"OMG YOU SENT TEH VIRUSESS"

[Stephen Swaney]

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> Behalf Of Jason Balicki
> Sent: Wednesday, June 15, 2005 12:46 PM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: OT: "OMG YOU SENT TEH VIRUSESS"
> 
> Like a lot of you, I'm on a lot of mailing lists.
> 
> Because of this, I get a large amount of garbage
> mail.  One particular type of garbage mail is
> mis-configured mail scanning suites that send
> "virus received" warning messages.  You all know
> why this is bad, so I won't discuss this.  I'll
> just say that it annoys me greatly -- especially
> when my users receive them and I have to go
> through the incredibly boring explanation of
> what happened yet again.
> 
> What I'd like to know, though, is what the general
> consensus is in regards to dealing with these.  Is
> it bad form to track down the admin and explain
> (gently) that it's a bad idea to send these?
> 
> I've sent mail to admins of domains before, but
> I've never received an "ok, we understand" (sign
> for OK!) back, and for the most part it does no
> good, because I get the same messages over and
> over.  The Samba users mailing list is especially
> bad for this sort of behavior.
> 
> It's not like it's bad enough for me to black
> list them, and threatening to blacklist their
> domain from my domain is kinda pointless --
> chances are they'd never need to send or
> receive mail from us, ever.  But they're still
> contributing to the problem of too much garbage
> traffic and not the solution.
> 
> Has anyone had any success with these situations
> before?  Any magic words that seem to help
> straighten out the offending parties?

We use a modified version of the # bogus-virus-warnings.cf:

	http://www.timj.co.uk/linux/bogus-virus-warnings.cf  

Our Version is modified to disable some rules that might catch valid
MailScanner messages / reports. Very few bogus virus warnings make it
through this ruleset.

A copy of:

	Our version of bogus-virus-warnings.cf
	Rules_Du_Jour
	Our Rules_Du_Jour wrapper script 
	An install script for Linux systems that use /etc/cron.daily

Is available from:

	www.fsl.con/support

Steve

Steve Swaney
President
Fort Systems Ltd.
Phone: 202 338-1670
Cell: 202 352-3262
www.fsl.com
steve.swaney at fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!