RE: [Declude.Virus] Message.zip possible virus

Fri, 01 Aug 2003 13:01:03 -0700

Title: Message
Hi;
 
Yes it is .. but we know they both exist and why take a chance.. it is always best to cover all bases..
 
With what Bill suggested and these two the message will definitely get trapped.  I also included the filename and name= since with those chances of false positive is less than just putting message().zip
 
Regards
Kami
 
 
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of paul
Sent: Friday, August 01, 2003 3:40 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.Virus] Message.zip possible virus

Kami -
    Wouldn't the bottom one be enough? since filename has name in it already?
 
    I want to make sure I'm looking at this correctly. What a pain, I've seen an increase of these here as well, had the "Did you send this to me?" emails due to the admin@ address.
 
Paul
 
>>For now we have added the following:
BODY 0 CONTAINS filename="message().zip"

BODY 0 CONTAINS name="message().zip"

without ()

Reply via email to