Hi, On Fri, 19 Sep 2003, Forrest Aldrich wrote:
> This new virus appears to generate many (random?) subjects, so it's getting > difficult to narrow down. > > Has anyone filters for Spamassassin that will correctly identify this > virus? I'd like to score this one high so they are rejected (via > spamass-milter)... it's been a huge problem all day. Why not just increase: score MICROSOFT_EXECUTABLE 0.100 to 4.9 or more? Of course, the message is generally too large for SA to scan anyway. Do people really send legitimate MS executables around in the raw? Is it too much for your correspondents to zip legitimate exeuctables before sending them? Better still to install MIMEDefang and mangle all inbound MS executables, regardless of source, subject, or sender. I use Anomy Sanitizer because it works with Postfix, but the concept is the same. Remember that SA is not an AV program. While a broad interpretation of "e-mail viruses" = "unsolicited bulk email" = "spam" is not unreasonable, SA is not designed to do what you're trying to do with it. hth, -- Bob ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
