Who know how to block Sircam Virus in PIX?

[Guest_imported]

Hi..
I use the PIX firewall.
Nowadays many sircam virus came in my mail server.
Can I block the this Virus to use PIX?
I heard that PIX could use by IDS.
Can you help me?

 

[Bluecrack]

Good thought, but unfortunately the answer is no according to this article.

http://www.cisco.com/warp/public/110/pixfaq.shtml#Q12

Depending on the mail server you are running you may be able to purchase an anti-virus package that removes the virus (something like Norton Antivirus for Microsoft Exchange) or you could possibly filter it on the client level.

Jason

 

[Pcarcary]

Hi

There are a couple of options here,

A good AV software (McAfee is one I like) will allow you to define file extensions that are stopped. since a double extension seems to be a signature of this it works..Also McAfee includes a FOC Groupshield scanner for exchange that stops these things before they get to the desktop

Or use a product like mimesweeper, from Baltimore it sits on a host between your mailhost and the internet and scans all in/out email. it can run AV for you but more use it will scan for text analysis, keywords, extensions, and properly configured almost does away with an AV requirement

Hope this helps