Novarg virus and SBS2000 w/Trend Micro

I have SBS2000 with TrendMicro on it, and I'm not sure if I fully understand how it works with SBS yet. Maybe I don't have it installed correctly too. I really don't know since I just got Trend Micro this month for our SBS2000 server and workstations.

We had numerous e-mails come in yesterday with the Novarg virus, a user in our office (duh!) opened the attachment. So, now our server shows it's infected as well as the workstation from the status section of Trend Micro located on SBS

My concern is that when Trend Micros workstation client scans the workstation, it states it doesn't find any viruses once it cleaned the infection from last night, but the server still says that the workstation is infected

Am I missing something here? Are there some type of logs that need to be reset in Trend Micro on SBS

Lastly, shouldn't TrendMicro have detected the virus attached to the e-mails that we were getting, and deleted them (which I what I think I have it set at)

Torrey Laue
Modern Travel Service

Susan
Wed Jan 28 01:14:39 CST 2004

Adjust that setting in Trend to update every hour on the hour.
Yesterday Trend updated three times. The default that it's set at is
not fast enough.
Mine show the ones that have been targeting in the past [mine] and I
can't remember when it resets those graphics.


Okay ... I gotta ask... why did they open the zip AND then the
executable.... what inside that file in any way shape or form did they
think was a email that they just had to open up? Torrey... get a bigger
2x4.


Torrey Lauer wrote:

> I have SBS2000 with TrendMicro on it, and I'm not sure if I fully understand how it works with SBS yet. Maybe I don't have it installed correctly too. I really don't know since I just got Trend Micro this month for our SBS2000 server and workstations.
>
> We had numerous e-mails come in yesterday with the Novarg virus, a user in our office (duh!) opened the attachment. So, now our server shows it's infected as well as the workstation from the status section of Trend Micro located on SBS.
>
> My concern is that when Trend Micros workstation client scans the workstation, it states it doesn't find any viruses once it cleaned the infection from last night, but the server still says that the workstation is infected.
>
> Am I missing something here? Are there some type of logs that need to be reset in Trend Micro on SBS?
>
> Lastly, shouldn't TrendMicro have detected the virus attached to the e-mails that we were getting, and deleted them (which I what I think I have it set at)?
>
> Torrey Lauer
> Modern Travel Services
>

--
http://www.sbslinks.com/really.htm

anonymous
Wed Jan 28 01:31:07 CST 2004

Susan, thanks for the reply. I agree, I do NOT know what compells some people to just have to click on EVERY single attachment that comes through! Oh well though, it's been opened, and we've got it all cleaned, I think. That's part of the problem thought for me with Trend Micro. I do think it's cleaned though because the scanning client on that workstation is not detecting any viruses. I'm still learning it. lo

Is is alright to have Trend Micro scan the M drive? I know that normally one never wants to even click on the M drive or even back it up, but I remember reading that Trend Micro is Exchange "safe" and that it can scan Exchange server in SBS. I haven't done it because I'm not sure if I would come to regret it later. lol So, is the M drive safe to scan or not? And, are there certain types of files within the M drive that it's not supposed to scan? Unfortunately, the docs that I printed from Trend Micro didn't exactly make it clear to me.

Okay, now you lost me. Waht is a 2x4

Thanks again

Torrey Lauer

Hendrik
Wed Jan 28 02:02:27 CST 2004

No, don't scan the M drive. If you have trend set up correctly, it should
co-operate with exchange, and you shouldn't scan anything on your behalf.

