RE: Nimda - Thought we were protected

[Struve, Jim]

Title: Message

The instructions are in the release notes on the NAV Corporate Edition CD.  Here are the files I use to set those options.  The reg file sets 12 extensions to block and the cmd file activates it.    nav12.reg Windows Registry Editor Version 5.00   [HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\NAVMSE\2.1\BlockingPolicy\Attachment] "UseRegularExpressions"=dword:00000000 "AttachmentNamesCount"=dword:0000000c "AllowsChecksWithinArchives"=dword:00000001 "AttachmentNames0"="*.shs" "AttachmentNames1"="*.vbs" "AttachmentNames2"="*.pif" "AttachmentNames3"="*.cmd" "AttachmentNames4"="*.bat" "AttachmentNames5"="*.vbe" "AttachmentNames6"="*.scr" "AttachmentNames7"="*.mpa" "AttachmentNames8"="*.mpeg" "AttachmentNames9"="*.avi" "AttachmentNames10"="*.mpg" "AttachmentNames11"="*.exe"   DisAllow.cmd nav12.reg naveupdate.exe -----Original Message----- From: David James [mailto:[EMAIL PROTECTED]] Sent: Monday, September 24, 2001 3:09 PM To: NT System Admin Issues Subject: RE: Nimda - Thought we were protected Peter, you got a doc on that from symantec? -----Original Message----- From: Kim, Peter J. [mailto:[EMAIL PROTECTED]] Sent: Monday, September 24, 2001 2:26 PM To: NT System Admin Issues Subject: RE: Nimda - Thought we were protected Or if you have Symantec NAV for exchange, you make minor adjustments to the Registry and it blocks all wanted attachments.   -----Original Message----- From: Ian Kelly [mailto:[EMAIL PROTECTED]] Sent: Monday, September 24, 2001 11:34 AM To: NT System Admin Issues Subject: RE: Nimda - Thought we were protected   Third party tools!     Ian --------------------------------- [EMAIL PROTECTED] --------------------------------- Love may not make the world go round, but I must admit that it makes the ride worthwhile. - Sean Connery -----Original Message----- From: Kelly Gosh [mailto:[EMAIL PROTECTED]] Sent: September 24, 2001 14:07 PM To: NT System Admin Issues Subject: RE: Nimda - Thought we were protected Where in Exchange 5.5 can you block certain attachments?  Ideally, I would like to block all *.exe and all *.vbs from most users.  I know how to block domains and email addresses, and I swear I've seen attachment blocking, but for the life of me I can't find it anywhere now! Any help would be appreciated. Kelly Gosh Information Systems Manager Brilliance Audio, Inc.   Phone: 616.846.5256 ext. 704 Fax: 616.846.0630   http://www.brillianceaudio.com       -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Monday, September 24, 2001 12:47 PM To: NT System Admin Issues Subject: RE: Nimda - Thought we were protected   SCAN ALL FILES  (asp,js,htm,html,shtm,shtml,dll), do  NOT use program files only! Replace riched20.dll and mcc.exe or you be infected again after you reboot! (ofcourse replace them with clean copys!) Kind regards, Pim Vessies CS&O Backoffice Philips Medical Systems IM/CS&O/BO Building QAII-441 Veenpluis 4 - 6, 5684 PC Best The Netherlands "Steve Kelsay" <[EMAIL PROTECTED]> on 09/24/2001 05:11:25 PM Please respond to "NT System Admin Issues" <[EMAIL PROTECTED]> To:     "NT System Admin Issues" <[EMAIL PROTECTED]> cc:      (bcc: Pim Vessies/BST/MS/PHILIPS) Subject:  RE: Nimda - Thought we were protected Classification:   Yes, I had installed all the patches we discussed here on the site. Steve Kelsay Network Administration Group South Carolina Department of Revenue 301 Gervais Street Columbia, SC 29201 (803) 898-5522 >>> [EMAIL PROTECTED] 09/24/01 10:59AM >>> Did you have the IE patch applied?  If the browsed to a infected site they can get the virus that way as well. Robert Muncy Sherman Financial Group -----Original Message----- From: Steve Kelsay [mailto:[EMAIL PROTECTED]] Sent: Monday, September 24, 2001 10:35 AM To: NT System Admin Issues Subject: Nimda - Thought we were protected   First alert, Maybe nothing. We just had our developer machines, running NT2000 Server hit with Nimda. The strange thing is, we have Nimda protection in our email scanner, and all the security fixes MS said should be applied. SP2 is installed. The machines boot up, a log in screen displays, and they login. The Novell login script begins to run as normal ( we run mixed network, NT and Novell), then the login script box clears as normal, a blue screen appears as normal, and nothing further happens. Could this be a new strain? Steve Kelsay Network Administration Group South Carolina Department of Revenue 301 Gervais Street Columbia, SC 29201 (803) 898-5522   http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm   http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm