Let me say one thing here. We got hit with it. If we were blocking .zip attachments then we would have not gotten infected, well at least it would have been rare.
Symantec is the only company that posted that it killed there live update files, so that the virus couldn't be found with new dat files. So to stop the Virus on my server getting spammed to the people in and out of my office. I blocked .zip attachments. In the logs it will tell you what IP the mail is coming from go to that computer and run the stinger. Problem fixed. Users are stupid we all know that and it seems more so in the tire business that if it doesn't have a tread on it with rubber and a steal belt that they don't know how to sell/work/comprehend it. No offence to the gear heads out there. Pip -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Erwin Sent: Tuesday, May 03, 2005 11:19 AM To: IMail_Forum@list.ipswitch.com Subject: Re: [IMail Forum] Worm.SOBER.P- Got it. Looks like all the antivirus software in place updated after the infection had taken place. I run the Clam, F-prot and Trend updates at 6:30am every day. I guess I'll have to do it more than once a day now. But even scanning the infected systems with Trend Officescan didn't turn up anything. However, when I actually searched for the files in Windows Exporer, the real time scan picked them up. Trend used to be my rock, now I'm not so sure. Thanks, Scott Doug Traylor wrote: >>200.0.0.231 is the lan address of the mail server. >>200.0.0.54 is a client on the lan. There are two other client machines >>that appear to be doing all the sending. Trend does not detect any virus >>on those systems. >> >>I have No Mail Relay selected and SMTP auth is required. What'g going on >>here? >> >> >> > >My guess is your client machine(s) is/are infected. Simply pull them >off the lan and see if the problem goes away. > >Try another desktop cleaner other than Trend. They are very slow to >react to new viruses. I use them for my gateway and I have had to >take extraordinary steps to block attachments due to Trend missing >them until they get an update out there. > >I use Kaspersky to clean systems that are infected with a new virus. >They seem to be by far the fastest to develop solutions to the new >viruses. They have a free trial for desktop computers. > >Good luck, > >Doug Traylor > >To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
