Should be able to trap all the happy99 stuff with this...
H~X-Spanska:virus
I have successfully trapped over 2,000 copies with that.
And it should catch anything posted to the list. This would
have to be in the rules.ima for the domain however. Not just
for the list.
The H~Zipped_files.exe:virusbox should work. I think...
Dusty
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Gary Mauer
> Sent: Thursday, December 02, 1999 2:36 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [IMail Forum] ExplorerZip Worm
>
>
> > Now I'm filtering for
> >
> > H~Zipped_files.exe:virusbox
>
> Any way to make that work for an IMail mailing list?
>
> That is, can there be a rules.ima file?
>
> We had someone send happy99.exe to a list recently, and it created quite a
> stir, even if apparently no one opened it.
>
> Gary Mauer
>
> [EMAIL PROTECTED]
>
> Host/Moderator of the Window Cleaning Network
> - Your People, Product and Information Site -
> http://www.window-cleaning-net.com/
>
> Email Groups - 980 Networking Links
> 8 Bulletin Board and 21 Trade Show Links
>
>
>
> > -----Original Message-----
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED]]On Behalf Of Scott Phelps
> > Sent: Thursday, December 02, 1999 1:52 PM
> > To: [EMAIL PROTECTED]
> > Subject: Re: [IMail Forum] ExplorerZip Worm
> >
> >
> > Might wanna rethink that... It's what I did and every virus
> alert that was
> > passed through my server got caught INCLUDING YOURS!!!!!
> >
> > Now I'm filtering for
> >
> > H~Zipped_files.exe:virusbox
> >
> > Scott Phelps
> > NT Admin. Customer Service
> > +=====================+
> > WebKorner Internet Services
> > [EMAIL PROTECTED]
> > www.webkorner.com
> >
> >
> >
> >
> > ----- Original Message -----
> > From: Bob Ferguson <[EMAIL PROTECTED]>
> > To: <[EMAIL PROTECTED]>
> > Sent: Thursday, December 02, 1999 2:21 PM
> > Subject: [IMail Forum] ExplorerZip Worm
> >
> >
> > > Per the NTSecurity.net Web site, the ExplorerZip Worm is out
> and about.
> > > They state that the following is in the body of the message:
> > >
> > > I received your email and I shall send
> > > you a reply ASAP.
> > > Till then, take a look at the attached
> > > zipped docs.
> > >
> > > So, would the following, added to the rules.ima work to block the
> > > ExplorerZip Worm?
> > >
> > > B~I received your email and I shall send you a reply ASAP. Till
> > then, take
> > a
> > > look at the attached zipped docs.:NUL
> > >
> > > Thanks.
> > >
> > > Bob
> > >
> > > Please visit http://www.ipswitch.com/support/mailing-lists.html
> > > to be removed from this list.
> > >
> >
> > Please visit http://www.ipswitch.com/support/mailing-lists.html
> > to be removed from this list.
> >
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
