"Brubaker, Aaron" wrote:
>
> Having Antigen notify external senders/recipient of viruses or filtered
> files could certainly cause a lot of unwanted emails.
Thank you for pointing out in your earlier message that Antigen _can_
be configured to behave in a manner different from that which causes the
problem. That way it boils down to an education issue for administrators
rather than for end users, and the smaller audience might help.
> Also, I've never seen Antigen 'alter its own return address to appear to
> come from the user's local E-mail system'. Are you sure that is what
> happened?
> [...]
See the second enclosed E-mail in the original message on this thread,
from Marc Conlin, reproduced here with HTML-ization removed; in the
original, he highlighted the offending header information in red after
converting to HTML. The "From:" header clearly says "[log in to unmask]",
which not only is not the true origin of the message, but it doesn't exist
at all.
> Return-Path: <[log in to unmask]>
> Received: from hrnt2.hr.msu.edu (hrnt2.hr.msu.edu [35.8.31.211])
> by kepler.pa.msu.edu (8.10.2+Sun/8.10.2) with ESMTP id g0SDi0P02729;
> Mon, 28 Jan 2002 08:44:00 -0500 (EST)
> Received: by hrnt2.hr.msu.edu with Internet Mail Service (5.5.2653.19)
> id <DSQQFCJ0>; Mon, 28 Jan 2002 08:44:53 -0500
> Received: from BIGHORN.rad.msu.edu (rad-159-35.rad.msu.edu [35.8.159.35]) by hrnt2.hr.msu.edu with SMTP
> (Microsoft Exchange Internet Mail Service Version 5.5.2653.13)
> id DSQQFCJ1; Mon, 28 Jan 2002 08:44:37 -0500
> Received: from mail pickup service by BIGHORN.rad.msu.edu with Microsoft SMTPSVC;
> Mon, 28 Jan 2002 08:43:45 -0500
> From: [log in to unmask]
> To: TimeAttendanceSA <[log in to unmask]>
> Subject: Antigen found =*.com file
> Message-ID: <[log in to unmask]>
> X-OriginalArrivalTime: 28 Jan 2002 13:43:45.0879 (UTC) FILETIME=[CEAA5E70:01C1A801]
> Date: 28 Jan 2002 08:43:45 -0500
> Content-Length: 270
> X-UID: 17010
>
> Antigen for Exchange found Unknown->www.myparty.yahoo.com matching =*.com file filter.
> The file is currently Removed. The message, "new photos from my party!", was
> sent from SHAULIS, CAROL and was discovered in SMTP Messages\Inbound
> located at Unknown/Unknown/BIL.
--
George
------------------------------------------------------------------------
George J Perkins [log in to unmask] Work: 517-432-3820
125 Physics-Astronomy Bldg, MSU Home: 517-332-2746 FAX: 517-353-4500
East Lansing, MI 48824-1116 http://www.pa.msu.edu/people/perkins/
