Hi, can any email sending/routing expert help me to answer this difficult question. How does emails get to the destination recipients? I need to know because I received 2000+ emails with W32.Swen@mm virus daily, and it’s harmless when quarantine by Symantec Antivirus. But the problem is it’s causing a huge amount of traffic for the company and costly. If an email get send to an address that does not exist in domino directory and is return to the sender. Eg. The email sent from the sending domain is 8MB size, does the full 8MB travel into the recipient’s domain through the recipient’s internet connection before a decision is made whether the recipient existed. Or are email servers/systems smart enough to actually send some sort of header signal to check that the recipients existed in the destination before the 8MB emails takeoff it’s journey into the destination domain? I myself had 2000+ emails W32.Swen@mm virus coming to my email address building up internet traffic around 100MB a day which is costly for the company. What’s an effective method to block it out???And also if I set a deny rule on the Domino server for the emails,eg. does the 8Mb email travel through our domain internet connection before being rejected, or the sending servers check for the permission before the 8Mb email takeoff it’s journey? Any documents on how emails travelled???
Subject: Help, how are emails SEND/ROUTE… need to prevent W32.Swen.Worm traffic
yes, the entire message is sent before the recipient chack is made (all smtp mail works this way)
read the RFC 821 doc in the net
your best bet is to get en antivirus product for your domino servers (groupshield or similar)
Subject: RE: Help, how are emails SEND/ROUTE… need to prevent W32.Swen.Worm traffic
I did stated that I have Symantec Antivirus for Lotus Domino Servers. SAV is the best antivirus product. The W32.Swen@mm virus is harmless. But the problem is it’s causing a huge amount of unwanted Traffic and costing the company.
Subject: RE: Help, how are emails SEND/ROUTE… need to prevent W32.Swen.Worm traffic
Are all the messages coming from the same domain, or do they have anything in common?
You could try setting up a mail rule on your SMTP server to not accept messages that meet the criteria.
Subject: RE: Help, how are emails SEND/ROUTE… need to prevent W32.Swen.Worm traffic
Many came from similar SMTP domains. Even though I can block out those SMTP domains, the traffic (emails) still gets through our ISP connection before it is reject/denied. The full 8Mb email would be accounted for in our Internet bill cost. Like I said I am not concerned about the potential virus damage, but Iam concerned about the Virus emails is generating a huge amount of TRAFFIC through our ISP. How do I prevent it travelling down our company ISP internet line. It’s giving me 200MB of unwanted emails traffic through the ISP a day which is 6GB a month and wasting hundreds of dollars. Like Adam say the full email size will gets to the destination domain before it actually decided whether it is rejected/denied. According to RFC821.
Subject: RE: Help, how are emails SEND/ROUTE… need to prevent W32.Swen.Worm traffic
I though Lotus notes are supposed to be NRPC port 1358 instead of SMTP and won’t be affected by SMTP emails.
Subject: W32.Swen Virus and Notes Temp Files
We are running a Domino/2003 6.5 server and noticed something interesting (re: virus attachment). Norton AV picks up on W32.Swen when the server is launched but says “unable to repair.”
To see NAV alert and reference to Notes TMP, use this URL: http://net2meeting.com/LotusSupport/NAVSWENAlert.jpg
I attempt to locate <maybe hidden?> the TMP file in the “Notes 74555E” directory under \Windows\Temp to no avail. Is it attempting to hijack the nsmtp task? I am not seeing severe amounts of mail but am most interested in this virus actually leveraging Domino! This TMP directory disappears once the server is shutdown. The EXE download from Symantec does not locate the virus. Just want to make sure there are no unknown exploits…
Subject: RE: Help, how are emails SEND/ROUTE… need to prevent W32.Swen.Worm traffic
Does your ISP offer a SMTP relay facility? if they do, let them deal with the virus scanning and rejection of bad mail before it is sent on to you. It may cost a bit extra but probably less than the extra traffic is currently costing you.
Subject: This is not entirely correct
In SMTP, the entire package is sent. However, ESMTP allows for size extension control. Many SMTP servers are ESMTP compliant (Domino, Exchange, SendMail, etc.). If both SMTP servers are compliant, you can use the ESMTP extensions. One of them is the size extension, which transmits the size of the message prior to sending. If it is over quota, then your server rejects the message after only a few bytes are sent. Now, this will also affect legitimate large email traffic, but you can set it up for either inbound, outbound, or both. As a stop gap, you could try enabling it for inbound only. Also remember this won’t work if the sending server is not ESMTP compliant. These controls are found in the server configuration document under the Router/SMTP – Advanced – Commands & Extensions tab.