At 09:56 AM 11/22/2005, Casey King wrote:
This morning we have been getting drilled by spam/virus emails.
Are they spam, or viruses? Not the same thing.
40 so far.
I should be so lucky to see as few as 40/hour during any kind of outbreak
Been getting a lot of phone calls from across the company about these emails. At least my mailscanner boxes are stripping the files, and tagging it as spam, but what worries me, is the low scores these messages are receiving.
SpamAssassin is a spam scanner. It's official policy is to EXPLICITLY not care about virus emails. No effort is made to try to catch them, because doing so would dilute the scores of the spam ruleset. No effort is made to try to avoid tagging them either. They're just removed from the corpus and handled by the developers as if they don't exist.
I start tagging spam, at 3.5 so each message has been tagged, but still sent through. Any one else seeing these emails?
I see plenty of viruses, and never give them a mind. My selective greylisting helps, but so far this morning my mailscanner still got 20 of them.
There was also a steep burst last Weds, 18 of them, which then leveled off through the rest of the day.
*shrug*.. tell your users in a broadcast email that there is a virus outbreak, but to not be concerned unless they have a message that looks like a virus and isn't tagged. You might also want to include some standard educational notes about viruses and their auto-sending, auto-forging habits.
