~ndi
EX5.5 sp4 - 1 site, 11 servers - all attached via leased lines. Clients are
all O2K on NT4 sp6a - identical builds.
Random users at different sites complain of the inability to open
attachments, getting a failure because of a lack of permissions. The
not-so-helpful help message suggests
What Antivirus software is running on the exchange servers?
Is http://support.microsoft.com/support/kb/articles/Q264/7/31.ASP
relevant?
Phil
-
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK
-Original Message-
From: Paul
The only exchange server in the site running Groupshield is a site that is
currently unaffected! The affected sites do not have an Exchange AV scanner
- only Netshield scanning traffic in and out of the server (excluding the IS
of course!).
The techdoc was of interest but not entirely relevant,
Very very close except there is no TS in the mix. I did come across this
and even tried the reg hack to see if it worked... but no, sadly. Thanks
anyway...
PBB
-Original Message-
From: Joyce, Louis [mailto:[EMAIL PROTECTED]]
Sent: 04 December 2001 14:36
To: Exchange Discussions
NT4, SP6a, Exchange 5.5 SP4, CA InoculateIT 4.53
There are a few articles on MSKB which document the timing problems that can
arise with Exchange-aware virus scanners, specifically those which prevent
items from being accessed during archival and synchronization. Exchange 5.5
SP4 was supposed
Chris,
Thanks.
I've found the configuration error. Our firewall was acting as a store and
forward device. Mail that was delivered there was sent to the mail servers
which had a listing of acceptable domains. That's where we were rejecting
domains not for us. Thanks for the clue in.
Actually, the conversation is complete... 250 Ok indicated an agreement to
deliver the mail. But I am wrong anyway (I know... It happens sometimes).
Additional post to follow.
Chris
--
Chris Scharff
Senior Sales Engineer
MessageOne
If you can't measure, you can't manage!
-Original
RGH! I blame lack of caffeine for allowing myself to fall into the logic
trap both sides set up.
Yes, it appears that BBandT.com is not an open relay.
Yes, it appears that BBandT.com as configured is horribly non-RFC complaint.
Yes, orbz and other RBL services purport to report on open
Now, that is interesting because I prevent the Temporary Internet Files
folder from roaming with the profile as many of my users tend to build up
rather large profiles with their internet activity... Arrgh! - It's all my
fault!!
Thanks Louis!
PBB
-Original Message-
From: Joyce,
Out of curiosity, does anyone know why Microsoft in their
infinite wisdom decided to make Temporary Internet Files
a property of the user (i.e. in their profile) as against
just one directory per PC?
The case of diskless workstations is a trivial one, so we
can ignore that and look for deeper
Roaming profiles.. Cookies.. To name a few... Their wisdom is so
infinite they are thinking of features that you might never need, but if
you do, they are there...
--
Kevinm M WLKMMAS, UCC+WCA, CKWSE CKST
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf
Cookies, yes, but cached web pages???
-
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK
-Original Message-
From: Kevin Miller [mailto:[EMAIL PROTECTED]]
Sent: 04 December 2001 15:40
To: Exchange Discussions
Subject: RE:
-Original Message-
From: Randal, Phil [mailto:[EMAIL PROTECTED]]
Sent: 04 December 2001 15:42
To: Exchange Discussions
Subject: RE: Spurious attachment permissions issue...
Out of curiosity, does anyone know why Microsoft in their
infinite wisdom decided to make Temporary
Given the negative side effects of this (huge amounts of
disk space on servers wasted, for one, excessive network
traffic, etc), it's just anoither reason not to use such
software :-)
Phil
-
Phil Randal
Network Engineer
Herefordshire Council
Given the negative side effects of this (huge amounts of
disk space on servers wasted, for one, excessive network
traffic, etc), it's just anoither reason not to use such software :-)
Or maybe just to set it up correctly. We don't generally have too many
problems here with roaming
So all you really wanted to do was complain?
Disk space is very cheap, I for one would much rather have speed then
disk space...
--
Kevinm M WLKMMAS, UCC+WCA, CKWSE CKST
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Randal, Phil
Sent: Tuesday,
With roaming profiles on a server, and thousands of users...
Plain crazy.. (No, not me...)
Phil
-
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK
-Original Message-
From: Kevin Miller [mailto:[EMAIL PROTECTED]]
Sent: 04
I am sorry if this question has been asked before but I looked through the
archives and didn't find much.
