Exceeded Internet Timeout Virus?

We have an Exchange 2k3 box running Antigen 9.0 that is finding this :
Microsoft Antigen for Exchange found a file infected with a virus. The file
is currently Removed.
File name: "CODE_.gif"
Virus name: "Exceeded Internet Timeout"

I can not seem to find anything on the net about this virus. I am starting
to notice a large amount of internet mail SMTP Connectors with
postmaster@mydomain.com in our exchange queues and since we do not have an
account with that name i am assuming something is spoofing that name.

We have Symantec 10. as the AV. I have scanned all 3 servers we have with
Symantec, Microtrend's System Cleaner, SpyBot , and the "free" version of
Ad-Aware from Lavasoft and all are clean. I also used Process Explorer to
see if we had any rouge processes. We even went so far as to turn off all the
workstations over a weekend period to see if there was something we missed
when scanning them. We still found the same amount of notifications in
Antigen and in the exchange queue.

Does anyone have any experience with this supposed virus ?

Wheere does ANYTHING say that this GIF file was a virus ?

You stated "Antigen for Exchange found a file infected with a virus". Ok, please provide
an extract of the AntiGen log file indicating what was found.

Was this GIF file completely deleted ?

I just copied the notification directly from Antigen on the above post,
they were using the virus verbiage. Here is the latest one from the log
files.

Tue Nov 07 16:57:55 2006 (2596-7028), "INFORMATION: Internet scan found virus:
Folder: SMTP Messages\Outbound
Message: Delivery Status Notification (Failure)
File: helpful_.gif
Incident: Exceeded Internet Timeout
State: Removed"

All that can be gleamed from this is a outbound message with attached file; "helpful_.gif"
exceeded a timout and was ultimately removed.

It says "Internet scan found virus:".
What virus ?
What is the name of this virus and which AV software cdtected this ?

All you can do is find out who the sender is and find the file "helpful_.gif" and then
submit it to Virus Total as a prescribed earlier in this thread.

In your original post, described the file name: "CODE_.gif" not "helpful_.gif". Were there
TWO or more incidents ?

You mention "We have Symantec 10. as the AV". Is that on the client PC or are you running a
symantec AV version for MS Exchange Server ?
If you are NOT, I suggest junking AntiGen for Symantec AV for MS Exchange Server or McAfee
Anti Virus for Exchange Server.

Yeah, I am not impressed with Antigen logs either. My problem on the
sender is the notification I get from Antigen is the sender is
postmaster@mydomain.com. Here is the exact notification I receive:
Microsoft Antigen for Exchange found a file infected with a virus. The file
is currently Removed.
File name: "helpful_.gif"
Virus name: "Exceeded Internet Timeout"
Message subject: "Delivery Status Notification _Failure_"
Sent from: "postmaster@mydomain.com"
Folder: "SMTP Messages\Outbound"

I don't have a postmaster account in our environment and all the
notifcations refer to that account as sender.

As far as file names and more than one incident , yes, it keeps changing
names of the gif file, I also am receiving notification of the file being :
body of message : instead of a gif file on some notifications.

On the AV question. unfortunatly I inherited this office recently and they
are not using the Symantec for Exchange version, I belive my predecessor
thought that Antigen would be enough for the exchange scan. They have the
same version of Symantec on the workstations as they do the server. Not sure
I can talk them into upgrading at this time.....

Note that I don't know many Exchange folks who would recommend Symantec
*anything* over Antigen - or TrendMicro's ScanMail (which is what I tend to
use).

Regarding Postmaster - check the properties of the built-in administrator
account & see whether postmaster@ is not defined therein.

I suggest you try posting in m.p.exchange.admin - to cast a wider net here.
A lot of people in there use Antigen.

You'd be surprised at how many US Gov't. Exchange Servers (civilian and Military) use
Symantec.

In fact, the US DoD has a "wide license" providing all Symantec AV products to all the
services (including the Coast Guard).

I'm sure they have a very nice relationship with Symantec - although for the
time being I'm not sure the fact that the DoD uses something is all that
much to be proud of!

I still don't know a lot of Exchange experts who like it.

[dnelson830038]

Ummm.... Excellent point. The government using SAV does not say much... in fact... you may as well state that my mom's bakery store uses it. The fact is, with anti-virus you can never put all of your eggs in one basket. There are viruses that will get passed every scan engine out there. Antegen is definatly your best bet with Exchange though. Take that from a 15 year vet who still works for MS Dave.

And what does this have to do with fixing the problem DAVE! Stop arguing on this site. Go find a chat room to arue in.

Microsoft has decided to retire a few scan engines that forefront and Antigen use causing message scan timeouts. This results in the message automatically being quarantined. Configure the timeout value for your scan engines by extending it.

Dave's not here!

...or there...

his posts are being borrowed from usenet by the website you are using to
to make yourself look like a fool.