On Thu, Sep 18, 2003 at 11:00:40PM +0500, Ivar Magne Auestad wrote:
You are writing in the FAQ that you don't focus on viruses, but I have a suggestion. It would be very easy to add attachment type as a qualifyer. Very many viruses are attached as .pif-files or double extention attachments (document.doc.exe) or refered to as inline mime code. This would remove quite some prosent of the viruses spread.
Set yourself a higher score for the "MICROSOFT_EXECUTABLE" test.
The problem I'm finding with the latest worm is that sometimes the MIME attachment for the actual worm isn't included in the e-mail. I've already set MICROSOFT_EXECUTABLE high but I'm still getting a few e-mails an hour that consist of the worms e-mail without the worm actually attached. Since there's no executable SA isn't filtering these properly. So relying on this as a method to block worms like this doesn't always work.
-Bruce
------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
