Anti-virus/Anti-spam Forum

Problematic e-mail service

Sat, 28 Nov 2009 07:27:18 Z

No one can recieve e-mail sent from my computer even though the intended recepients have cleared their cache spam folders. No error messages occur, but no one seems to recieve the e-mails.

Virus Virus Virus Virus Viurs Iam feed up with this Virus... Pls Help???

Fri, 15 Feb 2008 17:48:00 Z

Copies itself to the %System% folder. Some variants may have one of the following file names:

Bling.exe
Netwmon.exe
Wuamgrd.exe

What type of virus is this? how can i remove..? i tried AVG Free edition.... All in vain.. can any body help me how can i manually remove it.. ?

I think this virus is risky.. So Iam not using my Laptop any more.. HELPPPPPPPPPPPPPPPPPP....

Shinevur.. Shinevur Shinevur

Shinevur Need your help...

Event 7000

Sun, 29 Nov 2009 07:17:58 Z

I have received several of the following errors in the Event Viewer/Administrative Events:

"The Windows CardSpace service failed to start due to the following error:

The service did not respond to the start or control request in a timely fashion.

Log Name: System
Source: Service Control Manager Eventlog Provider
Event ID: 7000
Level: Error
User: N/A
OpCode: Info
Task Category: None
Key Words: Classic"

I have checked the Web and am not sure if my computer has been compromised. Would appreciate any help. Thanks!

I checked the Web and am not sure which applies. Can you tell me what this could mean?

Error message on start up!

Sat, 28 Nov 2009 08:05:30 Z

Whenever i boot up my pc, i can the following error message "Scheduled agent cannot create shell notification"
How do i solve this "potential" problem.

help-remove ANTIVIRUS SYSTEM PRO2009?

Sat, 28 Nov 2009 18:25:36 Z

seem like im not the only one infect with this malware or whatever you want to call it. Ive tried all of this steps found in the forums, but nothing seems to help since antivurs systen pro2009 doesnt allow me to open any programs. Can anybody help me please, when trying to open malware bytes i get a Security Warning as follow " Application cannot be executed. The file mbam.exe is infected. Do want to activate your antivirus software now?" ofcourse i click on NO. Can someone help me? again it does NOT ALLOW ME TO OPEN ANY PROGRAMS.

What does X-SpamScore: mean?

Fri, 27 Nov 2009 15:06:07 Z

Hello,

Some of my users are receiving NDRs when sending to a particular domain.
These NDRs say:
The following organization rejected your message: xyz.com
They also have a line with the following: X-SpamScore: 1 and sometimes there's an eleven instead of the one.

Does this mean that the receiving email server is considering the message as spam?

Thanks for your help.

Transport Service starts then stops with error

Wed, 25 Nov 2009 11:28:19 Z

Hi,

I'm running SBS 2008 with exchange 2007 SP1.

I used a trial version of AVG 8 and recently it ran out.

I purchased a full version which is version 9.

I had problems installing new version so used a cleanup tool sent by AVG support.

The new version installed ok.

WHen I rebooted the server the transport service now starts and then stops with the following errors

Log Name: Application

Source: MSExchangeTransport

Date: 25/11/2009 11:07:35

Event ID: 16023

Task Category: Configuration

Level: Error

Keywords: Classic

User: N/A

Computer: SBSERVER.amhhyde.lan

Description:

Microsoft Exchange couldn't start transport agents. The Microsoft Exchange Transport service will be stopped. Exception details: Failed to create type 'Avg8Antispam4Exchange2007.AvgAspamSmtpReceiveAgentFactory' from assembly 'C:\Program Files (x86)\AVG\AVG8\Exchange2007\Avg8asta.dll' due to error 'Invalid agent assembly path.'. : Microsoft.Exchange.Data.ExchangeConfigurationException: Failed to create type 'Avg8Antispam4Exchange2007.AvgAspamSmtpReceiveAgentFactory' from assembly 'C:\Program Files (x86)\AVG\AVG8\Exchange2007\Avg8asta.dll' due to error 'Invalid agent assembly path.'. ---> System.ArgumentException: Invalid agent assembly path.

