I changed it from header to body and it's trapping nicely now. No "real" viruses but my pretend one I sent as a test was caught right away.
Thanks, Rodney -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Rick Leske Sent: Friday, August 01, 2003 2:16 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] M e s s a g e . z i p possible virus put something like B~This email address will be expiring into your exsisting rules.ima file ~Rick -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Rodney Bertsch Sent: Friday, August 01, 2003 12:46 PM - FamHost To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] M e s s a g e . z i p possible virus What's the best way to trap this in I-Mail? I tried adding m e s s a g e . z i p to the list of captures for message header, but a test came right on through? Thanks, Rodney Bertsch IS Coordinator Kirk NationaLease Co. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff (Lists) Sent: Friday, August 01, 2003 1:35 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] M e s s a g e . z i p possible virus The ones I got came from 204.73.176.250 John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell LaRock Sent: Friday, August 01, 2003 10:20 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] M e s s a g e . z I p possible virus We are getting pounded by this. Literally 100's per minute. They are all coming from 198.45.18.20. Darrell Darrell LaRock Systems Analyst Gannett Television 716-849-2272 ___________________________________________________________________ Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
