Re: zero-hour protection

sj@xxxxxxxxxx wrote:
> I attended a conference where I heard about the Zero-Hour protection
> by Commtouch and a Hungarian AV-vendor has licenced their solution.
>
> Basically Commtouch has many sensors (probably email addresses) in the 
> Internet. If the sensors are picking up a lot of similar emails it is 
> obvious that they are virus/worm/spam/... This technique does not need
> any signature since it counts the similar messages so it can give you
> protection before any signature could be made.

This is unlikely. Viruses tend to spread to mail addresses
stored inside peoples address books and not to honeypot
mail addresses.

Cami
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html