Some more changes to witty worm detection