RE: [Declude.Virus] No wonder viruses spread

2003-08-24 Thread Marc Catuogno
Um - I'm not sure, but I think he may be right. The declude virus catch looks like a bounce from his server, not sent through his server. As you said the e-mail address is forged - so if an infected computer has a user from your domain and a bad address from his, once his server can't deliver the

RE: [Declude.Virus] No wonder viruses spread

2003-08-24 Thread David Dodell
>Um - I'm not sure, but I think he may be right. The declude virus catch >looks like a bounce from his server, not sent through his server. As >you said the e-mail address is forged - so if an infected computer has a >user from your domain and a bad address from his, once his server can't I don'

RE: [Declude.Virus] No wonder viruses spread

2003-08-24 Thread Marc Catuogno
But since the subject that you are receiving is "undeliverable : RE: Details" isn't that his server is just returning the message Unless the virus has more subjects then the list of subjects that I am aware of. Looks like the original message had the virus attached and that was Declude detected wh

RE: [Declude.Virus] No wonder viruses spread

2003-08-24 Thread R. Scott Perry
But since the subject that you are receiving is "undeliverable : RE: Details" isn't that his server is just returning the message Unless the virus has more subjects then the list of subjects that I am aware of. Comparing it to the headers generated by the copies of Sobig.F we've looked at, it ap

[Declude.Virus] RE:No wonder viruses spread

2003-08-24 Thread David Dodell
-- Original Message -- From: "R. Scott Perry" <[EMAIL PROTECTED]> >Comparing it to the headers generated by the copies of Sobig.F we've looked >at, it appears that it was indeed a bounce message. Then I'm confused .. to me it appeared from the headers that

[Declude.Virus] Ooops, I was wrong

2003-08-24 Thread David Dodell
Just sent a test message to the domain, and the headers are the same: Received: from guava.uch.edu [168.200.2.37] by stat.com with ESMTP (SMTPD32-8.02) id A882145022C; Sun, 24 Aug 2003 10:40:18 -0700 Received: from mail pickup service by guava.uch.edu with Microsoft SMTPSVC; Sun, 24 Aug

Re: [Declude.Virus] No wonder viruses spread

2003-08-24 Thread David Dodell
>>Received: from guava.uch.edu [168.200.2.37] by stat.com with ESMTP >> (SMTPD32-8.02) id A94AD300BE; Sat, 23 Aug 2003 13:06:34 -0700 >>Received: from mail pickup service by guava.uch.edu with Microsoft >>SMTPSVC; >> Sat, 23 Aug 2003 14:06:33 -0600 >>Received: from uchaex2.uch.ad.pvt ([168

[Declude.Virus] Manifest

2003-08-24 Thread Don Brown
Hi Scott, I like the idea of an e-mail notification when a dangerous attachment is quarantined and when a virus is killed. They remind the customers of the services we are providing them. However, these notifications became a significant impact during the recent outbreak and now, I'm wondering a

Re: [Declude.Virus] Manifest

2003-08-24 Thread R. Scott Perry
However, these notifications became a significant impact during the recent outbreak and now, I'm wondering about the possibility of incorporating a daily manifest, as an option. Do you think that a manifest option is a possibility for the future? That's an interesting idea, that would be very nice

RE: [Declude.Virus] Manifest

2003-08-24 Thread Tandem Group
I was just thinking along the same lines and have given instructions to my tech to produce stats for each local address to send to them when this is all over. Remember, we not only have to do our job, but also be seen to do it. :-) Erik > -Original Message- > From: [EMAIL PROTEC