RE: Anti-virus auto-replies

Jonas,

We had the same problem and I complained repeatedly to our AV vendor until they made a change in their code on the next revision that they call "worm precedence". If the message is classified as a worm it does not send out a message, it purges it knowing it is not a message sent that may be an accidentally infected file. It was a major improvement as far as I was concerned.

Samuel Mason
Information Technology Security Office
State of Montana  

-----Original Message-----
From: Jonas Anden [mailto:dajudge@home.se] Sent: Saturday, June 28, 2003 2:27 AM
To: focus-virus@securityfocus.com
Subject: Re: Anti-virus auto-replies

On Fri, 2003-06-27 at 21:09, Joey Matesic wrote:
> Can't you turn the auto-replies off?

First of all, it's not *my* autoreplies that are the problem. It's everyone elses -- that are sending autoreplies to my address (even though I didn't actually send the virus). So no, I can't turn them off.

Second, I don't want them completely off. It's a great feature notifying the sender of an email that the email contained a virus. I want to disable notifications for the viruses that are known to *fake* the sender field in the mails it sends.

All I can do is filter the autoreplies, but I don't want to do that. My users *should* get notified if they send email with viruses. But I don't want them to be notified when they *didn't* send viruses. Sending false notifications has only two effects:

• My users are getting annoyed.
• My users will eventually ignore *real* virus notifications.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

I don't want either to happen.

  // J