HC

Torrey Lauer wrote:
> Susan, thanks for the reply. I agree, I do NOT know what compells
> some people to just have to click on EVERY single attachment that
> comes through! Oh well though, it's been opened, and we've got it
> all cleaned, I think. That's part of the problem thought for me with
> Trend Micro. I do think it's cleaned though because the scanning
> client on that workstation is not detecting any viruses. I'm still
> learning it. lol
>
> Is is alright to have Trend Micro scan the M drive? I know that
> normally one never wants to even click on the M drive or even back it
> up, but I remember reading that Trend Micro is Exchange "safe" and
> that it can scan Exchange server in SBS. I haven't done it because
> I'm not sure if I would come to regret it later. lol So, is the M
> drive safe to scan or not? And, are there certain types of files
> within the M drive that it's not supposed to scan? Unfortunately,
> the docs that I printed from Trend Micro didn't exactly make it clear
> to me.
>
> Okay, now you lost me. Waht is a 2x4?
>
> Thanks again!
>
> Torrey Lauer

Javier
Wed Jan 28 05:36:56 CST 2004

More information (specially on other exclusions that you might want to set
on trend):

Do not backup or scan drive M
http://support.microsoft.com/default.aspx?scid=kb;EN-US;298924

XADM: Exchange and Antivirus Software
http://support.microsoft.com/default.aspx?scid=kb;en-us;328841

--
Javier [SBS MVP]

<< SBS ROCKS !!! >>

"Hendrik Cannoodt" <ask@for.it> wrote in message
news:Ov6lTUX5DHA.2776@TK2MSFTNGP09.phx.gbl...
> No, don't scan the M drive. If you have trend set up correctly, it should
> co-operate with exchange, and you shouldn't scan anything on your behalf.
>
> HC
>
> Torrey Lauer wrote:
> > Susan, thanks for the reply. I agree, I do NOT know what compells
> > some people to just have to click on EVERY single attachment that
> > comes through! Oh well though, it's been opened, and we've got it
> > all cleaned, I think. That's part of the problem thought for me with
> > Trend Micro. I do think it's cleaned though because the scanning
> > client on that workstation is not detecting any viruses. I'm still
> > learning it. lol
> >
> > Is is alright to have Trend Micro scan the M drive? I know that
> > normally one never wants to even click on the M drive or even back it
> > up, but I remember reading that Trend Micro is Exchange "safe" and
> > that it can scan Exchange server in SBS. I haven't done it because
> > I'm not sure if I would come to regret it later. lol So, is the M
> > drive safe to scan or not? And, are there certain types of files
> > within the M drive that it's not supposed to scan? Unfortunately,
> > the docs that I printed from Trend Micro didn't exactly make it clear
> > to me.
> >
> > Okay, now you lost me. Waht is a 2x4?
> >
> > Thanks again!
> >
> > Torrey Lauer
>
>

Victor
Wed Jan 28 07:59:57 CST 2004


"Torrey Lauer" <anonymous@discussions.microsoft.com> wrote in message
news:DADF6A04-A54F-482F-AC5B-40E88DE9206C@microsoft.com...
> Susan, thanks for the reply. I agree, I do NOT know what compells some
people to just have to click on EVERY single attachment that comes through!
Oh well though, it's been opened, and we've got it all cleaned, I think.
That's part of the problem thought for me with Trend Micro. I do think it's
cleaned though because the scanning client on that workstation is not
detecting any viruses. I'm still learning it. lol
>
> Is is alright to have Trend Micro scan the M drive? I know that normally
one never wants to even click on the M drive or even back it up, but I
remember reading that Trend Micro is Exchange "safe" and that it can scan
Exchange server in SBS. I haven't done it because I'm not sure if I would
come to regret it later. lol So, is the M drive safe to scan or not? And,
are there certain types of files within the M drive that it's not supposed
to scan? Unfortunately, the docs that I printed from Trend Micro didn't
exactly make it clear to me.
>
> Okay, now you lost me. Waht is a 2x4?
>
> Thanks again!
>
> Torrey Lauer

What Trend Product(s) are you using?
On my SBS and 2K w/Exchange sites I use:
Trend Scan Mail for Exchange
Trend Office Scan
Trend Server Protect

You need all 3 and there are specific recomendations from Trend on
Exclusions. See Trend Solution 15164.

David
Wed Jan 28 09:06:10 CST 2004

By the way, 2 x 4 is a large plank of wood with which to 'punish' your
all-attachment-opening-without-thinking-users...!

