RE: New Virus outbreak
What type of scan were you doing? If it was MAPI only, that is why. I was just talking yesterday about how you HAVE TO use AVAPI or ESE based scanning. MAPI will overload. SO which was it? BTW, Get ScanMail or Sybari anyways. -Original Message- From: Edwards, Aaron [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:18 PM To: Exchange Discussions Subject: RE: New Virus outbreak The weird thing is that we are blocking .scr files but after a certain point of being hammered, NAV for exchange just couldn't keep up and users started opening it and we now have 5000 hi emails all over the place. About ready to throw in the towel and start using Scanmail. Aaron -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:48 PM To: Exchange Discussions Subject: RE: New Virus outbreak Behold, the beauty of multiple scan engines :) ~ -K.Borndale Network Administrator Sybari Software 631.630.8569 -direct dial 631.439.0689 -fax http://www.sybari.com One man's ceiling is another man's floor |+--- || Martin Blackstone| || MBlackstone@superioracce| || ss.com | || Sent by: | || bounce-exchange-148870@ls| || .swynk.com | || | || | || 12/04/2001 05:16 PM | || Please respond to| || Exchange Discussions | || | |+--- --- | | | | To: Exchange Discussions [EMAIL PROTECTED] | | cc: | | Subject: RE: New Virus outbreak | --- | Wow. That's mighty nice of them to get something out before the end of the day -Original Message- From: James Winzenz [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:15 PM To: Exchange Discussions Subject: RE: New Virus outbreak Just got released officially about 20 minutes ago. Definition is from 12/4, version 31204p. James Winzenz, MCSE, A+ Associate Systems Administrator Peregrine Systems, Inc. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:28 PM To:Exchange Discussions Subject:RE: New Virus outbreak I've been hitting live update on Norton AV 2001 on my desktop every hour today. Nothing past 28 Nov. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Stop plate Tectonics! -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:36 PM To: Exchange Discussions Subject: RE: New Virus outbreak Ooops.. insert foot in mouth). We use Symantec and Trend here. I know Trend has been picking it up all day with the new defs, but Norton must not have a new def out yet. I just checked again and it looks like Nov. 28th is the latest for Norton. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak Where did you find the defs? I am unable to download it from Symantec's site as it still as the defs dated 28Nov2001 and LiveUpdate says that we have the current defs. -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:16 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yep. Has been available for a few hours, I believe. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing
RE: New Virus outbreak
You would probably have the same problem with Scanmail - use Antigen scans before it hits the information store - -Original Message- From: Edwards, Aaron [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 6:18 PM To: Exchange Discussions Subject: RE: New Virus outbreak The weird thing is that we are blocking .scr files but after a certain point of being hammered, NAV for exchange just couldn't keep up and users started opening it and we now have 5000 hi emails all over the place. About ready to throw in the towel and start using Scanmail. Aaron -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:48 PM To: Exchange Discussions Subject: RE: New Virus outbreak Behold, the beauty of multiple scan engines :) ~ -K.Borndale Network Administrator Sybari Software 631.630.8569 -direct dial 631.439.0689 -fax http://www.sybari.com One man's ceiling is another man's floor |+--- || Martin Blackstone| || MBlackstone@superioracce| || ss.com | || Sent by: | || bounce-exchange-148870@ls| || .swynk.com | || | || | || 12/04/2001 05:16 PM | || Please respond to| || Exchange Discussions | || | |+--- --- | | | | To: Exchange Discussions [EMAIL PROTECTED] | | cc: | | Subject: RE: New Virus outbreak | --- | Wow. That's mighty nice of them to get something out before the end of the day -Original Message- From: James Winzenz [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:15 PM To: Exchange Discussions Subject: RE: New Virus outbreak Just got released officially about 20 minutes ago. Definition is from 12/4, version 31204p. James Winzenz, MCSE, A+ Associate Systems Administrator Peregrine Systems, Inc. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:28 PM To:Exchange Discussions Subject:RE: New Virus outbreak I've been hitting live update on Norton AV 2001 on my desktop every hour today. Nothing past 28 Nov. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Stop plate Tectonics! -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:36 PM To: Exchange Discussions Subject: RE: New Virus outbreak Ooops.. insert foot in mouth). We use Symantec and Trend here. I know Trend has been picking it up all day with the new defs, but Norton must not have a new def out yet. I just checked again and it looks like Nov. 28th is the latest for Norton. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak Where did you find the defs? I am unable to download it from Symantec's site as it still as the defs dated 28Nov2001 and LiveUpdate says that we have the current defs. -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:16 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yep. Has been available for a few hours, I believe. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because
RE: New Virus outbreak
NOT It isn't the software per se, but rather the scanning method. MAPI will do this to you every time. AVAPI (Trend) and ESE (Sybari/Trend) wouldn't do this. -Original Message- From: David Weinstein [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 7:01 AM To: Exchange Discussions Subject: RE: New Virus outbreak You would probably have the same problem with Scanmail - use Antigen scans before it hits the information store - -Original Message- From: Edwards, Aaron [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 6:18 PM To: Exchange Discussions Subject: RE: New Virus outbreak The weird thing is that we are blocking .scr files but after a certain point of being hammered, NAV for exchange just couldn't keep up and users started opening it and we now have 5000 hi emails all over the place. About ready to throw in the towel and start using Scanmail. Aaron -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:48 PM To: Exchange Discussions Subject: RE: New Virus outbreak Behold, the beauty of multiple scan engines :) ~ -K.Borndale Network Administrator Sybari Software 631.630.8569 -direct dial 631.439.0689 -fax http://www.sybari.com One man's ceiling is another man's floor |+--- || Martin Blackstone| || MBlackstone@superioracce| || ss.com | || Sent by: | || bounce-exchange-148870@ls| || .swynk.com | || | || | || 12/04/2001 05:16 PM | || Please respond to| || Exchange Discussions | || | |+--- --- | | | | To: Exchange Discussions [EMAIL PROTECTED] | | cc: | | Subject: RE: New Virus outbreak | --- | Wow. That's mighty nice of them to get something out before the end of the day -Original Message- From: James Winzenz [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:15 PM To: Exchange Discussions Subject: RE: New Virus outbreak Just got released officially about 20 minutes ago. Definition is from 12/4, version 31204p. James Winzenz, MCSE, A+ Associate Systems Administrator Peregrine Systems, Inc. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:28 PM To:Exchange Discussions Subject:RE: New Virus outbreak I've been hitting live update on Norton AV 2001 on my desktop every hour today. Nothing past 28 Nov. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Stop plate Tectonics! -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:36 PM To: Exchange Discussions Subject: RE: New Virus outbreak Ooops.. insert foot in mouth). We use Symantec and Trend here. I know Trend has been picking it up all day with the new defs, but Norton must not have a new def out yet. I just checked again and it looks like Nov. 28th is the latest for Norton. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak Where did you find the defs? I am unable to download it from Symantec's site as it still as the defs dated 28Nov2001 and LiveUpdate says that we have the current defs. -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:16 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yep. Has been available for a few hours, I believe. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak
RE: New Virus outbreak
Only those who use it would truly know that. ;o) D The ultimate measure of a man is not where he stands in moments of comfort, but where he stands at times of challenge and controversy. -Martin Luther King, Jr. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 7:14 AM To: Exchange Discussions Subject: RE: New Virus outbreak NOT It isn't the software per se, but rather the scanning method. MAPI will do this to you every time. AVAPI (Trend) and ESE (Sybari/Trend) wouldn't do this. -Original Message- From: David Weinstein [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 7:01 AM To: Exchange Discussions Subject: RE: New Virus outbreak You would probably have the same problem with Scanmail - use Antigen scans before it hits the information store - -Original Message- From: Edwards, Aaron [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 6:18 PM To: Exchange Discussions Subject: RE: New Virus outbreak The weird thing is that we are blocking .scr files but after a certain point of being hammered, NAV for exchange just couldn't keep up and users started opening it and we now have 5000 hi emails all over the place. About ready to throw in the towel and start using Scanmail. Aaron -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:48 PM To: Exchange Discussions Subject: RE: New Virus outbreak Behold, the beauty of multiple scan engines :) ~ -K.Borndale Network Administrator Sybari Software 631.630.8569 -direct dial 631.439.0689 -fax http://www.sybari.com One man's ceiling is another man's floor |+--- || Martin Blackstone| || MBlackstone@superioracce| || ss.com | || Sent by: | || bounce-exchange-148870@ls| || .swynk.com | || | || | || 12/04/2001 05:16 PM | || Please respond to| || Exchange Discussions | || | |+--- --- | | | | To: Exchange Discussions [EMAIL PROTECTED] | | cc: | | Subject: RE: New Virus outbreak | --- | Wow. That's mighty nice of them to get something out before the end of the day -Original Message- From: James Winzenz [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:15 PM To: Exchange Discussions Subject: RE: New Virus outbreak Just got released officially about 20 minutes ago. Definition is from 12/4, version 31204p. James Winzenz, MCSE, A+ Associate Systems Administrator Peregrine Systems, Inc. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:28 PM To:Exchange Discussions Subject:RE: New Virus outbreak I've been hitting live update on Norton AV 2001 on my desktop every hour today. Nothing past 28 Nov. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Stop plate Tectonics! -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:36 PM To: Exchange Discussions Subject: RE: New Virus outbreak Ooops.. insert foot in mouth). We use Symantec and Trend here. I know Trend has been picking it up all day with the new defs, but Norton must not have a new def out yet. I just checked again and it looks like Nov. 28th is the latest for Norton. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak Where did you find the defs? I am unable to download it from Symantec's site as it still as the defs dated 28Nov2001 and LiveUpdate says that we have the current defs. -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:16 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yep. Has been available for a few hours, I believe. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus
RE: New Virus outbreak
NAV has missed some of the gone.scr at our site also. Not that many coming in. Bill Kuhl The weird thing is that we are blocking .scr files but after a certain point of being hammered, NAV for exchange just couldn't keep up and users started opening it and we now have 5000 hi emails all over the place. About ready to throw in the towel and start using Scanmail. Aaron _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
That's a known problem with MAPI based scanners... D UNIX is an operating system, OS/2 is half an operating system, Windows is a shell, and DOS is a boot partition virus. -Peter H. Coffin -Original Message- From: Bill Kuhl [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 7:19 AM To: Exchange Discussions Subject: RE: New Virus outbreak NAV has missed some of the gone.scr at our site also. Not that many coming in. Bill Kuhl The weird thing is that we are blocking .scr files but after a certain point of being hammered, NAV for exchange just couldn't keep up and users started opening it and we now have 5000 hi emails all over the place. About ready to throw in the towel and start using Scanmail. Aaron _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
That's NAV for you. You need to check out Antigen for Exchange. www.sybari.com -Original Message- From: Edwards, Aaron [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 6:18 PM To: Exchange Discussions Subject: RE: New Virus outbreak The weird thing is that we are blocking .scr files but after a certain point of being hammered, NAV for exchange just couldn't keep up and users started opening it and we now have 5000 hi emails all over the place. About ready to throw in the towel and start using Scanmail. Aaron -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:48 PM To: Exchange Discussions Subject: RE: New Virus outbreak Behold, the beauty of multiple scan engines :) ~ -K.Borndale Network Administrator Sybari Software 631.630.8569 -direct dial 631.439.0689 -fax http://www.sybari.com One man's ceiling is another man's floor |+--- || Martin Blackstone| || MBlackstone@superioracce| || ss.com | || Sent by: | || bounce-exchange-148870@ls| || .swynk.com | || | || | || 12/04/2001 05:16 PM | || Please respond to| || Exchange Discussions | || | |+--- --- | | | | To: Exchange Discussions [EMAIL PROTECTED] | | cc: | | Subject: RE: New Virus outbreak | --- | Wow. That's mighty nice of them to get something out before the end of the day -Original Message- From: James Winzenz [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:15 PM To: Exchange Discussions Subject: RE: New Virus outbreak Just got released officially about 20 minutes ago. Definition is from 12/4, version 31204p. James Winzenz, MCSE, A+ Associate Systems Administrator Peregrine Systems, Inc. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:28 PM To:Exchange Discussions Subject:RE: New Virus outbreak I've been hitting live update on Norton AV 2001 on my desktop every hour today. Nothing past 28 Nov. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Stop plate Tectonics! -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:36 PM To: Exchange Discussions Subject: RE: New Virus outbreak Ooops.. insert foot in mouth). We use Symantec and Trend here. I know Trend has been picking it up all day with the new defs, but Norton must not have a new def out yet. I just checked again and it looks like Nov. 28th is the latest for Norton. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak Where did you find the defs? I am unable to download it from Symantec's site as it still as the defs dated 28Nov2001 and LiveUpdate says that we have the current defs. -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:16 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yep. Has been available for a few hours, I believe. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only
RE: New Virus outbreak
No it's not. It's trying to do the job of NAV for Gateways with NAV for Exchange. Most people who own NAV for Exchange own the gateway product too and don't deploy it. At peak times NAV-Gateways was tossing these into the quarantine at the rate of a few dozen per minute yesterday. Not even a hiccup, and it's running on a workstation. Maybe you're thinking of InoculateIT. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Posted At: Wednesday, December 05, 2001 10:12 AM Posted To: MSExchange Mailing List Conversation: New Virus outbreak Subject: RE: New Virus outbreak That's NAV for you. You need to check out Antigen for Exchange. www.sybari.com -Original Message- From: Edwards, Aaron [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 6:18 PM To: Exchange Discussions Subject: RE: New Virus outbreak The weird thing is that we are blocking .scr files but after a certain point of being hammered, NAV for exchange just couldn't keep up and users started opening it and we now have 5000 hi emails all over the place. About ready to throw in the towel and start using Scanmail. Aaron _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
I've exchanged email with Sybari support. They say filtering *.vbs will also filter txt.vbs, etc. Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:06 PM To: Exchange Discussions Subject: RE: New Virus outbreak Most of the free email services should be filtering or disallowing these types of attachments to be sent. I know that mail.yahoo.com does. -Original Message- From: Darryl Harris [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:59 PM To: Exchange Discussions Subject: RE: New Virus outbreak It is best to test this from an outside mail account like hotmail and send a message with a harmless attachment having a txt.vbs extension. Darryl -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 12:01 PM To: Exchange Discussions Subject: RE: New Virus outbreak Won't filtering *.vbs also filter *.txt.vbs? Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:51 PM To: Exchange Discussions Subject: RE: New Virus outbreak I pretty much filter everything. One of the good aspects of Antigen for Sybari is that I can quarantine certain items and approve delivery later if I choose. For example, I filter all *.exe files but some *.exe files might serve a legitimate purpose (very rarely happens..but it does). User will notify me before or after the file is sent. If I deem the executable worthy then I simply forward it to the recipient using the Antigen interface. Even though I'm filtering just about every extension known to man I still have to watch out for these double extensions.(Example: *.txt.vbs,, *.txt.exe,, *.txt.lnk). ETC. The next version of Antigen will allow content filtering. This helps but can cause other problems so I will use it sparingly. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:46 PM To: Exchange Discussions Subject: RE: New Virus outbreak Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED
RE: New Virus outbreak
YEs. They told me the same. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 11:46 AM To: Exchange Discussions Subject: RE: New Virus outbreak I've exchanged email with Sybari support. They say filtering *.vbs will also filter txt.vbs, etc. Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:06 PM To: Exchange Discussions Subject: RE: New Virus outbreak Most of the free email services should be filtering or disallowing these types of attachments to be sent. I know that mail.yahoo.com does. -Original Message- From: Darryl Harris [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:59 PM To: Exchange Discussions Subject: RE: New Virus outbreak It is best to test this from an outside mail account like hotmail and send a message with a harmless attachment having a txt.vbs extension. Darryl -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 12:01 PM To: Exchange Discussions Subject: RE: New Virus outbreak Won't filtering *.vbs also filter *.txt.vbs? Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:51 PM To: Exchange Discussions Subject: RE: New Virus outbreak I pretty much filter everything. One of the good aspects of Antigen for Sybari is that I can quarantine certain items and approve delivery later if I choose. For example, I filter all *.exe files but some *.exe files might serve a legitimate purpose (very rarely happens..but it does). User will notify me before or after the file is sent. If I deem the executable worthy then I simply forward it to the recipient using the Antigen interface. Even though I'm filtering just about every extension known to man I still have to watch out for these double extensions.(Example: *.txt.vbs,, *.txt.exe,, *.txt.lnk). ETC. The next version of Antigen will allow content filtering. This helps but can cause other problems so I will use it sparingly. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:46 PM To: Exchange Discussions Subject: RE: New Virus outbreak Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource
RE: New Virus outbreak
With antigen or scanmail... is it better to have it on a seperate server or can you have it on your exchange box? Aaron -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 9:47 AM To: Exchange Discussions Subject: RE: New Virus outbreak YEs. They told me the same. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 11:46 AM To: Exchange Discussions Subject: RE: New Virus outbreak I've exchanged email with Sybari support. They say filtering *.vbs will also filter txt.vbs, etc. Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:06 PM To: Exchange Discussions Subject: RE: New Virus outbreak Most of the free email services should be filtering or disallowing these types of attachments to be sent. I know that mail.yahoo.com does. -Original Message- From: Darryl Harris [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:59 PM To: Exchange Discussions Subject: RE: New Virus outbreak It is best to test this from an outside mail account like hotmail and send a message with a harmless attachment having a txt.vbs extension. Darryl -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 12:01 PM To: Exchange Discussions Subject: RE: New Virus outbreak Won't filtering *.vbs also filter *.txt.vbs? Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:51 PM To: Exchange Discussions Subject: RE: New Virus outbreak I pretty much filter everything. One of the good aspects of Antigen for Sybari is that I can quarantine certain items and approve delivery later if I choose. For example, I filter all *.exe files but some *.exe files might serve a legitimate purpose (very rarely happens..but it does). User will notify me before or after the file is sent. If I deem the executable worthy then I simply forward it to the recipient using the Antigen interface. Even though I'm filtering just about every extension known to man I still have to watch out for these double extensions.(Example: *.txt.vbs,, *.txt.exe,, *.txt.lnk). ETC. The next version of Antigen will allow content filtering. This helps but can cause other problems so I will use it sparingly. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:46 PM To: Exchange Discussions Subject: RE: New Virus outbreak Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource
RE: New Virus outbreak
I think you're supposed to install it on the Exchange box. At least that's how it is with Trend. If you look at it from a pure efficiency/performance standpoint, even if it was possible, a separate server would not be a good idea. Every message that hits your store will have to be teleported to the scanner server and then teleported back. That's an awful lot of extra network traffic. S. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 2:00 PM To: Exchange Discussions Subject: RE: New Virus outbreak Dunno about Scanmail but Antigen interfaces directly with the Exchange Store and actually scans attachments before they enter users mailboxesUnlike NAV. -Original Message- From: Edwards, Aaron [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 1:00 PM To: Exchange Discussions Subject: RE: New Virus outbreak With antigen or scanmail... is it better to have it on a seperate server or can you have it on your exchange box? Aaron -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 9:47 AM To: Exchange Discussions Subject: RE: New Virus outbreak YEs. They told me the same. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 11:46 AM To: Exchange Discussions Subject: RE: New Virus outbreak I've exchanged email with Sybari support. They say filtering *.vbs will also filter txt.vbs, etc. Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:06 PM To: Exchange Discussions Subject: RE: New Virus outbreak Most of the free email services should be filtering or disallowing these types of attachments to be sent. I know that mail.yahoo.com does. -Original Message- From: Darryl Harris [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:59 PM To: Exchange Discussions Subject: RE: New Virus outbreak It is best to test this from an outside mail account like hotmail and send a message with a harmless attachment having a txt.vbs extension. Darryl -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 12:01 PM To: Exchange Discussions Subject: RE: New Virus outbreak Won't filtering *.vbs also filter *.txt.vbs? Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:51 PM To: Exchange Discussions Subject: RE: New Virus outbreak I pretty much filter everything. One of the good aspects of Antigen for Sybari is that I can quarantine certain items and approve delivery later if I choose. For example, I filter all *.exe files but some *.exe files might serve a legitimate purpose (very rarely happens..but it does). User will notify me before or after the file is sent. If I deem the executable worthy then I simply forward it to the recipient using the Antigen interface. Even though I'm filtering just about every extension known to man I still have to watch out for these double extensions.(Example: *.txt.vbs,, *.txt.exe,, *.txt.lnk). ETC. The next version of Antigen will allow content filtering. This helps but can cause other problems so I will use it sparingly. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:46 PM To: Exchange Discussions Subject: RE: New Virus outbreak Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended
RE: New Virus outbreak
