On Thu, 2004-03-11 at 09:40, Barry Gill wrote:

Hello All. Hi Barry

This form of server administration is a very very poor form of security as you are willfully informing people who have possibly never thought of you or your servers before several key steps that it may have taken them some time to figure out. Better yet, configure your smtp server to require authentication when sending smtp. Only allow clients on your network to send smtp via the mail server. The viruses you are talking about rely on open smtp through the firewall, or unauthenticated smtp via the mail server.

Sending out mass mailer responses to virii wastes as much respource as coping with the virii themselves.

So does html mail, but we have two chances of that stopping, right?

Stop wasting your and my bandwidth, send reports only to admin, check the headers and if you receive mail form an address or domain often and the headers check out, THEN notify the admin/postmaster of that domain.

Too much work for the average Exchange 'administrator' ... First they have to figure out how to turn on message tracking ...

I mean please, telling Lucy in the clerks dept about the fact that she is sending virii to somebody she has never met in Luxembourg is only going to cost her tima and money as she will call out her IT people to clean her "infected machine"

Lucy in the clerks dept is the most likely cause that the virus is spreading. Virus education should be top priority in any company.

Sorry about the rant, this is just one of the most annoying things that for some reason no-one ever seems to consider when setting up all this AV stuff.

Yeah, like someone using Frontpage to 'design' a web page and then call themselves a web developer ...

Barry -- -- Raymond Leach Network Support Specialist http://www.knowledgefactory.co.za "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import" Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28 --

-----Original Message----- From: Barry Gill [mailto:b@rry.co.za] Sent: 11 March 2004 07:40 To: suse-security@suse.com Subject: [suse-security] Anti-Virus reports

Hello All.

As most of you are technical, you should for the most part be in control of, or have the ear of the person who is in control of your corporate anti-virus solutions.

I don't agree with this bit, but...

Please for the sake of the internet can you STOP your servers sending virus notifications to the originators of the message as with today's modern virii 90% of virii use spoofed "from:" addresses.

<snip not unjustified rant> Here I agree totally and wholeheartedly. This really pisses me off, big time, if only because it confuses the hell out of the people I support. I normally send emails to the sysadmin of the site explaining the problem, and if I get no response from them (I do ask for one, just to make sure my message is read by a human, not just piped through to an unread mailbox), I try to contact the management, suggesting they retrain or dump their sysadmins. Petty, but _I_ enjoy it! Tom.