On Thu, 04 May 2000, Cherubini Enrico wrote: >> if ($h_subject: is "ILOVEYOU" or $h_subject: is "I LOVE YOU") and not >> error_mess > >what if someone change subject ? I can't understand why we should believe >the virus can be only in email with these subject (or like the penpal friend >one) >Wouldn't be better do scan email in body searching for fingerprint of macros >? maybe it can be of high weight to scan all email, but if you want to do >something, it's better to do it at the best.
Another issue of course is that this subject filter will really suck when St Valentine's day comes around. -- My current location - X marks the spot. X X X