You would install either one on the Exchange server. ~ -K.Borndale Network Administrator Sybari Software 631.630.8569 -direct dial 631.439.0689 -fax http://www.sybari.com One man's ceiling is another man's floor |+--- || Edwards, Aaron | || [EMAIL PROTECTED] | || Sent by: | || bounce-exchange-148870@ls| || .swynk.com | || | || | || 12/05/2001 01:59 PM | || Please respond to| || Exchange Discussions | || | |+--- ---| | | | To: Exchange Discussions [EMAIL PROTECTED] | | cc: | | Subject: RE: New Virus outbreak | ---| With antigen or scanmail... is it better to have it on a seperate server or can you have it on your exchange box? Aaron -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 9:47 AM To: Exchange Discussions Subject: RE: New Virus outbreak YEs. They told me the same. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 11:46 AM To: Exchange Discussions Subject: RE: New Virus outbreak I've exchanged email with Sybari support. They say filtering *.vbs will also filter txt.vbs, etc. Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:06 PM To: Exchange Discussions Subject: RE: New Virus outbreak Most of the free email services should be filtering or disallowing these types of attachments to be sent. I know that mail.yahoo.com does. -Original Message- From: Darryl Harris [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:59 PM To: Exchange Discussions Subject: RE: New Virus outbreak It is best to test this from an outside mail account like hotmail and send a message with a harmless attachment having a txt.vbs extension. Darryl -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 12:01 PM To: Exchange Discussions Subject: RE: New Virus outbreak Won't filtering *.vbs also filter *.txt.vbs? Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:51 PM To: Exchange Discussions Subject: RE: New Virus outbreak I pretty much filter everything. One of the good aspects of Antigen for Sybari is that I can quarantine certain items and approve delivery later if I choose. For example, I filter all *.exe files but some *.exe files might serve a legitimate purpose (very rarely happens..but it does). User will notify me before or after the file is sent. If I deem the executable worthy then I simply forward it to the recipient using the Antigen interface. Even though I'm filtering just about every extension known to man I still have to watch out for these double extensions.(Example: *.txt.vbs,, *.txt.exe,, *.txt.lnk). ETC. The next version of Antigen will allow content filtering. This helps but can cause other problems so I will use it sparingly. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:46 PM To: Exchange Discussions Subject: RE: New Virus outbreak Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love
RE: New Virus outbreak
Correct. You could use an AV Gateway and put it in front of the Exch server to scan all incoming internet mail, but you still need AV on the Exch box. -Original Message- From: Soysal, Serdar [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 11:07 AM To: Exchange Discussions Subject: RE: New Virus outbreak I think you're supposed to install it on the Exchange box. At least that's how it is with Trend. If you look at it from a pure efficiency/performance standpoint, even if it was possible, a separate server would not be a good idea. Every message that hits your store will have to be teleported to the scanner server and then teleported back. That's an awful lot of extra network traffic. S. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 2:00 PM To: Exchange Discussions Subject: RE: New Virus outbreak Dunno about Scanmail but Antigen interfaces directly with the Exchange Store and actually scans attachments before they enter users mailboxesUnlike NAV. -Original Message- From: Edwards, Aaron [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 1:00 PM To: Exchange Discussions Subject: RE: New Virus outbreak With antigen or scanmail... is it better to have it on a seperate server or can you have it on your exchange box? Aaron -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 9:47 AM To: Exchange Discussions Subject: RE: New Virus outbreak YEs. They told me the same. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 11:46 AM To: Exchange Discussions Subject: RE: New Virus outbreak I've exchanged email with Sybari support. They say filtering *.vbs will also filter txt.vbs, etc. Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:06 PM To: Exchange Discussions Subject: RE: New Virus outbreak Most of the free email services should be filtering or disallowing these types of attachments to be sent. I know that mail.yahoo.com does. -Original Message- From: Darryl Harris [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:59 PM To: Exchange Discussions Subject: RE: New Virus outbreak It is best to test this from an outside mail account like hotmail and send a message with a harmless attachment having a txt.vbs extension. Darryl -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 12:01 PM To: Exchange Discussions Subject: RE: New Virus outbreak Won't filtering *.vbs also filter *.txt.vbs? Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:51 PM To: Exchange Discussions Subject: RE: New Virus outbreak I pretty much filter everything. One of the good aspects of Antigen for Sybari is that I can quarantine certain items and approve delivery later if I choose. For example, I filter all *.exe files but some *.exe files might serve a legitimate purpose (very rarely happens..but it does). User will notify me before or after the file is sent. If I deem the executable worthy then I simply forward it to the recipient using the Antigen interface. Even though I'm filtering just about every extension known to man I still have to watch out for these double extensions.(Example: *.txt.vbs,, *.txt.exe,, *.txt.lnk). ETC. The next version of Antigen will allow content filtering. This helps but can cause other problems so I will use it sparingly. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:46 PM To: Exchange Discussions Subject: RE: New Virus outbreak Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out
RE: New Virus outbreak
Yeah, F-Secure really is amazing that way, Kelly. -- be - MOS One man's brain plus one other will produce one half as many ideas as one man would have produced alone. These two plus two more will produce half again as many ideas. These four plus four more begin to represent a creative meeting, and the ratio changes to one quarter as many ... -- Anthony Chevins -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 5:48 PM To: Exchange Discussions Subject: RE: New Virus outbreak Behold, the beauty of multiple scan engines :) ~ -K.Borndale Network Administrator Sybari Software 631.630.8569 -direct dial 631.439.0689 -fax http://www.sybari.com One man's ceiling is another man's floor |+--- || Martin Blackstone| || MBlackstone@superioracce| || ss.com | || Sent by: | || bounce-exchange-148870@ls| || .swynk.com | || | || | || 12/04/2001 05:16 PM | || Please respond to| || Exchange Discussions | || | |+--- - -- | | | | To: Exchange Discussions [EMAIL PROTECTED] | | cc: | | Subject: RE: New Virus outbreak | - -- | Wow. That's mighty nice of them to get something out before the end of the day _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
We use NAV Enterprise and we've been catching everything BEFORE it gets to the mailboxes. That includes this recent outbreak. _ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
I've checked both Mcafee.com and Symantec.com sites and found nothing. -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:14 AM To: Exchange Discussions Subject:RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Trend Information: http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=WORM_GONE.A; VSect=T -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:14 AM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Symantec/Norton AV Information: http:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:20 AM To: Exchange Discussions Subject: RE: New Virus outbreak Trend Information: http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=WORM_GONE.A; VSect=T -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:14 AM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
As have we. 26 so far. -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 12:05 PM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Yessir! We all read your now (in)famous list. Didn't we? ;-) Phil - Phil Randal Network Engineer Herefordshire Council Hereford, UK -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 17:05 To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
We are here, and EXE, and PIF, and VBS and so on If they want it, they have to talk to me first. POWER! -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Actually, you should always block it. .SCR files have no business use at all unless you mfg screen savers. -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Good catch! -Original Message- From: Durkee, Peter [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:38 AM To: Exchange Discussions Subject: RE: New Virus outbreak Or unless you have an accounting package which runs under NT but comes from the Unix world and uses scripts that have an SCR extension. This is where Antigen's ability to block all SCR files, except those that are really text files, comes in handy. -Peter -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:24 To: Exchange Discussions Subject: RE: New Virus outbreak Actually, you should always block it. .SCR files have no business use at all unless you mfg screen savers. -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] __ This message is private or privileged. If you are not the person for whom this message is intended, please delete it and notify me immediately, and please do not copy or send this message to anyone else. _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL
RE: New Virus outbreak
We are getting hammered. 100 catches on the Internet gateway within the last half hour. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only because you yourself know it to be true. -- Buddha -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 12:39 PM To: Exchange Discussions Subject: RE: New Virus outbreak Good catch! -Original Message- From: Durkee, Peter [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:38 AM To: Exchange Discussions Subject: RE: New Virus outbreak Or unless you have an accounting package which runs under NT but comes from the Unix world and uses scripts that have an SCR extension. This is where Antigen's ability to block all SCR files, except those that are really text files, comes in handy. -Peter -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:24 To: Exchange Discussions Subject: RE: New Virus outbreak Actually, you should always block it. .SCR files have no business use at all unless you mfg screen savers. -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] __ This message is private or privileged. If you are not the person for whom this message is intended, please delete it and notify me immediately, and please do not copy or send this message to anyone else
RE: New Virus outbreak
Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE: New Virus outbreak Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:17 PM To: Exchange Discussions Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE: New Virus outbreak Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ
RE: New Virus outbreak
It will block the attachments first. So it never gets scanned, just deleted. -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:37 AM To: Exchange Discussions Subject: RE: New Virus outbreak After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:17 PM To: Exchange Discussions Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE: New Virus outbreak Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource
RE: New Virus outbreak
Alright, but even if it blocks the attachment it still sends mail to the user. Is there anyway to stop that? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:37 PM To: Exchange Discussions Subject: RE: New Virus outbreak It will block the attachments first. So it never gets scanned, just deleted. -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:37 AM To: Exchange Discussions Subject: RE: New Virus outbreak After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:17 PM To: Exchange Discussions Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE: New Virus outbreak Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List
RE: New Virus outbreak
No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only because you yourself know it to be true. -- Buddha -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:44 PM To: Exchange Discussions Subject: RE: New Virus outbreak Alright, but even if it blocks the attachment it still sends mail to the user. Is there anyway to stop that? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:37 PM To: Exchange Discussions Subject: RE: New Virus outbreak It will block the attachments first. So it never gets scanned, just deleted. -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:37 AM To: Exchange Discussions Subject: RE: New Virus outbreak After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:17 PM To: Exchange Discussions Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE: New Virus outbreak Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL
RE: New Virus outbreak
I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only because you yourself know it to be true. -- Buddha -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:44 PM To: Exchange Discussions Subject: RE: New Virus outbreak Alright, but even if it blocks the attachment it still sends mail to the user. Is there anyway to stop that? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:37 PM To: Exchange Discussions Subject: RE: New Virus outbreak It will block the attachments first. So it never gets scanned, just deleted. -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:37 AM To: Exchange Discussions Subject: RE: New Virus outbreak After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:17 PM To: Exchange Discussions Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE: New Virus outbreak Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05