--- End of inner exception stack trace ---

at Microsoft.Exchange.Data.Transport.Internal.MExRuntime.FactoryTable.CreateAgentFactory(AgentInfo agentInfo)

at Microsoft.Exchange.Data.Transport.Internal.MExRuntime.FactoryTable..ctor(IEnumerable agents)

at Microsoft.Exchange.Data.Transport.Internal.MExRuntime.RuntimeSettings..ctor(MExConfiguration config, String agentGroup)

at Microsoft.Exchange.Data.Transport.Internal.MExRuntime.MExRuntime.Initialize(String configFile, String agentGroup)

at Microsoft.Exchange.Protocols.Smtp.MExEvents.Initialize(String configFilePath)

at Microsoft.Exchange.Transport.Components.SmtpMExRuntimeLoader.Load()

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="MSExchangeTransport" />

<EventID Qualifiers="49156">16023</EventID>

<Level>2</Level>

<Task>16</Task>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2009-11-25T11:07:35.000Z" />

<EventRecordID>315336</EventRecordID>

<Channel>Application</Channel>

<Computer>SBSERVER.amhhyde.lan</Computer>

<Security />

</System>

<EventData>

<Data>Failed to create type 'Avg8Antispam4Exchange2007.AvgAspamSmtpReceiveAgentFactory' from assembly 'C:\Program Files (x86)\AVG\AVG8\Exchange2007\Avg8asta.dll' due to error 'Invalid agent assembly path.'.</Data>

<Data>Microsoft.Exchange.Data.ExchangeConfigurationException: Failed to create type 'Avg8Antispam4Exchange2007.AvgAspamSmtpReceiveAgentFactory' from assembly 'C:\Program Files (x86)\AVG\AVG8\Exchange2007\Avg8asta.dll' due to error 'Invalid agent assembly path.'. ---> System.ArgumentException: Invalid agent assembly path.

--- End of inner exception stack trace ---

at Microsoft.Exchange.Data.Transport.Internal.MExRuntime.FactoryTable.CreateAgentFactory(AgentInfo agentInfo)

at Microsoft.Exchange.Data.Transport.Internal.MExRuntime.FactoryTable..ctor(IEnumerable agents)

at Microsoft.Exchange.Data.Transport.Internal.MExRuntime.RuntimeSettings..ctor(MExConfiguration config, String agentGroup)

at Microsoft.Exchange.Data.Transport.Internal.MExRuntime.MExRuntime.Initialize(String configFile, String agentGroup)

at Microsoft.Exchange.Protocols.Smtp.MExEvents.Initialize(String configFilePath)

at Microsoft.Exchange.Transport.Components.SmtpMExRuntimeLoader.Load()</Data>

</EventData>

</Event>

Log Name: Application

Source: MSExchange Extensibility

Date: 25/11/2009 11:07:35

Event ID: 1052

Task Category: MExRuntime

Level: Error

Keywords: Classic

User: N/A

Computer: SBSERVER.amhhyde.lan

Description:

The creation of an agent factory for the agent 'AVG Antispam Agent' failed with error 'Failed to create type 'Avg8Antispam4Exchange2007.AvgAspamSmtpReceiveAgentFactory' from assembly 'C:\Program Files (x86)\AVG\AVG8\Exchange2007\Avg8asta.dll' due to error 'Invalid agent assembly path.'.'. Verify that the corresponding transport agent assembly and dependencies with the correct version are installed.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

   <Provider Name="MSExchange Extensibility" />

   <EventID Qualifiers="49156">1052</EventID>

   <Level>2</Level>

   <Task>1</Task>

   <Keywords>0x80000000000000</Keywords>

   <TimeCreated SystemTime="2009-11-25T11:07:35.000Z" />

   <EventRecordID>315335</EventRecordID>

   <Channel>Application</Channel>

   <Computer>SBSERVER.amhhyde.lan</Computer>

   <Security />

  </System>

  <EventData>

   <Data>AVG Antispam Agent</Data>

   <Data>Failed to create type 'Avg8Antispam4Exchange2007.AvgAspamSmtpReceiveAgentFactory' from assembly 'C:\Program Files (x86)\AVG\AVG8\Exchange2007\Avg8asta.dll' due to error 'Invalid agent assembly path.'.</Data>

  </EventData>

</Event>

Log Name: Application

Source: MSExchangeTransport

Date: 25/11/2009 11:07:35

Event ID: 7001

Task Category: Components

Level: Information

Keywords: Classic

User: N/A

Computer: SBSERVER.amhhyde.lan

Description:

The service will be stopped. Reason: Failed to create type 'Avg8Antispam4Exchange2007.AvgAspamSmtpReceiveAgentFactory' from assembly 'C:\Program Files (x86)\AVG\AVG8\Exchange2007\Avg8asta.dll' due to error 'Invalid agent assembly path.'.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

