> The main reason is adding rules to catch or not catch viruses would wind
up
> diluting the scores of the spam rules. This would weaken SA's spam
> detecting abilities, in order to grant it rather lame virus catching
abilities.
Hum. Interesting philosophy, but I don't know that it is actually true, at
least these days.
If you think about it, most virui you are likely to get are from infected
zombies sending out another copy of themselves.
Most spam that you are likely to get is from infected zombies sending out
spam. Sounds to me like the source is pretty much the same in both cases.
So source rules should work fine for either.
Also, virui are designed to have enticing subjects, or innocous subjects, so
that unsuspecting fools will open them and activate the payload. Most spam
is designed to have enticing or innocous subjects to get past spam scanners
and hopefully get fools to open them and trigger the web bugs and payload.
Again, that sounds a lot like the same thing.
Now, I grant the payload differs. But there isn't a lot different between a
virus payload and body and a gif-spam body and payload. In either case SA
will ignore the real payload, and all you are left with is a few lines of
body text.
About the only real difference is SURBL isn't effective against a virus.
Loren
