Re: Exchange, Symantec Antivirus, and mydoom issues
From: Evan Mann (ask_at_for.it)
Date: 02/07/04
- Next message: Salim: "Re: 250907 - XFOR: 'Extension SMTP could not be loaded' error"
- Previous message: Thierry DEMAN [MVP]: "Re: HTTP open relay on E 5.5? how to test? how to fix? help"
- In reply to: Zigby: "Exchange, Symantec Antivirus, and mydoom issues"
- Messages sorted by: [ date ] [ thread ]
Date: Sat, 07 Feb 2004 13:48:18 GMT
The newer versions of SAV Client (at least 8.0 and 8.1) will automatically
detect major MS applications and ignore the files/folders that should not be
scanned, but only on the C drive. It does this for SQL Server and Exchange
2003. It won't pick up any other drives where you may be storing logs or
partitions however, which is a stupid oversight IMO.
"Zigby" <zippy@nuze.net> wrote in message
news:qv49205cu0euvdpdcefjc9jj42vpf5cnu1@4ax.com...
> This has been one of the toughest weeks at work. We lost 4 servers in
> the last 2 days - all having to be re-built in one way or another
> (restored, reinstalled, mtachecked etc.)
>
> This was all due to the person who configures SAV (file antivirus
> scanner) not properly setting up the exchange folders as being exempt
> from virus scanning.
>
> What was happening is that SAV would find a file... say a file in the
> mta directory, or say a file such as EDB00.log... and simply delete
> it. Exchange doesn't like that - we all know this, we know you don't
> let file scanners quarantine or delete system files or mail database
> logs etc.
>
> Well, by the time the setting were put into place properly, SAV had
> detected 4 such files on 4 separate servers. I spend the entire last
> 2 days restoring email servers and trying to explain why we can't keep
> our servers running.
>
> So..... just in case anyone out there hasn't done it - get Microsoft's
> Q article on proper installation and operation of antivirus on an
> Exchange server... don't let your antivirus (file scanner) client
> break your email servers.
>
> Oh, and keep it away from your email scanner as well... we had one
> installation of Trend trashed due to trend and Symantec fighting over
> quarantined virus files...
>
> End of story...
>
>
> ----== Posted via Newsfeed.Com - Unlimited-Uncensored-Secure Usenet
News==----
> http://www.newsfeed.com The #1 Newsgroup Service in the World! >100,000
Newsgroups
> ---= 19 East/West-Coast Specialized Servers - Total Privacy via Encryption
=---
>
- Next message: Salim: "Re: 250907 - XFOR: 'Extension SMTP could not be loaded' error"
- Previous message: Thierry DEMAN [MVP]: "Re: HTTP open relay on E 5.5? how to test? how to fix? help"
- In reply to: Zigby: "Exchange, Symantec Antivirus, and mydoom issues"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
