It's tiresome to see a renewed flood of warnings about supposed viruses
from a brand of lame software spread by the same brand of lame junkware
from systems running that same brand of malware to other systems running
that brand of nonsense.
The flood would be helped by either:
1. fixing the IETF's mailing list systems to reject all mail with the
tell tale "X-Mailer: Internet Mail Service" header
2. fixing the IETF's mailing list systems to reject all mail with
a header starting with "Content-Type: multipart"
#1 is the right answer. However, if you want to coddle those who insist
on using broken malware, #2 would stem the flood silly warnings, reduce
spam, and reduce bandwidth wasted by those who insist on sending several
encoded copies of demonstrations of their wit and perception while
protecting those who need coddling.
Judging from the Received: line added by ietf.org, something like the
following added to a sendmail.cf might do #2:
HContent-Type: $>+Check_CT
SCheck_CT
R$*multipart$* $#error $: 553 reject multi-part spam
I think the following would be better, but I'm not so crazy to think
there is much hope:
HX-Mailer: $>+Check_junk
SCheck_junk
R$*Internet.Mail.Service$* $#error $: 553 reject broken vacation mailer
Vernon Schryver vjs(_at_)rhyolite(_dot_)com
...
Received: by ietf.org (8.9.1a/8.9.1a) id RAA25928
for ietf-outbound(_dot_)05(_at_)ietf(_dot_)org; Tue, 26 Dec 2000
17:30:02 -0500 (EST)
...
Message-ID:
<1FAC8547DACBD411A99600204840339533FC9F(_at_)whq-msgrtr-01(_dot_)pit(_dot_)comms(_dot_)marconi(_dot_)com>
From: Anti-Virus Utility
<ANTIGEN_WHQ-MSGRTR-01(_at_)pit(_dot_)comms(_dot_)marconi(_dot_)com>
To: "'ietf(_at_)ietf(_dot_)org'" <ietf(_at_)ietf(_dot_)org>
Subject: Antivirus Utility found the W32/Hybris(_dot_)gen(_at_)M virus
Date: Tue, 26 Dec 2000 14:32:53 -0500
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2650.21)
Content-Type: text/plain
Antivirus Utility for Exchange found enano.exe infected with the
W32/Hybris(_dot_)gen(_at_)M virus. The file is currently Deleted. The
message,
...