Alex Scoble's IT Notes - An Information Technology Blog

Postini Adding Authentium Antivirus Protection

If you remember my problems of a week ago with a "zero hour virus" (virus that is so new that it hasn't been added to Dat files) version of Mydoom, you will recall my lament that neither McAfee's engine that Postini uses nor our own Symantec caught the new Mydoom.AZ variant.

Well Postini just announced today that they are adding a new layer of virus protection in addition to their existing McAfee protection:

"Virus Blocking: Authentium Antivirus Added as Second Virus Engine

Enterprise Edition now provides better virus protection with the addition of the Authentium Antivirus engine. For an added level of inspection, Authentium scans all inbound emails which are determined to be clean by the current McAfee Antivirus engine. The strengths of Authentium Antivirus are its heuristic virus scanning engine, and ability to detect viruses in files that are compressed and encrypted. Authentium provides both weekly antivirus definition file updates and urgent updates. Perimeter Manager polls Authentium for antivirus definition file updates every minute to ensure timely protection.

The addition of Authentium Antivirus gives Enterprise Edition two sources for antivirus definition file updates and two heuristic techniques for catching viruses. This augments Postini's ability to protect you from known viruses as well as zero-hour threats (new viruses that have not yet been included in antivirus definition files).

Authentium Antivirus protection will be rolled out to groups of customers over the month of March. We will send a notification when the deployment to all customers is completed. At this time, we cannot notify you individually when you have been upgraded to Release 5.4. However, you do not need to make any changes or configuration settings to enable Authentium Antivirus. We thank you for your patience throughout this process."

That should take care of the issue of new viruses getting through at least from the email vector standpoint.

If spam and virus laden emails are a problem for your organization, why aren't you using Postini or some other web based solution? I don't quite understand why anyone would use Barracuda (a hardware spam filter that sits inside your network, allowing spam traffic to use up your bandwidth) as their first line of spam defense.

How To Prevent An Exchange User From Sending and Receiving SMTP Emails

Here's a question that came up today.

How do you prevent an Exchange 2003 user from sending and receiving SMTP traffic through the internet, while still allowing them to receive emails from within the Exchange organization?

In the Exchange System Management tool, you have to add the account in question deny lists in two separate places.

The first place is Message Delivery in Global Settings of your organization. Here you go to Properties and select Recipient Filtering tab, add all SMTP addresses for accounts that you want to deny receipt of internet email.

Second place is in any Internet Mail SMTP Connectors you have for your organization. Go into the Properties for each connector and select the Delivery Restriction tab. Add the accounts in question to the Reject Messages From list.

Might take 15 minutes or so before the changes become active.

Wrong About Phone Features of Blackberry?

Thanks to Gary Slinger (wonder if he has a blog) I now know how to set up the Blackberry to display missed and placed calls.

You just click the trackwheel and select Options while in the Phone app on the Blackberry.

-------------

A user just called me up asking if there was a method of locking the keys on the Blackberry.

There's a method of locking the Blackberry, but the keys are still active and she was wondering if having it in her purse while the keys were pressed randomly would shorten the battery life. It's a good suggestion.

** Note: This is completely wrong ** Another thing that I came across is that there is no call log for the phone portion of the unit. Nothing tells you when you've missed a call or if you have a voicemail waiting. Not sure if the 7100T is different, but that phone has horrible reception which makes it a waste of time (in my opinion) to begin with. **Completely wrong info...please ignore**

Big Time Blackberry Outage

Well it looks like there's a nationwide outage of Blackberry service at the moment. Some people can send, but most people cannot receive messages.

*Note* Guess I should have looked closer at the source that I just posted and saw that the date of that linked article was 1 Dec 2004.

Might have something to do with their rollout of the version 4 software? Too many people downloading it at once, perhaps? At any rate...not good considering we just rolled ours out.

4.0 Handheld Software Available for T-Mobile 7730

Thanks to Gary Slinger I now know that T-Mobile has released version 4 of the handheld software for Blackberry 7730s and 7230s. This means that you can now get the most advanced features out of your Blackberry if you already have BES 4.0.

Click here to go to the T-Mobile Blackberry software site

New Mydoom Strain Update

Well, it looks like Symantec added protection for the strain that I reported here on Friday. The Dat file that protection was added appears to be the 18 Feb 2005 Dat file. Actual name of the strain found was W32.Mydoom.AZ@mm (Symantec's naming) or W32/Mydoom.bd@mm!zip (McAfee's naming). Protection must have been added after I went home. I notice that Postini (which uses McAfee's AV) started catching emails with the virus around 5:21 PM PST.

So this is just another reminder how even the best antivirus protection is not absolute. This virus made it through 2 zones of protection by 2 different AV vendors on Friday. And to boot, because the message looked like an email failure, it got me to open and activate the payload. Not the smartest thing I've ever done, but luckily the damage that this particular virus does is minimal.

Next time I don't expect to be so lucky and will have to be a bit more vigilant.

Virus Issues Update

Looks like at least one of the scanners out there can detect the virus. Tried to send it to myself from my sonic.net account to my work account and it was blocked by either the sonic.net server or the Postini server.

Which means that the original message that was sent to me originated inside the firm. I know which system it came from most likely as I found it on one system previously today, but not before it sent out a bunch of emails.

The question still remains though, how did the original message that caused the infection make it into our email system?

Perhaps we should move to running TrendMicro or F-Secure on either our mail systems or our desktops for another level of virus security. As this is another example of how you can't depend on one vendor to give you complete security.

Virus Issues Update

Trend Micro's online virus scanner also failed to detect the infected file as such.

One annoying thing about Symantec's site is that there is no way for the public to send them virus samples that is readily available.

If you click the link, you either have to be a retail customer or corp customer with contract. Now while we have a contract I don't have the time at the moment to call them up to find out what the website is.

Why not just have a public way of uploading payloads?

Thoughts on Firefox

I've been trying out Firefox for about a month or so now.

I've got to say that it's a pretty good browser. Certainly seems to have less problems with spyware, popups and the like than IE.

But lately, I've been reminded about why I switched to using IE after 5 came out in the first place. When I use IE, that's all I need to use. When I use Firefox, there's plenty of websites out there that I still need IE to use properly. Some examples are Windows Updates, the web interface of our Netscreen firewall, the Trend Micro online virus scanner, and Yahoo Games.

So while Firefox is in many ways the better browser, it certainly isn't the more standard browser. Everyone makes sure that their sites work for IE (if you don't you shouldn't be building web sites, unless you want most of the people of the world to NOT visit your site) but not so for Firefox.

Having said that, I will continue to use Firefox where I can, but anyone who makes it out to be the end all-be all web browser is smoking some good stuff and needs to look at the facts instead of just wallowing in their emotional response to Microsoft.

Update on Mydoom.AX

Well, I believe that I have contained the virus from spreading outside the company at least by blocking all PCs except the mail servers from communicating to outside servers using Port 25.

Would still like to know why our AV software isn't catching the virus even though the latest Dat file supposedly has protection for the virus.

The virus is launched through a file (jave.exe in my case) in the %windows% directory (C:\windows in my case). I ran multiple scans against this file using the Mydoom tool that Symantec provides as well as the regular Symantec Antivirus scanner and neither found it.

Will try to use one of the web based scanner to see if they catch it.