I am looking for a good software to do backups for Exchange. I currently
have Veratis backup exec. Has anyone used this?
I am looking for the best any ideas.
TIA,
Brett
Check the archives. It was discussed in depth last week.
-Original Message-
From: Brett Wesoloski [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 10:59 AM
To: Exchange Discussions
Subject: Veratis backup software
I am sorry if this question has been asked before but I
Then again the part of the RFC discussing this uses should rather than
must.
- Original Message -
From: Chris Scharff [EMAIL PROTECTED]
To: Exchange Discussions [EMAIL PROTECTED]
Sent: Tuesday, December 04, 2001 8:15 AM
Subject: RE: ORB UK - cross post - long
I tested between the time
Note that relays are specifically mentioned in 2821. In the discussion of
relaying the bottom line is that a relay is not expected to do much of
anything at all, though it _should_ do xyz and _may_ do abc.
What he should be testing on is the return of the NDR.
- Original Message -
From:
~ndi
Well, I'm happy someone else brought the subject up as I was going to slyly
ask if anyone had a means of 'controlling' the amount of cached/temporary
internet data so that my roaming profiles didn't take hours to load. I know
there is a limit profile size in Profile editor and the setting
-Original Message-
From: Daniel Chenault [mailto:[EMAIL PROTECTED]]
Sent: 04 December 2001 16:01
To: Exchange Discussions
Subject: Re: ORB UK - cross post - long
Note that relays are specifically mentioned in 2821. In the
discussion of relaying the bottom line is that a
Yeah.. I'm back after 3.5 days of downtime thanks to ATT and Excite
communications. I HAD 3 static IP'sgone now and probably won't get any
for another 3-4 weeks. I have been reduced to using DHCP assigned
addresses. Had to reconfigure my firewall and my DNS. Could not get a call
back from
Setting cache to a small size so it stays fresh and gets purged after just
a short length of time works for us.
--
Robert Moir,
IT Systems Engineer,
Luton Sixth Form College
Rome did not create a mighty empire by having management meetings
-Original Message-
From: Paul Bouzan
Sorry Robert, being a complete thicky here - on the workstation I assume?
PBB
-Original Message-
From: Robert Moir [mailto:[EMAIL PROTECTED]]
Sent: 04 December 2001 16:07
To: Exchange Discussions
Subject: RE: Spurious attachment permissions issue...
Setting cache to a small size so
Um, security?
--
Roger D. Seielstad - MCSE MCT
Senior Systems Administrator
Peregrine Systems
Atlanta, GA
http://www.peregrine.com
-Original Message-
From: Randal, Phil [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001
I had a great experience with Charter last night. My modem had died on
Saturday. Just waited for things to settle before calling. I called last
night. This was my entire conversation
Tech : hello how may help you?
Me : well my modem does not seem to be right, It is giving me a 192
address?
Me :
Well, as they're using Internet Exploder security has already gone out the
window(s TM). :-)
Phil
-
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK
-Original Message-
From: Roger Seielstad [mailto:[EMAIL PROTECTED]]
Sent:
What do expect from a cheapo Internet connection?
There is a simple rule when it comes to picking your Internet provider.
There are three basic qualities...
Lots of Bandwidth/Low latency
Great Technical Support and Reliability
Inexpensive
pick any two of those qualities.
Aaron
-Original
Never heard of it... Care to elaborate? ;o)
D
-Original Message-
From: Roger Seielstad [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 8:10 AM
To: Exchange Discussions
Subject: RE: Spurious attachment permissions issue...
Um, security?
caller id?
-Original Message-
From: Kevin Miller [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 10:12 AM
To: Exchange Discussions
Subject: RE: Hello
I had a great experience with Charter last night. My modem had died on
Saturday. Just waited for things to settle before
Please note that there is a new Email virus out with an attachment Gone.scr
Cheers
Paul
Standards are like toothbrushes,
everybody agrees you should have one,
but no one wants to use yours
**
The information contained in
My connection isnt cheap... I have the @Business connection with Turbo.
Very expensive for a company like ours.
-Original Message-
From: Aaron Brasslett [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 10:13 AM
To: Exchange Discussions
Subject: RE: Hello
What do expect from
Any links to any info?
