[Avcheck] infected is sick?

[Ralf Hildebrandt]

On Wed, Nov 28, 2001 at 06:24:39PM +0300, Michael Tokarev wrote:

> It should be done easily enouth if you can change the script (sending
> back only headers as in recipient notification).  But are you shure you
> need this? 

I agree with you. Let me tell a story:

A virus scanner removed (!) a virus from the mail. There was only the text
portion and 4 empty (!) attachments reaching the sender.

He was confused. He called our hotline, I talked to him and we found out,
that some other virusscanner removed all virulent stuff and sent the message
on. In the end, the message reaching the recipient was worthlesse, since all
the relevant stuff was removed (attachments).

So: Either bounce the mail, or let it through completely.

Notifying the recipient:

Stupid idea. Right now, with BadTrans, we have thousands of virulent
messages coming in. If we were to send a notification to each recipient ala
"You were about to get a virus, but we found and killed it" would then kill
our network. The users would get flooded with worthless data.

-- 
Ralf Hildebrandt                            Tel.  +49 (0)30-450 570-155
                                            Fax.  +49 (0)30-450 570-916
"My other computer is an abacus ... which is still better than a mac."
                                                          -- Anonymous