W32/Sobig.F virus header

[Peter Peters]

On Thu, 21 Aug 2003 12:16:06 -0700, you wrote:

>3) there are ways to mitigate some of that, by having MS append or
>replace existing headers when it finds them, but that doesn't give the
>user any choices.  And, again, the user still wont have a way of knowing
>who was the source of a particular "append" value.

I prefer to add headers instead of appending to them. We have a number
of servers and sometimes mail is bounced around (resend) one time or
another. Because MS allways adds headers to the end I can check the
order of the Received: headers with the order of the X-*-MailScanner
headers. In this way I found a misconfigured server (not one of mine).

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