afloyd

Marcos, Yes we host our own Exchange 2003 server and use it with Outlook, ActiveSync, and OWA. We have ESET Mail Security 4.2.xx running on it, however, during my recent discussion with an ESET support rep I was informed the more recent 5.0.xx version has better spam and filtering capabilities so we're going to upgrade it this weekend. We also have filtering at the external DNS level (via Barracuda RBL, SpamCop, Spamhaus SBL, and Spamhaus XBL), and at the router (via our SonicWALL Content Filter, Gateway Anti-Virus, Anti-Spyware, Intrusion Prevention, and Botnet protection). None of these caught the Zbot intrusion either. I will be reaching out to SonicWALL support to see what else we can do at the router level to prevent this. The ESET rep was kind enough (after sending me a very basic security response and little else) to take a closer look at our current versions (hence the upgrade) and current configuration (to determine it was in good shape). I got the spiel about 'methods of attack are always changing and sometimes we are not able to anticipate new attack vectors'. I understand no security product will ever be 100% effective. But, I don't really want to argue the harsh reality of IT Security - I'm much more interested in what can be done with our current resources (or ones we haven't considered) to minimize our vulnerability as much as possible. Thanks again for responding. -Aaron

Jem & Marcos, I don't believe this is an isolated incident. Twice now in the past month our network has been compromised with the Win32/Spy.Zbot.AAU trojan. In both cases the systems infected reported an infection only after running a scheduled full scan. The systems were compromised by the Trojan while running current real-time protecion under ESET NOD32 AntiVirus 4.2.76 and current definitions on Windows 7 PCs. We were also have the Outlook Add-In installed on all our systems, and the there was no indication of a threat detected prior to the full manual scan. Our company was blacklisted due to the infection. What steps can be taken to mitigate future risk to our network? I have also submitted a support request but would appreciate any feedback you may have. We will be re-evaulating our anti-virus and anti-malware solution as our license expires next March.