Bugtraq: Re: getting rid of outbreaks and spam

["Dave Warren" <dave.warren () devilsplayground net>]

Thor Larholm wrote:
> > 2. In a broader view, notifications ARE currently the
> > problem rather than a solution.
> I think we all recognize the fundamental truth that AV notifications
> are pure marketing. They contain no instructions on removing the
> virus and only serve to spread FUD. Somewhere sometime, a marketer at
> an AV company thought "hey, let's get new customers by notifying
> people that send the virus!", implemented it and everybody followed
> suit since "everybody is doing it, we might as well also".
Think back to the beginning.  Before viruses emailed themselves out, back
when viruses attached themselves to otherwise legitimate EXEs, DOCs(macro
viruses), etc.  In those days when I implemented a virus scanner, I didn't
notify people initially (long story, it was a hacked together solution), I
started getting complaints that email with attachments wasn't making it
through.

In this context, virus notifications were a positive thing.

Next in the evolution we had viruses that emailed themselves out, wasn't
Melissa one of the first?

At any rate, in the beginning, viruses emailed out with a legitimate "MAIL
FROM" address, so even then, notifications typically went to the correct
sender, although in this case notifying the recipient wasn't very effective.

-- 
Dave Warren,
 Email Address:  dave.warren () devilsplayground net
 Cell: (403) 371-3470         Fax: (403) 371-3471
 Toll free: (888) 371-3470 Vonage: (817) 886-0860
 ICQ: 17848192  AIM: devilspgd  Yahoo!: devilspgd
 MSN/PASSPORT:   dave.warren () devilsplayground net