W32/Sobig.F virus header

[Tony Finch]

Malcolm Ray <M.Ray at ULCC.AC.UK> wrote:
>
>In the case of outgoing mail (which is what I was talking about), the header
>serves no useful purpose, except in cases where an existing trust relationship
>exists between the sending and receiving sites.

We add the headers to outgoing email as well, partly to advertise
that we have a scanner and partly so that people know that their
correspondence with people at Cambridge may be filtered. We *never* do
sender notifications because of the spam they cause when a new virus
turns up, so we rely on recipients (inside and outside Cambridge)
to distinguish between legitimate and illegitimate email, and if a
legitimate message gets filtered they must deal with the sender to
get the attachment another way. The headers and replacement attachment
contain URLs for the scanner's documentation which (because of the policy)
is of interest to anyone who gets a message via our scanner.

http://www.cam.ac.uk/cs/email/scanner/

Tony.
--
f.a.n.finch  <dot at dotat.at>  http://dotat.at/
BISCAY: NORTH OR NORTHEAST 4 OR 5. MAINLY FAIR. MODERATE OR GOOD.