Video Screencast Help
Search Video Help Close Back
to help
Not able to make it to Vision this year? Get a sampling in the Best of Vision on Demand group.

Increase in Spam the Past Month

Updated: 21 May 2010 | 11 comments
fnbrowning's picture
-1 1 Vote
Login to vote
This issue has been solved. See solution.

My Symantec Mail Security is running with Exchange 2003 on server 2003.
Installed version = 6.09.286
Auto-Protect state = Started
Virus definitions = 2/5/2010, Rev 2
SPA license status = Valid

Without any system changes taking place on my side, the last 30 days or so, my previously spam-free mail system has been showing a disturbing increase in spam being delivered to the end users.

Has something changed in regard to the spammers vs. Symantec? Is the product being updated conscientiously by Symantec to reflect the latest spam techniques?

 

Discussion Filed Under:

Comments

TSE-JDavis's picture
08
Feb
2010
3 Votes +3
Login to vote

You will want to check your

You will want to check your server status to see what date your spam definitions are at, this can be accessed under Monitors->Server Status.

If the date for Symantec Premium Antispam is behind more than 10 minutes, you need to follow this document:

Title: 'Premium AntiSpam for Symantec Mail Security for Microsoft Exchange fails to detect spam'
Document ID: 2007020615531854
> Web URL: http://service1.symantec.com/SUPPORT/ent-gate.nsf/...

Make sure to follow it step-bystep and don't skip any steps.

fnbrowning's picture
09
Feb
2010
3 Votes -3
Login to vote

You say >>"If the date for

You say >>"If the date for Symantec Premium Antispam is behind more than 10 minutes"<<
HUH????????????????
 
The document you posted covers what to do if  >>Question/Issue:
The Premium AntiSpam (PAS) component of Symantec Mail Security for Microsoft Exchange (SMSMSE) is not detecting spam emails.<<
 
THAT IS NOT MY ISSUE.

Really, did you read my inquiry??  Let's swap the sentences around, and you take another run at it:

Has something changed in regard to the spammers vs. Symantec? Is the product being updated conscientiously by Symantec to reflect the latest spam techniques?
Because
Without any system changes taking place on my side, the last 30 days or so, my previously spam-free mail system has been showing a disturbing increase in spam being delivered to the end users.

 

groberts's picture
09
Feb
2010
2 Votes +2
Login to vote

Hi fnbrowning, I'd definitely

Hi fnbrowning,

I'd definitely recommend following the document TSE-JDavis posted. The behavior you are expiriencing sounds very much like out of date antispam rulesets. Essentially, if the rulesets stop updating (for whatever reason) spam will increase over time as the rules in use are no longer addressing the current batch of spam.

To address this sentence:

"Has something changed in regard to the spammers vs. Symantec? "

There have not been any significant changes in the state of spam on the internet (outside of ordinary spammer adaptations to antispam technology, which are easily addressed by ruleset updates)

"Is the product being updated conscientiously by Symantec to reflect the latest spam techniques?"

Absolutely, this is the purpose behind our brightmail/premium antispam technology, it is constantly being updated (new rules are loaded every 5-10 minutes) to deal with new types of spam.

"Without any system changes taking place on my side, the last 30 days or so, my previously spam-free mail system has been showing a disturbing increase in spam being delivered to the end users."

Again, this behavior is typical of a ruleset downloading problem, which would be addressed by following the steps in the document TSE-JDavis provided.

fnbrowning's picture
09
Feb
2010
2 Votes -2
Login to vote

Hello grobets Thank you for

Hello grobets

Thank you for the more targeted diagnostic. I'll buy the out of date antispam rulesets, and I've implemented the protocol as described in the document.  It will take a little time to survey my users and document any changes.

 I hope that other Symantec employees understand that the average Administrator is skeptical of a "shotgun" approach to problem resolution.

TSE-JDavis's picture
10
Feb
2010
1 Vote +1
Login to vote

I take offense at you saying

I take offense at you saying I am taking a shotgun approach. The document I provided you was written by Gavin (groberts) for this exact situation.

