RE: *** Warning *** New Virus - W32.goner.a@mm
Simon - I'm looking at Mail Marshal here - there's a Sophos AV plugin right now in our demo system. Is this what you run or do you use another (i.e. Norman)? I understand there's a pretty significant difference in $$$ but cheaper is not better if its crap. Any preference? -Original Message- From: Simon Curtiss [SMTP:[EMAIL PROTECTED]] Sent: December 5, 2001 7:32 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm I do have filtering - I use Mail Marshal. Why would you not check for updates everyday?? Why would you not want the latest AV signature for your product? As the release time for the update is variable I check 3 times a day - I'm not wasting bandwidth, if there's no update of the AV Signatures I don't download anything. Simon A good filtering system works better and is more complete. Updates everyday are more a waste of bandwidth and gives you a false sense of protection. ellery -Original Message- From: Simon Curtiss [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 3:38 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Why only check once a day? I run the update check every 8 hours, I'm thinking of making it more frequent than that. Simon -Original Message- From: Michael Johnson [mailto:[EMAIL PROTECTED]] Sent: Thursday, 6 December 2001 10:12 a.m. To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Thats very true. We changed from 6am to 4am, If that will help. Mike Johnson GRFLLP -Original Message- From: Briggs, Bruce [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:06 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Depends on when you have Antigen set up to check for an automatic update and which anti-virus engines you are running. We were lucky and got an automatic update which covered us about 15 minutes before we started getting hit. Bruce -Original Message- From: Michael Johnson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:18 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Neither did Antigen until we blocked all.scr's. Mike Johnson GRFLLP -Original Message- From: Karen Palmer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:03 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm We just got this one. Norton's on Exchange and the desktops did NOT catch it and our virus definitions are current, so be careful. We are downloading Antigen as I type. Karen Palmer SCJD List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm This electronic message (email) is intended only for the use of the individual or entity named above, and may contain information that is privileged, confidential and protected from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication, or the taking of any action relative to its contents, is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone at (310) 553-1707 or by email. Please destroy all hard copies of this communication and delete it from all electronic files. Thank you. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm This electronic message (email) is intended only for the use of the individual or entity named above, and may contain information that is privileged, confidential and protected from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication, or the taking of any action relative to its contents, is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone at (310) 553-1707 or by email. Please destroy all hard copies of this communication and delete it from all electronic files. Thank you. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm ## ## # Notice
RE: *** Warning *** New Virus - W32.goner.a@mm
Odd ... when I looked before I went home last night (about 3 hours before your message) it quite clearly said 4174 was needed: different information in different parts of the site?? Karen -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 20:59 To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm That figures... Their dumb site says 4173 will catch it. -Original Message- From: Dimitri Limanovski [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:48 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You need to get the 4174 DATs to catch it and of course McAfee FTP servers are hammered! Use ftp:/ftpeur.nai.com and manually download the sdat-4174.zip. You will then have to manually apply it to your Exchange server, witch is major PITA by itself. See in FAQs on www.mcafeeb2b.com for Why are all attachments being blocked? question on instructions how to do it. Feel free to email me with any questions. Dimitri -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:33 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Groupsuck REALLY sucks... Even though I already had the latest dat installed, and all my services are running, two instances of this virus made it through. Thankfully I don't trust GS, and I sent out a warning and my users actually read it, and acted on it. Any idea why GS might not be catching them? Everything looks like it's set up properly. I caught all the Badtrans viruses last week. -Original Message- From: Dennis Atherton [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:27 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Download and save the file sarcx86.exe, and then execute it on the system to be updated. -Original Message- From: MHR(Michael Ross) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:50 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_def initions/norto ftp://ftp2.symantec.com/public/english_us_canada/antivirus_de finitions/nort o n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http://securityresponse.symantec.com/avcenter/venc/data/w32.go [EMAIL PROTECTED] http://securityresponse.symantec.com/avcenter/venc/data/w32.g [EMAIL PROTECTED] Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm *** The information transmitted in this email is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this email in error, please contact the sender and permanently delete the email from any computer. List Charter and FAQ at: http://www.sunbelt-software.com
RE: *** Warning *** New Virus - W32.goner.a@mm
dunno, but you def. need 4174 not 3!!! -Original Message- From: Lynn Karen [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 10:12 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Odd ... when I looked before I went home last night (about 3 hours before your message) it quite clearly said 4174 was needed: different information in different parts of the site?? Karen -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 20:59 To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm That figures... Their dumb site says 4173 will catch it. -Original Message- From: Dimitri Limanovski [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:48 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You need to get the 4174 DATs to catch it and of course McAfee FTP servers are hammered! Use ftp:/ftpeur.nai.com and manually download the sdat-4174.zip. You will then have to manually apply it to your Exchange server, witch is major PITA by itself. See in FAQs on www.mcafeeb2b.com for Why are all attachments being blocked? question on instructions how to do it. Feel free to email me with any questions. Dimitri -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:33 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Groupsuck REALLY sucks... Even though I already had the latest dat installed, and all my services are running, two instances of this virus made it through. Thankfully I don't trust GS, and I sent out a warning and my users actually read it, and acted on it. Any idea why GS might not be catching them? Everything looks like it's set up properly. I caught all the Badtrans viruses last week. -Original Message- From: Dennis Atherton [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:27 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Download and save the file sarcx86.exe, and then execute it on the system to be updated. -Original Message- From: MHR(Michael Ross) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:50 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_def initions/norto ftp://ftp2.symantec.com/public/english_us_canada/antivirus_de finitions/nort o n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http://securityresponse.symantec.com/avcenter/venc/data/w32.go [EMAIL PROTECTED] http://securityresponse.symantec.com/avcenter/venc/data/w32.g [EMAIL PROTECTED] Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm *** The information transmitted in this email is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons
RE: *** Warning *** New Virus - W32.goner.a@mm
