Would it be a good idea to learn viruses as spam?

[Ugo Bellavance]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

John Wilcock wrote:
> It struck me that most of the Bagle variants we receive here get highish
> Bayes scores (90+) whereas most of the Sober.Js still get lowish Bayes
> (20 or 30 at most). As new variants of viruses often retain at least
> some of the message text from previous variants, it seems to me that it
> might be a good idea to teach them to Bayes in the hopes of adding yet
> another line of defense to MailScanner's many talents.
>
> What does the combined wisdom of the list reckon on this one? Would it
> be a good idea for Julian to implement an option to automatically feed
> confirmed viruses to sa-learn --spam?


They usually get caught by the digest checks (pyzor, razor, dcc), so it
might not be useful if you use those.

>
>
> John.
>
> --
> -- Over 2500 webcams from ski resorts around the world - www.snoweye.com
> -- Translate your technical documents and web pages    - www.tradoc.fr
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!