On Tuesday 23 September 2003 16:44 CET Landy wrote: > On Tue, Sep 23, 2003 at 03:42:56PM +0200, Malte S. Stretz wrote: > > Jepp, the rule is slightly broken, especially for those "use this patch > > now" worms. It currently uses this RegExp: > > /^TVqQAAMAAAAEAAAA/ > > But it seems like some of those .EXEs have different "magic" bytes. > > This works for me: > > /^TV[qp]QAA[MI]AAAAEAA[A8]A/ > > but why did it change from 2.55 i mean if it's not broken why change it?
The rule hasn't changed. As Bart already pointed out does 2.60 use exactly the same pattern as 2.5x. But the virii have changed in between. Try it with 2.55 if you like: You'll get the same results. Cheers, Malte ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