:-)

David



"Javier Gomez [SBS MVP]" <javier_gomez@remove.this.bit.engineer.com> wrote
in message news:#Q58JMZ5DHA.2732@TK2MSFTNGP09.phx.gbl...
> More information (specially on other exclusions that you might want to set
> on trend):
>
> Do not backup or scan drive M
> http://support.microsoft.com/default.aspx?scid=kb;EN-US;298924
>
> XADM: Exchange and Antivirus Software
> http://support.microsoft.com/default.aspx?scid=kb;en-us;328841
>
> --
> Javier [SBS MVP]
>
> << SBS ROCKS !!! >>
>
> "Hendrik Cannoodt" <ask@for.it> wrote in message
> news:Ov6lTUX5DHA.2776@TK2MSFTNGP09.phx.gbl...
> > No, don't scan the M drive. If you have trend set up correctly, it
should
> > co-operate with exchange, and you shouldn't scan anything on your
behalf.
> >
> > HC
> >
> > Torrey Lauer wrote:
> > > Susan, thanks for the reply. I agree, I do NOT know what compells
> > > some people to just have to click on EVERY single attachment that
> > > comes through! Oh well though, it's been opened, and we've got it
> > > all cleaned, I think. That's part of the problem thought for me with
> > > Trend Micro. I do think it's cleaned though because the scanning
> > > client on that workstation is not detecting any viruses. I'm still
> > > learning it. lol
> > >
> > > Is is alright to have Trend Micro scan the M drive? I know that
> > > normally one never wants to even click on the M drive or even back it
> > > up, but I remember reading that Trend Micro is Exchange "safe" and
> > > that it can scan Exchange server in SBS. I haven't done it because
> > > I'm not sure if I would come to regret it later. lol So, is the M
> > > drive safe to scan or not? And, are there certain types of files
> > > within the M drive that it's not supposed to scan? Unfortunately,
> > > the docs that I printed from Trend Micro didn't exactly make it clear
> > > to me.
> > >
> > > Okay, now you lost me. Waht is a 2x4?
> > >
> > > Thanks again!
> > >
> > > Torrey Lauer
> >
> >
>
>

Susan
Wed Jan 28 09:58:25 CST 2004

It's applied to the 8th layer of th OSI
...you know.. the round thing at the top of the shoulders, take 2x4 and
with a rotating movement apply to round thing, aka 8th layer of the OSI
model. Reapply when needed.

http://www.webopedia.com/quick_ref/OSI_Layers.asp

David Elders wrote:
> By the way, 2 x 4 is a large plank of wood with which to 'punish' your
> all-attachment-opening-without-thinking-users...!
>
> :-)
>
> David
>
>
>
> "Javier Gomez [SBS MVP]" <javier_gomez@remove.this.bit.engineer.com> wrote
> in message news:#Q58JMZ5DHA.2732@TK2MSFTNGP09.phx.gbl...
>
>>More information (specially on other exclusions that you might want to set
>>on trend):
>>
>>Do not backup or scan drive M
>>http://support.microsoft.com/default.aspx?scid=kb;EN-US;298924
>>
>>XADM: Exchange and Antivirus Software
>>http://support.microsoft.com/default.aspx?scid=kb;en-us;328841
>>
>>--
>>Javier [SBS MVP]
>>
>><< SBS ROCKS !!! >>
>>
>>"Hendrik Cannoodt" <ask@for.it> wrote in message
>>news:Ov6lTUX5DHA.2776@TK2MSFTNGP09.phx.gbl...
>>
>>>No, don't scan the M drive. If you have trend set up correctly, it
>
> should
>
>>>co-operate with exchange, and you shouldn't scan anything on your
>
> behalf.
>
>>>HC
>>>
>>>Torrey Lauer wrote:
>>>
>>>>Susan, thanks for the reply. I agree, I do NOT know what compells
>>>>some people to just have to click on EVERY single attachment that
>>>>comes through! Oh well though, it's been opened, and we've got it
>>>>all cleaned, I think. That's part of the problem thought for me with
>>>>Trend Micro. I do think it's cleaned though because the scanning
>>>>client on that workstation is not detecting any viruses. I'm still
>>>>learning it. lol
>>>>
>>>>Is is alright to have Trend Micro scan the M drive? I know that
>>>>normally one never wants to even click on the M drive or even back it
>>>>up, but I remember reading that Trend Micro is Exchange "safe" and
>>>>that it can scan Exchange server in SBS. I haven't done it because
>>>>I'm not sure if I would come to regret it later. lol So, is the M
>>>>drive safe to scan or not? And, are there certain types of files
>>>>within the M drive that it's not supposed to scan? Unfortunately,
>>>>the docs that I printed from Trend Micro didn't exactly make it clear
>>>>to me.
>>>>
>>>>Okay, now you lost me. Waht is a 2x4?
>>>>
>>>>Thanks again!
>>>>
>>>>Torrey Lauer
>>>
>>>
>>
>
>