Yes... just use the Exmerge utility from the latest service pack. You can then go into the options and remove messages using specific criteria. Just read everything really carefully and set the options with caution. -Original Message-From: Mal Sasalu [mailto:[EMAIL PROTECTED]]Sent: Tuesday, December 04, 2001 4:43 PMTo: MS-Exchange Admin IssuesSubject: RE: *** Warning *** New Virus - W32.goner.a@mm Hi there, Is there any tool with which I can clean all the mailboxes on my exchange from this dirty Hi message? Thanks mal -Original Message-From: Bob Fronk (BTR Technologies, Inc) [mailto:[EMAIL PROTECTED]]Sent: Tuesday, December 04, 2001 2:13 PMTo: MS-Exchange Admin IssuesSubject: RE: *** Warning *** New Virus - W32.goner.a@mm Configure NAV for Exchange to block attachments. This stopped "goner" in its tracks. I block: *.com, *.exe, *.scr and also the double extensions like *.jpg.vbs. and assorted others. http://service4.symantec.com/SUPPORT/ent-security.nsf/docid/271215411348 Bob -Original Message-From: Karen Palmer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:03 PMTo: MS-Exchange Admin IssuesSubject: RE: *** Warning *** New Virus - W32.goner.a@mm We just got this one. Norton's on Exchange and the desktops did NOT catch it and our virus definitions are current, so be careful. We are downloading Antigen as I type. Karen Palmer SCJD List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at:http://www.sunbelt-software.com/exchange_list_charter.htmList Charter and FAQ at:http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
my (limited) understanding is that IISCAN will let you nuke the attachments but leave the messages intact (not sure why anyone would want to do that in the case of a self-replicating worm but...). Meanwhile exmerge will kill the message and attachment together (not just the attachment). But I have only read some of the Q's from technet and have no real experience with the tools -- so I'm not sure -- which utility is more appropriate? -Original Message- From: Ray Zorz [SMTP:[EMAIL PROTECTED]] Sent: December 4, 2001 8:40 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm ISSCAN -Original Message- From: Ellery July [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:46 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm exmerge -Original Message- From: Mal Sasalu [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:43 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Hi there, Is there any tool with which I can clean all the mailboxes on my exchange from this dirty Hi message? Thanks mal -Original Message- From: Bob Fronk (BTR Technologies, Inc) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:13 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Configure NAV for Exchange to block attachments. This stopped goner in its tracks. I block: *.com, *.exe, *.scr and also the double extensions like *.jpg.vbs. and assorted others. http://service4.symantec.com/SUPPORT/ent-security.nsf/docid/271215411 348 Bob -Original Message- From: Karen Palmer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:03 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm We just got this one. Norton's on Exchange and the desktops did NOT catch it and our virus definitions are current, so be careful. We are downloading Antigen as I type. Karen Palmer SCJD List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
All I know is that a friend on mine called me at 10:00 AM EST that he got hit by the virus, I immediately went to my Exchange server, and did the live update. it said there were no new def's. I thought that was odd, so I went to their web site. Sure enough, on the home page, there was a huge warning about the virus. At that time, the virus def said 4173. This finally gave me the excuse I needed to rip that junk off my server, and install ScanMail. So far, I am loving the new program. -Original Message- From: Lynn Karen [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 5:12 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Odd ... when I looked before I went home last night (about 3 hours before your message) it quite clearly said 4174 was needed: different information in different parts of the site?? Karen -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 20:59 To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm That figures... Their dumb site says 4173 will catch it. -Original Message- From: Dimitri Limanovski [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:48 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You need to get the 4174 DATs to catch it and of course McAfee FTP servers are hammered! Use ftp:/ftpeur.nai.com and manually download the sdat-4174.zip. You will then have to manually apply it to your Exchange server, witch is major PITA by itself. See in FAQs on www.mcafeeb2b.com for Why are all attachments being blocked? question on instructions how to do it. Feel free to email me with any questions. Dimitri -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:33 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Groupsuck REALLY sucks... Even though I already had the latest dat installed, and all my services are running, two instances of this virus made it through. Thankfully I don't trust GS, and I sent out a warning and my users actually read it, and acted on it. Any idea why GS might not be catching them? Everything looks like it's set up properly. I caught all the Badtrans viruses last week. -Original Message- From: Dennis Atherton [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:27 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Download and save the file sarcx86.exe, and then execute it on the system to be updated. -Original Message- From: MHR(Michael Ross) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:50 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_def initions/norto ftp://ftp2.symantec.com/public/english_us_canada/antivirus_de finitions/nort o n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http://securityresponse.symantec.com/avcenter/venc/data/w32.go [EMAIL PROTECTED] http://securityresponse.symantec.com/avcenter/venc/data/w32.g [EMAIL PROTECTED] Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com
RE: *** Warning *** New Virus - W32.goner.a@mm
Yep, then you have to run the database utilities to fix the broken links and database pages. Besides, a message with a worm usually is a throw away anyway. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 My toys! My toys! I can't do this job without my toys! -Original Message- From: Toni, Randy [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 10:34 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm my (limited) understanding is that IISCAN will let you nuke the attachments but leave the messages intact (not sure why anyone would want to do that in the case of a self-replicating worm but...). Meanwhile exmerge will kill the message and attachment together (not just the attachment). But I have only read some of the Q's from technet and have no real experience with the tools -- so I'm not sure -- which utility is more appropriate? -Original Message- From: Ray Zorz [SMTP:[EMAIL PROTECTED]] Sent: December 4, 2001 8:40 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm ISSCAN -Original Message- From: Ellery July [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:46 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm exmerge -Original Message- From: Mal Sasalu [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:43 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Hi there, Is there any tool with which I can clean all the mailboxes on my exchange from this dirty Hi message? Thanks mal -Original Message- From: Bob Fronk (BTR Technologies, Inc) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:13 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Configure NAV for Exchange to block attachments. This stopped goner in its tracks. I block: *.com, *.exe, *.scr and also the double extensions like *.jpg.vbs. and assorted others. http://service4.symantec.com/SUPPORT/ent-security.nsf/docid/271215411 348 Bob -Original Message- From: Karen Palmer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:03 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm We just got this one. Norton's on Exchange and the desktops did NOT catch it and our virus definitions are current, so be careful. We are downloading Antigen as I type. Karen Palmer SCJD List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
