RE: Antivirus Software to Send Back Infected E-mail
- From: "Patrick Cote" <Patrick.Cote@xxxxxxxxxxx>
- To: "[ExchangeList]" <exchangelist@xxxxxxxxxxxxx>
- Date: Mon, 25 Aug 2003 17:30:37 -0400
It's been my experience with Melissa, Iloveyou viruses and now this SOBIG &
variants that while keeping notification turned on during normal operation is
desired, in a crisis situation it's not.
Think about it, for every virus email sent another email is fired off by the
antivirus software to the administrator, the internal user and possibly the
virus sender depending on your configurations. You are spamming your own
network with more messages than the virus is actually generating. Management
also usually has the perseption of being affected by the virus even though the
antivirus software is acting as it should.
I would suggest disabling the notifications until the storm passes. Just my 2
cents...
Patrick Cote
Ph: (613)231-2357
InnEight IT Solutions Inc.
167 Russell Ave, Suite 1B
Ottawa, ON
K1N 7X3
-----Original Message-----
From: John Tolmachoff (Lists) [mailto:johnlist@xxxxxxxxxxxxxxxxxxx]
Sent: Monday, August 25, 2003 1:00 PM
To: [ExchangeList]
Subject: [exchangelist] RE: Antivirus Software to Send Back Infected
E-mail
http://www.MSExchange.org/
The problem you describe is not acceptable.
An AV program should never clean and then send an infected message.
99.99% of infected messages are bogus.
If your AV software is doing this, yell at them and then run away from them.
Another reason why I hate CA.
The preferred method is to quarantine the message and send the recipient a
notification.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
> -----Original Message-----
> From: Lloyd Williams [mailto:Williams@xxxxxxxxxxxxxxxxxxxxxxx]
> Sent: Monday, August 25, 2003 9:53 AM
> To: [ExchangeList]
> Subject: [exchangelist] Antivirus Software to Send Back Infected E-mail
>
> http://www.MSExchange.org/
>
>
> Hi does anyone use an antivirus program. That automatically returns and
> infected E-mail to the sender, and stops it appearing in the users inbox.
> Our current antivirus solution "CA E-trust" just removes the infected
> attachment, so the body of the E-mail appears in the user's inbox.
> Consequently we have users with hundreds of So-Big Emails cluttering their
> inboxes. A preferred solution would be the users never see the infected
> E-mail at all, only the sender gets a notification. The other acceptable
> solution would be, the user just gets a notification from the AV agent
that
> a virus infect E-mail from "smith@xxxxxxxxxxxx" was blocked.
> For this solution to be useful to me if would have to work with exchange
5.5
> which we are currently running and Exchange 2003 which we intend to
upgrade
> to
> Lloyd Williams
>
> ------------------------------------------------------
> List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist
> Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp
> Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ
> ------------------------------------------------------
> Other Internet Software Marketing Sites:
> Leading Network Software Directory: http://www.serverfiles.com
> No.1 ISA Server Resource Site: http://www.isaserver.org
> Windows Security Resource Site: http://www.windowsecurity.com/
> Network Security Library: http://www.secinf.net/
> Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
> ------------------------------------------------------
> You are currently subscribed to this MSExchange.org Discussion List as:
> johnlist@xxxxxxxxxxxxxxxxxxx
> To unsubscribe send a blank email to leave-exchangelist-
> 1440469J@xxxxxxxxxxxxx
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist
Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp
Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com
No.1 ISA Server Resource Site: http://www.isaserver.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this MSExchange.org Discussion List as:
patrick.cote@xxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
Other related posts:
