W32/Sobig.F virus header

[Malcolm Ray]

> Malcolm Ray <M.Ray at ULCC.AC.UK> wrote:
> >
> >In the case of outgoing mail (which is what I was talking about), the header
> >serves no useful purpose, except in cases where an existing trust relationship
> >exists between the sending and receiving sites.
>
> We add the headers to outgoing email as well, partly to advertise
> that we have a scanner and partly so that people know that their
> correspondence with people at Cambridge may be filtered.

Aha!  The latter is the first decent argument in favour that I've seen.
Thanks.

> We *never* do
> sender notifications because of the spam they cause when a new virus
> turns up, so we rely on recipients (inside and outside Cambridge)
> to distinguish between legitimate and illegitimate email, and if a
> legitimate message gets filtered they must deal with the sender to
> get the attachment another way. The headers and replacement attachment
> contain URLs for the scanner's documentation which (because of the policy)
> is of interest to anyone who gets a message via our scanner.
>
> http://www.cam.ac.uk/cs/email/scanner/

Good documentation.