As many others may also be experiencing, our environment is under a virus attack from various sources out on the Internet. The latest one is an e-mail which contains a virus that has a built-in SMTP engine. The result is that the virus is spread very quickly.
We have tools now in place to prevent the various viruses from coming in house altogether, and we also have various virus scanning engines protecting our servers and desktops.
The issue now is those users, who despite repeated educational e-mails, continue to open such attachments, propagating the problem.
Does anyone have any suggestions (some way of preventing the use of these attachments) once they are in our environment?
We have written several agents that are currently going through all mail databases and deleting existing e-mail, but it will take time as there are 2 dozen+ servers and thousands of e-mail databases to process.
Any other ideas would be appreciated. Thank you.
Subject: Virus Issue
We currently use Symantec Antivirus for Domino, and also have antivirus on each PC, and each server. We are in the process of adding the Symantec Gateway product to add another layer of protection. Inside Domino, I use the new Server rules that became available in Version 6. I refuse any messages that have certain attachments, so the user never gets it.
We also do not allow our users access to any personal email accounts that they might have, so that they can not introduce virus from an outside email source.
I know this does not help your current situation, good luck.
Deb
Subject: RE: Virus Issue
It is also fairly easy to write a quick server agent that “quarentines” any attachment that ends with certain extensions. …files ending with .PIF, .EXE, etc. could be automatiaclly detached to a restricted directory and the attachment replaced by a tag to warn the user. They an admin can process them… or delete them. Or you could also be more drastic and simply delete them straight before they get to the user’s mailbox.
Nicolas Abesdris
Quintessence e-solutions Inc.
Subject: Virus Issue
We’re blocking all ‘dangerous’ extensions (.com .pif .scr .cpl , …) exept .exe-files.the exe files are captured by a rule, a warning is added to the subject line and in the body, and then forwarded to the users.
We’re allowing exe-files, because sometimes it are legimate self-extracting ZIP-files.
But I never had someone that could explain to me why he should be able to send a pif, com or scr-file!
On top of that we’re running eTrust antivirus on the server and the desktops