[Spambayes] Spamvolution

Tim Peters tim.one@comcast.net
Fri, 20 Sep 2002 17:02:52 -0400


> ...
>>  It was great to talk to you today I should have the propsal done by
>> tommorrow

[Greg Ward]
> I believe that's a new-ish virus that's been making the rounds this
> summer -- it appears in that basic form, with various common English
> male and female names in place of "Tim" and "Susan".

I'm too fried -- I actually have a lot of these in my spam.  It's just that
*this* one is the only false negative remaining from that set -- it got
supernatural benefit out of putting "Tim" in the subject header, and from
misspelling proposal (someone on c.l.py made a propsal once too <wink>).
Under Robinson's combining scheme, it scores between 40 and 50 even so.

> Sure there were no attachments, or funky "I removed a virus and
> forwarded you this junk anyways" crap from a stupid virus scanner?

Believe it or not, that was the whole banana -- and they're all like that.
The

Content-Length: 106
Lines: 9

in the quoted headers was telling the truth, although one of the lines got
folded by mailer when I quoted the message (so you saw 10 lines in the body;
"tomorrow" belonged on the preceding line).

However, it *is* a worm, and a very smart one:  it's somehow managed to copy
itself all over this list of people who should know better <wink>.