Depends on how thorough you want to be. I use whatever tool is required to obtain the required result. D I only regret that I have but one life to lose for my country. -Nathan Hale -Original Message- From: Toni, Randy [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 7:34 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm my (limited) understanding is that IISCAN will let you nuke the attachments but leave the messages intact (not sure why anyone would want to do that in the case of a self-replicating worm but...). Meanwhile exmerge will kill the message and attachment together (not just the attachment). But I have only read some of the Q's from technet and have no real experience with the tools -- so I'm not sure -- which utility is more appropriate? -Original Message- From: Ray Zorz [SMTP:[EMAIL PROTECTED]] Sent: December 4, 2001 8:40 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm ISSCAN -Original Message- From: Ellery July [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:46 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm exmerge -Original Message- From: Mal Sasalu [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:43 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Hi there, Is there any tool with which I can clean all the mailboxes on my exchange from this dirty Hi message? Thanks mal -Original Message- From: Bob Fronk (BTR Technologies, Inc) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:13 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Configure NAV for Exchange to block attachments. This stopped goner in its tracks. I block: *.com, *.exe, *.scr and also the double extensions like *.jpg.vbs. and assorted others. http://service4.symantec.com/SUPPORT/ent-security.nsf/docid/27121 5411 348 Bob -Original Message- From: Karen Palmer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:03 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm We just got this one. Norton's on Exchange and the desktops did NOT catch it and our virus definitions are current, so be careful. We are downloading Antigen as I type. Karen Palmer SCJD List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
Why only check once a day? I run the update check every 8 hours, I'm thinking of making it more frequent than that. Simon -Original Message- From: Michael Johnson [mailto:[EMAIL PROTECTED]] Sent: Thursday, 6 December 2001 10:12 a.m. To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Thats very true. We changed from 6am to 4am, If that will help. Mike Johnson GRFLLP -Original Message- From: Briggs, Bruce [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:06 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Depends on when you have Antigen set up to check for an automatic update and which anti-virus engines you are running. We were lucky and got an automatic update which covered us about 15 minutes before we started getting hit. Bruce -Original Message- From: Michael Johnson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:18 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Neither did Antigen until we blocked all.scr's. Mike Johnson GRFLLP -Original Message- From: Karen Palmer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:03 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm We just got this one. Norton's on Exchange and the desktops did NOT catch it and our virus definitions are current, so be careful. We are downloading Antigen as I type. Karen Palmer SCJD List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm This electronic message (email) is intended only for the use of the individual or entity named above, and may contain information that is privileged, confidential and protected from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication, or the taking of any action relative to its contents, is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone at (310) 553-1707 or by email. Please destroy all hard copies of this communication and delete it from all electronic files. Thank you. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm This electronic message (email) is intended only for the use of the individual or entity named above, and may contain information that is privileged, confidential and protected from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication, or the taking of any action relative to its contents, is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone at (310) 553-1707 or by email. Please destroy all hard copies of this communication and delete it from all electronic files. Thank you. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm # Notice of Confidential information The information contained in this electronic mail is CONFIDENTIAL INFORMATION and may be LEGALLY PRIVILEGED, intended only for the individual or entity named above. If you are not the intended recipient, you are hereby notified that the use, dissemination, distribution, or copying of this document is strictly prohibited. If you have received this electronic message in error, please immediately notify us by return or telephone call collect to 07 577 6049) and destroy the original message. Thank you. This e-mail message has been scanned and cleared by MailMarshal www.marshalsoftware.com # List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
Agreed. -Original Message- From: Ellery July [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 5:29 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm A good filtering system works better and is more complete. Updates everyday are more a waste of bandwidth and gives you a false sense of protection. ellery -Original Message- From: Simon Curtiss [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 3:38 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Why only check once a day? I run the update check every 8 hours, I'm thinking of making it more frequent than that. Simon -Original Message- From: Michael Johnson [mailto:[EMAIL PROTECTED]] Sent: Thursday, 6 December 2001 10:12 a.m. To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Thats very true. We changed from 6am to 4am, If that will help. Mike Johnson GRFLLP -Original Message- From: Briggs, Bruce [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:06 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Depends on when you have Antigen set up to check for an automatic update and which anti-virus engines you are running. We were lucky and got an automatic update which covered us about 15 minutes before we started getting hit. Bruce -Original Message- From: Michael Johnson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:18 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Neither did Antigen until we blocked all.scr's. Mike Johnson GRFLLP -Original Message- From: Karen Palmer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:03 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm We just got this one. Norton's on Exchange and the desktops did NOT catch it and our virus definitions are current, so be careful. We are downloading Antigen as I type. Karen Palmer SCJD List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm This electronic message (email) is intended only for the use of the individual or entity named above, and may contain information that is privileged, confidential and protected from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication, or the taking of any action relative to its contents, is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone at (310) 553-1707 or by email. Please destroy all hard copies of this communication and delete it from all electronic files. Thank you. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm This electronic message (email) is intended only for the use of the individual or entity named above, and may contain information that is privileged, confidential and protected from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication, or the taking of any action relative to its contents, is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone at (310) 553-1707 or by email. Please destroy all hard copies of this communication and delete it from all electronic files. Thank you. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm # Notice of Confidential information The information contained in this electronic mail is CONFIDENTIAL INFORMATION and may be LEGALLY PRIVILEGED, intended only for the individual or entity named above. If you are not the intended recipient, you are hereby notified that the use, dissemination, distribution, or copying of this document is strictly prohibited. If you have received this electronic message in error, please immediately notify us by return or telephone call collect to 07 577 6049) and destroy the original message. Thank you. This e-mail message has been scanned and cleared by MailMarshal www.marshalsoftware.com # List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com
RE: *** Warning *** New Virus - W32.goner.a@mm
Are you on commission with those Antigen guys? ;) -Original Message- From: Arnold, Jamie [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 3:09 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Agreed. -Original Message- From: Ellery July [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 5:29 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm A good filtering system works better and is more complete. Updates everyday are more a waste of bandwidth and gives you a false sense of protection. ellery -Original Message- From: Simon Curtiss [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 3:38 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Why only check once a day? I run the update check every 8 hours, I'm thinking of making it more frequent than that. Simon -Original Message- From: Michael Johnson [mailto:[EMAIL PROTECTED]] Sent: Thursday, 6 December 2001 10:12 a.m. To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Thats very true. We changed from 6am to 4am, If that will help. Mike Johnson GRFLLP -Original Message- From: Briggs, Bruce [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:06 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Depends on when you have Antigen set up to check for an automatic update and which anti-virus engines you are running. We were lucky and got an automatic update which covered us about 15 minutes before we started getting hit. Bruce -Original Message- From: Michael Johnson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:18 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Neither did Antigen until we blocked all.scr's. Mike Johnson GRFLLP List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