Regards
Mr Louis Joyce
Computer Support Analyst
Network Administrator
BT Ignite eSolutions
-Original Message-
From: Hurst, Paul [mailto:[EMAIL PROTECTED]]
Sent: 04 December 2001 16:15
To: Exchange Discussions
Subject: New Virus outbreak
Please note that
However, it sounds like they are charging me for the @Business name but I'm
getting the same @Home service.
-Original Message-
From: Murphy, Brian [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 10:16 AM
To: Exchange Discussions
Subject: RE: Hello
My connection isnt
I've checked both Mcafee.com and Symantec.com sites and found nothing.
-Original Message-
From: Joyce, Louis [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 11:14 AM
To: Exchange Discussions
Subject:RE: New Virus outbreak
Any links to any info?
Regards
Not to mention I had 3 static IP addresses bound to a very expensive
firewall that refuses (for obvious reasons) to use DHCP addressing. So, I
had to restructure my entire WAN and a few servers. Some systems had to be
removed from service for security reasons.
-Original Message-
Trend Information:
http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=WORM_GONE.A;
VSect=T
-Original Message-
From: Joyce, Louis [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 8:14 AM
To: Exchange Discussions
Subject: RE: New Virus outbreak
Any links to any
http://www.viruslist.com/eng/default.asp?tnews=2nview=1id=1264page=0
-Original Message-
From: Joyce, Louis [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 7:14 PM
To: Exchange Discussions
Subject: RE: New Virus outbreak
Any links to any info?
Regards
Mr Louis Joyce
Brett,
Use to use that at my last place no complaints, in fact we found it better
than Arcserve/Legatto for Exchange.
Cheers
Paul
Standards are like toothbrushes,
everybody agrees you should have one,
but no one wants to use yours
-Original Message-
From: Brett Wesoloski
I initiated a block on .SCR extensions in ScanMail. As soon as I initiated
a block I started seeing it. Shit!!! I'm waiting for Trend to get a
pattern, but I would suggest blocking until it's available.
-Original Message-
From: Usachev Oleg [mailto:[EMAIL PROTECTED]]
Sent: Tuesday,
Symantec/Norton AV Information:
http:[EMAIL PROTECTED]
-Original Message-
From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 8:20 AM
To: Exchange Discussions
Subject: RE: New Virus outbreak
Trend Information:
We have been blocking .scr's for a LONG time, but we have seen 5 of these
blocked already this morning.
Jim Blunt
Network / Exchange Admin
-Original Message-
From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 9:02 AM
To: Exchange Discussions
As have we. 26 so far.
-Original Message-
From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 12:05 PM
To: Exchange Discussions
Subject: RE: New Virus outbreak
We have been blocking .scr's for a LONG time, but we have seen 5 of these
blocked already
We are all blocking .SCR files anyway...right kids?
-Original Message-
From: Hurst, Paul [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 8:15 AM
To: Exchange Discussions
Subject: New Virus outbreak
Please note that there is a new Email virus out with an attachment Gone.scr
Yessir!
We all read your now (in)famous list.
Didn't we? ;-)
Phil
-
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK
-Original Message-
From: Martin Blackstone [mailto:[EMAIL PROTECTED]]
Sent: 04 December 2001 17:05
To:
I am. And, .vbs, .js, .htm, .html, .txt.vbs,
etc.
My users love it.
-Original Message-
From: Martin Blackstone [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 11:05 AM
To: Exchange Discussions
Subject: RE: New Virus outbreak
We
We are here, and EXE, and PIF, and VBS and so on
If they want it, they have to talk to me first. POWER!
-Original Message-
From: Martin Blackstone [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 9:05 AM
To: Exchange Discussions
Subject: RE: New Virus outbreak
We are
Veritas BUE seems to work well for me. You do have the Exchange plugin,
right?
Denis
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Brett Wesoloski
Sent: Tuesday, December 04, 2001 10:59 AM
To: Exchange Discussions
Subject: Veratis backup software
I
I know Groupshield can suffer from this problem, though we were able to minimize it
through the timing changes in the registry. I'm don't know if it's true with other
AVAPI scanners though.
Did you write Mac shareware in years past?
