Version 7. Changed the text-match back to the original that was using wildcards. Added a tentative filter for real microsoft bulletins. I don't have any actual emails to analyze to I have based this on the fact that Microsoft says that their emails are digitally signed and I therefore match "-----BEGIN PGP SIGNED MESSAGE-----" which is the usual indication of a signed message.
Version 6 of the swen spam filter includes detection of various antivirus-messages.
The filter detects most of the virus-infected spam that is sent as a sideeffect of someone getting infected with the W32.Swen.A@mm worm (http://www.symantec.com/avcenter/venc/data/w32.swen.a@mm.html).
See http://nakawe.sf.net/MMM3 for more information.