Re: [Exim] My Exim virus filter

On Wed, 6 Mar 2002, Greg Ward wrote:

> Also, mail loops are always a possibility; if someone has an
> autoresponder that responds to the "From" header ("mailer-daemon@..."),
> and their autoresponder includes the original bounced virus, then the
> regexes that look for virus text will trigger again, and my filter will
> respond again, and ... oh, you get the picture.

We've experienced something similar to this. A remote mailer thought
it had detected a virus, but forwarded the suspect mail to us with an
accompanying message saying that it had filtered out the virus and
forwarded the rest. Unfortunately, it had left enough evidence in
there for our mailer to bounce it as a potential virus. And when it
got the bounce, you can imagine what it did with it next...