-Peter
-Original Message-
From: Loftus Greig
Neither. I should have read the faq first. My previous posts stated that
the SMTP relay had to be the Proxy Server in question. He rebuilt the
Exchange Server from scratch but Internet Mail was not functioning. It
would seem more advantageous to separate the function of Internet Mail
The fix is to increase OpenRetryDelay as detailed here:
http://support.microsoft.com/support/kb/articles/Q264/7/31.ASP
We use 0x800 as our value.
If you're using Groupshield, get hotfix 7 from http://b2b.mcafee.com
(follow the download links for product updates, login, and look under
patches
Actually, you should always block it. .SCR files have no business use at all
unless you mfg screen savers.
-Original Message-
From: Pfefferkorn, Pete (PFEFFEPE) [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 9:02 AM
To: Exchange Discussions
Subject: RE: New Virus outbreak
oops, brain not in gear..
http://www.mcafeeb2b.com/naicommon/download/upgrade/login.asp
Phil
-
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK
-Original Message-
From: Randal, Phil
Sent: 04 December 2001 17:29
To:
Good catch!
-Original Message-
From: Durkee, Peter [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 9:38 AM
To: Exchange Discussions
Subject: RE: New Virus outbreak
Or unless you have an accounting package which runs under NT but comes from
the Unix world and uses scripts
What error message in the event logs? Can you back it up with NTBackup?
Missy
- Original Message -
From: Victor Sanchez [EMAIL PROTECTED]
To: Exchange Discussions [EMAIL PROTECTED]
Sent: Tuesday, December 04, 2001 12:37 PM
Subject: RE: Veratis backup software
I'm running the latest
We are getting hammered. 100 catches on the Internet gateway within the last
half hour.
John Matteson; Exchange Manager
Geac Corporate Infrastructure Systems and Standards
(404) 239 - 2981
Believe nothing because it is written in books. Believe nothing because wise
men say it is so. Believe
Does the user that BUE runs as have access to the Exchange store?
Denis
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Victor Sanchez
Sent: Tuesday, December 04, 2001 12:38 PM
To: Exchange Discussions
Subject: RE: Veratis backup software
I'm running
Here is the log for the portion that fails
Media Name: Media created 11/6/01 01:07:24 PM
Backup of \\EXCHANGE\Microsoft Exchange Information Store
Backup set #2 on storage media #1
Backup set description: Exchange Backup
Backup Type: FULL - Database Logs (flush committed logs)
Backup started
I'm sure it does.. I'll take a look.
-Original Message-
From: Denis Baldwin [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 9:59 AM
To: Exchange Discussions
Subject: RE: Veratis backup software
Does the user that BUE runs as have access to the Exchange store?
Denis
Even though we were blocking .scr we still had the virus explode
within...BUMMER!!!
Trend 177 catches it...have updated...now to get the PCs infected...
rudy ;-)
Network Engineer/E-Mail Administrator
VLC, an Anchor Gaming Company
2311 South 7th Ave
Bozeman, MT 59715
mailto:[EMAIL PROTECTED]
Probably some user that has hotmail or something.
I just sent an email to all my users begging them not to use it today.
-Original Message-
From: Schneider, Rudy [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 10:18 AM
To: Exchange Discussions
Subject: RE: New Virus outbreak
After updating to pattern file 177 is anyone getting the email alerts Virus
Found? All I'm still getting is attachment blocking alerts? Doesn't seem
like the pattern file has kicked in. Has anyone experienced this??
___
John Bowles
Exchange Administrator
Enterprise
It will block the attachments first. So it never gets scanned, just deleted.
-Original Message-
From: Bowles, John L. [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 10:37 AM
To: Exchange Discussions
Subject: RE: New Virus outbreak
After updating to pattern file 177 is
Alright, but even if it blocks the attachment it still sends mail to the
user. Is there anyway to stop that?
___
John Bowles
Exchange Administrator
Enterprise Support Engineering
Celera Genomics
[EMAIL PROTECTED] mailto:[EMAIL PROTECTED]
-Original Message-
No.. not that I have found. The attachment gets stripped out and the mail
goes on it's merry way to the user.
John Matteson; Exchange Manager
Geac Corporate Infrastructure Systems and Standards
(404) 239 - 2981
Believe nothing because it is written in books. Believe nothing because wise
men
I concur. I don't think there is a way.
