Anti-virus filtering

This web page explains what to do about messages that have been filtered by the University of Cambridge central email scanner. The scanner alters email to remove viruses and other dangerous content.

In particular, the scanner filters out attachments that contain viruses identified by commercial anti-virus software. If a message has been filtered for this reason, the problematic attachment is deleted and replaced by a notice similar to this:

This is an automated message from the University of Cambridge's
central email virus filter.

The original email attachment "eicar.com"
was believed to be infected by a virus, so it has been deleted and
replaced by this notice. For more information about the virus filter
and advice on what to do about this message, see
<http://www.cam.ac.uk/cs/email/scanner/virus.html>

At Thu Jul 10 12:34:56 2003 the virus scanner said:
        Found: EICAR test file

The message as a whole might or might not be legitimate.

If it does appear to be legitimate, the person that sent you the message probably has a virus infection in their computer. You should warn them about this problem, with reference to this web page and to <http://www.cam.ac.uk/cs/virus/>. The virus scanner does try to disinfect the attachment; if it succeeds then it will forward the cleaned attachment to you. If not, the attachment is deleted and cannot be recovered because it is too dangerous.

If the message is not legitimate, the only thing you can do is delete it. Viruses frequently forge email, so the apparent sender of the message is probably not the one that is infected.

Click here for more information on the email scanner.