In case anyone hasn't noticed this yet, the virus also uses random email address on the outgoing emails. I was unfortunate enough to be sent this email by someone and now other emails have been going out (from the same person it looks like) using our domain name in the senders address. Unfortunately the good folks at Messagelabs cannot read email headers and sent me an email saying that we are sending out viruses. They were even so kind as to attach the header of the incoming infected message clearing showing the email did not come from our mail server.
Chuck -----Original Message----- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Monday, September 30, 2002 5:30 PM To: Exchange Discussions Subject: RE: W32/Bugbear-A spreading rapidly You should be on 3.8 Best way to do this is in attachment blocking by extension, then duplicate by name in the other field. Exe;scr;com etc *.exe;*.scr;*.com etc -----Original Message----- From: Smith, Ronni [mailto:[EMAIL PROTECTED]] Sent: Monday, September 30, 2002 5:04 PM To: Exchange Discussions Subject: RE: W32/Bugbear-A spreading rapidly Those who were having Trend Scanmail successfully catch this by using attachment screening could you please reply with which version engine etc. you are using? My Scanmail did not catch it in spite of my having *.scr in my attachment extensions to block list. It still didn't with *.*.scr either. I think I saw something about this problem about a year ago or so on this list but I can't find the appropriate message and can't seem to find the right search terms today. And, unsurprisingly, I can't get onto Trend's site to check there. Thanks, Ronni _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
