RE: [IMail Forum] New virus going around - W32/Swen@MM

[Mark Gordon]

Title: RE: [IMail Forum] New virus going around - W32/[EMAIL PROTECTED]

Greg we have tried Declude. The amount of traffic on our server and the number of hosts prevents us from doing so. It kills the box CPU wise.

-----Original Message-----
From: Greg Foulks [mailto:[EMAIL PROTECTED]
Sent: Friday, September 19, 2003 11:18 AM
To: [EMAIL PROTECTED]
Subject: RE: [IMail Forum] New virus going around - W32/[EMAIL PROTECTED]

Mark,

Why aren't using some kind of scanner in front of your Imail server? then you won't have to worry about using a rule to stop these emails... They'll be stopped because of the extensions that are attached more importantly it'll be stopped because your virus scanner would detect the virus that is attached to the email.

 

Check out http://www.declude.com works great!

 

Greg

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Mark Gordon
Sent: Friday, September 19, 2003 11:03 AM
To: '[EMAIL PROTECTED]'
Subject: RE: [IMail Forum] New virus going around - W32/[EMAIL PROTECTED]

Group can someone come up with a rule to block this virus on the imail end so far here are my senders and the subject. The attachement name changes also but it is still an '.exe'

From:                 
Customer Support <[EMAIL PROTECTED]>
To:  "Customer" <[EMAIL PROTECTED]>
SUBJECT: Latest Microsoft Critical Update

From:
<[EMAIL PROTECTED]>
To: "User" <[EMAIL PROTECTED]>
SUBJECT: New Net Critical Pack

From: "" <[EMAIL PROTECTED]>
To: "Commercial Customer" <[EMAIL PROTECTED]>
SUBJECT: Latest Internet Security Patch

FROM: "Microsoft" <[EMAIL PROTECTED]>
TO: "Commercial Client" <[EMAIL PROTECTED]>
SUBJECT: Internet Security Upgrade

From: "Microsoft" <[EMAIL PROTECTED]>
To: "Customer" <[EMAIL PROTECTED]>
SUBJECT: New Network Security Pack

FROM: "Microsoft" <[EMAIL PROTECTED]>
TO: "MS Partner" <[EMAIL PROTECTED]>
SUBJECT:

FROM: "Microsoft" <[EMAIL PROTECTED]>
TO: "Microsoft Corporation Customer" <[EMAIL PROTECTED]>
SUBJECT: Current Security Pack

FROM: "Microsoft Corporation Program Security Division" <[EMAIL PROTECTED]>
TO: "User" <[EMAIL PROTECTED]>
SUBJECT: New Network Critical Update

This is just a sample. I was blocking all .exe from the rules, but someone of our customers complained now we had to remove this rule.

Anyone with any ideas on how to stop this via rules please post to the list thanks.