Virus found in message "Re: Qmail and Procmail"

[System Anti-Virus Administrator]

Ett virus upptäcktes i e-post som var adresserad till dig. Vi har
stoppat det infekterade brevet för att din dator inte ska bli smittad.

A virus was discovered in an e-mail addressed to you. We have
rejected the infected mail so your computer will not be infected.


The header from the infected e-mail:

RCPT TO:[EMAIL PROTECTED]
From:   "jessica" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject:Re: Qmail and Procmail
Message-ID: <015901c0cbfe$f0de8320$0300a8c0@acer345t>
Date:   Mon, 23 Apr 2001 22:05:43 +0800

Re: Virus found in message "Re: Qmail and Procmail"

[Mads E Eilertsen]

> From: System Anti-Virus Administrator <[EMAIL PROTECTED]>
> To: [EMAIL PROTECTED]

> A virus was discovered in an e-mail addressed to you. We have
> rejected the infected mail so your computer will not be infected.

Thank you. However,

  - a message from the list to me doesn't go through your computers.
  - you have now revealed that andreas2 is subscribed to the list.

What about sending such warning messages to the envelope sender address?

Or what about just dropping the infected messages silently?
A simple 'grep ... exit 99' quietly stopped it for me.

Sitting here with no virus but lots of warning messages it occurs
to me that the latter is at least as disturbing as the first.
Please consider doing something with your AV-software.

Mads

Re: Virus found in message "Re: Qmail and Procmail"

[Jason Haar]

On Mon, Apr 23, 2001 at 07:01:57PM +0200, Mads E Eilertsen wrote:
> 
> > From: System Anti-Virus Administrator <[EMAIL PROTECTED]>
> > To: [EMAIL PROTECTED]
> 
> > A virus was discovered in an e-mail addressed to you. We have
> > rejected the infected mail so your computer will not be infected.
> 
> Sitting here with no virus but lots of warning messages it occurs
> to me that the latter is at least as disturbing as the first.
> Please consider doing something with your AV-software.

A better statement to say would be: "don't dick with your AV-software, the
author knew what he was doing!!!"

That's *MY* Qmail-Scanner software that generated that message.
Unfortunately that site has *REWRITTEN IT* so that it doesn't act as I
intended. I went through a *LOT* of effort to stop Qmail-Scanner being like
all those bl**dy commercial scanners that spam mailing-lists when they find
viruses - mine specifically doesn't send AV messages to mailing-lists.

I have vented by displeasure at the site owner. I am not happy.

[one of the drawbacks of Open Source of course. Each user can rewrite it as
they please]

So now in an attempt to make a silk purse from a sow's ear; for those
interested in a Email AV solution that won't spam mailing-lists with such
messages, take a look at http://qmail-scanner.sourceforge.net/ ;-)

-- 
Cheers

Jason Haar

Unix/Special Projects, Trimble NZ
Phone: +64 3 9635 377 Fax: +64 3 9635 417