other).
7. It become evident from an email sent to me from Internet Solutions that your router IP was blocked SPAM was being sent out from one of the pc's in that office.
8. I requested an unblock - which takes anything from 2 - 24 hours. In this case it was sorted out over night and your IP is no longer blocked.
9. I sent an email to all Built Environment and Martime staff this morning and requested that each of you reply to the email. I got respones from Tara, Heather and Melissa. Still awaiting for the rest to respond.
10. Shaun phoned to say he still cannot send emails to certain outside addresses. This means that some servers have still blocked the IP.
Current situation:
1. GroupWise Client - Some users : Greg, Tara, Heather - cannot access from their desktop gwise icons. Numerous attempts at reinstalling the GWise Client on these desktops failed. I've escalated this to an engineer, as this seems as if it is as a result of what happened to the GWise PO. It is just too much of a coinsident that three users software suddenly is problematic. These users can however still access email via : http://192.168.1.1/gw/webacc
Jon - I still need you to inform me if you are one of these users or not?
2. IP Blocked - Those users who are having problems sending emails - please provide me with any "return messages/bounce back errors" so I can follow up where the problem is.
Lastly: I need every users to (a) Check your Panda icon on the bottom right corner of your task bar. Hover over the icon to see when the last update took place - if this is old - right-click on icon and choose UPDATE. The when complete, please run FULL SCAN and send me the results page.
The IP was blocked because of spam, and it will get blocked again if the problem is not found.
Regards
Nancy
My Panda is updated and attached is my scan results.
Regards,
Tara
>>> "NANCY CLOETE" <NCLOETE@sahra.org.za> 10/30/12 9:57 AM >>>
** High Priority **
Dear Colleagues!
Background
1. A week ago your GroupWise PostOffice (which is located on the server) corrupted and crashed. This could be caused by any number of things, e.g. spikes in electrical current, damage to hardware, dust, dirt etc.)
2. Lateral Dynamics engineer worked for a number of hours rebuilding the post office. Although he managed to get it back up, it unfortunately not without loss of email data for some users.
REMINDER: Email data which is important (attachments, letters etc.) should be saved on the server
3. After the rebuild, the groupwise postoffice was tested and working, however, some users could not access it via the GWise icon on their desktops.
4. These users have to connect via the web link : http://192.168.1.1/gw/webacc
5. Normal web access (from outside your office) remains the same as always : http://wcmail.wc.sahra.org.za
6. Yesterday I was informed that you cannot send or received any emails - although you could access your mailboxes (one way or the other).
7. It become evident from an email sent to me from Internet Solutions that your router IP was blocked SPAM was being sent out from one of the pc's in that office.
8. I requested an unblock - which takes anything from 2 - 24 hours. In this case it was sorted out over night and your IP is no longer blocked.
9. I sent an email to all Built Environment and Martime staff this morning and requested that each of you reply to the email. I got respones from Tara, Heather and Melissa. Still awaiting for the rest to respond.
10. Shaun phoned to say he still cannot send emails to certain outside addresses. This means that some servers have still blocked the IP.
Current situation:
1. GroupWise Client - Some users : Greg, Tara, Heather - cannot access from their desktop gwise icons. Numerous attempts at reinstalling the GWise Client on these desktops failed. I've escalated this to an engineer, as this seems as if it is as a result of what happened to the GWise PO. It is just too much of a coinsident that three users software suddenly is problematic. These users can however still access email via : http://192.168.1.1/gw/webacc
Jon - I still need you to inform me if you are one of these users or not?
2. IP Blocked - Those users who are having problems sending emails - please provide me with any "return messages/bounce back errors" so I can follow up where the problem is.
Lastly: I need every users to (a) Check your Panda icon on the bottom right corner of your task bar. Hover over the icon to see when the last update took place - if this is old - right-click on icon and choose UPDATE. The when complete, please run FULL SCAN and send me the results page.
The IP was blocked because of spam, and it will get blocked again if the problem is not found.
Regards
Nancy
LogType:
Comments
The IP address of that server is being blocked by more than one service provider and mailserver across the globe, because it has picked up spamming from one of the computers/notebooks in that building.
All users must run a FULL scan on their PC's as requested previously.
All users must check that their Panda software is updating
I will thereafter come on site and run walware software as well.
The virus has to be found and cleaned, otherwise that IP will continuously be blocked.
Awaiting response from all staff re Full Scan.
Requested delisting from Barracuda : Your confirmation number is BBR21352110656-28991-19954.
CBL Removal
Removal of the IP address 196.211.116.254 from the CBL is now pending.
This means that your removal request has been accepted and your IP address WILL be delisted as soon as possible.
The CBL lookup page will already show that the IP address has been removed, but it takes a little longer for mail servers to notice the removal.
It should take no more than an hour or two before all servers that use the CBL notice the removal. Do not contact us to try to speed up removal - it's not possible to speed it up any more than it already is. Please be patient.
Request Received
Thank you for submitting your request. If this is your first request, your IP address will have its reputation increased to "normal" for 48 hours while we investigate. It may take up to 1 hour for the reputation increase to propagate to all Barracuda Spam Firewalls globally. We appreciate your patience and apologize for any inconvenience.
Your confirmation number is BBR21352112290-44747-20019.