For the win32.sober.N german/english worm we all love - I have done the following:

1. put the known attachment names in the attachments filter:

account_info-text.zip
account_info.zip
<sender domain>_PassWort-Info.zip
autoemail-text.zip
mail_info.zip
error-mail_info.zip
okTicket-info.zip
Fifa_Info-Text.zip
our_secret.zip
LOL.zip

2. Also added worm german subject lines to the keyword filter:

Ihr Passwort
Mail-Fehler!
Ihre E-Mail wurdeverweigert
Ich bin' s, was zum lachen ;)
Glueckwunsch: Ihr WM Ticket
WM Ticket Verlosung
WM-Ticket-Auslosung

This reduced the flow of viruses passing through the filter.  I am not running the new norman virus plug-in.  I thought I would share the info and ask you to share any additional ideas regarding the filtering this threat. (keywords and subject lines are from Computer Associates)

Dwight