First the bacground...and a rant... so [rant]
I assume the other sysadmins here have been watching Sobig bounce off email antivirus wall.
It was easy to stop (we block all attachments regardless) but then we started getting bombarded with messages from other company antivirus systems telling our users that they had sent infected emails. Our helpdesk got flooded with concerned users, they are used to the "blocked" messages but not these AV bounces.

To my peeve.
Those frikkin email administrators who turn on the "reply with warning to sender" on their email AV gateways.
Given that 99% of current viruses out there spoof the "from" address, who do these idiots think they are sending the reply to? Or whose bandwidth they are chewing up by sending out the "replies".
We have just changed our policy to send the infected email to the bitbucket and am trying to figure out how to do the same for these spamming admins.
[/rant]
Wow, I feel much better now.
All I have to figure out is when to let email from these companies back into our system.

I must admit that I was one of these admins, until about noon on Tues. Until recently, we figured there were enough virus' going around that DIDN'T spoof that it was worth the few false alarms that did. No longer.

Yeah - I got a ton of calls from my peeps on this issue over the last couple days. We turned off the AV reply notice some time ago, when one of the big From: forgers first hit. (sigh) My log files are getting way too big, though.

-jk