   <Provider Name="MSExchangeTransport" />

   <EventID Qualifiers="16388">7001</EventID>

   <Level>4</Level>

   <Task>6</Task>

   <Keywords>0x80000000000000</Keywords>

   <TimeCreated SystemTime="2009-11-25T11:07:35.000Z" />

   <EventRecordID>315337</EventRecordID>

   <Channel>Application</Channel>

   <Computer>SBSERVER.amhhyde.lan</Computer>

   <Security />

  </System>

  <EventData>

   <Data>Failed to create type 'Avg8Antispam4Exchange2007.AvgAspamSmtpReceiveAgentFactory' from assembly 'C:\Program Files (x86)\AVG\AVG8\Exchange2007\Avg8asta.dll' due to error 'Invalid agent assembly path.'.</Data>

  </EventData>

</Event>

Log Name: Application

Source: MSExchange TransportService

Date: 25/11/2009 11:07:35

Event ID: 1022

Task Category: ProcessManager

Level: Information

Keywords: Classic

User: N/A

Computer: SBSERVER.amhhyde.lan

Description:

Worker process with process ID 3384 requested the service to be stopped.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

   <Provider Name="MSExchange TransportService" />

   <EventID Qualifiers="16388">1022</EventID>

   <Level>4</Level>

   <Task>1</Task>

   <Keywords>0x80000000000000</Keywords>

   <TimeCreated SystemTime="2009-11-25T11:07:35.000Z" />

   <EventRecordID>315338</EventRecordID>

   <Channel>Application</Channel>

   <Computer>SBSERVER.amhhyde.lan</Computer>

   <Security />

  </System>

  <EventData>

   <Data>3384</Data>

  </EventData>

</Event>

Ok quite obvious this is due to the old version of AVG not being there.

Any ideas how I can change exchange config as not to look for these files?

Thanks in advance

Malware

Sun, 22 Nov 2009 18:46:05 Z

Hi, what is malware? is it to remove Trojans and viruses. I don't know if this company even exists? Can some one tell me, is there a Company called ANTIVIR? And how do I get them off of my computer? Thanks

AVG v9 w/ Exchange scanning option broke(?) NTBackup of Exchange 2003 SP2

Fri, 20 Nov 2009 00:03:10 Z

Hi,

We've been running NTbackups of our (SBS) WinServer2003 R2 machine, including the MS Exchange 2003 SP2 install, for 2.5 years without any incident relating to MS Exchange.

Two days ago I installed AVG v9 on the server with the Exchange scanning option. AVG was not previously installed on the server.

For the past two evenings the Exchange portion of the NTBackup routine has failed with error "Portions of "\Exchange\MDBDATA\priv1.edb" cannot be read. The backed up data is corrupt or incomplete."

Anybody have any idea?

The server is running AVG 9.0.707

Regards,
JD

19/11/2009 11:30 PM
-------------------------------
Date: 19/11/2009
Time: 11:30 PM
User: SYSTEM
-------------------------------

Backup Runner started.
Launching NTBackup: ntbackup.exe backup "@C:\Program Files\Microsoft Windows Small Business Server\Backup\Small Business Backup Script.bks" /d "SBS Backup created on 19/11/2009 at 11:30 PM" /v:yes /r:no /rs:no /hcff /m normal /j "Small Business Server Backup Job" /l:s /f "F:\Backup Files\Small Business Server Backup (04).bkf" /UM
NTBACKUP LOG FILE: C:\Documents and Settings\SBS Backup User\Local Settings\Application Data\Microsoft\Windows NT\NTBackup\data\backup02.log
=====================<BEGIN NTBACKUP LOG FILE>=====================
Backup Status
Operation: Backup
Active backup destination: File
Media name: "Small Business Server Backup (04).bkf created 19/11/2009 at 11:30 PM"

Volume shadow copy creation: Attempt 1.
Backup (via shadow copy) of "C: SYSTEM"
Backup set #1 on media #1
Backup description: "SBS Backup created on 19/11/2009 at 11:30 PM"
Media name: "Small Business Server Backup (04).bkf created 19/11/2009 at 11:30 PM"

Backup Type: Normal

Backup started on 19/11/2009 at 11:36 PM.
Backup completed on 20/11/2009 at 12:16 AM.
Directories: 7902
Files: 67340
Bytes: 14,678,459,878
Time: 40 minutes and 14 seconds
Backup (via shadow copy) of "D: DATA"
Backup set #2 on media #1
Backup description: "SBS Backup created on 19/11/2009 at 11:30 PM"
Media name: "Small Business Server Backup (04).bkf created 19/11/2009 at 11:30 PM"

Backup Type: Normal

Backup started on 20/11/2009 at 12:16 AM.

WARNING: Portions of "\Exchange\MDBDATA\priv1.edb" cannot be read. The backed up data is corrupt or incomplete.
This file will not restore correctly.
WARNING: Portions of "\Exchange\MDBDATA\priv1.stm" cannot be read. The backed up data is corrupt or incomplete.
This file will not restore correctly.
Backup completed on 20/11/2009 at 1:55 AM.
Directories: 9839
Files: 101618
Corrupt: 2
Bytes: 66,619,295,283
Time: 1 hour, 39 minutes, and 1 second
Backup of "BA-SERV-01\Microsoft Information Store\First Storage Group"
Backup set #3 on media #1
Backup description: "SBS Backup created on 19/11/2009 at 11:30 PM"
Media name: "Small Business Server Backup (04).bkf created 19/11/2009 at 11:30 PM"

Backup Type: Normal

Backup started on 20/11/2009 at 1:55 AM.
Backup completed on 20/11/2009 at 2:07 AM.
Directories: 4
Files: 6
Bytes: 11,516,682,872
Time: 11 minutes and 47 seconds
Backup (via shadow copy) of "System State"
Backup set #4 on media #1
Backup description: "SBS Backup created on 19/11/2009 at 11:30 PM"
Media name: "Small Business Server Backup (04).bkf created 19/11/2009 at 11:30 PM"

Backup Type: Copy

Backup started on 20/11/2009 at 2:07 AM.
Backup completed on 20/11/2009 at 2:09 AM.
Directories: 300
Files: 3004
Bytes: 661,160,311
Time: 1 minute and 59 seconds

----------------------

Verify Status
Operation: Verify After Backup
Active backup destination: File
Active backup destination: F:\Backup Files\Small Business Server Backup (04).bkf

Verify of "C:"
Backup set #1 on media #1
Backup description: "SBS Backup created on 19/11/2009 at 11:30 PM"
Verify started on 20/11/2009 at 2:09 AM.
Verify completed on 20/11/2009 at 2:18 AM.
Directories: 7902
Files: 67340
Different: 0
Bytes: 14,678,459,878
Time: 8 minutes and 25 seconds

Verify of "D:"
Backup set #2 on media #1
Backup description: "SBS Backup created on 19/11/2009 at 11:30 PM"
Verify started on 20/11/2009 at 2:18 AM.
Verify completed on 20/11/2009 at 3:00 AM.
Directories: 9839
Files: 101618
Different: 0
Bytes: 66,619,295,283
Time: 42 minutes and 38 seconds

Verify of "BA-SERV-01\Microsoft Information Store\First Storage Group"
Backup set #3 on media #1
Backup description: "SBS Backup created on 19/11/2009 at 11:30 PM"
Verify started on 20/11/2009 at 3:00 AM.
Verify completed on 20/11/2009 at 3:09 AM.
Directories: 4
Files: 0
Different: 0
Bytes: 11,516,682,872
Time: 8 minutes and 30 seconds

Verify of "System State"
Backup set #4 on media #1
Backup description: "SBS Backup created on 19/11/2009 at 11:30 PM"
Verify started on 20/11/2009 at 3:09 AM.
Verify completed on 20/11/2009 at 3:09 AM.
Directories: 300
Files: 3004
Different: 0
Bytes: 661,160,311
Time: 31 seconds

----------------------

=======================<END NTBACKUP LOG FILE>=====================
NTBackup finished the backup with errors.

For more information about failed backups, see the article on troubleshooting your backup at the following Web page: Troubleshooting Windows Small Business Server 2003

Backup ended at Friday, 20 November 2009 3:09 AM
Backup Runner finished.

Forefront on a CCR clustered mailbox server and event id 9411

Thu, 03 Jan 2008 18:38:05 Z

We are running Forefront for Exchange Server SP1 on all of our Exchange 2007 SP1 servers, including our Hub/CAS and CCR clustered mailbox servers. On the passive CCR node, every 15 minutes or so, we get the following warning events for Template.fdb, ScanJobs.fdb, FileScanners.fdb, Notifications.fdb, and Filterlists.fdb:

---------------

Event Type: Warning
Event Source: FSECCRService
Event Category: CCR Service
Event ID: 9411
Date:  1/3/2008
Time:  10:07:06 AM
User:  N/A
Computer: mbx02
Description:
Microsoft Forefront Server Security CCR Replication service has skipped replication of a file.
    File: Template.fdb
    Reason: Cannot obtain a Forefront Run lock.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
---------------

Any idea what "Forefront Run lock" means, or why these template files are not replicating to the passive node?

Thanks,

Aaron

Windows defender error message

Thu, 31 Jan 2008 18:04:43 Z

Mk, so i have MS windows vista home premium edition and i have Windows live onecare. Ive noticed that only when i have Windows live Oncecare installed it turns off windows defender only on startup, so all i have to do is turn it back on... But now for some reason I am getting this error message 'windows defender error :0x800710dd' and it turns off windows defender. Is this going to be a problem for me if i already have an anti-virus/anti-spyware program? If it MIGHT be a problem, how can i get rid of this problem? Thanks in advance if any1 can help me.

Problem reinstalling McAfee Security protection because of System Mechanic

Mon, 23 Nov 2009 02:50:50 Z

I uninstalled System Mechanic because McAfee claims a conflict. I find a few files listed under IOLO (system mechanic source) and wonder if individually removing all of those will: (1) remove all traces of System Mechanic so I can install McAfee (2) cause problems with any other program not associated with System Mechanic. I also have some problem with "corrupt files" in Microsoft Works files, and will be going to clean those out next. If I uninstall Works (both Spreadsheet and Word, then run malware cleanup, then reinstall from the original disc, I should have a functional Works program?

Thanks for the help.

Pop Ups

Mon, 23 Nov 2009 08:20:11 Z

different websites keep on popping up on different end-user's pc's....?

Windows Media Player

Sun, 22 Nov 2009 18:49:03 Z

It's Fernrockdog, again. Is their problems with the Windows Media Player. This so called company called ANTIVIR says there's problems with it?

antispam - excluding domain name

Sat, 21 Nov 2009 22:14:57 Z

hi
i have configured "ip block list providers" and it works perfect
but i don't know how to EXCLUDE some Domain Name (not by IP address) from checking against this list. ?

no puedo poner un antivirus

Fri, 20 Nov 2009 17:15:20 Z

como bajo un programa antivirus y como se si mi computadora tiene un virus

How to filter emails with Virusses?

Thu, 19 Nov 2009 15:28:40 Z

Starting as of last week, a bunch of our managers are receiving emails from various senders to take action on certain emails.
Make a payment, confirm something, etc.
Basically the typical SPAM mails.
The emails are different everytime but have in common that they all contain an attachment in ZIP format with the "Trojan.Win32.Sasfis.vbw"
Our Kaspersky Antivirus product running on our Exchange server 2007 filters these emails without problems, but do send them on (stripped from the Trojan) on to the mailbox of the users.

On the Exchange server the AntiSpam filters of Exchange itself are active.
I have enabled the following filters.

Content Filtering
IP Allow List
IP Allow List Providers
IP Block List Providers
Recipient Filtering
Sender Filtering

I have NOT enabled (yet) the following filters
Sender ID
Sender Reputation

For the IP Block List providers we are using SPAMHAUS & SPAMCOP to filter.

I realize that putting in place SPAM appliances, etc will help but budget for these solutions are very limited at the moment.
I need to look for a solution with the means I have available right now.
Question:
What can I do to prevent these mails from being send on to the users mailbox?

Kind regards,

Remko de Koning

Exchange 2007 AntiSpam Auto Response

Fri, 06 Nov 2009 13:23:43 Z

Hi folks,

we recently had to implement an AntiSpam filter since we auto replied (Out-Of-Office, Ticketsystem, ...) to Spam mails and therefore got blacklisted. We managed to remove our IP from the Blacklists again, implemented the Exchange 2007 AntiSpam filter and added two Blacklists - SpamHAUS and Spamcop.
But for a reason I don't know yet the Exchange Server replies to the mails coming from Mailservers which are listed on these Blacklists. So we autorespond to every SpamMail which is coming into the system.
Furthermore when a SpamMail will be sent with our employees eMail address as SenderAddress, he will also get the Auto response message as soon the SpamMail will be dropped.

Isn't that a bit senseless?
Is there a way to disable these auto response messages. As I said, we got blacklisted because we already responded to Spammails before we implemented the AntiSpam filter.
I would rather prefer to just drop the Connection request without sending this notification.

Appreciate any help or info !

Many thanks in advance
Siegfried

recover the lost windows password

Thu, 24 Jan 2008 11:52:20 Z

Hi there!

Just few week before someone requested me for reseting/recovering windows xp lost password.

Here are the few step!

Here'an easy way to crack any password on XP...
The only thing you need is a XP Pro CD and a valid Serial#
1.Boot off the CD and do a Repair (not from the recovery console)
2.Setup will copy all the dll's... then your pc will restart and start the next step of the repair(were it give's you all bunch of info about XP)
3.On the left side of your screen you'll see the progress bar
4. As soon as you see "Installing Devices" press Shift+F10
5.This will open a command prompt.
6.from the command prompt, type nusrmgr.cpl
7.This command will open the user profile were you can reset any password (including the administrators)
8.After you reseted the password, simply close the user profile window and the command prompt and let the setup finish the install.
9.That's it, as soon as the install is done your password will be reseted and you'll have access to everything.

cheers!

shinevur@yahoo.com

thanks dude..for your help.. and correcting my Grammer...

Exchange Server 2007 - Content Filter Agent not applying an SCL rating

Mon, 16 Nov 2009 12:36:37 Z

Hi

Installed Forefront 2010 recently and had to remove due to problems with Blackberry software. Installed Forefront 2007 (which doesnt have any inbuilt spam - but uses the 2k7 premium antispam features).

No spam is being filtered and this is because the content filter agent is not adding an SCL rating to the emails (seen from emails before changes to software etc) please help we're being inundated with thousands of SPAM email everyday......!!

Thanks

Alex

Antivirus on Windows Server 2003

Sun, 19 Nov 2006 21:07:18 Z

Hi,

Does anyone have any ideaas where I can get a decent free antivirus program (preferably with realtime protection), compatible with Server 2003, standard (32bit) edition?

Or.. if push come to shove, a complany that does a server compatible antivirus program for which you dont have to buy gazillions of liscences - I only need one, so I don't want to be forking out more than i really have to.

Many Thanks,

Kieran

Lsas.Blaster.Keylooger virus removal

Sun, 15 Nov 2009 05:25:13 Z

Lsas.Blaster.Keyloger is fake Windows Alert which is secretly installed by trojan. It is a part of rogue application. A rogue software application designed to trick users into buying a fake product by using scare tactics. It will bombard you with pop ups in order to try and scam you out of money. This infection can come into after fake video codec installation that usually comes with malware.
heres the manaul removal guide to remove lsas.blaster.keylogger
http://darfuns.com/remove-trojan-lsas-blaster-keylogger/

Message blocked due to "unacceptable attachments"

Tue, 27 Oct 2009 14:13:34 Z

Hi, I'm running Exchange 2007 with Edge Services and Forefront for Exchange. Generally, it works great! But I recently had one problem which I just can't seem to figure out.

One of our systems sends out automated reports as .XLSX files. However, the messages are always blocked at the Edge servers with the error "550 5.7.1 Message rejected due to unacceptable attachments". I have a copy of the file, and it seems fine to me. It passes virus scan, opens with Excel, and generally just... well... works.

Why would a run-of-the-mill .XLSX file be causing this behavior, and more importantly, what can I do to further diagnose and/or fix the problem?

Thanks,
- Jim

Cyber Security virus infection

Sun, 15 Nov 2009 05:23:09 Z

Cyber Security is a rogue anti-spyware program and appears to be a clone of the highly popular System Security and Total Security. This parasite usually spreads by using browser hijackers to redirect the user to websites hosting fake online system scans and thus tricking him into downloading the program. While this method is by fat the most common, rogues such as this have been known to infect the system by using downloader trojans. Cyber Security relies on misleading advertising to sell it’s so-called “licensed version”.

For more information and removal guide to remove Cyber Security virus, see
http://www.darfuns.com/spyware-removal/cyber-security-virus-removal/

Please help with virus!

Sun, 08 Nov 2009 15:16:15 Z

I have a virus. I got a "windows security center" popup and I was prompted to remove a virus. It started installing a bunch of ____. Now IE doesn't work and I'm getting constant security related popups. I removed what I could, but it's obviously still here. System restore does not work and I also keep getting svchUst.exe errors. I was able to run the last known good configuration, but the logon screen is hung on 'Loading your personal settings'. I also still got the svchust.exe error. How do i remove this garbage?

Thanks

Mike

RBL Problems

Thu, 12 Nov 2009 00:34:56 Z

I am having a problem with E-mails being rejected by the IP Block List providers but the sending IP address is not listed in the database of the blocklist providers.

The sender recently changed ISPs and thus has a new IP address and it is after this change that the problem began. The sender is sending to another customer of mine so thankfully I can make changes on either side of the equation.

The recipient's server is configured to use a few different RBLs. The ones that are causing the blocks are Spamhaus XBL, Sorbs and Ahbl. Again, the sending party's new IP address is not listed in any of those DBs and I've been checking for over 24 hours now. The recipient's server is also configured to use the custom error messages on each block list provider so that if someone is blocked, they know which specific block list provider is causing them to be blocked. This is also how I know that it is more than one provider causing the problem. For example, when I disable the Spamhaus one, sorbs will block.

I am 99.9% certain that this problem does not lie with the providers. Again, the IP address is not listed. On top of that, the sender is able to send to some of my other servers that use the exact same blocklist providers. So if the blocklist providers were blocking based on that IP address even though it wasn't showing up in the database check, it would block on other servers. It isn't. So that means it is specific to this one problematic server.

The recipient server is running SBS2008 and thus Exchange 2007 and Version 8.1 (Build 240.6)

Here is the log when testing from telnet (from the sending server of course)

220 remote.recipient.com Microsoft ESMTP MAIL Service ready at Wed, 11 Nov
2009 18:05:49 -0600
helo
250 remote.sending.com Hello [70.184.239.XXX]
mail from: sean@sending.com
250 2.1.0 Sender OK
rcpt to: sean@recipient.com
550 5.7.1 Error 550: Blocked by XBL Spamhaus.
quit
221 2.0.0 Service closing transmission channel

("Blocked by XBL Spamhaus" is my custom error message tied to the Spamhaus XBL provider; if I change the error message on the server, it changes in the rejection)

From the rejected e-mail:

Diagnostic information for administrators:

Generating server: SBS2008.sending.local

sean@recipient.com
remote.recipient.com #550 5.7.1 Error 550: Blocked by XBL Spamhaus ##

Original message headers:

Received: from SBS2008.sender.local ([fe80::6466:d581:9d90:c2c3]) by

 SBS2008.sender.local ([fe80::6466:d581:9d90:c2c3%12]) with mapi; Tue, 10 Nov

 2009 16:33:39 -0600

From: Sean PT <sean@sender.com>

To: Sean PT <sean@recipeint.com>

Date: Tue, 10 Nov 2009 16:33:32 -0600

Subject: RE: Email test

Thread-Topic: Email test

Thread-Index: AQHKYlXB61Ip9u96TkuaIbpetT3DCZEv5v8s

Message-ID: <97E438E3F83E7F459C3FC93557E4B8709970D75EB3@SBS2008.sender.local>

References: <8A97006EA0389F4294691D7B8A3AB2DECA5E9D42A6@SBS2008.recipient.local>

In-Reply-To: <8A97006EA0389F4294691D7B8A3AB2DECA5E9D42A6@SBS2008.recipient.local>

Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

acceptlanguage: en-US

Content-Type: multipart/alternative;

	boundary="_000_97E438E3F83E7F459C3FC93557E4B8709970D75EB3SBS2008obsloc_"

MIME-Version: 1.0

I have tried removing the provider and adding it back in and the same problem exists. There are block list providers other than the ones I listed (such as the SBL for Spamhaus) that are working just fine so it isn't a complete blocklist problem. I've also added the sending domain to the whitelist and that didn't do the trick.

Right now I have turned off those three RBLs and those three RBLs are our best spam blockers so I would really like to get them re-enabled.

Thank you!

Forefront Security for Exchange Server 2010, Blackberry Error

Thu, 12 Nov 2009 19:52:23 Z

Hi

We upgraded Forefront 2007 to Forefront Security for Exchange Servers 2010 this morning, Exchange 2k7 on Win 2k8 64bit ESXi. Result was excellent spam filtering and am very pleased with the new UI however experienced serious set back with Blackberry Professional Software installed on Win2k3 32bit, the Blackberry program doesnt seem to be able to communicate with Exchange 2k7, have fought with this all day!! - to prove its Forefront I have uninstalled it and Blackberry is working again... unfortunately I cant stop the transport during working hours but have tried all manner of services restarts etc.

The windows firewall is disabled on the Exchange server.

Are there some port blocking / firewall type properties to Forefront I cant see - nothing on the net about it as far as I can see!

I really want to get this update on and please our staff with less / non existant spam!?!

Many thanks

Alex

revers dns lookup

Thu, 12 Nov 2009 16:16:13 Z

Dears ,

if I check the perform revers DNS lookup in the forfront in the edge

so will it perform reverse dns to the IP and the Reverse DNS should match SMTP Banner or the IP should be resolved to any name to bypass my server !!

and how can I get a list of blocking domains which the exchange blocks by this revers DNS lookup

Regards,

New Exchange 2007 server - what AV and Anti-Spam/Content Filtering do I get (without an ETS)

Wed, 11 Nov 2009 11:50:31 Z

Can someone please give me a little advice - we are a small organisation installing our first Exchange 2007 server (currently using Pop3 servers) and all anti-virus/spam etc will be on the Hub Transport server - what do I get out of the box and if the answer is nothing, what should I be thinking about getting (we use Sophos Endpoint here but the cost of Exchange agent is huge).
I have read that you can install Forefront Eval - how does this work for pricing if you decided it was a viable solution?

many thanks,

Brian.

Can I filter spam by sender name?

Wed, 04 Nov 2009 17:00:28 Z

Using Exchange 2007 on Windows 2008, Edge Server, Forefront.