RE: New Virus outbreak
Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only because you yourself know it to be true. -- Buddha -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:44 PM To: Exchange Discussions Subject: RE: New Virus outbreak Alright, but even if it blocks the attachment it still sends mail to the user. Is there anyway to stop that? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:37 PM To: Exchange Discussions Subject: RE: New Virus outbreak It will block the attachments first. So it never gets scanned, just deleted. -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:37 AM To: Exchange Discussions Subject: RE: New Virus outbreak After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:17 PM To: Exchange Discussions Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE: New Virus outbreak Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual
RE: New Virus outbreak
What is the latest Trend Pattern? -Original Message- From: Akerlund, Scott [mailto:[EMAIL PROTECTED]] Posted At: Tuesday, December 04, 2001 7:10 PM Posted To: Exchange Conversation: New Virus outbreak Subject: RE: New Virus outbreak We are here, and EXE, and PIF, and VBS and so on If they want it, they have to talk to me first. POWER! -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Don't you guys use an Intrusion Detection Package..something like Snort??? _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Yep. Has been available for a few hours, I believe. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only because you yourself know it to be true. -- Buddha -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:44 PM To: Exchange Discussions Subject: RE: New Virus outbreak Alright, but even if it blocks the attachment it still sends mail to the user. Is there anyway to stop that? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:37 PM To: Exchange Discussions Subject: RE: New Virus outbreak It will block the attachments first. So it never gets scanned, just deleted. -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:37 AM To: Exchange Discussions Subject: RE: New Virus outbreak After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:17 PM To: Exchange Discussions Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE: New Virus outbreak Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended
RE: New Virus outbreak
Don't you guys run a Intrusion Detection Package like snort or something? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Posted At: Tuesday, December 04, 2001 8:17 PM Posted To: Exchange Conversation: New Virus outbreak Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE: New Virus outbreak Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED
RE: New Virus outbreak
177 (977) Jeffrey R. Waters Senior Systems Engineer Information Technology, Hanover County -Original Message- From: Exchange [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 12:20 PM To: Exchange Discussions Subject: RE: New Virus outbreak What is the latest Trend Pattern? -Original Message- From: Akerlund, Scott [mailto:[EMAIL PROTECTED]] Posted At: Tuesday, December 04, 2001 7:10 PM Posted To: Exchange Conversation: New Virus outbreak Subject: RE: New Virus outbreak We are here, and EXE, and PIF, and VBS and so on If they want it, they have to talk to me first. POWER! -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak - OT on snort
yes. do you have a rule that is catching gone_A and pulling the frames off the wire? -Original Message- From: Koos Jacobs [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:39 AM To: Exchange Discussions Subject: RE: New Virus outbreak Don't you guys use an Intrusion Detection Package..something like Snort??? _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Don't you guys use a Intrusion Detection PackageSomething like Snort? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Posted At: Tuesday, December 04, 2001 8:17 PM Posted To: Exchange Conversation: New Virus outbreak Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE: New Virus outbreak Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED
RE: New Virus outbreak
177 -Original Message- From: Exchange [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:20 AM To: Exchange Discussions Subject: RE: New Virus outbreak What is the latest Trend Pattern? -Original Message- From: Akerlund, Scott [mailto:[EMAIL PROTECTED]] Posted At: Tuesday, December 04, 2001 7:10 PM Posted To: Exchange Conversation: New Virus outbreak Subject: RE: New Virus outbreak We are here, and EXE, and PIF, and VBS and so on If they want it, they have to talk to me first. POWER! -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak - OT on snort
alert tcp any any - any 25 (msg:Virus - Possible Gone.scr;content: name=\gone.scr\; nocase; rev:1; resp:rst_all;) That is what I am using... -Original Message- From: Byron Kennedy [mailto:[EMAIL PROTECTED]] Posted At: Tuesday, December 04, 2001 9:18 PM Posted To: Exchange Conversation: New Virus outbreak - OT on snort Subject: RE: New Virus outbreak - OT on snort yes. do you have a rule that is catching gone_A and pulling the frames off the wire? -Original Message- From: Koos Jacobs [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:39 AM To: Exchange Discussions Subject: RE: New Virus outbreak Don't you guys use an Intrusion Detection Package..something like Snort??? _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Where did you find the defs? I am unable to download it from Symantec's site as it still as the defs dated 28Nov2001 and LiveUpdate says that we have the current defs. -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:16 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yep. Has been available for a few hours, I believe. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only because you yourself know it to be true. -- Buddha -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:44 PM To: Exchange Discussions Subject: RE: New Virus outbreak Alright, but even if it blocks the attachment it still sends mail to the user. Is there anyway to stop that? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:37 PM To: Exchange Discussions Subject: RE: New Virus outbreak It will block the attachments first. So it never gets scanned, just deleted. -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:37 AM To: Exchange Discussions Subject: RE: New Virus outbreak After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:17 PM To: Exchange Discussions Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE: New Virus outbreak Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email
RE: New Virus outbreak
Us too. 129 so far. This blocking is really saving our buts. McAfee's new DAT is not scheduled till tomorrow(An extra.dat is out now). Although that will probably change Audio International Chris Hyche MIS Technician Phone: (501) 801-0457 Fax: (501) 801-0421 www.audiointl.com -Original Message- From: Randal, Phil [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:15 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yessir! We all read your now (in)famous list. Didn't we? ;-) Phil - Phil Randal Network Engineer Herefordshire Council Hereford, UK -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 17:05 To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Ooops.. insert foot in mouth). We use Symantec and Trend here. I know Trend has been picking it up all day with the new defs, but Norton must not have a new def out yet. I just checked again and it looks like Nov. 28th is the latest for Norton. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak Where did you find the defs? I am unable to download it from Symantec's site as it still as the defs dated 28Nov2001 and LiveUpdate says that we have the current defs. -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:16 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yep. Has been available for a few hours, I believe. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only because you yourself know it to be true. -- Buddha -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:44 PM To: Exchange Discussions Subject: RE: New Virus outbreak Alright, but even if it blocks the attachment it still sends mail to the user. Is there anyway to stop that? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:37 PM To: Exchange Discussions Subject: RE: New Virus outbreak It will block the attachments first. So it never gets scanned, just deleted. -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:37 AM To: Exchange Discussions Subject: RE: New Virus outbreak After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:17 PM To: Exchange Discussions Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE: New Virus outbreak Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message
RE: New Virus outbreak
Just wanted to thank Paul and this list about the warning. I was able to send out an alert and notify the users (Exchange and non-Exchange) and I think we avoided some additional problems with the notification. Thanks again! -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Where is the extra.dat? I cant find it on the WWW or FTP sites -Original Message- From: Chris Hyche [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak Us too. 129 so far. This blocking is really saving our buts. McAfee's new DAT is not scheduled till tomorrow(An extra.dat is out now). Although that will probably change Audio International Chris Hyche MIS Technician Phone: (501) 801-0457 Fax: (501) 801-0421 www.audiointl.com -Original Message- From: Randal, Phil [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:15 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yessir! We all read your now (in)famous list. Didn't we? ;-) Phil - Phil Randal Network Engineer Herefordshire Council Hereford, UK -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 17:05 To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Never mind -Original Message- From: Martin Blackstone Sent: Tuesday, December 04, 2001 11:33 AM To: Exchange Discussions Subject: RE: New Virus outbreak Where is the extra.dat? I cant find it on the WWW or FTP sites -Original Message- From: Chris Hyche [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak Us too. 129 so far. This blocking is really saving our buts. McAfee's new DAT is not scheduled till tomorrow(An extra.dat is out now). Although that will probably change Audio International Chris Hyche MIS Technician Phone: (501) 801-0457 Fax: (501) 801-0421 www.audiointl.com -Original Message- From: Randal, Phil [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:15 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yessir! We all read your now (in)famous list. Didn't we? ;-) Phil - Phil Randal Network Engineer Herefordshire Council Hereford, UK -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 17:05 To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Go to their FTP site: ftp://ftp.symantec.com/public/english_us_canada/antivirus_definitions/norton _antivirus/ Then click on specdefs, you will see the latest. SARCi32.exe These could possibly cause problems, not sure. It seems like they usually release the final defs around 5PM everytime something comes up. Barry -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 1:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak Where did you find the defs? I am unable to download it from Symantec's site as it still as the defs dated 28Nov2001 and LiveUpdate says that we have the current defs. -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:16 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yep. Has been available for a few hours, I believe. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only because you yourself know it to be true. -- Buddha -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:44 PM To: Exchange Discussions Subject: RE: New Virus outbreak Alright, but even if it blocks the attachment it still sends mail to the user. Is there anyway to stop that? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:37 PM To: Exchange Discussions Subject: RE: New Virus outbreak It will block the attachments first. So it never gets scanned, just deleted. -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:37 AM To: Exchange Discussions Subject: RE: New Virus outbreak After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:17 PM To: Exchange Discussions Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE: New Virus outbreak Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp
RE: New Virus outbreak
Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
