> 1.15. Does SpamAssassin filter email-borne viruses as well as spam?
>
> No. SpamAssassin is focussed on identifying spam, and not viruses.
> The mechanism of scanning for viruses is different, and software
> tailored for virus scanning is much much better at this task.

Well, I wouldn't expect SpamAssassin to be able to know a virus by
looking at patterns inside executable files.

But there's a certain subset of viruses - worms - that follow a fairly
predictable pattern. For example, the recent Microsoft worm always
says something like ``this is the latest version of security update,
the "September 2003, Cumulative Patch" update which eliminates all
known security vulnerabilities'' at the beginning (although it
replaces words with synonyms at random).

Another virus that sends a .scr file is always Content-type
multipart/alternative, and the text/plain part always says "Myzli!".

Isn't this exactly the kind of thing that SpamAssassin's pattern
scoring strategy is targeted against?

Or is the problem that every new worm would require new rules to be
written, since their message body could say anything, while
unsolicited commercial mail, in order to be profitable, has to use
certain words like [the drug that increases bloodflow to male anatomy,
which I can't name or else the mailing list rejects my message] and
"money back guarantee"?


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Reply via email to