Re: *** Warning *** New Virus - W32.goner.a@mm
I check every hour (paranoid, yes - but paranoid enough?) - and have filtering as well. The bandwidth is there and paid for - and if no updates, very little bandwidth is used. Ellery July wrote: A good filtering system works better and is more complete. Updates everyday are more a waste of bandwidth and gives you a false sense of protection. ellery -Original Message- From: Simon Curtiss [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 3:38 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Why only check once a day? I run the update check every 8 hours, I'm thinking of making it more frequent than that. Simon -Original Message- From: Michael Johnson [mailto:[EMAIL PROTECTED]] Sent: Thursday, 6 December 2001 10:12 a.m. To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Thats very true. We changed from 6am to 4am, If that will help. Mike Johnson GRFLLP -Original Message- From: Briggs, Bruce [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:06 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Depends on when you have Antigen set up to check for an automatic update and which anti-virus engines you are running. We were lucky and got an automatic update which covered us about 15 minutes before we started getting hit. Bruce -Original Message- From: Michael Johnson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:18 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Neither did Antigen until we blocked all.scr's. Mike Johnson GRFLLP -Original Message- From: Karen Palmer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:03 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm We just got this one. Norton's on Exchange and the desktops did NOT catch it and our virus definitions are current, so be careful. We are downloading Antigen as I type. Karen Palmer SCJD List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm This electronic message (email) is intended only for the use of the individual or entity named above, and may contain information that is privileged, confidential and protected from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication, or the taking of any action relative to its contents, is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone at (310) 553-1707 or by email. Please destroy all hard copies of this communication and delete it from all electronic files. Thank you. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm This electronic message (email) is intended only for the use of the individual or entity named above, and may contain information that is privileged, confidential and protected from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication, or the taking of any action relative to its contents, is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone at (310) 553-1707 or by email. Please destroy all hard copies of this communication and delete it from all electronic files. Thank you. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm # Notice of Confidential information The information contained in this electronic mail is CONFIDENTIAL INFORMATION and may be LEGALLY PRIVILEGED, intended only for the individual or entity named above. If you are not the intended recipient, you are hereby notified that the use, dissemination, distribution, or copying of this document is strictly prohibited. If you have received this electronic message in error, please immediately notify us by return or telephone call collect to 07 577 6049) and destroy the original message. Thank you. This e-mail message has been scanned and cleared by MailMarshal www.marshalsoftware.com # List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter
RE: *** Warning *** New Virus - W32.goner.a@mm
How often do they usually do updates for ScanMail? -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 10:21 To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm All I know is that a friend on mine called me at 10:00 AM EST that he got hit by the virus, I immediately went to my Exchange server, and did the live update. it said there were no new def's. I thought that was odd, so I went to their web site. Sure enough, on the home page, there was a huge warning about the virus. At that time, the virus def said 4173. This finally gave me the excuse I needed to rip that junk off my server, and install ScanMail. So far, I am loving the new program. -Original Message- From: Lynn Karen [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 5:12 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Odd ... when I looked before I went home last night (about 3 hours before your message) it quite clearly said 4174 was needed: different information in different parts of the site?? Karen -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 20:59 To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm That figures... Their dumb site says 4173 will catch it. -Original Message- From: Dimitri Limanovski [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:48 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You need to get the 4174 DATs to catch it and of course McAfee FTP servers are hammered! Use ftp:/ftpeur.nai.com and manually download the sdat-4174.zip. You will then have to manually apply it to your Exchange server, witch is major PITA by itself. See in FAQs on www.mcafeeb2b.com for Why are all attachments being blocked? question on instructions how to do it. Feel free to email me with any questions. Dimitri -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:33 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Groupsuck REALLY sucks... Even though I already had the latest dat installed, and all my services are running, two instances of this virus made it through. Thankfully I don't trust GS, and I sent out a warning and my users actually read it, and acted on it. Any idea why GS might not be catching them? Everything looks like it's set up properly. I caught all the Badtrans viruses last week. -Original Message- From: Dennis Atherton [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:27 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Download and save the file sarcx86.exe, and then execute it on the system to be updated. -Original Message- From: MHR(Michael Ross) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:50 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_def initions/norto ftp://ftp2.symantec.com/public/english_us_canada/antivirus_de finitions/nort o n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http://securityresponse.symantec.com/avcenter/venc/data/w32.go [EMAIL PROTECTED] http://securityresponse.symantec.com/avcenter/venc/data/w32.g [EMAIL PROTECTED] Bruce Briggs System Administration State
RE: *** Warning *** New Virus - W32.goner.a@mm
Usually, weekly. HOWEVER, that doesn't hold them back from doing it as needed also. But they have a scheduled update weekly. Usually Tues AM -Original Message- From: David N. Precht [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 4:42 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm How often do they usually do updates for ScanMail? -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 10:21 To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm All I know is that a friend on mine called me at 10:00 AM EST that he got hit by the virus, I immediately went to my Exchange server, and did the live update. it said there were no new def's. I thought that was odd, so I went to their web site. Sure enough, on the home page, there was a huge warning about the virus. At that time, the virus def said 4173. This finally gave me the excuse I needed to rip that junk off my server, and install ScanMail. So far, I am loving the new program. -Original Message- From: Lynn Karen [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 5:12 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Odd ... when I looked before I went home last night (about 3 hours before your message) it quite clearly said 4174 was needed: different information in different parts of the site?? Karen -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 20:59 