[prev in list] [next in list] [prev in thread] [next in thread] 

List:       security-basics
Subject:    RE: SirCam Protection
From:       "james Tomlinson" <jamest1234 () yahoo ! com>
Date:       2001-09-27 18:01:56
[Download RAW message or body]

The best defense against all of these types of email/vbs virus' is to make
sure that all your users have installed the office service packs 1a and 2.
This will turn off Outlooks ability to run .exe, .vbs, .js and other types
of executable files.  These service packs also contain a number of other
security patches.

The only other thing to do is make sure that they all have an anti-virus
program that is checking for updates DAILY.

On last idea would be to install some filters further upstream from your
exchange server.  Do you use any proxy, relays or firewalls in front of the
Exchange server?  If so, you might be able to filter out the messages at
that point instead of letting your Exchange server deal with it.

Hope this helps.

James

-----Original Message-----
From: Andrew Blevins [mailto:ABlevins@arrowheadgrp.com]
Sent: Tuesday, September 25, 2001 2:39 PM
To: SECURITY-BASICS@securityfocus.com
Subject: SirCam Protection


Thanks in advance for any help. We are running Exchange 5.5, and we are
blocking vbs, exe, eml, and the like at the server. However. When one of our
outside agents gets hit with Sircam, we get an instantaneous flood (the
whole address book) of these emails, and the server isn't fast enough to
delete all of the attachments as they go through, so sometimes a Sircam
infected email will sit in a user's inbox for a few minutes before its
attachment is deleted. Sorry if this is a basic question, but are there any
other changes that can be made at the server level that anyone knows of?
Any help would be well appreciated.

Andrew Blevins


_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com

[prev in list] [next in list] [prev in thread] [next in thread]