W32.Swen Slamming my Exchange 1

[Dreddnews]

Within the last week my Exchange2k server has been slammed with Swen viruses. I have Symantec Antivirus with Exchange protection on there, but my inbox is still getting full of virus warnings that have been blocked. I keep getting emails about a new update from Microsoft or an Admin sending me an email titled Advice. Also is a pack of failure notices from sites I never sent to.

I checked all PC's on my network and none have the virus on them. Also ran the removal tool from Symantec and it said clean. What can I do to stop this from flooding my exchange and my inbox?

Any help would be greatly appreciated!

-D

 

[philmang]

I wish somebody could help with this too! I get several hundered e-mail messages every day on my Exchange2K server because of SWEN. I've tried filtering domains on the SMTP Virtual Server but that is futile as the domains are endless...confidence.com, newsletters_msdn.com, newsletters.ms.net, and on and on adnauseum! I too get never ending failure notices. ANy help is WAY appreciated.

 

[wallst32]

I'm running Symantec Anti-Virus Filtering 3.0; not sure if that's what you mean by Symc AV with Exchange protection. You can block messages by subject (I think those messages use something like "patch" as the subject all the time). Then you can set it up so that any message rejected for this criteria does not send a notification e-mail to admin.

I set this up for that big virus that came out a month or two ago; can't remember the name ("your appliation", "did you see that movie"... that virus).

 

[Dreddnews]

Someone suggested to me an event sink and it has reduced the problem ten fold.

Here is the link:

http://www.vamsoft.com/orf/tools.asp#swen

This is an SMTP transport event sink script developed specifically to filter Win32.Swen.A@mm worm emails. Emails that seems to be infected by the worm are dropped.