To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm That figures... Their dumb site says 4173 will catch it. -Original Message- From: Dimitri Limanovski [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:48 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You need to get the 4174 DATs to catch it and of course McAfee FTP servers are hammered! Use ftp:/ftpeur.nai.com and manually download the sdat-4174.zip. You will then have to manually apply it to your Exchange server, witch is major PITA by itself. See in FAQs on www.mcafeeb2b.com for Why are all attachments being blocked? question on instructions how to do it. Feel free to email me with any questions. Dimitri -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:33 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Groupsuck REALLY sucks... Even though I already had the latest dat installed, and all my services are running, two instances of this virus made it through. Thankfully I don't trust GS, and I sent out a warning and my users actually read it, and acted on it. Any idea why GS might not be catching them? Everything looks like it's set up properly. I caught all the Badtrans viruses last week. -Original Message- From: Dennis Atherton [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:27 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Download and save the file sarcx86.exe, and then execute it on the system to be updated. -Original Message- From: MHR(Michael Ross) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:50 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_def initions/norto ftp://ftp2.symantec.com/public/english_us_canada/antivirus_de finitions/nort o n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming
RE: *** Warning *** New Virus - W32.goner.a@mm
probably most of them (oh, sorry , that's here...) -Original Message- From: Cicerrella, Steve [SMTP:[EMAIL PROTECTED]] Sent: December 4, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http:[EMAIL PROTECTED] l Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
Tell your wife that you do not read them that way you can just keep sitting. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:49 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm CDW Commercial I opened that virus you told us not too /CDW Commercial That commercial was on last night. I told my wife to watch so she can see what my job is really like. She seems to think I sit on my a** answering emails all day :) -Original Message- From: Cicerrella, Steve [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:24 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http:[EMAIL PROTECTED] Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
Eric, We use groupsuck here still, (primarily because we can't get rid of it clean) but it has worked flawlessly (yeah I know, a miracle). I have had a few other people try to sell me other on-board scanners for exchange, but the two I had seen demo'd both broke SIS by opening and copying messages in the MTA for the scanning process. This also triggers delivery notification. Is there another on-board product out there that does suck, doesn't break SIS and doesn't open messages and trigger delivery notification as part of the scanning process? Brad -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:35 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm I have nothing good to say about Groupsuck. How they can sell that product is beyond me. I am also getting away from it ASAP. Just to warn you, the uninstall is not clean. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
CDW Commercial I opened that virus you told us not too /CDW Commercial That commercial was on last night. I told my wife to watch so she can see what my job is really like. She seems to think I sit on my a** answering emails all day :) -Original Message- From: Cicerrella, Steve [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:24 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http:[EMAIL PROTECTED] Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
Title: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/norto n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already. I have not found a patch for Norton for Exchange yet. Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http:[EMAIL PROTECTED] Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm *** The information transmitted in this email is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this email in error, please contact the sender and permanently delete the email from any computer. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
Download and save the file sarcx86.exe, and then execute it on the system to be updated. -Original Message- From: MHR(Michael Ross) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:50 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/norto ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/nort o n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http:[EMAIL PROTECTED] http:[EMAIL PROTECTED] Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm *** The information transmitted in this email is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this email in error, please contact the sender and permanently delete the email from any computer. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
Groupsuck REALLY sucks... Even though I already had the latest dat installed, and all my services are running, two instances of this virus made it through. Thankfully I don't trust GS, and I sent out a warning and my users actually read it, and acted on it. Any idea why GS might not be catching them? Everything looks like it's set up properly. I caught all the Badtrans viruses last week. -Original Message- From: Dennis Atherton [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:27 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Download and save the file sarcx86.exe, and then execute it on the system to be updated. -Original Message- From: MHR(Michael Ross) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:50 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/norto ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/nort o n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http:[EMAIL PROTECTED] http:[EMAIL PROTECTED] Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm *** The information transmitted in this email is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this email in error, please contact the sender and permanently delete the email from any computer. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
Using AVAPI?? -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 12:33 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Groupsuck REALLY sucks... Even though I already had the latest dat installed, and all my services are running, two instances of this virus made it through. Thankfully I don't trust GS, and I sent out a warning and my users actually read it, and acted on it. Any idea why GS might not be catching them? Everything looks like it's set up properly. I caught all the Badtrans viruses last week. -Original Message- From: Dennis Atherton [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:27 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Download and save the file sarcx86.exe, and then execute it on the system to be updated. -Original Message- From: MHR(Michael Ross) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:50 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/norto ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/nort o n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http:[EMAIL PROTECTED] http:[EMAIL PROTECTED] Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm *** The information transmitted in this email is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this email in error, please contact the sender and permanently delete the email from any computer. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
You need to get the 4174 DATs to catch it and of course McAfee FTP servers are hammered! Use ftp:/ftpeur.nai.com and manually download the sdat-4174.zip. You will then have to manually apply it to your Exchange server, witch is major PITA by itself. See in FAQs on www.mcafeeb2b.com for Why are all attachments being blocked? question on instructions how to do it. Feel free to email me with any questions. Dimitri -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:33 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Groupsuck REALLY sucks... Even though I already had the latest dat installed, and all my services are running, two instances of this virus made it through. Thankfully I don't trust GS, and I sent out a warning and my users actually read it, and acted on it. Any idea why GS might not be catching them? Everything looks like it's set up properly. I caught all the Badtrans viruses last week. -Original Message- From: Dennis Atherton [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:27 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Download and save the file sarcx86.exe, and then execute it on the system to be updated. -Original Message- From: MHR(Michael Ross) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:50 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/norto ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/nort o n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http:[EMAIL PROTECTED] http:[EMAIL PROTECTED] Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm *** The information transmitted in this email is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this email in error, please contact the sender and permanently delete the email from any computer. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
