Les
Thu Aug 21 13:21:23 CDT 2003
Let me rephrase that, please.
It's not precisely at the exchange level, rather the SMTP level and it's a
feature of ISA feature pack. Sorry about that.
http://www.microsoft.com/isaserver/featurepack1/email.asp
--
Les Connor
------------------
[SBS MVP]
"Filippo" <inutile@nospam.com> wrote in message
news:#CDnwhAaDHA.2336@TK2MSFTNGP09.phx.gbl...
> where can we find a detalied description on how to block certain
attachments
> from exchange?
>
> thanks,
> Filippo
>
>
> "Les Connor [SBS MVP]" <les.connor@cfiveDEL.ca> ha scritto nel messaggio
> news:OZzNXVAaDHA.1816@TK2MSFTNGP09.phx.gbl...
> > MVP's got nailed hundreds or 10's of hundreds of times earlier this
week.
> > Most of the emails were sent from only 2 to 5 ip addresses, but not all
> > MVP's got nailed by the same ip's. In my case, the mailings stopped in
> about
> > 20 hours.
> >
> > Some things that help:
> >
> > a) see Steve Fosters method of using ISA to block the ip's. (look for
> thread
> > earlier this week).
> > b) if it's only a few ip's, set exchange not to accept mail from those
> ip's
> > c) use attachment blocking, there's no reason to allow scr, pif, bat,
exe
> > ttc. attachments. Do this at the A/V or exchange level.
> >
> > --
> > Les Connor
> > ------------------
> > [SBS MVP]
> >
> >
> >
> > "David Mathias" <davidm@clip.com> wrote in message
> > news:07fa01c367fd$81aa14e0$a001280a@phx.gbl...
> > > all of the email addresses are external -
> > >
> > > My understanding of the sobig virus though is that the
> > > message header may not mean anything as to the real source.
> > >
> > > Thanks for your input - any other ideas?
> > >
> > > david
> > > >-----Original Message-----
> > > >Check the email headers to see what the origin is -
> > > internal or external.
> > > >
> > > >--
> > > >Les Connor
> > > >------------------
> > > >[SBS MVP]
> > > >
> > > >
> > > >
> > > >"David Mathias" <davidm@clip.com> wrote in message
> > > >news:0f5201c367fa$7ea62b10$a401280a@phx.gbl...
> > > >> John,
> > > >>
> > > >> Yep, I've run it on all the PC's with the latest virus
> > > >> defs.. i even ran symantec's "special" sobig removal
> > > tool
> > > >> on everyone via a login script this morning.. and it
> > > >> hasn't found it anywhere on the clients.
> > > >>
> > > >> I'm basically just redoing all of my steps...
> > > >>
> > > >> thanks for the reply.. unfortunately I'm the only one
> > > here
> > > >> that knows anything about virus removal... so I wanted
> > > to
> > > >> raise my head of the weeds and talk to someone else
> > > >> intelligent <smile>
> > > >>
> > > >> David
> > > >>
> > > >>
> > > >> >-----Original Message-----
> > > >> >Done a scan of all client PCs yet? Thats where I would
> > > >> start.
> > > >> >
> > > >> >"David Mathias" <Davidm@clip.com> wrote in message
> > > >> >news:0ec301c367f7$1e61e120$a401280a@phx.gbl...
> > > >> >> Well this has been a fun day....
> > > >> >>
> > > >> >> Anyone having a problem with the Sobig.F virus? I
> > > found
> > > >> >> one pc on our network that was infected, I've removed
> > > >> the
> > > >> >> virus from the PC and am still getting a ton of the
> > > >> emails
> > > >> >> being being sent to my public folders.
> > > >> >>
> > > >> >> My Virus software (NAV Corp) is picking up and
> > > deleting
> > > >> >> the attachments, but I'm still getting nearly 200
> > > emails
> > > >> >> per hour - so it's got to be in my network somewhere.
> > > >> >>
> > > >> >> Any suggestions on clearing all of this up? anyone
> > > else
> > > >> >> run into this problem lately?
> > > >> >>
> > > >> >> Luckily Blaster was not a problem....
> > > >> >>
> > > >> >>
> > > >> >> thanks in advance for suggestions.
> > > >> >>
> > > >> >> david
> > > >> >
> > > >> >
> > > >> >.
> > > >> >
> > > >
> > > >
> > > >.
> > > >
> >
> >
>
>