http://bugzilla.spamassassin.org/show_bug.cgi?id=3010
------- Additional Comments From [EMAIL PROTECTED] 2004-02-05 10:12 ------- Subject: Re: Implement base anti-worm plugin ... Here's a thought. Virus zip files are more likely to be small. Real zip files are more likely to be large. Seems to me that the SIZE of the zip file might be significant. [EMAIL PROTECTED] wrote: >http://bugzilla.spamassassin.org/show_bug.cgi?id=3010 > > > > > >------- Additional Comments From [EMAIL PROTECTED] 2004-02-05 08:29 ------- >This is a great idea. The anti-virus plugin should probably also include >some basic rules that are useful for generating rules more specific to various >worms, viruses, trojans, etc. sent via email. > >base64 for the first line of Zip archives is always: > > /^UEsDB[A-P]/ > >because PK\003 turns into "UEsD". \004 is B plus 2 bits which end up limiting >the next character to be in the range [A-P]. > >Maybe we could opt for less verbose names. :-) > >BINARY_EXE >BINARY_ZIP > >etc. > > > > >------- You are receiving this mail because: ------- >You are the assignee for the bug, or are watching the assignee. > > > ------- You are receiving this mail because: ------- You are the assignee for the bug, or are watching the assignee.
