Re: How to block usurpated address return path ?

> Hello,
>
> We are seeing an increasing number of error messages (wrong address,
> virus,
> etc...) coming back to somebody who has not sent the incriminated message
> in the first place.

You too, eh?

> In most cases, the address is usurpated by some virus,
> using the address book and/or the messages on the infected machine. When
> the mail server or the antivirus software sends back an error message to
> the apparent sender, it comes into the legitimate owner mailbox, who
> wanders why he receives this message. It wouldn't be a big problem if it
> concerned a small amount of messages, but sometimes, it happens to be
> hundreds of error messages, saturating a mailbox in a few hours time.
>
> Does anyone has some ideas about how to discard this kind of messages
> ONLY,
> without discarding legitime MAILER-DAEMON messages in the mean time ? Is
> there any way to distinguish a legitimate error message from an usurpated
> address one when people use various SMTP servers for sending mail, often
> different from the one receiving their mail ?

You can use Tim's bogus-virus-warnings SA ruleset to look for the virus
warning component of this problem - http://www.timj.co.uk/linux/sa.php

Peter