Re: [Declude.Virus] file extensions banned by domain

[Matt]

Gene, This will only detect base64 attachments (there are three other encoding formats that might be used), and only ones that follow strict MIME protocol in the format specified.  This is not by any means a safe way to tag all Zip attachments, especially for virus blocking, however it will catch most, especially the legitimate ones. Matt Gene Head wrote: Scott, I came up with this filter to trigger on emails with attachments with a .zip extension. I created a file called ziptest and added it into the global.cfg file as a filter named zipper. Ziptest.txt # Zip test HEADERS 0 CONTAINS Content-Type: application/x-zip BODY 0 CONTAINS Content-Type: application/x-zip In the .junkmail file for the domain or the individual user in the domain I put an action to take if the email failed this test. During my limited amount of testing it did stop the emails with a .zip file attached. Are you aware of any file extensions that may get caught with this filter that isn't a .zip? Gene Head ACCRAM Inc. MCP,Net+,A+,CCNA,CCDA [EMAIL PROTECTED] [EMAIL PROTECTED] -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Thursday, February 26, 2004 7:24 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] file extensions banned by domain Would I be able to ban extensions by domain using Declude Junk Mail? No, Declude JunkMail isn't designed to ban file extensions. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================