PSA #1: Automated virus warning e-mails

Jzero

Lifer
Oct 10, 1999
18,834
1
0
To all System Administrators and anyone else who operates antivirus software on a mail server:

In 1999, it may have been helpful or courteous to set up your mail server's antivirus software to issue notifications to senders of e-mails containing viruses. Someone might be spewing out viruses without even knowing it, and you could help them figure it out.

Fast forward 5 years. It is now 2004. Viruses now come packaged with their own SMTP server, and they forge the From address of the outbound messages. Recent memory cannot recall the last time a widespread virus was traceable based on the sender's e-mail address.

Therefore, it is no longer beneficial in any way to enable such notification features in the antivirus software. In 1999, you may have been helping to solve the problem. In 2004 you are contributing to the problem because you are creating a boatload of extra traffic, along with confused users, resulting in administrators spending precious time answering the same repeated question, "I just got this e-mail....do I have a virus?"

Of special interest is the obnoxiously worded notification. Case in point, received by one of my faitfhful minions:
The Virus software on our mail server detected the W32/Mydoom.A@mm virus that appears to have come from your mail server. It was sent in an attachment readme.scr, from XXX@YYY.com to aaa@bbb.com, with the subject "Mail Transaction Failed". The Message-ID was:
<>.

If your mail server had virus protection, it would have caused less work for our server and would have likely prevented one of your users from getting a virus in the first place!
This is not an appropriate message to send. It begs the obvious response, "If YOUR mail administrator had not configured his virus protection poorly, it would have saved your server TONS of work, and mine too!"
If you feel you MUST take advantage of this no-longer-useful feature, at least word your message politely and truthfully.

Remember folks:
VIRUS NOTIFICATIONS ARE FOR NEWBIES!
Turn 'em off, please.
 

Jzero

Lifer
Oct 10, 1999
18,834
1
0
Great post, Jzero! Worth the read :D

Actually, I just got ANOTHER question about one of these e-mails.
:|
 

Kenazo

Lifer
Sep 15, 2000
10,429
1
81
I got the following email from Postmaster@ingramicro.ca:

Network Associates WebShield SMTP V4.5 MR1a on CATORWSH01 detected virus W32/Mydoom.a@MM in attachment message.zip from <youremail@yourhost.net> and it was Deleted.

how the heck did that happen? I have my Norton activated, zonealarm pro running, with pretty much every port blocked, and program blocked that I know doesn't need the internet... and I've run symantec's "FXmydoom" tool, and it didn't find anything. I think ingrammicro is on crack.
 

DBL

Platinum Member
Mar 23, 2001
2,637
0
0
Originally posted by: Kenazo
I got the following email from Postmaster@ingramicro.ca:

Network Associates WebShield SMTP V4.5 MR1a on CATORWSH01 detected virus W32/Mydoom.a@MM in attachment message.zip from <youremail@yourhost.net> and it was Deleted.

how the heck did that happen? I have my Norton activated, zonealarm pro running, with pretty much every port blocked, and program blocked that I know doesn't need the internet... and I've run symantec's "FXmydoom" tool, and it didn't find anything. I think ingrammicro is on crack.

Well, that's the point. Most current email viruses forge the email header making it appear as if someone else sent the message. In this case, that someone else was you. You're fine. Someone else with an infected computer sent out the email with a forged header pointing to your email address. Therefore the receiving server found the virus and responded back to you explaining that you are infected. In the end, this only results in more unnecessary traffic.

 

Kenazo

Lifer
Sep 15, 2000
10,429
1
81
Originally posted by: DBL
Originally posted by: Kenazo
I got the following email from Postmaster@ingramicro.ca:

Network Associates WebShield SMTP V4.5 MR1a on CATORWSH01 detected virus W32/Mydoom.a@MM in attachment message.zip from <youremail@yourhost.net> and it was Deleted.

how the heck did that happen? I have my Norton activated, zonealarm pro running, with pretty much every port blocked, and program blocked that I know doesn't need the internet... and I've run symantec's "FXmydoom" tool, and it didn't find anything. I think ingrammicro is on crack.

Well, that's the point. Most current email viruses forge the email header making it appear as if someone else sent the message. In this case, that someone else was you. You're fine. Someone else with an infected computer sent out the email with a forged header pointing to your email address. Therefore the receiving server found the virus and responded back to you explaining that you are infected. In the end, this only results in more unnecessary traffic.

That's what I assumed. I'm assuming that whoever's computer it originated from has my email address in their address book? Perhaps I shall warn everyone I know has my address.