Why (some) anti-virus companies are to blame for the recen..

As everyone knows, Sobig.F has generated a tremendous amount of e-mail
traffic world-wide. However, that traffic is partly to blame on some
of the anti-virus companies.



What I am referring to is the large number of incorrectly configured
mail filters that respond with a "virus alert" to the "From:" address.
As Sobig.F forges the From: address, those mails just clutter up
mailboxes of innocent, non-infected people, causing annoyance and
worry, as typically (and incorrectly) the messages claim people sent
out a virus.



Worse yet, if the mail filters send out one message for every copy of
Sobig.F you receive, they are in effect doubling the traffic - which
makes them a part of the problem, not a part of the solution.



The problem is that some commercial mail filters have this behaviour
set as the default, or worse yet - at least one filter only allows
this behaviour or "pass the message through to the recipient", which
is clearly not acceptable either.



I have only one word for this: Stupid!



Acceptable behaviour would be one of the following:



1) Have the mail filter properly distinguish between worms that
forge the

From: address and those that don't and only send the warning
message

when the Address is likely to be the "right" one.



2) Do not send the alerts at all.



In fact, sending an alert automatically to the From: address for every
virus or worm received by e-mail should not even be a selectable
option.



I hope other anti-virus producers will be updating their products in
the near future, but that is not going to happen unless their
customers request this.



-frisk

null.DeleteThis@zilch.com wrote:
> On 9 Sep 2003 05:45:50 -0700, frisk.DeleteThis@complex.is (Fridrik Skulason)
> wrote:
[snip]
>>I hope other anti-virus producers will be updating their products in
>>the near future, but that is not going to happen unless their
>>customers request this.
>
>
> That strikes me as very odd. Why would the av producers not go ahead
> and do what's obviously required?

because a number of anti-virus software houses (in fact most software
houses of any type) are ruled by 'management'... sometimes they might
look at something other than the bottom line, but don't count on them
doing so... if there are a lot of user requests for this then
management has 2 options, satisfy the users request or leave the users
unsatisfied - which obviously affects their bottom line...

--
"hungry people don't stay hungry for long
they get hope from fire and smoke as the weak grow strong
hungry people don't stay hungry for long
they get hope from fire and smoke as they reach for the dawn"