We had the same thing happen-Groupshield missed one, but caught the rest (so far). Fortunately, the particular user it was sent to is a power user, and was smart enought not to open it, and called us instead. Would love to know why it's not catching them all. --- Eric Brouwer [EMAIL PROTECTED] wrote: Groupsuck REALLY sucks... Even though I already had the latest dat installed, and all my services are running, two instances of this virus made it through. Thankfully I don't trust GS, and I sent out a warning and my users actually read it, and acted on it. Any idea why GS might not be catching them? Everything looks like it's set up properly. I caught all the Badtrans viruses last week. -Original Message- From: Dennis Atherton [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:27 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Download and save the file sarcx86.exe, and then execute it on the system to be updated. -Original Message- From: MHR(Michael Ross) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:50 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/norto ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/nort o n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http:[EMAIL PROTECTED] http:[EMAIL PROTECTED] Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm *** The information transmitted in this email is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this email in error, please contact the sender and permanently delete the email from any computer. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm __ Do You Yahoo!? Buy the perfect holiday gifts at Yahoo! Shopping. http://shopping.yahoo.com List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
I should probably know that, huh? How can I tell if I am? What is the alternative? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:40 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Using AVAPI?? -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 12:33 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Groupsuck REALLY sucks... Even though I already had the latest dat installed, and all my services are running, two instances of this virus made it through. Thankfully I don't trust GS, and I sent out a warning and my users actually read it, and acted on it. Any idea why GS might not be catching them? Everything looks like it's set up properly. I caught all the Badtrans viruses last week. -Original Message- From: Dennis Atherton [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:27 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Download and save the file sarcx86.exe, and then execute it on the system to be updated. -Original Message- From: MHR(Michael Ross) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:50 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/norto ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/nort o n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http:[EMAIL PROTECTED] http:[EMAIL PROTECTED] Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm *** The information transmitted in this email is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this email in error, please contact the sender and permanently delete the email from any computer. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
The same thing is happening here... It's catching some, but not others. Shamika -Original Message- From: Glen Macdonald [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:47 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm We had the same thing happen-Groupshield missed one, but caught the rest (so far). Fortunately, the particular user it was sent to is a power user, and was smart enought not to open it, and called us instead. Would love to know why it's not catching them all. --- Eric Brouwer [EMAIL PROTECTED] wrote: Groupsuck REALLY sucks... Even though I already had the latest dat installed, and all my services are running, two instances of this virus made it through. Thankfully I don't trust GS, and I sent out a warning and my users actually read it, and acted on it. Any idea why GS might not be catching them? Everything looks like it's set up properly. I caught all the Badtrans viruses last week. -Original Message- From: Dennis Atherton [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:27 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Download and save the file sarcx86.exe, and then execute it on the system to be updated. -Original Message- From: MHR(Michael Ross) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:50 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/norto ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/nort o n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http:[EMAIL PROTECTED] http:[EMAIL PROTECTED] Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm *** The information transmitted in this email is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this email in error, please contact the sender and permanently delete the email from any computer. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm __ Do You Yahoo!? Buy the perfect holiday gifts at Yahoo! Shopping. http://shopping.yahoo.com List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
What you should do is deny .scr, .js, etc... as attachment types, then the viruses won't get through.. I have my firewall block all known executable file types... Thanks! Joe Irvine http://www.tbopayroll.com/ 609-597-1155 -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:33 PM To: MS-Exchange Admin Issues Subject:RE: *** Warning *** New Virus - W32.goner.a@mm Groupsuck REALLY sucks... Even though I already had the latest dat installed, and all my services are running, two instances of this virus made it through. Thankfully I don't trust GS, and I sent out a warning and my users actually read it, and acted on it. Any idea why GS might not be catching them? Everything looks like it's set up properly. I caught all the Badtrans viruses last week. -Original Message- From: Dennis Atherton [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:27 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Download and save the file sarcx86.exe, and then execute it on the system to be updated. -Original Message- From: MHR(Michael Ross) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:50 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/n orto ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/ nort o n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http:[EMAIL PROTECTED] tml http://securityresponse.symantec.com/avcenter/venc/data/w32.goner.a@mm. html Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm *** The information transmitted in this email is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this email in error, please contact the sender and permanently delete the email from any computer. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
We just got this one. Norton's on Exchange and the desktops did NOT catch it and our virus definitions are current, so be careful. We are downloading Antigen as I type. Karen Palmer SCJD List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
Anyone done this and can tell me if it requires a reboot to take effect? We are in full production mode at the moment. -Original Message- From: Dennis Atherton [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:27 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Download and save the file sarcx86.exe, and then execute it on the system to be updated. -Original Message- From: MHR(Michael Ross) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:50 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/norto ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/nort o n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http:[EMAIL PROTECTED] http:[EMAIL PROTECTED] Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm *** The information transmitted in this email is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this email in error, please contact the sender and permanently delete the email from any computer. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
