The latest mass mailer virus is somehow getting around our mail rules. The past few days our Symantec AV is scanning and cleaning hundreds of incoming emails that contain .exe attachments even though we have a Domino Server Mail rule setup so that it does Not Accept emails with attachments that contain .exe as well as some other file extensions. Up until last week we were seeing fewer than 10 virus infected emails a day being cleaned by Symantec AV.
The rule works when I test it by sending an EXE attachment from an outside email account. Yet, when I check my Symantec Mail Security for Domino, the Symantec Log shows that the Anti-Virus is cleaning incoming emails that contain .exe attachments. Then the emails still containing the .exe attachment are being delivered to user mailboxes.
Here’s from the Symantec log:
“The attachment Greeting Card.exe contained the risk Trojan.Peacomm and was deleted.”
So the server is blocking some emails with .exe attachments but not others. Any idea why this would happen?
Also, in Mail.box I am finding some dead emails with .exe attachments. The failure reason says “Document has been rejected by a mail rule.” But the email can’t be returned to the sender because the sender address and\or domain does not exist.
How are these emails getting into mail.box in the first place if a rule is supposed to Not Accept them? From what I read, the rules act on the emails before being accepted into mail.box. I’d appreciated any suggestions.
Subject: Stange Server Mail Rule Behavior and the Trojan.Peacomm Virus
Hello Greg,
on our DominoServer 6.5.5FP2 on W2K3 with SMSDOM 5.1.3.29 we figured out a similar event. Intermediatelly our SMSDOM stopp to execute the attachment-rule created in SMSDOM. For this, we add in our “Weekly ToDo” a simple “open, edit and close” of the rule-document to work properly. Do you intend to open a call at Symantec? Please inform me. Rgrds Heinz
Subject: RE: Stange Server Mail Rule Behavior and the Trojan.Peacomm Virus
Hello and thanks for the response.
In our case, we’re using the Domino Server rules to block attachments not the Symantec Rules. We only use Symantec for Anti-Virus. So the problem for us is the way Domino server rules work, not Symantec. At least that’s the way I understand it.
Subject: RE: Stange Server Mail Rule Behavior and the Trojan.Peacomm Virus
Hello,cause i never find out, whether domino checks with attachment-rules really by file type or just for the ending of the filename (.exe) i preferred SMSDOM-Rule instead of Domino-Rules. As we see, unfortunately, both are not reliably.
Subject: RE: Stange Server Mail Rule Behavior and the Trojan.Peacomm Virus
Hello Everyone, This issue is caused by the size of the attachment and Domino automatically parsing the small attachment as an inline. Domino needs to be forced to extract this to an actual attachment.
The setting called MIMEForceAttachments=1 needs to be set in the Domino server’s Notes.INI file.