--
http://www.sbslinks.com/really.htm

anonymous
Wed Jan 28 12:26:04 CST 2004

Victor

It's the OfficeScan Client/Server/Messenging Suite which Micro Trend's website states should be used for SBS

Torrey Laue
Modern Travel Services

dkediger
Wed Jan 28 12:31:46 CST 2004

Also referred to as a "Clue" x 4
>-----Original Message-----
>David, I love that idea! LOL
>
>Torrey Lauer
>Modern Travel Services
>.
>

Victor
Wed Jan 28 13:15:03 CST 2004


"Torrey Lauer" <anonymous@discussions.microsoft.com> wrote in message
news:08F1E942-3557-4B0E-AE31-012C6D26537F@microsoft.com...
> Victor,
>
> It's the OfficeScan Client/Server/Messenging Suite which Micro Trend's
website states should be used for SBS.
>
> Torrey Lauer
> Modern Travel Services

That includes the components I mentioned and the Scan Mail for Exchange
should be blocking Novarg for you now if properly configured and updated.

Are your live updates running?

Susan
Wed Jan 28 14:22:55 CST 2004

They need to be set for an update every hour on the hour these days.
The default is not set for that.

Victor wrote:

> "Torrey Lauer" <anonymous@discussions.microsoft.com> wrote in message
> news:08F1E942-3557-4B0E-AE31-012C6D26537F@microsoft.com...
>
>>Victor,
>>
>>It's the OfficeScan Client/Server/Messenging Suite which Micro Trend's
>
> website states should be used for SBS.
>
>>Torrey Lauer
>>Modern Travel Services
>
>
> That includes the components I mentioned and the Scan Mail for Exchange
> should be blocking Novarg for you now if properly configured and updated.
>
> Are your live updates running?
>
>

--
http://www.sbslinks.com/really.htm

Victor
Wed Jan 28 18:30:27 CST 2004


"Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@pacbell.net>
wrote in message news:uaALMyd5DHA.1504@TK2MSFTNGP12.phx.gbl...
> They need to be set for an update every hour on the hour these days.
> The default is not set for that.

All my Trend Sites are set for hourly updates. I have 1 SBS site wi Norton
AV for Exchange that can't be set to update more than 10 times a month. That
is absurd and it makes me VERY nervous. I recomended to the client that he
consider upgrading to Trend.

Merv
Wed Jan 28 19:05:04 CST 2004

Victor, any help here... (or is there some issue with NAV w/Exchange that
I'm not aware of)