I pretty much filter everything. One of the good aspects of Antigen for Sybari is that I can quarantine certain items and approve delivery later if I choose. For example, I filter all *.exe files but some *.exe files might serve a legitimate purpose (very rarely happens..but it does). User will notify me before or after the file is sent. If I deem the executable worthy then I simply forward it to the recipient using the Antigen interface. Even though I'm filtering just about every extension known to man I still have to watch out for these double extensions.(Example: *.txt.vbs,, *.txt.exe,, *.txt.lnk). ETC. The next version of Antigen will allow content filtering. This helps but can cause other problems so I will use it sparingly. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:46 PM To: Exchange Discussions Subject: RE: New Virus outbreak Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Of course, I don't have to worry about any of this when my ISP dies on me without any notice and I'm unable to contact them for 3 days. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:51 PM To: Exchange Discussions Subject: RE: New Virus outbreak I pretty much filter everything. One of the good aspects of Antigen for Sybari is that I can quarantine certain items and approve delivery later if I choose. For example, I filter all *.exe files but some *.exe files might serve a legitimate purpose (very rarely happens..but it does). User will notify me before or after the file is sent. If I deem the executable worthy then I simply forward it to the recipient using the Antigen interface. Even though I'm filtering just about every extension known to man I still have to watch out for these double extensions.(Example: *.txt.vbs,, *.txt.exe,, *.txt.lnk). ETC. The next version of Antigen will allow content filtering. This helps but can cause other problems so I will use it sparingly. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:46 PM To: Exchange Discussions Subject: RE: New Virus outbreak Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
RE: New Virus outbreak
They currently expect one after 1pm PST today -- Roger D. Seielstad - MCSE MCT Senior Systems Administrator Peregrine Systems Atlanta, GA http://www.peregrine.com -Original Message- From: Network Issues [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only because you yourself know it to be true. -- Buddha -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:44 PM To: Exchange Discussions Subject: RE: New Virus outbreak Alright, but even if it blocks the attachment it still sends mail to the user. Is there anyway to stop that? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:37 PM To: Exchange Discussions Subject: RE: New Virus outbreak It will block the attachments first. So it never gets scanned, just deleted. -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:37 AM To: Exchange Discussions Subject: RE: New Virus outbreak After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:17 PM To: Exchange Discussions Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE: New Virus outbreak Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=12 64page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out
RE: New Virus outbreak
It is best to test this from an outside mail account like hotmail and send a message with a harmless attachment having a txt.vbs extension. Darryl -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 12:01 PM To: Exchange Discussions Subject: RE: New Virus outbreak Won't filtering *.vbs also filter *.txt.vbs? Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:51 PM To: Exchange Discussions Subject: RE: New Virus outbreak I pretty much filter everything. One of the good aspects of Antigen for Sybari is that I can quarantine certain items and approve delivery later if I choose. For example, I filter all *.exe files but some *.exe files might serve a legitimate purpose (very rarely happens..but it does). User will notify me before or after the file is sent. If I deem the executable worthy then I simply forward it to the recipient using the Antigen interface. Even though I'm filtering just about every extension known to man I still have to watch out for these double extensions.(Example: *.txt.vbs,, *.txt.exe,, *.txt.lnk). ETC. The next version of Antigen will allow content filtering. This helps but can cause other problems so I will use it sparingly. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:46 PM To: Exchange Discussions Subject: RE: New Virus outbreak Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource
RE: New Virus outbreak
Yep! If a man knows not what harbor he seeks, any wind is the right wind. -Seneca -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 12:01 PM To: Exchange Discussions Subject: RE: New Virus outbreak Won't filtering *.vbs also filter *.txt.vbs? Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:51 PM To: Exchange Discussions Subject: RE: New Virus outbreak I pretty much filter everything. One of the good aspects of Antigen for Sybari is that I can quarantine certain items and approve delivery later if I choose. For example, I filter all *.exe files but some *.exe files might serve a legitimate purpose (very rarely happens..but it does). User will notify me before or after the file is sent. If I deem the executable worthy then I simply forward it to the recipient using the Antigen interface. Even though I'm filtering just about every extension known to man I still have to watch out for these double extensions.(Example: *.txt.vbs,, *.txt.exe,, *.txt.lnk). ETC. The next version of Antigen will allow content filtering. This helps but can cause other problems so I will use it sparingly. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:46 PM To: Exchange Discussions Subject: RE: New Virus outbreak Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch
RE: New Virus outbreak
I don't believe so. Seem's like there are some gotchas with this but I prob need to verify this with Sybari before I speak. When I notice a new type of extension I try to adopt the attitude better safe then sorry and add that to my filter. I guess it would depend on how their filter works. It seems that the double filter was designed to throw off some of the filters out there. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:01 PM To: Exchange Discussions Subject: RE: New Virus outbreak Won't filtering *.vbs also filter *.txt.vbs? Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:51 PM To: Exchange Discussions Subject: RE: New Virus outbreak I pretty much filter everything. One of the good aspects of Antigen for Sybari is that I can quarantine certain items and approve delivery later if I choose. For example, I filter all *.exe files but some *.exe files might serve a legitimate purpose (very rarely happens..but it does). User will notify me before or after the file is sent. If I deem the executable worthy then I simply forward it to the recipient using the Antigen interface. Even though I'm filtering just about every extension known to man I still have to watch out for these double extensions.(Example: *.txt.vbs,, *.txt.exe,, *.txt.lnk). ETC. The next version of Antigen will allow content filtering. This helps but can cause other problems so I will use it sparingly. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:46 PM To: Exchange Discussions Subject: RE: New Virus outbreak Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com
RE: New Virus outbreak
Most of the free email services should be filtering or disallowing these types of attachments to be sent. I know that mail.yahoo.com does. -Original Message- From: Darryl Harris [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:59 PM To: Exchange Discussions Subject: RE: New Virus outbreak It is best to test this from an outside mail account like hotmail and send a message with a harmless attachment having a txt.vbs extension. Darryl -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 12:01 PM To: Exchange Discussions Subject: RE: New Virus outbreak Won't filtering *.vbs also filter *.txt.vbs? Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:51 PM To: Exchange Discussions Subject: RE: New Virus outbreak I pretty much filter everything. One of the good aspects of Antigen for Sybari is that I can quarantine certain items and approve delivery later if I choose. For example, I filter all *.exe files but some *.exe files might serve a legitimate purpose (very rarely happens..but it does). User will notify me before or after the file is sent. If I deem the executable worthy then I simply forward it to the recipient using the Antigen interface. Even though I'm filtering just about every extension known to man I still have to watch out for these double extensions.(Example: *.txt.vbs,, *.txt.exe,, *.txt.lnk). ETC. The next version of Antigen will allow content filtering. This helps but can cause other problems so I will use it sparingly. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:46 PM To: Exchange Discussions Subject: RE: New Virus outbreak Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http
RE: New Virus outbreak
As far as I've seen on Antigen, it will. Antigen filters based on the last extension (i.e. the rightmost 3 chars after the last period) as far as I've seen, and in practice my and my clients' Antigens pick off attachments with the double extensions w/no problem when we simply filter for *.PIF, *.SCR, *.VB? etc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of [EMAIL PROTECTED] Sent: Tuesday, December 04, 2001 2:01 PM To: ExchangeList@swynk Subject: RE: New Virus outbreak Won't filtering *.vbs also filter *.txt.vbs? Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:51 PM To: Exchange Discussions Subject: RE: New Virus outbreak I pretty much filter everything. One of the good aspects of Antigen for Sybari is that I can quarantine certain items and approve delivery later if I choose. For example, I filter all *.exe files but some *.exe files might serve a legitimate purpose (very rarely happens..but it does). User will notify me before or after the file is sent. If I deem the executable worthy then I simply forward it to the recipient using the Antigen interface. Even though I'm filtering just about every extension known to man I still have to watch out for these double extensions.(Example: *.txt.vbs,, *.txt.exe,, *.txt.lnk). ETC. The next version of Antigen will allow content filtering. This helps but can cause other problems so I will use it sparingly. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:46 PM To: Exchange Discussions Subject: RE: New Virus outbreak Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe
RE: New Virus outbreak
hey Brian- i can say that Antigen's file filter *.vbs will also catch *.jpg.vbs. perhaps you're seeing some CLSIDs, which are attachments that end with a CLSID file extension, but do not show the actual full extension of the file when saved and viewed with Windows Explorer. CLSIDs can circumvent content filtering solutions by allowing dangerous file types to look as though they are simple, harmless files - such as JPG or WAV files that are normally not filtered. maybe? cheers.byron -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:59 AM To: Exchange Discussions Subject: RE: New Virus outbreak I don't believe so. Seem's like there are some gotchas with this but I prob need to verify this with Sybari before I speak. When I notice a new type of extension I try to adopt the attitude better safe then sorry and add that to my filter. I guess it would depend on how their filter works. It seems that the double filter was designed to throw off some of the filters out there. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:01 PM To: Exchange Discussions Subject: RE: New Virus outbreak Won't filtering *.vbs also filter *.txt.vbs? Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:51 PM To: Exchange Discussions Subject: RE: New Virus outbreak I pretty much filter everything. One of the good aspects of Antigen for Sybari is that I can quarantine certain items and approve delivery later if I choose. For example, I filter all *.exe files but some *.exe files might serve a legitimate purpose (very rarely happens..but it does). User will notify me before or after the file is sent. If I deem the executable worthy then I simply forward it to the recipient using the Antigen interface. Even though I'm filtering just about every extension known to man I still have to watch out for these double extensions.(Example: *.txt.vbs,, *.txt.exe,, *.txt.lnk). ETC. The next version of Antigen will allow content filtering. This helps but can cause other problems so I will use it sparingly. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:46 PM To: Exchange Discussions Subject: RE: New Virus outbreak Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http
RE: New Virus outbreak
