[Esd-l] SoBig.F backscatter trap

Brett Glass brett at lariat.org
Fri Aug 22 11:03:53 PDT 2003


At 12:00 PM 8/22/2003, Kevin Hemenway wrote:

>I'm seeing less "Undeliverable" bounces, and more "OH NOE! YOUR EMAIL HAS A VIRUS IN IT! POOH POOH!" auto-responses (which, cynically, anyone who's running a virus notifier should be painfully aware that the From: addresses are faked, and they're merely wasting even more time and energy).

The frustrating thing is that these can't be caught, because each antivirus
has its own form of message. But we can recognize the standard "Undeliverable:"
subject line which occurs when the worm sends itself to an obsolete address.
(This happens to be the bulk of what's landing in my mailbox, for some reason.)

--Brett



More information about the esd-l mailing list