RE: Anti-virus auto-replies

From: Dowling, Gabrielle <dowlingg(at)sullcrom.com>
Date: Mon Jun 30 2003 - 23:23:11 EDT

Samuel....

That sounds tremendously useful in terms of recipient notification (but not sender notification, if the idea behind sender notification is to notify third parties that they are infected).

I'm curious to know which scanner you're using.

Best

Gaby

 -----Original Message-----

From: 	Mason, Samuel
Sent:	Mon Jun 30 22:52:49 2003
To:	'Jonas Anden'
Cc:	'focus-virus@securityfocus.com'
Subject:	RE: Anti-virus auto-replies

Jonas,

We had the same problem and I complained repeatedly to our AV vendor until they made a change in their code on the next revision that they call "worm precedence". If the message is classified as a worm it does not send out a message, it purges it knowing it is not a message sent that may be an accidentally infected file. It was a major improvement as far as I was concerned.

Samuel Mason
Information Technology Security Office
State of Montana  

-----Original Message-----
From: Jonas Anden [mailto:dajudge@home.se] Sent: Saturday, June 28, 2003 2:27 AM
To: focus-virus@securityfocus.com
Subject: Re: Anti-virus auto-replies

On Fri, 2003-06-27 at 21:09, Joey Matesic wrote:
> Can't you turn the auto-replies off?

First of all, it's not *my* autoreplies that are the problem. It's everyone elses -- that are sending autoreplies to my address (even though I didn't actually send the virus). So no, I can't turn them off.

Second, I don't want them completely off. It's a great feature notifying the sender of an email that the email contained a virus. I want to disable notifications for the viruses that are known to *fake* the sender field in the mails it sends.

All I can do is filter the autoreplies, but I don't want to do that. My users *should* get notified if they send email with viruses. But I don't want them to be notified when they *didn't* send viruses. Sending false notifications has only two effects:

• My users are getting annoyed.
• My users will eventually ignore *real* virus notifications.

I don't want either to happen.

  // J

---

---

---

---

---

This e-mail is sent by a law firm and contains information that may be privileged and confidential. If you are not the intended recipient, please delete the e-mail and notify us immediately.

---

---

---

Received on Tue Jul 1 13:01:57 2003