Configure NAV for Exchange to block attachments. This stopped goner in its tracks. I block: *.com, *.exe, *.scr and also the double extensions like *.jpg.vbs. and assorted others. http://service4.symantec.com/SUPPORT/ent-security.nsf/docid/271215411348 Bob -Original Message- From: Karen Palmer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:03 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm We just got this one. Norton's on Exchange and the desktops did NOT catch it and our virus definitions are current, so be careful. We are downloading Antigen as I type. Karen Palmer SCJD List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
That figures... Their dumb site says 4173 will catch it. -Original Message- From: Dimitri Limanovski [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:48 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You need to get the 4174 DATs to catch it and of course McAfee FTP servers are hammered! Use ftp:/ftpeur.nai.com and manually download the sdat-4174.zip. You will then have to manually apply it to your Exchange server, witch is major PITA by itself. See in FAQs on www.mcafeeb2b.com for Why are all attachments being blocked? question on instructions how to do it. Feel free to email me with any questions. Dimitri -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:33 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Groupsuck REALLY sucks... Even though I already had the latest dat installed, and all my services are running, two instances of this virus made it through. Thankfully I don't trust GS, and I sent out a warning and my users actually read it, and acted on it. Any idea why GS might not be catching them? Everything looks like it's set up properly. I caught all the Badtrans viruses last week. -Original Message- From: Dennis Atherton [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:27 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Download and save the file sarcx86.exe, and then execute it on the system to be updated. -Original Message- From: MHR(Michael Ross) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:50 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/norto ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/nort o n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http:[EMAIL PROTECTED] http:[EMAIL PROTECTED] Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm *** The information transmitted in this email is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this email in error, please contact the sender and permanently delete the email from any computer. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
Neither did Antigen until we blocked all.scr's. Mike Johnson GRFLLP -Original Message- From: Karen Palmer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:03 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm We just got this one. Norton's on Exchange and the desktops did NOT catch it and our virus definitions are current, so be careful. We are downloading Antigen as I type. Karen Palmer SCJD List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm This electronic message (email) is intended only for the use of the individual or entity named above, and may contain information that is privileged, confidential and protected from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication, or the taking of any action relative to its contents, is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone at (310) 553-1707 or by email. Please destroy all hard copies of this communication and delete it from all electronic files. Thank you. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
What version of GroupShield do you have? -Original Message- From: Glen Macdonald [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:47 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm We had the same thing happen-Groupshield missed one, but caught the rest (so far). Fortunately, the particular user it was sent to is a power user, and was smart enought not to open it, and called us instead. Would love to know why it's not catching them all. --- Eric Brouwer [EMAIL PROTECTED] wrote: Groupsuck REALLY sucks... Even though I already had the latest dat installed, and all my services are running, two instances of this virus made it through. Thankfully I don't trust GS, and I sent out a warning and my users actually read it, and acted on it. Any idea why GS might not be catching them? Everything looks like it's set up properly. I caught all the Badtrans viruses last week. -Original Message- From: Dennis Atherton [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:27 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Download and save the file sarcx86.exe, and then execute it on the system to be updated. -Original Message- From: MHR(Michael Ross) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:50 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/norto ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/nort o n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http:[EMAIL PROTECTED] http:[EMAIL PROTECTED] Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm *** The information transmitted in this email is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this email in error, please contact the sender and permanently delete the email from any computer. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm __ Do You Yahoo!? Buy the perfect holiday gifts at Yahoo! Shopping. http://shopping.yahoo.com List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
Antigen for Exchange Trend Micro Scanmail for Exchange. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Stop plate Tectonics! -Original Message- From: Brad Metzler [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:49 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Eric, We use groupsuck here still, (primarily because we can't get rid of it clean) but it has worked flawlessly (yeah I know, a miracle). I have had a few other people try to sell me other on-board scanners for exchange, but the two I had seen demo'd both broke SIS by opening and copying messages in the MTA for the scanning process. This also triggers delivery notification. Is there another on-board product out there that does suck, doesn't break SIS and doesn't open messages and trigger delivery notification as part of the scanning process? Brad -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:35 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm I have nothing good to say about Groupsuck. How they can sell that product is beyond me. I am also getting away from it ASAP. Just to warn you, the uninstall is not clean. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
Seriously... forget relying on updates... get Antigen... configure all the attachment extentions. .cmd, .pif, .scr, .com, .bat, .vbs, .sh, .exe, etc, etc... load em up... sleep easier. -Original Message- From: Briggs, Bruce [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:59 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm As William says, You're no fun. Bruce P.S. But you are safer than many. -Original Message- From: Arnold, Jamie [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:55 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Hm...I've had .scr in my extension filter list for over a year. Perhaps some of you should add it also? Jamie Arnold Using Antigen since 1999 -Original Message- From: Dimitri Limanovski [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:48 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You need to get the 4174 DATs to catch it and of course McAfee FTP servers are hammered! Use ftp:/ftpeur.nai.com and manually download the sdat-4174.zip. You will then have to manually apply it to your Exchange server, witch is major PITA by itself. See in FAQs on www.mcafeeb2b.com for Why are all attachments being blocked? question on instructions how to do it. Feel free to email me with any questions. Dimitri -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:33 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Groupsuck REALLY sucks... Even though I already had the latest dat installed, and all my services are running, two instances of this virus made it through. Thankfully I don't trust GS, and I sent out a warning and my users actually read it, and acted on it. Any idea why GS might not be catching them? Everything looks like it's set up properly. I caught all the Badtrans viruses last week. -Original Message- From: Dennis Atherton [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:27 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Download and save the file sarcx86.exe, and then execute it on the system to be updated. -Original Message- From: MHR(Michael Ross) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:50 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/n orto ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/ nort o n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http:[EMAIL PROTECTED] tml http://securityresponse.symantec.com/avcenter/venc/data/w32.goner.a@mm. html Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm *** The information transmitted in this email is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this email
