Les
Tue Jan 27 22:14:21 CST 2004
Honestly, in about 5 years of using Trend A/V products, I think I have seen
1, 2 at most, updates that caused any kind of problem. I have no experience
with other A/V products, other than from posts it appears that not all are
as reliable as Trend.
--
Les Connor [SBS MVP]
-------------------------------------
SBS Rocks !
"Andrew M. Saucci, Jr." <spam-only@2000computer.com> wrote in message
news:eZTg5cT5DHA.2540@TK2MSFTNGP11.phx.gbl...
> I would never update that quickly. Too much danger of downloading
a
> half-baked update. I simply cannot risk having all my servers (maybe
> workstations too) crash all at once. I feel safe enough updating once a
day
> (let everyone else be the beta testers) and blocking EXE, COM, BAT, PIF,
> SCR, JS, VBS, REG, and SHS files. I'd rather chance a virus getting in
> through an unusual avenue (those file attachments probably account for the
> lion's share of threats these days) than chance downloading a bad update
> onto all the servers all at once. I know that's a value judgment but it
> seems most sensible for my situation, and I have downloaded bad updates
that
> affected the operation of the server. As long as the virus, worm, or
trojan
> is contained in one of the blocked attachment types, I don't have to worry
> about updates at all. And with SBS 2003, if SBS doesn't catch it, my
> Symantec Mail Security setup will, because it blocks the same attachments,
> so I'm doubly protected. In fact, what has been happening with me is that
> SBS 2003 grabs it on account of the extension and then SAV CE actually
scans
> it from the Blocked Attachments folder and quarantines it. Anyway, you
can't
> count on A/V vendors to update fast enough. If you're really paranoid, you
> use ISA to block all known webmail sites so that they don't bypass the
mail
> scanners.
>
> "Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@pacbell.net>
> wrote in message news:eZ7lgRI5DHA.1292@TK2MSFTNGP11.phx.gbl...
> > But keep in mind that this stuff comes out sooooooooo quickly that if
> > you DAT file is not up to date no scanner in the world is going to help
> you.
> >
> > This why we have our A/V set to get an update every hour on the hour.
> >
> > Trend only got this updated signature file THIS AFTERNOON. Thus if you
> > got this email, this morning, you were not protected.
> >
> > Conversely, if you only update once a week you may NOT be protected now.
> >
> > I'll yell for emphasis....
> >
> > YOU MAY NOT BE PROTECTED UNLESS YOUR A/V SIGNATURE FILE HAS BEEN UPDATED
> > TO CATCH THIS. Don't assume that you are protected. Go to the vendor's
> > web site and check what dat file signature protects for this.
> >
> > YOU MUST BE ON Trend's 743 to get this scanned.
> >
> > Andrew M. Saucci, Jr. wrote:
> > > I don't block ZIP's but Symantec Mail Security will scan
> within a
> > > ZIP, so if a ZIP contains an SCR or other blocked attachment then the
> whole
> > > ZIP is blocked.
> > >
> > > "Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]"
<sbradcpa@pacbell.net>
> > > wrote in message news:eAqCC5F5DHA.2740@TK2MSFTNGP09.phx.gbl...
> > >
> > >>New Worm Activity - W32.Novarg.A@mm
> > >>Symantec and other anti-virus vendors are reporting a new mass-mailing
> > >>worm called W32.Novarg.A@mm. Initial reports indicate the worm spreads
> > >>through .exe, .pif, .scr, and .zip attachments. Preliminary reports
> > >>indicate the worm listens on TCP port 3127. More information will be
> > >>posted when it becomes available.
> > >>
> > >>Since about 2 p.m. my pacbell account is getting some zip files
[besides
> > >>the normal SWENs that it gets regularly] I think they are Novarg.
all
> > >>about 33 KB in size.
> > >>
> > >>--
> > >>
> > >>
> > >>--
> > >>
http://www.sbslinks.com/really.htm
> > >>
> > >
> > >
> > >
> >
> > --
> >
http://www.sbslinks.com/really.htm
> >
>
>