Sending Suspicious Email To U-M Virus Busters For Us To Examine

This information can be freely reproduced in any medium, as long as the information is unmodified.

In order to decide whether or not you should even consider sending us suspicious or infected email attachments, see our What To Do With Suspicious Email page.

In order to help, we need several things:

1. The body of the email:
   This is pretty obvious -- most emailers will include this automatically

2. Any and all attachments:
   This is pretty obvious, too, but may depend on your emailer. Without the attachments, we cannot determine with certainty what virus it is -- or even if it is a virus or other nasty.

3. FULL EMAIL HEADERS:
   This is the tricky part; see below. We need the full RFC2822 headers to be certain that we contact the real victim, if there is one: some viruses forge the From: field, and only with full email headers can we find the true source of the problem.

   RFC 2822 (leaving our site) is the document that formally specifies Internet Message Format.

=== How to send email headers ===

If you use one of the standard email packages recommended by the University (pine, Mulberry, or mail.umich.edu), it's particularly easy to give us everything we need (headers, body, and attachments):

• If you use pine, just press the "b" key to "bounce" me a copy. [You may need to enable the bounce command: See under Setup/Configure; in Advanced Command Preferences, select "enable-bounce-cmd".]

• If you use Mulberry, choose Bounce from the Messages menu.

• If you use mail.umich.edu, view the message and then click on the "Redirect" button at the bottom of the window.

  25 December 2002 -- NOTE: The Redirect feature may be disabled at this time, pending resolution of other issues. If it's not available, then obviously you'll have to find another way to send us the information.

• For Apple's Mail program users: If you need them to send headers to virus-busters, just go to View>Show all headers; then simply forward the message and the original headers will come along automatically

Otherwise, ....

If you don't use one of the above email applications, and you don't know how to display the full email headers, please check SpamCop's Email Header FAQ, (leaving our site) or WHOA's How to Get Full Headers in Your Software page (leaving our site), both of which have (different, somewhat non-overlapping) instructions for many different email programs.

If you can't find instructions at these sites for your emailer, then: