nolan@celery.tssi.com writes:
> Also, I DO run spamassassin here, and it is finding only perhaps 10-20%
> of the copies of the most recent worm. I think it sends out copies that
> are sufficiently different from each other that it bypasses all the
> checks, including a Bayesian filter.
Hmm. I've had no trouble filtering the actual worm (I filter using a
pattern that looks for the first few bytes of a base64-encoded Windows
executable file). The only copies that were getting as far as my spam
inbox were ones that had had the executable file removed by various
"helpful" filtering programs.
> I hope there is a special corner of hell reserved for spammers and an
> even worse corner reserved for virus/worm writers.
And "antivirus" writers whose work increases the noise level instead of
reducing it. They should know better than to bounce back complaint
messages to the From: line when they have recognized a worm that is
known to forge From:.
regards, tom lane
