Nearly every day, my wife receives a message purporting to be from Paypal
with the subject "IMPORTANT" and within the email there is the message:
"A message filter removed the following attachment(s) from this message:
www.paypal.com.pif"
Now if Onetel can provide virus filtering, why can't more ISPs? What are
the arguments against ISPs filtering viruses?
Well, those of us who were concerned that ISPs and antivirus vendors
would bungle the job were right. However, I never anticipated the
various creative ways they would come up with to botch it.
We now often hear the sad tales of users having their internet service
dropped by their providers because their PCs are allegedly infested
with some worm ... when they're not! That's due to the way worms often
fake the actual sender. To add insult to injury, users are being sent
proud announcements by stupid antivirus companies who have the policy
of notifying alleged senders of malware infested emails ... whether
they are the actual sender or not ... thus further cluttering up email
with useless junk emails ... which are nothing but spam by the av
companies.
Another problem I've noticed ever since antivirus companies got
"cutesy" and decided to zap zipped attachments containing files with
certain file extensions, including password protected zips, is that
you often can't submit suspect files to av vendors for analysis
without taking draconian measures. One way I found that works for the
time being with my submissions to KAV in Russia is to password protect
a zip and then RAR that. How ridiculous! And I wasn't even notified by
whatever bot along the way zapped my submssions ... I would hear about
it from a KAV virus analyst. In some cases, it was a competing av
product that was doing the zapping but in one case it was a KAV
scanner
It's becoming insane.
Now, ever since my email server limit of 10 meg was once threatened by
floods of large Sircam infested attackments, I became a proponent of
ISPs doing a simple zap of such very obvious and current malwares. But
_only_ that! Nothing more! That's the responsible thing for ISPs to
do. There's no way users can prevent their ISP's servers from being
flooded with the latest and current malwares. Only the ISPs can do
that. But IMO, tha't _all_ they should do.
ISP virus filtering is now faily prevelant. My ISP offers such a
service as an option. I had tried their combo spam/virus filtering
service and found that it was goofing up more than I liked, so I
dropped it. I much prefer doing my own filtering of both malware and
spam.
Art
http://www.epix.net/~artnpeg