RE: *** Warning *** New Virus - W32.goner.a@mm
exmerge -Original Message-From: Mal Sasalu [mailto:[EMAIL PROTECTED]]Sent: Tuesday, December 04, 2001 3:43 PMTo: MS-Exchange Admin IssuesSubject: RE: *** Warning *** New Virus - W32.goner.a@mm Hi there, Is there any tool with which I can clean all the mailboxes on my exchange from this dirty Hi message? Thanks mal -Original Message-From: Bob Fronk (BTR Technologies, Inc) [mailto:[EMAIL PROTECTED]]Sent: Tuesday, December 04, 2001 2:13 PMTo: MS-Exchange Admin IssuesSubject: RE: *** Warning *** New Virus - W32.goner.a@mm Configure NAV for Exchange to block attachments. This stopped "goner" in its tracks. I block: *.com, *.exe, *.scr and also the double extensions like *.jpg.vbs. and assorted others. http://service4.symantec.com/SUPPORT/ent-security.nsf/docid/271215411348 Bob -Original Message-From: Karen Palmer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:03 PMTo: MS-Exchange Admin IssuesSubject: RE: *** Warning *** New Virus - W32.goner.a@mm We just got this one. Norton's on Exchange and the desktops did NOT catch it and our virus definitions are current, so be careful. We are downloading Antigen as I type. Karen Palmer SCJD List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at:http://www.sunbelt-software.com/exchange_list_charter.htmList Charter and FAQ at:http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
Hi there, Is there any tool with which I can clean all the mailboxes on my exchange from this dirty Hi message? Thanks mal -Original Message- From: Bob Fronk (BTR Technologies, Inc) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:13 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Configure NAV for Exchange to block attachments. This stopped goner in its tracks. I block: *.com, *.exe, *.scr and also the double extensions like *.jpg.vbs. and assorted others. http://service4.symantec.com/SUPPORT/ent-security.nsf/docid/271215411348 Bob -Original Message- From: Karen Palmer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:03 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm We just got this one. Norton's on Exchange and the desktops did NOT catch it and our virus definitions are current, so be careful. We are downloading Antigen as I type. Karen Palmer SCJD List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
Gotta love McAfee... -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 15:59 To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm That figures... Their dumb site says 4173 will catch it. -Original Message- From: Dimitri Limanovski [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:48 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You need to get the 4174 DATs to catch it and of course McAfee FTP servers are hammered! Use ftp:/ftpeur.nai.com and manually download the sdat-4174.zip. You will then have to manually apply it to your Exchange server, witch is major PITA by itself. See in FAQs on www.mcafeeb2b.com for Why are all attachments being blocked? question on instructions how to do it. Feel free to email me with any questions. Dimitri -Original Message- From: Eric Brouwer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:33 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Groupsuck REALLY sucks... Even though I already had the latest dat installed, and all my services are running, two instances of this virus made it through. Thankfully I don't trust GS, and I sent out a warning and my users actually read it, and acted on it. Any idea why GS might not be catching them? Everything looks like it's set up properly. I caught all the Badtrans viruses last week. -Original Message- From: Dennis Atherton [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:27 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Download and save the file sarcx86.exe, and then execute it on the system to be updated. -Original Message- From: MHR(Michael Ross) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:50 AM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Which file do you grab from there -Original Message- From: Philip Youngworth [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 1:37 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm You can get the sarc update from their ftp server. ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/n orto ftp://ftp2.symantec.com/public/english_us_canada/antivirus_definitions/ nort o n_antivirus/specdef You should be able to grab the sarc there for it. -Original Message- From: Cicerrella, Steve [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 2:24 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Seeing this one already.I have not found a patch for Norton for Exchange yet.Already sent a broadcast to the users pleading with them to use some common sense and explicitly telling them NOT to open that one. I wonder how many of them will open it anyway.. ;) Steve -Original Message- From: Briggs, Bruce [ mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] ] Sent: Tuesday, December 04, 2001 10:41 AM To: MS-Exchange Admin Issues Subject: *** Warning *** New Virus - W32.goner.a@mm Just in case you are not aware yet, there is a new virus out there. Lots of incoming infected mail here, right now. We got an automatic update this morning for Antigen which is protecting us. Hope the same for you. http:[EMAIL PROTECTED] tml http://securityresponse.symantec.com/avcenter/venc/data/w32.goner.a@mm. html Bruce Briggs System Administration State University of NY List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm *** The information transmitted in this email is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this email in error, please contact the sender and permanently delete the email from any computer. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt
RE: *** Warning *** New Virus - W32.goner.a@mm
Title: RE: *** Warning *** New Virus - W32.goner.a@mm Not sure about E2k, but if you are using 5.5 check out Q224493 Danny Cahoon Network Engineer Saflink Corp -Original Message- From: Mal Sasalu [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:43 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Hi there, Is there any tool with which I can clean all the mailboxes on my exchange from this dirty "Hi" message? Thanks mal -Original Message- From: Bob Fronk (BTR Technologies, Inc) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:13 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm Configure NAV for Exchange to block attachments. This stopped goner in its tracks. I block: *.com, *.exe, *.scr and also the "double extensions" like *.jpg.vbs. and assorted others. http://service4.symantec.com/SUPPORT/ent-security.nsf/docid/271215411348 Bob -Original Message- From: Karen Palmer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:03 PM To: MS-Exchange Admin Issues Subject: RE: *** Warning *** New Virus - W32.goner.a@mm We just got this one. Norton's on Exchange and the desktops did NOT catch it and our virus definitions are current, so be careful. We are downloading Antigen as I type. Karen Palmer SCJD List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
RE: *** Warning *** New Virus - W32.goner.a@mm
ISSCAN -Original Message-From: Ellery July [mailto:[EMAIL PROTECTED]]Sent: Tuesday, December 04, 2001 4:46 PMTo: MS-Exchange Admin IssuesSubject: RE: *** Warning *** New Virus - W32.goner.a@mm exmerge -Original Message-From: Mal Sasalu [mailto:[EMAIL PROTECTED]]Sent: Tuesday, December 04, 2001 3:43 PMTo: MS-Exchange Admin IssuesSubject: RE: *** Warning *** New Virus - W32.goner.a@mm Hi there, Is there any tool with which I can clean all the mailboxes on my exchange from this dirty Hi message? Thanks mal -Original Message-From: Bob Fronk (BTR Technologies, Inc) [mailto:[EMAIL PROTECTED]]Sent: Tuesday, December 04, 2001 2:13 PMTo: MS-Exchange Admin IssuesSubject: RE: *** Warning *** New Virus - W32.goner.a@mm Configure NAV for Exchange to block attachments. This stopped "goner" in its tracks. I block: *.com, *.exe, *.scr and also the double extensions like *.jpg.vbs. and assorted others. http://service4.symantec.com/SUPPORT/ent-security.nsf/docid/271215411348 Bob -Original Message-From: Karen Palmer [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:03 PMTo: MS-Exchange Admin IssuesSubject: RE: *** Warning *** New Virus - W32.goner.a@mm We just got this one. Norton's on Exchange and the desktops did NOT catch it and our virus definitions are current, so be careful. We are downloading Antigen as I type. Karen Palmer SCJD List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at:http://www.sunbelt-software.com/exchange_list_charter.htmList Charter and FAQ at:http://www.sunbelt-software.com/exchange_list_charter.htmList Charter and FAQ at:http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
