Re: Imaginary viruses

[David Gibbs <david@xxxxxxxxxxxx>]

Some of the virus scanners don't actually look for virus signatures, like
Norton AV and McAffee, but they look for key words associated with a virus.

For instance, if the words "Good" and "Times" showed up in the subject, it
would kick the message out.

Obviously an inefficient and inaccurate technique, but it gives them
comfort (I guess, I'm sure they are still hit with a number of viruses, and
end up loosing real mail).

My recommendation is to just ignore the virus alert messages.

The mailing list software that I am running automatically strips out any
attachments (much to the shagrin of those sending word documents or pdf's)
so it's very difficult for a virus to be distributed through one of the
mailing lists I host.

david

At 02:45 AM 8/14/2002, you wrote:
>Hi all
>
>Just got an automatic reply to a post I just sent to Midrange-L from one
>of the subscriber's mail systems to say it had a virus attached, and it
>had been deleted. It didn't say which virus, and as I don't use Windows,
>only send plain text and don't include attachments when posting to
>Midrange, I can't see how it managed to get so confused. As the list
>software strips attachments anyway, I can't see how genuine viruses could
>propagate anyway. Does anyone else get these sort of replies?
>
>Regards, Martin
>---------------8<-----------------------
>MDaemon Warning - Virus Found
>Date: Wed, 14 Aug 2002 09:26:52 +0200
>From: postmaster@xxxxxx.xx
>  To: martin@dbg400.net
>Reply to: postmaster@xxxxxx.xx
>
>  The following message had attachment(s) which contained viruses:
>
> >From      : martin@dbg400.net
>To        : xxxxx@xxxxxx.xx
>Subject   : Re: srcmbr utility.
>Date      : Wed, 14 Aug 2002 08:24:29 +0100
>Message-ID: <20020814072421.LAQK23840.mta03-svc.ntlworld.com@there>
>
>Attachment                    Virus name               Action taken
>------------------------------------------------------------------------------
>cf1750817916.hdr              ???                      Removed
>--
>martin@dbg400.net  jamaro@firstlinux.net  http://www.dbg400.net    /"\
>DBG/400 - DataBase Generation utilities - AS/400 / iSeries Open    \ /
>Source free test environment tools and others (file/spool/misc)     X
>Debian GNU/Linux | ASCII Ribbon Campaign against HTML mail & news  / \
>_______________________________________________
>This is the Non-Technical Discussion about the AS400 / iSeries
>(Midrange-NonTech) mailing list
>To post a message email: Midrange-NonTech@midrange.com
>To subscribe, unsubscribe, or change list options,
>visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-nontech
>or email: Midrange-NonTech-request@midrange.com
>Before posting, please take a moment to review the archives
>at http://archive.midrange.com/midrange-nontech.