The title of the document is 'Premium AntiSpam for Symantec Mail Security for Microsoft Exchange fails to detect spam', which is exactly what you described, we are failing to detect some spam messages.

The way our premium antispam works with the Exchange product it needs to have everything cleared out and started from scratch to reliably fix this issue. Just doing one of the items in the document leaves room for this to happen in a week or even a day later.

What was the date listed when you looked at the Premium Antispam status? I am just curious at this point.

Brightmail, what Premium Antispam uses, is an enterprise level product used by millions of servers around the world. We have a large team of engineers dedicated to keeping up with the latest spam trends by monitoring our probe network. There has not been any reduced level of detection on our end. We are working harder than ever.

fnbrowning's picture
10
Feb
2010
1 Vote -1
Login to vote

TSE-JDavis  you are

TSE-JDavis  you are representing Symantec on a public forum, meaning your attitude reflects on the company.  Wether you like it or not, I am a paying customer that is having problems with the product you represent. 

Now to the issue at hand. 
As of 20:30 CST, I have followed all the directions in the document  written by Gavin (groberts).  On a restart of the server, I tested the effectiveness of the Symantec Mail Security by emailing two messages from a test account.  The test message with http://www.example.com/url-1.blocked/ made it through (which had never happened before) and a second spam message also.

I will wait 1/2 a day to test the results further, but from the test, I'd say the preliminary results look worse than when I started.

groberts's picture
11
Feb
2010
2 Votes +2
Login to vote

Hi fnbrowning, When you

Hi fnbrowning,

When you tested the http://www.example.com/url-1.blocked string, was this done from an outside account, or an account within the organization? I just wanted to verify that this message was coming via an SMTP connection, and not an internal (MAPI) connection, as MAPI connections are not scanned for spam.

If it comes through from an outside email address, and you have configured an action to take under Policies -> Premium Antispam actions which is not being taken, I'd recommend collecting the following debug log to help assess why these messages are not being scanned (we can safely say they are not being scanned if an email containing the test string comes through an SMTP session without your configured action being taken as expected, as all messages with that test string will be considered "spam" if they are seen by the scanner):

Title: 'How to obtain a DebugView log file from Symantec Mail Security for Microsoft Exchange 6.x for Microsoft Exchange 2007 transport agents'
Document ID: 2008020110381854
> Web URL: http://service1.symantec.com/SUPPORT/ent-gate.nsf/...

However, your problem seems different enough from our common cases of Premium Antispam not detecting spam that I would recommend opening a technical support case for more in depth troubleshooting. If you choose this path, please have patience with the agent that takes the case, as they are likely to want to verify the actions taken based on the documented TSE-JDavis linked earlier before continuing to more complicated troubleshooting. This is because roughly 97% of all of our spam cases are solved by following the steps in that document, and is not intended as a slight against you.

TSE-JDavis's picture
11
Feb
2010
1 Vote +1
Login to vote

There is no reason to wait

There is no reason to wait any amount of time. It will work immediately or will not work at all for the spam test string.

You will need to check the status page I mentioned previously and make sure Symantec Premium Antispam says enabled and has a date and time within the last 10 minutes listed.

If there is a current time and date listed and Premium Antispam shows as enabled, but the spam string is not detected, then something is going on with our monitoring of port 25.

Is this the first server that mail for yoru domain hits? Does the MX record for your domain point at the Exchange server or are there any other devices in front of it?

Frosty's picture
11
Feb
2010
1 Vote +1
Login to vote

A big, big thankyou!!!

Special thanks from me to:

 
 
 
TSE-JDavis's picture
TSE-JDavis's picture
12
Feb
2010
1 Vote +1
Login to vote

Great to hear Frosty! Believe

Great to hear Frosty! Believe it or not, I don't get paid to answer questions on this forum. I only get paid for taking phone calls. I do this in my spare time to help customers out. Its good to see some grattitude.

fnbrowning's picture
11
Feb
2010
0 Votes 0
Login to vote

No, I did not send the spam

No, I did not send the spam from within the organization! <LOL> 
As I said previously  >>"Without any system changes taking place on my side"<<  So that covers appliances, MX records, etc.

Thanks groberts for the help. I will pursue this through other avenues.