-Original Message-
From: John Matteson [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 10:53 AM
To: Exchange Discussions
Subject: RE: New Virus outbreak
No.. not that I have found. The attachment gets stripped out and the mail
goes
Also in the event viewer I have an error saying a read verification error
had occoured.
-Original Message-
From: Missy Koslosky [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 9:55 AM
To: Exchange Discussions
Subject: Re: Veratis backup software
What error message in the
Does anyone know if Symantec has come out with a def update for this virus?
-Original Message-
From: Martin Blackstone [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 10:53 AM
To: Exchange Discussions
Subject: RE: New Virus outbreak
I concur. I don't think there is a way.
Hi,
I wonder if someone can give a clearer picture how DACLs
are inherited in WSS and if someone can explain how the
different atttributes work togheter.
S:dacl S:defaulted=0 S:protected=0 S:autoinherited=1
what´s defaulted, protected and autoinherited mean ?
S:access_allowed_ace
Problem: Currenly in our Exchange site noone had the rite to send on
behalf, but if your a Domain Admin you can go to outlook and pull down the
FROM field and send a message from anyone. Does anyone no where I can
restrict this right in Exchange. I think it's done on the Exchange
server,
Hi everybody
Please can any one guide me on how to restore a single public folder from
the backup of Information store. The backups are taken using the native NT
backup utility provided in Win NT Server V4.0.
Regards
Vishwas Pathak
Hi,
I wonder if someone can give a clearer picture how DACLs
are inherited in WSS and if someone can explain how the
different atttributes below work togheter. XML taken from
a Security Descriptor.
S:dacl S:defaulted=0 S:protected=0 S:autoinherited=1
what´s defaulted, protected and
What is the latest Trend Pattern?
-Original Message-
From: Akerlund, Scott [mailto:[EMAIL PROTECTED]]
Posted At: Tuesday, December 04, 2001 7:10 PM
Posted To: Exchange
Conversation: New Virus outbreak
Subject: RE: New Virus outbreak
We are here, and EXE, and PIF, and VBS and so
Restore to a recovery server and archive PF to a PST file and copy to
production server PF.
If a man knows not what harbor he seeks, any wind is the right wind.
-Seneca
-Original Message-
From: vishwas pathak [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 7:31 AM
To:
Don't you guys use an Intrusion Detection Package..something like
Snort???
_
List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
Archives: http://www.swynk.com/sitesearch/search.asp
To unsubscribe:
Yep. Has been available for a few hours, I believe.
Denis
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues
Sent: Tuesday, December 04, 2001 2:10 PM
To: Exchange Discussions
Subject: RE: New Virus outbreak
Does anyone know if Symantec has
Don't you guys run a Intrusion Detection Package like snort or
something?
-Original Message-
From: Martin Blackstone [mailto:[EMAIL PROTECTED]]
Posted At: Tuesday, December 04, 2001 8:17 PM
Posted To: Exchange
Conversation: New Virus outbreak
Subject: RE: New Virus outbreak
Probably
177 (977)
Jeffrey R. Waters
Senior Systems Engineer
Information Technology, Hanover County
-Original Message-
From: Exchange [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 12:20 PM
To: Exchange Discussions
Subject: RE: New Virus outbreak
What is the latest Trend Pattern?
Note that relays are specifically mentioned in 2821. In the discussion
of relaying the bottom line is that a relay is not expected to do much
of anything at all, though it _should_ do xyz and _may_ do abc.
Agreed.
What he should be testing on is the return of the NDR.
No. There are three
yes. do you have a rule that is catching gone_A and pulling the frames off
the wire?
-Original Message-
From: Koos Jacobs [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 10:39 AM
To: Exchange Discussions
Subject: RE: New Virus outbreak
Don't you guys use an Intrusion
I am attempting to setup my INS to connect to news.microsoft.com to see if
they still support the newnews command and after the INS makes the request
for new messages of the groups I have subscribed to I get back a 502 error,
Access Denied. I thought that news.microsoft.com was an anonoymous
Don't you guys use a Intrusion Detection PackageSomething like
Snort?
-Original Message-
From: Martin Blackstone [mailto:[EMAIL PROTECTED]]
Posted At: Tuesday, December 04, 2001 8:17 PM
Posted To: Exchange
Conversation: New Virus outbreak
Subject: RE: New Virus outbreak
Probably
177
-Original Message-
From: Exchange [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 9:20 AM
To: Exchange Discussions
Subject: RE: New Virus outbreak
What is the latest Trend Pattern?
