I should probably correct myself about this. postmaster.eml is fine,
it's the otherpostmaster.eml and sender.eml that should be modified.
Personally I would also remove them from the standard part of the
manual and only include them as a footnote. Since recipient.eml and
postmaster.eml are sent to local accounts, you can't make a good
argument for changes there.
Matt
Colbeck, Andrew wrote:
I agree completely.
I use the postmaster
notification only, so only internal notifications happen. I use the
FORGINGVIRUS statements to limit what we have to see.
Recently, we had a single "macro
virus" type issue, and that was where a HTML based Microsoft Word
document used a document template that was referenced as a URL. F-Prot
flagged that as a potential vulnerability and our postmaster account
was duly notified. After vetting the attachmeent, the message was
internally re-queued for the user.
I can barely remember
the incident before that. The notifications always turn out to be
flagging a new worm.
Andrew.
Regarding the names, this is why I would recommend that people
completely abandon any form of postmaster and sender bounce messages
for detected viruses...it's just too much to keep up with without
creating backscatter, and most won't bother to keep up with it
regardless because they don't know how to or don't pay attention to
such things.
Just like Scott change BOUNCE to BOUNCEONLYIFYOUMUST (and refused to
answer questions directly about why things no longer worked so that
users could be tested for their worthiness of continuing to use the
functionality), I think that it would be good for the community at
large if postmaster.eml and sender.eml were changed to
postmasteronlyifyoumust.eml and senderonlyifyoumust.eml while also
promoting the idea of abandoning this functionality.
I have seen statistics from one of the AV companies showing that macro
viruses accounted for less than 1% of all such viruses detected if I
recall the exact percentage properly. From the perspective of E-mail,
I believe the only messages that are end-user initiated that should be
detected by our scanners are macro and hoax viruses. These are very
rare, probably far less than 1% of what is blocked by E-mail systems
since macro viruses don't mass mail. I think it's safe therefore to
assume that even if a virus wasn't forged (some use the infected
computer's user instead of a random or predefined one), that it wasn't
user initiated and avoid notifying them for fear of creating
backscatter.
Matt
Colbeck, Andrew wrote:
A kapser was detected on my F-Prot based system today.
I'm attaching the output of the scan from virustotal.com for your
interest.
I also scanned it with my TrendMicro which detects it by a different
name:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FG
REW%2EA
You might add:
FORGINGVIRUS KAPSER
FORGINGVIRUS GREW
FORGINGVIRUS WORM
To your virus.cfg to cover the various naming conventions in the various
engines, particularly that last one.
I'll submit the virus to Symantec if someone could point me to the right
way to do that; they're the only big name that doesn't detect this
malware.
Andrew.
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Mark Reimer
Sent: Monday, January 16, 2006 12:42 PM
To: [email protected]
Subject: RE: [Declude.Virus] New Virus?
I think this started happening after I updated my F-prot
virus defs to 16th.
Does anyone else see this?
Mark Reimer
IT Project Manager
American CareSource
214-596-2464
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Mark Reimer
Sent: Monday, January 16, 2006 12:32 PM
To: [email protected]
Subject: [Declude.Virus] New Virus?
I saw an entry in my virus log to day for [EMAIL PROTECTED]
Has anyone else seen this? I cannot find any information on it.
Mark Reimer
IT Project Manager
American CareSource
214-596-2464
---
[This E-mail has been scanned for viruses]
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail has been scanned for viruses]
---
[This E-mail has been scanned for viruses]
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
|
