218942 - W32.Mimail worm's emails never learned by the spam/junk filter

Status: NEW

(MailNews Core :: Filters, defect)

Description

[Adam D. Moss]

I'm receiving several large emails a day -- sometimes dozens -- from the
W32.Mimail worm.

While I don't much care from a security point of view, since I'm not running a
platform that it targets, if I mark it as 'junk' (as often as I like) it still
never gets 'learned' by Mozilla MailNews' spam filter and always gets through,
despite having a very characteristic unobfuscated opening paragraph (and then an
attachment -- I don't know if the attachment is randomized).

I think that the spam filter really should be able to 'learn' this spam.

Comment 1

[Adam D. Moss]

Attachment: an example W32.Mimail email

Comment 2

[Adam D. Moss]

Attachment: another example W32.Mimail email

Comment 3

[Adam D. Moss]

Hmm, yes, even the attachments of the worm's emails are virtually the same (one
just has a little more cruft on the end for some reason).

Comment 4

[José Jeria]

*** Bug 218941 has been marked as a duplicate of this bug. ***

Comment 5

[Jerry Baker]

This also applies to W32.Swen.A@mm virus. I have received 7 in the last two
hours and have manually marked each of them as junk. Still, Mozilla does not
mark them as such as they come in.

Comment 6

[Jerry Baker]

See also: "JunkMail Controls seem to becomming less effective - not catching
Microsoft Patch spam" (W32.Swen.A@mm) thread in n.p.m.mail-news.

Comment 7

[Federico Tello Gentile]

I trained it yesterday and the day before and today I had 6 of them
automatically marked as spam. I use mozilla 1.4

Comment 8

[Adam D. Moss]

After a couple of days of training it seems to catch W32.Swen about 50% of the
time.  BUT, it correspondingly starts to drop a bunch of pretty obvious 'normal'
spams.  :)

And it's still not learning W32.Mimail.

Comment 9

[Matthias Versen [:Matti]]

*** Bug 223472 has been marked as a duplicate of this bug. ***

Comment 10

[Zook Valem]

It been noticed that the virus is being altered or being copy-cat repeatly.  (It
even defy the Norton Anti-Virus temporary when I'm using MS-Outlook until the
DAT was updated nightly - Not related to this Mozilla).  The question here is
how to write a better programming for the Spam/Junk Filter to adapt to the
changing nature of the spam mail?

Comment 11

[Adam D. Moss]

Well, no, that's not really the question -- Mozilla doesn't even seem to learn
the vanilla virus.  Adapting to mutants would be a different bug.

Comment 12

[(not reading, please use [e-mail] instead)]

sorry for the spam.  making bugzilla reflect reality as I'm not working on these bugs.  filter on FOOBARCHEESE to remove these in bulk.

Comment 13

[Serge Gautherie (:sgautherie)]

Filter on "Nobody_NScomTLD_20080620"