-Original Message-
From: Akerlund, Scott [mailto:[EMAIL PROTECTED]]
Posted
What version of Exchange are you using?
- Original Message -
From: Ben Harris [EMAIL PROTECTED]
To: Exchange Discussions [EMAIL PROTECTED]
Sent: Tuesday, December 04, 2001 10:18 AM
Subject: Sending on Behalf
Problem: Currenly in our Exchange site noone had the rite to send on
behalf,
Isn't .js created by Office product when sending document from within the
productivity suite?
-Original Message-
From: Murphy, Brian [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 9:10 AM
To: Exchange Discussions
Subject: RE: New Virus outbreak
I am. And, .vbs, .js,
alert tcp any any - any 25 (msg:Virus - Possible Gone.scr;content:
name=\gone.scr\; nocase; rev:1; resp:rst_all;)
That is what I am using...
-Original Message-
From: Byron Kennedy [mailto:[EMAIL PROTECTED]]
Posted At: Tuesday, December 04, 2001 9:18 PM
Posted To: Exchange
Where did you find the defs? I am unable to download it from Symantec's
site as it still as the defs dated 28Nov2001 and LiveUpdate says that we
have the current defs.
-Original Message-
From: Denis Baldwin [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 11:16 AM
To:
Us too. 129 so far. This blocking is really saving our buts. McAfee's new
DAT is not scheduled till tomorrow(An extra.dat is out now). Although that
will probably change
Audio International
Chris Hyche
MIS Technician
Phone: (501) 801-0457
Fax: (501) 801-0421
www.audiointl.com
-Original
Ooops.. insert foot in mouth).
We use Symantec and Trend here. I know Trend has been picking it up all day
with the new defs, but Norton must not have a new def out yet. I just
checked again and it looks like Nov. 28th is the latest for Norton.
Denis
-Original Message-
From: [EMAIL
Just wanted to thank Paul and this list about the warning. I was able to
send out an alert and notify the users (Exchange and non-Exchange) and I
think we avoided some additional problems with the notification.
Thanks again!
-Original Message-
From: Hurst, Paul [mailto:[EMAIL
Where is the extra.dat? I cant find it on the WWW or FTP sites
-Original Message-
From: Chris Hyche [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 10:53 AM
To: Exchange Discussions
Subject: RE: New Virus outbreak
Us too. 129 so far. This blocking is really saving our
Never mind
-Original Message-
From: Martin Blackstone
Sent: Tuesday, December 04, 2001 11:33 AM
To: Exchange Discussions
Subject: RE: New Virus outbreak
Where is the extra.dat? I cant find it on the WWW or FTP sites
-Original Message-
From: Chris Hyche [mailto:[EMAIL
Go to their FTP site:
ftp://ftp.symantec.com/public/english_us_canada/antivirus_definitions/norton
_antivirus/
Then click on specdefs, you will see the latest.
SARCi32.exe
These could possibly cause problems, not sure.
It seems like they usually release the final defs around 5PM everytime
Do a Liveupdate get message, Update Not Necessary when last def is 31128c on
11/28/01.
Is site too busy?
Bill
Yep. Has been available for a few hours, I believe.
Denis
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Network Issues
Sent: Tuesday,
What user runs the service?
This user needs to have appropriate permissions in ExchangeService
Account Admin.
You can adjust this from Exchange Admin.
BEM
-Original Message-
From: Denis Baldwin [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 11:59 AM
To: Exchange
Not unless it's Java Script.
-Original Message-
From: Tea, Justin [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 1:25 PM
To: Exchange Discussions
Subject: RE: New Virus outbreak
Isn't .js created by Office product when sending document from within the
productivity suite?
I pretty much filter everything. One of the good aspects of Antigen for
Sybari is that I can quarantine certain items and approve delivery later
if I choose. For example, I filter all *.exe files but some *.exe files
might serve a legitimate purpose (very rarely happens..but it does). User
Of course, I don't have to worry about any of this when my ISP dies on me
without any notice and I'm unable to contact them for 3 days.
-Original Message-
From: Murphy, Brian [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, December 04, 2001 1:51 PM
To: Exchange Discussions
Subject: RE: New
1 - 100 of 159 matches
Mail list logo