Lately we are getting a lot of spam with an SCL=0. The word VIAGRA is in the sender's name, but not in the subject or the body of the text.
I added viagra to the custom words filter, but I'm guessing that only scans the body of the message. Right? Any way to get it to work on the sender's name?
For example, I get spam from:
Try Viagra4Free [bisecty1@flibus.com]

Thanks in advance....

Exchange 2003 server - sending spamming from my IP

Mon, 02 Nov 2009 15:56:52 Z

Hi,

I have Exchange 2003 server installed on a Windows Sb 2003 server. (network includes 25 desktops & 10 home worker VPN laptops)
The exchange server is setup to send emails from the server directly but Incoming emails are downloaded using POPbeamer from a outside POP3 mail server.

last week I had a real problem with Spamming from our server to outside. So outside spam tracking servers blocked our IP including hotmail.
So we couldnt send emails most of domains.
What i did was unpluged all the machines from the network & run the Mcafee & spybot to remove every unwanted thinng including PUPs detected on the machines.
Our IP was blocked from more than 10 spam tracking server last friday. Now its down to 03 servers. So its getting better.

If any one could tell me how to avoide happen this again?
Is there any way to track what really happen last week? i was looking for some Logs but couldt found.

I am not an expert on exchange but I have an idea how things happening on the Exchange.

Thanks
Appreciate any help

Anti spam question

Fri, 06 Nov 2009 09:18:35 Z

Hi,

I have a question regarding spam,

We have installed EBS 2008, as you this system has edge transport server installed on the TMG server, I did not know that so I did install anti spamon the CA server, now I would like to know if this would cuse some problem? and if I should remove it from CA server?

Shahin

Outlook Junk Folder

Wed, 04 Nov 2009 13:39:59 Z

Hi

We have observed that vaild mails from Partner Domains are moved to Junk 
Folder (false positive). Its also observed that out of 45 mails from partner 
domain only 5 mail are moved to junk folder. These 5 mails either have 
attachment or hyperlink.

Problem facing user are not keen in adding the partner domain into Safe 
Sender List, since the partner domain list is to large and keeps changing.

We have Outlook on 2007 without SP and Exchange 2007 with SP1

Any kind of help will be great

Regards

IP is blacklisted

Sat, 07 Nov 2009 17:58:03 Z

Dears ,

the previous post that I ask how to reject the spam , because I recieve alot

but now the problem is that one of my two EDGE IP is blacklisted in two of the blacklist provider .

how something like this is happening , and I scan for virus in the edge but no any virus , what is the problem , I do a search for it and it says that maybe a virus or something like that , but the servers are cleaned , any way i will send to this blacklist provider to remove the IP from spam

but I would like to know how this is happening !!

I appreciate your efforts

Regards,

so many spam

Mon, 02 Nov 2009 20:05:18 Z

Dears,

is my domain is the only domain that recives so many spam these days

I was reciving from my domain , then i solced it , theni now recieve from microsoft to update something with a harmfull link , and facebook to edit information with a page looks like facebook

my ANTI-spam downloaded in edge and updating very good

and the SCL to reject a message is 6 which is Ithink low enough to block these things

so what should I do,

these things happened from about tow weeks

Regards,

Junk Mail - Outlook 2007\Exchange 2007

Mon, 02 Nov 2009 21:15:32 Z

We have Exchange 2007 with Outlook 2007 as our client. When Outlook was first deployed we had Junk mail disabled. Now we want to enable junk mail at the client level and have the default setting be set to "none". The user can go in and modify it if they wish.

Do I need to make any changes on the Exchange server to support junk mail functionality in the Outlook 2007 client?

Attachment Filtering

Sun, 01 Nov 2009 11:03:30 Z

I read about Attachment Filtering @ http://technet.microsoft.com/en-us/library/bb124399.aspx
Does this filtering apply only on inbound emails or do they apply to outbound emails too?
In other words, If I choose to silently block the attachments, will OUTGOING emails from my exchange having filtered attachment types also be blocked silently?

Exchange Server 2003: Why some users are receiving Junk emails from their own email addresses?

Wed, 10 Dec 2008 17:31:00 Z

Winmail.dat and Exceedinglyinfected

Fri, 30 Oct 2009 20:10:27 Z

Using Forefront antivirus for Exchange 2007 and have received alert that Forefront detected virus exceedinglyinfected in file winmail.dat. I don't find explanation of this in the documentation. Any clue's?

Thanks,
Ted

No Exchange queues

Thu, 22 Oct 2009 17:21:15 Z

I have just enabled the antispam agent on our hub transport server(Exchange 2007). It is a single exchange environment

The queues disapeared after I enabled it. the only queue there is the submission queue. Currently all mail is going there but nothing is delivered. Internal and external.

Can someone please help

Thanks