MYDoom hits hard

[The PIT]

Shakes head here we go again.

Due to poor antivirus software on the mailhubs and users still not learning the lesson the latest MYdoom spread like mad on our network at work.

The mail service had to be suspended due to overload and so the antivirus software could be reconfigured. It was doing "oh I can't check this" and letting it pass.

Over 300 machines infected in the morning we're now keeping pace with it. But doh why do people keep opening attachments from people they haven't emailed.

Yet another non destructive virus creates havoc.

[ZokesPro]

And it'll keep infecting systems for ever and ever and ever....

[rylan]

Amazing how many complete morons use computers and blindly open everything they get sent.

[Tjalfe]

can you block executable attachments on a server level?.. should cut back on the problem a bit..

[The PIT]

Originally posted by tjalfe
can you block executable attachments on a server level?.. should cut back on the problem a bit..

The great Sophos antivirus software is supposed to that. However since it couldn't scan the file by default it sent the file through and recorded an error.

[Byock]

Say what you will about Symantec, I love their mail security, it gives you options on how to handle unscannable, encrypted, and every other file type.

I have it set to block everything, and log it. I can then release it, if the person truly needs the file, which is very rare.

[The PIT]

Well in todays age if the virus scanner can't scan the file it shouldn't let it through by default.
Anyway it's now time to clean the machines up. Luckly it's not hard to clean. Sadly though the dumber users go re-open the attchment in their mail folder and re-infect themselfs. This is mainly becuase they've also still forgotten too update their own anti virus software as well.