I need to clarify my security department is running Interscan VirusWall but it didn't detect the virus and let the email pass. I assume that with the updated patterns that future messages would be blocked. That still leaves a problem that this type of message, can score nothing by SpamAssassin. I am sure that [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> didn't send the messages....why didn't that trip any rules?
I've not seen a single credible review that rated Interscan any better than "better than nothing". I threw it away for clamav over a year ago and haven't looked back. It's far too much money for what you get.
Beyond that, there's not much there for any kind of rule to grab onto. You could always block incoming zip files.
Remember, it was a virus, not spam. SpamAssassin is optimized around finding spam (hence the name).
I have 3 different AV products from 3 different vendors running at 3 different layers here (gateway, server, client station). Generally at least one of the three has their stuff together well enough to keep the viruses out.
-Steve
