SCIEH2
asked on
Global inbox rule in exchange
We have recently been hit by the loveletter virus. To stop this reoccuring I want to set up this global inbox rule in exchange to stop us recieving .vbs extension files. Is there anyway to do this globally as I cant go into everyones account and do this manually (too big a task and the network is currently down)
Thanks in advance
Thanks in advance
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
The reason I posted the comment I did is because I *know* what you're asking is extremely difficult--you'd need to write an Exchange plug-in to do the job. Virtually everything in Exchange is held on a per-mailbox basis, which makes global chopping and changing like this tricky without major coding.
You need a third party app to filter out files with specific extensions - ie messagesweeper, mimesweeper, groupshield exchange etc..
To delete *.VBS files en masse, you'd need access to take ownership of each user's mailbox and delete them manually !
There is a love letter virus fix out now - can you not apply this to your Antivirus systems and be done with it ?
To delete *.VBS files en masse, you'd need access to take ownership of each user's mailbox and delete them manually !
There is a love letter virus fix out now - can you not apply this to your Antivirus systems and be done with it ?
I deleted vscript.exe and cscript.exe from all clients as my checker was fooled by the name.vbs.txt style extenson name, string filtering is no use as anyone can edit the containing email and signature filtering won't keep up with the simplicity of editing the script. WSH goes pants up unless it can be stopped from autoexecutes without prompting.
Mimesweeper with 6 plugin checkers (some listed above) did not kill this one but quick unplugging of the firewall stopped us from replicating it across the web.
Mimesweeper with 6 plugin checkers (some listed above) did not kill this one but quick unplugging of the firewall stopped us from replicating it across the web.
ah---I know this doesn't answer the question but you need Norton Antivirus for exchange asap.....stopping VBS extensions is hardly the cure-all. We stopped the virus through automated norton updates...
ASKER
ok, first of all sorry to piknibbs for the curt response as I was extremely agitated by that time as you could imagine. I did indeed install the virus check update when we recieved it. I have recently put on an excellent package called email essentials from GFI.com. This stops all sorts of files globally, you can decide what extensions, types of keywords to exclude spamming etc. I now Know exchange has no built in feature and the points go to piknibbs for pointing that out. (and a bit of humble pie)
Thanks everyone, We have now recovered from this mess.
Thanks everyone, We have now recovered from this mess.
ASKER