I seem to remember this also. Seems like you had to add a strange filter for .)~ or something like that. -Original Message- From: Byron Kennedy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:17 PM To: Exchange Discussions Subject: RE: New Virus outbreak hey Brian- i can say that Antigen's file filter *.vbs will also catch *.jpg.vbs. perhaps you're seeing some CLSIDs, which are attachments that end with a CLSID file extension, but do not show the actual full extension of the file when saved and viewed with Windows Explorer. CLSIDs can circumvent content filtering solutions by allowing dangerous file types to look as though they are simple, harmless files - such as JPG or WAV files that are normally not filtered. maybe? cheers.byron -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:59 AM To: Exchange Discussions Subject: RE: New Virus outbreak I don't believe so. Seem's like there are some gotchas with this but I prob need to verify this with Sybari before I speak. When I notice a new type of extension I try to adopt the attitude better safe then sorry and add that to my filter. I guess it would depend on how their filter works. It seems that the double filter was designed to throw off some of the filters out there. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:01 PM To: Exchange Discussions Subject: RE: New Virus outbreak Won't filtering *.vbs also filter *.txt.vbs? Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:51 PM To: Exchange Discussions Subject: RE: New Virus outbreak I pretty much filter everything. One of the good aspects of Antigen for Sybari is that I can quarantine certain items and approve delivery later if I choose. For example, I filter all *.exe files but some *.exe files might serve a legitimate purpose (very rarely happens..but it does). User will notify me before or after the file is sent. If I deem the executable worthy then I simply forward it to the recipient using the Antigen interface. Even though I'm filtering just about every extension known to man I still have to watch out for these double extensions.(Example: *.txt.vbs,, *.txt.exe,, *.txt.lnk). ETC. The next version of Antigen will allow content filtering. This helps but can cause other problems so I will use it sparingly. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:46 PM To: Exchange Discussions Subject: RE: New Virus outbreak Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com
RE: New Virus outbreak
Well, I've worked with a lot of virus companies and a lot of viruses and haven't come across this... I always use the digits that follow the . and whatever I enter to be blocked is blocked. D The leadership instinct you are born with is the backbone. You develop the funny bone and the wishbone that go with it. -Elaine Agather -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 12:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak I'm not sure about this statement. I'm almost positive that a few AV vendors about 10 months ago or so had some issues with their filter sets. They subsequently release fixes. Like I said better safe then sorry. -Original Message- From: Durkee, Peter [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:13 PM To: Exchange Discussions Subject: RE: New Virus outbreak I think the double extension are just meant to throw off humans (with some help from Windows), not filters. -Peter -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:59 To: Exchange Discussions Subject: RE: New Virus outbreak I don't believe so. Seem's like there are some gotchas with this but I prob need to verify this with Sybari before I speak. When I notice a new type of extension I try to adopt the attitude better safe then sorry and add that to my filter. I guess it would depend on how their filter works. It seems that the double filter was designed to throw off some of the filters out there. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:01 PM To: Exchange Discussions Subject: RE: New Virus outbreak Won't filtering *.vbs also filter *.txt.vbs? Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:51 PM To: Exchange Discussions Subject: RE: New Virus outbreak I pretty much filter everything. One of the good aspects of Antigen for Sybari is that I can quarantine certain items and approve delivery later if I choose. For example, I filter all *.exe files but some *.exe files might serve a legitimate purpose (very rarely happens..but it does). User will notify me before or after the file is sent. If I deem the executable worthy then I simply forward it to the recipient using the Antigen interface. Even though I'm filtering just about every extension known to man I still have to watch out for these double extensions.(Example: *.txt.vbs,, *.txt.exe,, *.txt.lnk). ETC. The next version of Antigen will allow content filtering. This helps but can cause other problems so I will use it sparingly. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:46 PM To: Exchange Discussions Subject: RE: New Virus outbreak Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http
RE: New Virus outbreak
I ran across a case recently where a tech support person was trying to send me an EXE renamed with a .txt extension. Norton for Exchange 2.12 blocked it as an Unauthorized file type nonetheless, so NAVMSE must be looking at the actual file data, not just the extension, to determine if a file is an executable. :::Ryan Malayter, MCSE :::Bank Administration Institute :::Chicago, Illinois, USA -Original Message- From: Don Ely [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Well, I've worked with a lot of virus companies and a lot of viruses and haven't come across this... I always use the digits that follow the . and whatever I enter to be blocked is blocked. D The leadership instinct you are born with is the backbone. You develop the funny bone and the wishbone that go with it. -Elaine Agather -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 12:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak I'm not sure about this statement. I'm almost positive that a few AV vendors about 10 months ago or so had some issues with their filter sets. They subsequently release fixes. Like I said better safe then sorry. -Original Message- From: Durkee, Peter [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:13 PM To: Exchange Discussions Subject: RE: New Virus outbreak I think the double extension are just meant to throw off humans (with some help from Windows), not filters. -Peter -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:59 To: Exchange Discussions Subject: RE: New Virus outbreak I don't believe so. Seem's like there are some gotchas with this but I prob need to verify this with Sybari before I speak. When I notice a new type of extension I try to adopt the attitude better safe then sorry and add that to my filter. I guess it would depend on how their filter works. It seems that the double filter was designed to throw off some of the filters out there. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:01 PM To: Exchange Discussions Subject: RE: New Virus outbreak Won't filtering *.vbs also filter *.txt.vbs? Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:51 PM To: Exchange Discussions Subject: RE: New Virus outbreak I pretty much filter everything. One of the good aspects of Antigen for Sybari is that I can quarantine certain items and approve delivery later if I choose. For example, I filter all *.exe files but some *.exe files might serve a legitimate purpose (very rarely happens..but it does). User will notify me before or after the file is sent. If I deem the executable worthy then I simply forward it to the recipient using the Antigen interface. Even though I'm filtering just about every extension known to man I still have to watch out for these double extensions.(Example: *.txt.vbs,, *.txt.exe,, *.txt.lnk). ETC. The next version of Antigen will allow content filtering. This helps but can cause other problems so I will use it sparingly. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:46 PM To: Exchange Discussions Subject: RE: New Virus outbreak Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other
RE: New Virus outbreak
McAfee has released the DATs and SuperDATS now. Audio International Chris Hyche MIS Technician Phone: (501) 801-0457 Fax: (501) 801-0421 www.audiointl.com -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:34 PM To: Exchange Discussions Subject: RE: New Virus outbreak Never mind -Original Message- From: Martin Blackstone Sent: Tuesday, December 04, 2001 11:33 AM To: Exchange Discussions Subject: RE: New Virus outbreak Where is the extra.dat? I cant find it on the WWW or FTP sites -Original Message- From: Chris Hyche [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak Us too. 129 so far. This blocking is really saving our buts. McAfee's new DAT is not scheduled till tomorrow(An extra.dat is out now). Although that will probably change Audio International Chris Hyche MIS Technician Phone: (501) 801-0457 Fax: (501) 801-0421 www.audiointl.com -Original Message- From: Randal, Phil [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:15 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yessir! We all read your now (in)famous list. Didn't we? ;-) Phil - Phil Randal Network Engineer Herefordshire Council Hereford, UK -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 17:05 To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak - OT on snort
Snort won't do that without the fairly experimental active response piece. ISS RealSecure will do it with an RSKill, which we started doing a few hours ago. -- Roger D. Seielstad - MCSE MCT Senior Systems Administrator Peregrine Systems Atlanta, GA http://www.peregrine.com -Original Message- From: Byron Kennedy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:18 PM To: Exchange Discussions Subject: RE: New Virus outbreak - OT on snort yes. do you have a rule that is catching gone_A and pulling the frames off the wire? -Original Message- From: Koos Jacobs [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:39 AM To: Exchange Discussions Subject: RE: New Virus outbreak Don't you guys use an Intrusion Detection Package..something like Snort??? _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Trend Micro can be updated not to send to Recepient, Sender and Administrator. Click on the Notification button and check/uncheck who you want to receive notification. rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:37 AM To: Exchange Discussions Subject: RE: New Virus outbreak After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:17 PM To: Exchange Discussions Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE: New Virus outbreak Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated a block I started seeing it. Shit!!! I'm waiting for Trend to get a pattern, but I would suggest blocking until it's available. -Original Message- From: Usachev Oleg [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:25 AM To: Exchange Discussions Subject: RE: New Virus outbreak http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0 -Original Message- From: Joyce, Louis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 7:14 PM To: Exchange Discussions Subject: RE: New Virus outbreak Any links to any info? Regards Mr Louis Joyce Computer Support Analyst Network Administrator BT Ignite eSolutions -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: 04 December 2001 16:15 To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out with an attachment Gone.scr Cheers Paul Standards are like toothbrushes, everybody agrees you should have one, but no one wants to use yours ** The information contained in this message or any of its attachments may be confidential and is intended for the exclusive use of the addressee(s). Any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited without the express permission of the sender. The views expressed in this email are those of the individual and not necessarily those of Sony or Sony affiliated companies. Sony email is for business use only. This email and any response may be monitored by Sony UK. (05) ** _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com
RE: New Virus outbreak
I have Norton for Exchange Quarantine all these messages, and if someone needs to get one (in a year, I was the only person who needed something). I can go to the NAVEx console and have it released. Best of both worlds Jim -Original Message- From: Ryan Malayter [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:36 PM To: Exchange Discussions Subject: RE: New Virus outbreak I ran across a case recently where a tech support person was trying to send me an EXE renamed with a .txt extension. Norton for Exchange 2.12 blocked it as an Unauthorized file type nonetheless, so NAVMSE must be looking at the actual file data, not just the extension, to determine if a file is an executable. :::Ryan Malayter, MCSE :::Bank Administration Institute :::Chicago, Illinois, USA -Original Message- From: Don Ely [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Well, I've worked with a lot of virus companies and a lot of viruses and haven't come across this... I always use the digits that follow the . and whatever I enter to be blocked is blocked. D The leadership instinct you are born with is the backbone. You develop the funny bone and the wishbone that go with it. -Elaine Agather -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 12:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak I'm not sure about this statement. I'm almost positive that a few AV vendors about 10 months ago or so had some issues with their filter sets. They subsequently release fixes. Like I said better safe then sorry. -Original Message- From: Durkee, Peter [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:13 PM To: Exchange Discussions Subject: RE: New Virus outbreak I think the double extension are just meant to throw off humans (with some help from Windows), not filters. -Peter -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:59 To: Exchange Discussions Subject: RE: New Virus outbreak I don't believe so. Seem's like there are some gotchas with this but I prob need to verify this with Sybari before I speak. When I notice a new type of extension I try to adopt the attitude better safe then sorry and add that to my filter. I guess it would depend on how their filter works. It seems that the double filter was designed to throw off some of the filters out there. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:01 PM To: Exchange Discussions Subject: RE: New Virus outbreak Won't filtering *.vbs also filter *.txt.vbs? Bill Lambert Endoxy Healthcare 847-941-9206 [EMAIL PROTECTED] -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:51 PM To: Exchange Discussions Subject: RE: New Virus outbreak I pretty much filter everything. One of the good aspects of Antigen for Sybari is that I can quarantine certain items and approve delivery later if I choose. For example, I filter all *.exe files but some *.exe files might serve a legitimate purpose (very rarely happens..but it does). User will notify me before or after the file is sent. If I deem the executable worthy then I simply forward it to the recipient using the Antigen interface. Even though I'm filtering just about every extension known to man I still have to watch out for these double extensions.(Example: *.txt.vbs,, *.txt.exe,, *.txt.lnk). ETC. The next version of Antigen will allow content filtering. This helps but can cause other problems so I will use it sparingly. -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:46 PM To: Exchange Discussions Subject: RE: New Virus outbreak Not unless it's Java Script. -Original Message- From: Tea, Justin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:25 PM To: Exchange Discussions Subject: RE: New Virus outbreak Isn't .js created by Office product when sending document from within the productivity suite? -Original Message- From: Murphy, Brian [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:10 AM To: Exchange Discussions Subject: RE: New Virus outbreak I am. And, .vbs, .js, .htm, .html, .txt.vbs, etc. My users love it. -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We are all blocking .SCR files anyway...right kids? -Original Message- From: Hurst, Paul [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 8:15 AM To: Exchange Discussions Subject: New Virus outbreak Please note that there is a new Email virus out
