Germans bypass Exchange 2003 IMF?

[Atom]

Is anyone else being pummeled by german spam all of a sudden? Weve gone months, virtually spam free thanks the the new IMF in Exchange 2003, then all of a sudden we get nailed hard w/ a ton of emails which look lke theyre originiating out of Germany. They look along the lines of this,

Notification of Ticket Registration

Project:

Oakland University Helpdesk

Ticket:

Dresden 1945

Ticket Number:

19594

Status:

Request

Date:

05/15/2005

Time:

21:43:03

Created By:

[email protected]

Click here to view Ticket in Browser

Description:

Entered on 05/15/2005 at 21:43:03 by [email protected]:

Lese selbst:

http://www.kommunisten-online.de/blackchanel/dresden3.htm

Current Assignees:

Contact Information:

[Sierra]

Looks like SPAM which uses Sober.Q... There will be a whole bunch of this SPAM again on the 27th according to those who took a closer look at the source code. No one knows yet who sent it and what you can do is just update your virus-signatures and run full scans

[Eversurf]

Yeah I have gotten some of it this morning. I told my users not to open the link and delete the email. I'm using GFI spam filter and I blocked the German language....we will see.

We got about 10 emails per users

Have fun!!!

[beacon]

We use message labs for now until we upgrade to a 2003 environment and it catches 99% i would say of all spam with few false positives.

I would say that perhaps you should increase your thresholds in IMF if the spam is getting through to the clients inbox or alter the settings on the outlook 2003 jumk mail filter.

[cq_]

YES!! omg i've been getting this too in my gmail account, as well as one of my co-workers gmail accounts. I don't think our exchange server has been hit yet, but something is definatly going on.

[MazX_Napalm]

I have my IMF set at 5 to archive, and that German stuff got through yesterday. Its the first time so much has got through IMF. Hope it calms down today though.

[semifamous]

http://isc.sans.org/diary.php?date=2005-05-15

[MazX_Napalm]

Anyone know when MS will release another update? The last one was 2/2/05

[Marsden]

There was one just last month. 4/1/2005

Update for Outlook 2003 Junk Email Filter (KB892236)

[MazX_Napalm]

IMF not Outlook.

[zorak]

Our IMF missed it also, i'd love to get some news from MS about future IMF updates.