Real World Computing

A Little History Over the years, we've had a fairly good run when it comes to viruses and malware. Much of that I can put down to the fact that we've always used IBM Notes as our mail system and it's less susceptible to hijacking. Of course, notes only slows down the distribution (and reduces the likelihood of specific mail calls being used).  It's not an effective anti-virus solution. Years ago, I used to run my anti-spam services on the mail server. There were two problems with this approach; The mail had already reached our systems before the first scan occurred - even if it was just spam, you're now using your bandwidth and your storage. You're running secondary processes on (or between) your mail server. It needs updates, maintenance etc.  Anti-Spam was the first service we moved offsite. For the past few years, we've been using the Symantec.Cloud anti-spam service. This was a very good service when it was a recent acquisition (Message...

This post is going to be an easy read because I don't have any time to update the blog at the moment - so just look at the pictures. Most people who've spent any time with me on the computer know that I hate anti-virus products because I think that they spend too much time slowing down the system without any guarantee of actually fixing the problem. Here's an example which just happened about five minutes ago. I received an email containing an obviously bad file. It passed neatly through our external scanning system which consists of SEVERAL different anti-virus and anti-spam filters. I knew it would be a virus, so I saved it to my hard drive. You can see that it has a Microsoft Word icon but that it ends in .EXE. If you accept the windows default to hide extensions for known file types, you'll never see the EXE and you might even be fooled into thinking that _doc is the same as .doc. So... I right clicked on the file and chose scan from the context menu. As mentioned ...

(warning... this is rant - I know you're not supposed to blog about things when you're irritated but I've been irritated with McAfee for ages and it's not going away). My irritation with McAfee's Anti-Malware technologies has slowly been building for the past six months. For a start, I find myself disabling their firewall more often than I leave it enabled. The thing constantly tries to chew up 90+ percent of my systems resources. What's the point of having security software if, for usability reasons, you have to constantly turn it off? Whenever I start Lotus Notes 8.0.2, I have to remember to stop the McShield service (from the services part of control panel) before I double-click the icon. If I forget, my PC slows to a crawl and I can make filtered coffee and still get back with plenty of hourglass watching time. It would be easy to blame Notes for this but it performs so well when McAfee is off. In addition, several of my other bits of software perform mu...

Ok, before everyone starts jumping on me for this, I'm talking about the need for our individual PCs to be processing this sort of stuff. Recent Issues - Scanning I've been finding myself increasingly turning McAfee's services off in order to do simple tasks without massive interference. It's a well known and demonstrated fact that applications which use a lot of small files, like the new version of the Notes client (the Eclipse version) do not run happily with Anti-Virus. Why? Because everytime they pick up a file to execute it, the Anti-Virus app "snatches it off them for a look". In the days of large applications, the anti-virus would simply scan a massive EXE file once and then move on. That's no longer the case. Last Friday, I was trying to download some things from the IBM site using their "Download Director" facility. McAfee seized the Java applet and took so long to scan it that it kept timing out. In the end, the only way I could dow...

I've just finished filling out a survey questionnaire for Michael Osterman and I noticed that the same sorts of things just keep on cropping up. I can't figure out why these things are "issues" in this day and age. Certainly, they're not problems for us. I was just wondering if people have email problems because of poor implementations, poor policy, low expenditure or because they're on other systems with less resilience than domino. The Problems Discussed The problems mentioned in the survey were as follows; Spam Outbound Confidential Material Archiving and Retrieval System Management Time Mail File Sizes None of these are issues for us. Spam After struggling for a few years with the Symantec Anti-Spam solutions, I finally redirected our mail through a cleansing service. This service runs our mail through several different Anti-Spam solutions. Anything considered spam is sent to spam@myorganisation.com while all other mail goes to it's rightful reci...

Our "Uncrashable" Notes Server has only crashed a few times in the last five years. Once it was due to an Archiving agent having issues with a corrupted mail. Every other time has been due to incompatibilities between the Symantec MailSecurity package and Windows. When we first got this package, we were very impressed and indeed it performed quite well for a number of years. The first really "WRONG" step, was when symantec lazily decided to get their premium Anti-Spam product to run from the Microsoft SMTP Service rather than from within Notes. This is not a technical issue. It's a cost cutting measure. Over the years, this one decision has caused us no end of grief. The final straw came a couple of months ago when we were about to go live with our second website on the same server. obviously we needed to move our configuration settings to site documents. Everything went fine until the reboot. Following the reboot, the Premium section of the Symantec MailSecu...

Last week, we needed to set up a secondary web site hosted from the same server. We did this by migrating from the standard Domino web setup to a configuration which used site documents. All worked well... Mail routed successfully, the old and the new web sites worked and everyone was happy. This morning, I applied the Microsoft Updates. Now these, being Microsoft products, required a server restart, so I dutifully complied. When the server came back up, no mail was routing. The Culprit After a bit of searching around (not very much searching really because I now tend suspect the Symantec MailSecurity services FIRST), I found a message saying that; "The Symantec Premium Anti-Spam service could not be started because you are using a site document". I rang Symantec and following a relatively quick game of telephone lotto, I got transferred to the right person. Yep, they confirmed it... Sorry - It's not supported. End of story. I disabled the service, but still mail did ...

A quick recap If you remember, last time I blogged about this software we ended up turning it off because it was causing a lot of problems with a particular regular correspondant. Well... We turned the service back on after about a week because we were getting a lot of spam. I changed the settings to notify us if an email was blocked, but not to delete/quarantine it. We were notified of the spam, but were never notified of mail from the "offending" mail system (and mail from that system was not being delivered). Clearly the problem was much more than a simple mis-detection issue. The Real Culprit After doing a lot of searching, I eventually found the answer. It was that Microsoft, being unsatisfied with using the industry standard 7 bit MIME format, decided to implement an 8 bit version. Out of the box, Notes/Domino has compatibility with this format turned off (after all, it isn't the industry standard). Normally what would happen is that; An Exchange server would con...

Today we finally resolved our problem getting emails from one of our major contacts. The problem had been going on for most of February, but had generally been unnoticed. The Symptoms There generally were no symptoms, people from Company X would send us emails and they wouldn't arrive. There was no mention in the Notes Logs about the emails and there was nothing in the Symantec Anti-Virus software to indicate that there was an issue. The company had recently changed their domain name from x1.com.au to x2.com.au (all domain names changed to protect the innocent) and we had, relatively recently upgraded to Domino 7.0, so there was much finger-pointing in both directions. Steps Taken The first thing I did was look through our firewall logs, but I quickly gave up - they were too difficult because of the sheer number of entries. I tried several methods of dumping the files, but they weren't readable and I couldn't see any filtering options. My first mistake was to not spend...