Distribution groups pounded by SPAM 1

[ecojohnson]

Hi everyone.

I am a fairly new user to Exchange 2003 and I apologize upfront for any "beginner ignorances" I may have.

I have been using Exchange 2003 for about a year now. We have a small little spam blocker and it seems to work.

http://www.vamisoft.com.

Yesterday, around 10:00 AM PST, I started getting 3-4 SPAM e-mails a minute. Every single one of them contain attachments. The e-mail will say something like:

Account and Password Information are attached!

or

My old address doesn't work. Please read and check...

Almost every attachment is a .zip file. I noticed that the users getting the e-mails are ones that are members of our "information" and "sales" distribution lists.

Any idea how to stop it?

 

[DanMIS]

It is a virus, look at

http://www.sarc.com

for W32.soberx@mm virus.

Dan

 

[DColcl]

Eco, I've been getting the same thing for months now. I have educated my users NOT to open .zip files. I will be checking this post to see if anyone can tell us IF there is a way to block these messages from passing out Exchange 2k3 Server.
BTW, I'm using Norton's Antispam software that I JUST installed. Lots of stuff getting blocked, however, these particular emails with the .zip attachments seem to be leaking through. I was about (no kidding here) to call Symantec tech support when I saw your post. I will wait for the gurus here to answer before I go spendin' plat for Tech suppport.

Dan

 

[ecojohnson]

Wow, that's a bit of a relief (well, not really, but I guess it's nice to know since "misery loves company").

I agree with you, if I don't hear anything from the forums, a support call to Symantec may be in order. I'm going to install the new version of our spam blocker. I'm not sure if this will have any effect, but it's worth a try.

 

[DColcl]

kewl. I'll be watching your replies. GL, Eco.


Dan

 

[ecojohnson]

Ok - well thank you for your reply. I appreciated it very much.

 

[Zelandakh]

If your AV and anti spam are up to date and you are running bayesian analysis, those .zip emails should never seep through.

 

[DColcl]

Bayesian Analysis.......how do you spell that?....

 

[markdmac]

A good quality AV should certainly help with the onslaught of crap that gets delivered. In addition to an AV package you should also use some form of anti-SPAM software. I like the free Intelligent Message Filter that Microsoft provides. If you have installed SP2 on your Exchange box, then you already have this and just need to enable it. If you are still on SP1 and can't go to SP2 for some reason you can still download IMF from

http://www.microsoft.com/exchange.

IMF does not offer anything in the way of management of trapped messages. Feel free to test out and use my solution:

http://www.thespidersparlor.com/downloads/imfspam.zip

I hope you find this post helpful.

Regards,

Mark

 

[DanMIS]

We use Symantec Mail Security for Exchange, and block all incoming .zip files with that. Our Exchange anti-virus catches those particular zip files as a virus.

I also run IMF as Mark mentioned, I recommend it highly. The price is right, and it catches a fair amount of SPAM. We're pretty small, and I estimate we save about 120 man-hours a year just by filtering that spam.

Good luck,
Dan