RE: New Virus outbreak
I've been hitting live update on Norton AV 2001 on my desktop every hour today. Nothing past 28 Nov. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Stop plate Tectonics! -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:36 PM To: Exchange Discussions Subject: RE: New Virus outbreak Ooops.. insert foot in mouth). We use Symantec and Trend here. I know Trend has been picking it up all day with the new defs, but Norton must not have a new def out yet. I just checked again and it looks like Nov. 28th is the latest for Norton. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak Where did you find the defs? I am unable to download it from Symantec's site as it still as the defs dated 28Nov2001 and LiveUpdate says that we have the current defs. -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:16 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yep. Has been available for a few hours, I believe. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only because you yourself know it to be true. -- Buddha -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:44 PM To: Exchange Discussions Subject: RE: New Virus outbreak Alright, but even if it blocks the attachment it still sends mail to the user. Is there anyway to stop that? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:37 PM To: Exchange Discussions Subject: RE: New Virus outbreak It will block the attachments first. So it never gets scanned, just deleted. -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:37 AM To: Exchange Discussions Subject: RE: New Virus outbreak After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:17 PM To: Exchange Discussions Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE: New Virus outbreak Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG time, but we have seen 5 of these blocked already this morning. Jim Blunt Network / Exchange Admin -Original Message- From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:02 AM To: Exchange Discussions Subject: RE: New Virus outbreak I initiated a block on .SCR extensions in ScanMail. As soon as I initiated
RE: New Virus outbreak
You can go to their FTP site (someone mentioned it earlier) and download their smart update utility if you want to do a manual update. :::Ryan Malayter, MCSE :::Bank Administration Institute :::Chicago, Illinois, USA -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 3:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak I've been hitting live update on Norton AV 2001 on my desktop every hour today. Nothing past 28 Nov. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Stop plate Tectonics! -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:36 PM To: Exchange Discussions Subject: RE: New Virus outbreak Ooops.. insert foot in mouth). We use Symantec and Trend here. I know Trend has been picking it up all day with the new defs, but Norton must not have a new def out yet. I just checked again and it looks like Nov. 28th is the latest for Norton. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak Where did you find the defs? I am unable to download it from Symantec's site as it still as the defs dated 28Nov2001 and LiveUpdate says that we have the current defs. -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:16 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yep. Has been available for a few hours, I believe. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only because you yourself know it to be true. -- Buddha -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:44 PM To: Exchange Discussions Subject: RE: New Virus outbreak Alright, but even if it blocks the attachment it still sends mail to the user. Is there anyway to stop that? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:37 PM To: Exchange Discussions Subject: RE: New Virus outbreak It will block the attachments first. So it never gets scanned, just deleted. -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:37 AM To: Exchange Discussions Subject: RE: New Virus outbreak After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:17 PM To: Exchange Discussions Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE: New Virus outbreak Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been
RE: New Virus outbreak - listen to this
This is great: Dingdong user goes to hotmail and d/ls or executes the email somehow. The next thing I know I have 458 emails about the filter of .scr sent and caught. Of course the end users got a few of these emails since it was spurring out of control across our Enterprise. Picture users calling me directly - a, I got a virus! Help me! - Then I say click on the file and it can be read. It says: FILE QUARANTINED Antigen for Exchange removed gone.scr since it was found to match the =*.scr file filter. The sad reality is the person spurring the virus was an IT staff member - the winners I work with!! Thank you, Erik L. Vesneski Internal Network Manager Epicentric, Inc. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak I've been hitting live update on Norton AV 2001 on my desktop every hour today. Nothing past 28 Nov. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Stop plate Tectonics! -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:36 PM To: Exchange Discussions Subject: RE: New Virus outbreak Ooops.. insert foot in mouth). We use Symantec and Trend here. I know Trend has been picking it up all day with the new defs, but Norton must not have a new def out yet. I just checked again and it looks like Nov. 28th is the latest for Norton. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak Where did you find the defs? I am unable to download it from Symantec's site as it still as the defs dated 28Nov2001 and LiveUpdate says that we have the current defs. -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:16 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yep. Has been available for a few hours, I believe. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only because you yourself know it to be true. -- Buddha -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:44 PM To: Exchange Discussions Subject: RE: New Virus outbreak Alright, but even if it blocks the attachment it still sends mail to the user. Is there anyway to stop that? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:37 PM To: Exchange Discussions Subject: RE: New Virus outbreak It will block the attachments first. So it never gets scanned, just deleted. -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:37 AM To: Exchange Discussions Subject: RE: New Virus outbreak After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:17 PM To: Exchange Discussions Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE
RE: New Virus outbreak
Just got released officially about 20 minutes ago. Definition is from 12/4, version 31204p. James Winzenz, MCSE, A+ Associate Systems Administrator Peregrine Systems, Inc. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:28 PM To: Exchange Discussions Subject:RE: New Virus outbreak I've been hitting live update on Norton AV 2001 on my desktop every hour today. Nothing past 28 Nov. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Stop plate Tectonics! -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:36 PM To: Exchange Discussions Subject: RE: New Virus outbreak Ooops.. insert foot in mouth). We use Symantec and Trend here. I know Trend has been picking it up all day with the new defs, but Norton must not have a new def out yet. I just checked again and it looks like Nov. 28th is the latest for Norton. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak Where did you find the defs? I am unable to download it from Symantec's site as it still as the defs dated 28Nov2001 and LiveUpdate says that we have the current defs. -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:16 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yep. Has been available for a few hours, I believe. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only because you yourself know it to be true. -- Buddha -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:44 PM To: Exchange Discussions Subject: RE: New Virus outbreak Alright, but even if it blocks the attachment it still sends mail to the user. Is there anyway to stop that? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:37 PM To: Exchange Discussions Subject: RE: New Virus outbreak It will block the attachments first. So it never gets scanned, just deleted. -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:37 AM To: Exchange Discussions Subject: RE: New Virus outbreak After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:17 PM To: Exchange Discussions Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject: RE: New Virus outbreak Even though we were blocking .scr we still had the virus explode within...BUMMER!!! Trend 177 catches it...have updated...now to get the PCs infected... rudy ;-) Network Engineer/E-Mail Administrator VLC, an Anchor Gaming Company 2311 South 7th Ave Bozeman, MT 59715 mailto:[EMAIL PROTECTED] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:05 AM To: Exchange Discussions Subject: RE: New Virus outbreak We have been blocking .scr's for a LONG
RE: New Virus outbreak - listen to this
Same here. The stupid thing is we are blocking hotmail for all users. Exceptions are made by request only and granted only if there's a proven business need. Whenever an exception is made that particular user is reminded again and again the potential risks involved. Just goes to show you that a moron is a moron is a moron. S. -Original Message- From: Erik Vesneski [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 5:02 PM To: Exchange Discussions Subject: RE: New Virus outbreak - listen to this This is great: Dingdong user goes to hotmail and d/ls or executes the email somehow. The next thing I know I have 458 emails about the filter of .scr sent and caught. Of course the end users got a few of these emails since it was spurring out of control across our Enterprise. Picture users calling me directly - a, I got a virus! Help me! - Then I say click on the file and it can be read. It says: FILE QUARANTINED Antigen for Exchange removed gone.scr since it was found to match the =*.scr file filter. The sad reality is the person spurring the virus was an IT staff member - the winners I work with!! Thank you, Erik L. Vesneski Internal Network Manager Epicentric, Inc. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak I've been hitting live update on Norton AV 2001 on my desktop every hour today. Nothing past 28 Nov. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Stop plate Tectonics! -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:36 PM To: Exchange Discussions Subject: RE: New Virus outbreak Ooops.. insert foot in mouth). We use Symantec and Trend here. I know Trend has been picking it up all day with the new defs, but Norton must not have a new def out yet. I just checked again and it looks like Nov. 28th is the latest for Norton. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak Where did you find the defs? I am unable to download it from Symantec's site as it still as the defs dated 28Nov2001 and LiveUpdate says that we have the current defs. -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:16 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yep. Has been available for a few hours, I believe. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only because you yourself know it to be true. -- Buddha -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:44 PM To: Exchange Discussions Subject: RE: New Virus outbreak Alright, but even if it blocks the attachment it still sends mail to the user. Is there anyway to stop that? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:37 PM To: Exchange Discussions Subject: RE: New Virus outbreak It will block the attachments first. So it never gets scanned, just deleted. -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:37 AM To: Exchange Discussions Subject: RE: New Virus outbreak After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support
