Re: Virus from user returning from leave
From: Andrew H (ajhpms_at_hotmail.com)
Date: 04/21/04
- Next message: Ralf Dierenbach: "outlook web access from outside?"
- Previous message: Miguel: "how-to setup my www as a sharepoint based site?"
- In reply to: Trevor OE News: "Re: Virus from user returning from leave"
- Next in thread: Les Connor [SBS MVP]: "Re: Virus from user returning from leave"
- Messages sorted by: [ date ] [ thread ]
Date: Wed, 21 Apr 2004 21:33:56 +0200
We're using CA eTrust Antivirus 7, and in general are more than satisfied
with it. It installs to remote machines from a central admin server (in
this case the SBS itself), but not in the login script. Signature updates,
on the other hand, happen on login and at periodic intervals. Our problem
is that we switched to eTrust AV from InoculateIT at approximately the same
time that MyDoom hit, so this user didn't have the right product loaded to
receive signature updates.
"Trevor OE News" <thetrev68 @ hotmail.com> wrote in message
news:OjdfUp8JEHA.620@tk2msftngp13.phx.gbl...
> Andrew,
>
> What kind of antivirus solution are you using now?
>
> I have trend's autopcc in the logon script for users, so anytime they
logon,
> the antivirus is installed or updated as appropriate. This would have
> prevented what you are seeing. I'm sure other antivirus vendors have a
> similar tool...
>
> -Trevor
>
> "Andrew H" <ajhpms@hotmail.com> wrote in message
> news:eJPkj23JEHA.624@TK2MSFTNGP11.phx.gbl...
> > A user at one of my sites came back from an extended leave, and his
> machine
> > started pumping out about 700Mb of email a day - fortunately this showed
> up
> > on the SBS usage report. We tracked it down to MyDoom.A on his machine.
> >
> > The issue is: while he was away on leave, the AV program in use at the
> site
> > was retired and replaced with a newer program for all the users on the
> > system, automatically, except for him. On his return, he either brought
> > MyDoom back with him or caught it quickly once he connected to the lan.
> >
> > Does anybody have any suggestions for preventing this sort of scenario
in
> > the future?
> >
> > I once heard somebody at Microsoft talking about a Quarantine facility
of
> > some sort which would have prevented that user fully attaching to the
LAN
> > until his AV was up-to-date, but I don't know if that was a forthcoming
> > attraction or something applicable to this situation.
> >
> >
>
>
- Next message: Ralf Dierenbach: "outlook web access from outside?"
- Previous message: Miguel: "how-to setup my www as a sharepoint based site?"
- In reply to: Trevor OE News: "Re: Virus from user returning from leave"
- Next in thread: Les Connor [SBS MVP]: "Re: Virus from user returning from leave"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