Schedule LiveUpdate to Run Hourly



1.. Open Task Scheduler. Click Next.
2.. Select "Command Prompt" from the list.
3.. Type a name for the scheduled task (like Run LiveUpdate Hourly)
4.. In "Perform this task:", select Daily. Click Next.
5.. Select a Start Time and Start Date. Select Everyday. Click Next.
6.. Type the appropriate user credentials. Click Next.
7.. Checkmark "Open advanced properties for this task when I click Finish"
. Click Finish.
8.. Under the Task tab, in the "Run:" field, type "C:\Program
Files\NAV\vpdn_lu.exe" /s (quotes required)
9.. In the "Start in:" field, type: "C:\Program Files\NAV" (quotes
required)
10.. Checkmark "Enabled (scheduled task runs at specified time)"
11.. Under the Schedule tab, click on the "Advanced" button.
12.. Checkmark Repeat task.
13.. Set repeat for: Every 1 hours; Until.Duration 23 hours 0 minutes
14.. Click OK twice.
--
Merv Porter [SBS MVP]
===================================

"Victor" <victor@yahoonomail.com> wrote in message
news:OXtmt7f5DHA.2580@TK2MSFTNGP11.phx.gbl...
>
> "Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@pacbell.net>
> wrote in message news:uaALMyd5DHA.1504@TK2MSFTNGP12.phx.gbl...
> > They need to be set for an update every hour on the hour these days.
> > The default is not set for that.
>
> All my Trend Sites are set for hourly updates. I have 1 SBS site wi Norton
> AV for Exchange that can't be set to update more than 10 times a month.
That
> is absurd and it makes me VERY nervous. I recomended to the client that he
> consider upgrading to Trend.
>
>

Victor
Thu Jan 29 07:36:44 CST 2004

Thanks Merv I will try that.

Victor

"Merv Porter [SBS-MVP]" <mwport@hotmail.com_no_spam> wrote in message
news:%234U4SPg5DHA.1664@TK2MSFTNGP11.phx.gbl...
> Victor, any help here... (or is there some issue with NAV w/Exchange that
> I'm not aware of)
>
>
>
> Schedule LiveUpdate to Run Hourly
>
>
>
> 1.. Open Task Scheduler. Click Next.
> 2.. Select "Command Prompt" from the list.
> 3.. Type a name for the scheduled task (like Run LiveUpdate Hourly)
> 4.. In "Perform this task:", select Daily. Click Next.
> 5.. Select a Start Time and Start Date. Select Everyday. Click Next.
> 6.. Type the appropriate user credentials. Click Next.
> 7.. Checkmark "Open advanced properties for this task when I click
Finish"
> . Click Finish.
> 8.. Under the Task tab, in the "Run:" field, type "C:\Program
> Files\NAV\vpdn_lu.exe" /s (quotes required)
> 9.. In the "Start in:" field, type: "C:\Program Files\NAV" (quotes
> required)
> 10.. Checkmark "Enabled (scheduled task runs at specified time)"
> 11.. Under the Schedule tab, click on the "Advanced" button.
> 12.. Checkmark Repeat task.
> 13.. Set repeat for: Every 1 hours; Until.Duration 23 hours 0 minutes
> 14.. Click OK twice.
> --
> Merv Porter [SBS MVP]
> ===================================
>
> "Victor" <victor@yahoonomail.com> wrote in message
> news:OXtmt7f5DHA.2580@TK2MSFTNGP11.phx.gbl...
> >
> > "Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@pacbell.net>
> > wrote in message news:uaALMyd5DHA.1504@TK2MSFTNGP12.phx.gbl...
> > > They need to be set for an update every hour on the hour these days.
> > > The default is not set for that.
> >
> > All my Trend Sites are set for hourly updates. I have 1 SBS site wi
Norton
> > AV for Exchange that can't be set to update more than 10 times a month.
> That
> > is absurd and it makes me VERY nervous. I recomended to the client that
he
> > consider upgrading to Trend.
> >
> >
>
>

Victor
Fri Jan 30 18:30:53 CST 2004


"Merv Porter [SBS-MVP]" <mwport@hotmail.com_no_spam> wrote in message
news:%234U4SPg5DHA.1664@TK2MSFTNGP11.phx.gbl...
> Victor, any help here... (or is there some issue with NAV w/Exchange that
> I'm not aware of)

This worked great, thanks.

I did have to change the path to show SAV in place of NAV. Also used the
concept to modify the NAVMSE (Exchange) live update schedule.