RE: New Virus outbreak
Really! I figured at least another our from now. I just saw it on their ftp site at 4:15CST -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Martin Blackstone Sent: Tuesday, December 04, 2001 4:16 PM To: Exchange Discussions Subject: RE: New Virus outbreak Wow. That's mighty nice of them to get something out before the end of the day -Original Message- From: James Winzenz [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:15 PM To: Exchange Discussions Subject: RE: New Virus outbreak Just got released officially about 20 minutes ago. Definition is from 12/4, version 31204p. James Winzenz, MCSE, A+ Associate Systems Administrator Peregrine Systems, Inc. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:28 PM To: Exchange Discussions Subject:RE: New Virus outbreak I've been hitting live update on Norton AV 2001 on my desktop every hour today. Nothing past 28 Nov. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Stop plate Tectonics! -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:36 PM To: Exchange Discussions Subject: RE: New Virus outbreak Ooops.. insert foot in mouth). We use Symantec and Trend here. I know Trend has been picking it up all day with the new defs, but Norton must not have a new def out yet. I just checked again and it looks like Nov. 28th is the latest for Norton. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak Where did you find the defs? I am unable to download it from Symantec's site as it still as the defs dated 28Nov2001 and LiveUpdate says that we have the current defs. -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:16 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yep. Has been available for a few hours, I believe. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only because you yourself know it to be true. -- Buddha -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:44 PM To: Exchange Discussions Subject: RE: New Virus outbreak Alright, but even if it blocks the attachment it still sends mail to the user. Is there anyway to stop that? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:37 PM To: Exchange Discussions Subject: RE: New Virus outbreak It will block the attachments first. So it never gets scanned, just deleted. -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:37 AM To: Exchange Discussions Subject: RE: New Virus outbreak After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:17 PM To: Exchange Discussions Subject: RE: New Virus outbreak Probably some user that has hotmail or something. I just sent an email to all my users begging them not to use it today. -Original Message- From: Schneider, Rudy [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:18 AM To: Exchange Discussions Subject
RE: New Virus outbreak - listen to this
Since you have Antigen, add gone.scr to your file filter, and set it to purge and not notify. -Peter -Original Message- From: Erik Vesneski [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 14:02 To: Exchange Discussions Subject: RE: New Virus outbreak - listen to this This is great: Dingdong user goes to hotmail and d/ls or executes the email somehow. The next thing I know I have 458 emails about the filter of .scr sent and caught. Of course the end users got a few of these emails since it was spurring out of control across our Enterprise. Picture users calling me directly - a, I got a virus! Help me! - Then I say click on the file and it can be read. It says: FILE QUARANTINED Antigen for Exchange removed gone.scr since it was found to match the =*.scr file filter. The sad reality is the person spurring the virus was an IT staff member - the winners I work with!! Thank you, Erik L. Vesneski Internal Network Manager Epicentric, Inc. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak I've been hitting live update on Norton AV 2001 on my desktop every hour today. Nothing past 28 Nov. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Stop plate Tectonics! -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:36 PM To: Exchange Discussions Subject: RE: New Virus outbreak Ooops.. insert foot in mouth). We use Symantec and Trend here. I know Trend has been picking it up all day with the new defs, but Norton must not have a new def out yet. I just checked again and it looks like Nov. 28th is the latest for Norton. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak Where did you find the defs? I am unable to download it from Symantec's site as it still as the defs dated 28Nov2001 and LiveUpdate says that we have the current defs. -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:16 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yep. Has been available for a few hours, I believe. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only because you yourself know it to be true. -- Buddha -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:44 PM To: Exchange Discussions Subject: RE: New Virus outbreak Alright, but even if it blocks the attachment it still sends mail to the user. Is there anyway to stop that? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:37 PM To: Exchange Discussions Subject: RE: New Virus outbreak It will block the attachments first. So it never gets scanned, just deleted. -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:37 AM To: Exchange Discussions Subject: RE: New Virus outbreak After updating to pattern file 177 is anyone getting the email alerts Virus Found? All I'm still getting is attachment blocking alerts? Doesn't seem like the pattern file has kicked in. Has anyone experienced this?? ___ John Bowles Exchange Administrator Enterprise Support Engineering Celera Genomics [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:17 PM To: Exchange Discussions Subject: RE: New
RE: New Virus outbreak
Behold, the beauty of multiple scan engines :) ~ -K.Borndale Network Administrator Sybari Software 631.630.8569 -direct dial 631.439.0689 -fax http://www.sybari.com One man's ceiling is another man's floor |+--- || Martin Blackstone| || MBlackstone@superioracce| || ss.com | || Sent by: | || bounce-exchange-148870@ls| || .swynk.com | || | || | || 12/04/2001 05:16 PM | || Please respond to| || Exchange Discussions | || | |+--- ---| | | | To: Exchange Discussions [EMAIL PROTECTED] | | cc: | | Subject: RE: New Virus outbreak | ---| Wow. That's mighty nice of them to get something out before the end of the day -Original Message- From: James Winzenz [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:15 PM To: Exchange Discussions Subject: RE: New Virus outbreak Just got released officially about 20 minutes ago. Definition is from 12/4, version 31204p. James Winzenz, MCSE, A+ Associate Systems Administrator Peregrine Systems, Inc. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:28 PM To:Exchange Discussions Subject:RE: New Virus outbreak I've been hitting live update on Norton AV 2001 on my desktop every hour today. Nothing past 28 Nov. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Stop plate Tectonics! -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:36 PM To: Exchange Discussions Subject: RE: New Virus outbreak Ooops.. insert foot in mouth). We use Symantec and Trend here. I know Trend has been picking it up all day with the new defs, but Norton must not have a new def out yet. I just checked again and it looks like Nov. 28th is the latest for Norton. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak Where did you find the defs? I am unable to download it from Symantec's site as it still as the defs dated 28Nov2001 and LiveUpdate says that we have the current defs. -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:16 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yep. Has been available for a few hours, I believe. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only because you yourself know it to be true. -- Buddha -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:44 PM To: Exchange Discussions Subject: RE: New Virus outbreak Alright, but even if it blocks the attachment it still sends mail
RE: New Virus outbreak
I just got the Norton update about 20 minutes ago. It worked for me. As a side question, could someone tell me how to block attachments? TIA Ric -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak I've been hitting live update on Norton AV 2001 on my desktop every hour today. Nothing past 28 Nov. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Stop plate Tectonics! _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
Take a look at http://service2.symantec.com/SUPPORT/ent-security.nsf/docid/271215411348 Tom Bloom Department of Student Life Texas AM University -Original Message- From: Ric Terwilliger [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 5:56 PM To: Exchange Discussions Subject: RE: New Virus outbreak I just got the Norton update about 20 minutes ago. It worked for me. As a side question, could someone tell me how to block attachments? TIA Ric -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak I've been hitting live update on Norton AV 2001 on my desktop every hour today. Nothing past 28 Nov. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Stop plate Tectonics! _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: New Virus outbreak
The weird thing is that we are blocking .scr files but after a certain point of being hammered, NAV for exchange just couldn't keep up and users started opening it and we now have 5000 hi emails all over the place. About ready to throw in the towel and start using Scanmail. Aaron -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:48 PM To: Exchange Discussions Subject: RE: New Virus outbreak Behold, the beauty of multiple scan engines :) ~ -K.Borndale Network Administrator Sybari Software 631.630.8569 -direct dial 631.439.0689 -fax http://www.sybari.com One man's ceiling is another man's floor |+--- || Martin Blackstone| || MBlackstone@superioracce| || ss.com | || Sent by: | || bounce-exchange-148870@ls| || .swynk.com | || | || | || 12/04/2001 05:16 PM | || Please respond to| || Exchange Discussions | || | |+--- --- | | | | To: Exchange Discussions [EMAIL PROTECTED] | | cc: | | Subject: RE: New Virus outbreak | --- | Wow. That's mighty nice of them to get something out before the end of the day -Original Message- From: James Winzenz [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:15 PM To: Exchange Discussions Subject: RE: New Virus outbreak Just got released officially about 20 minutes ago. Definition is from 12/4, version 31204p. James Winzenz, MCSE, A+ Associate Systems Administrator Peregrine Systems, Inc. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 4:28 PM To:Exchange Discussions Subject:RE: New Virus outbreak I've been hitting live update on Norton AV 2001 on my desktop every hour today. Nothing past 28 Nov. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Stop plate Tectonics! -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 2:36 PM To: Exchange Discussions Subject: RE: New Virus outbreak Ooops.. insert foot in mouth). We use Symantec and Trend here. I know Trend has been picking it up all day with the new defs, but Norton must not have a new def out yet. I just checked again and it looks like Nov. 28th is the latest for Norton. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:28 PM To: Exchange Discussions Subject: RE: New Virus outbreak Where did you find the defs? I am unable to download it from Symantec's site as it still as the defs dated 28Nov2001 and LiveUpdate says that we have the current defs. -Original Message- From: Denis Baldwin [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 11:16 AM To: Exchange Discussions Subject: RE: New Virus outbreak Yep. Has been available for a few hours, I believe. Denis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues Sent: Tuesday, December 04, 2001 2:10 PM To: Exchange Discussions Subject: RE: New Virus outbreak Does anyone know if Symantec has come out with a def update for this virus? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak I concur. I don't think there is a way. -Original Message- From: John Matteson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 10:53 AM To: Exchange Discussions Subject: RE: New Virus outbreak No.. not that I have found. The attachment gets stripped out and the mail goes on it's merry way to the user. John Matteson; Exchange Manager Geac Corporate Infrastructure Systems and Standards (404) 239 - 2981 Believe nothing because it is written in books. Believe nothing because wise men say it is so. Believe nothing because it is religious doctrine. Believe it only because you yourself know it to be true. -- Buddha -Original Message- From: Bowles, John L. [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 1:44 PM To: Exchange Discussions Subject: RE: New Virus outbreak Alright, but even if it blocks
