Hmmm, Dusty are you there?
The name of the attachment appears in the header so searching the header for
the attachment name should do the trick...
Scott Phelps
NT Admin. Customer Service
+=====================+
WebKorner Internet Services
[EMAIL PROTECTED]
www.webkorner.com
----- Original Message -----
From: John Henderson <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, December 02, 1999 3:43 PM
Subject: Re: [IMail Forum] ExplorerZip Worm!!!!!!!!!!!
> I just tried this and it did not work. I created a small file and
attached
> it to a message and it still went to my box. I named the file
> "Zipped_files.exe". Why? Should it be in the header??
> ----- Original Message -----
> From: Scott Phelps <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Thursday, December 02, 1999 1:52 PM
> Subject: Re: [IMail Forum] ExplorerZip Worm
>
>
> > Might wanna rethink that... It's what I did and every virus alert that
was
> > passed through my server got caught INCLUDING YOURS!!!!!
> >
> > Now I'm filtering for
> >
> > H~Zipped_files.exe:virusbox
> >
> > Scott Phelps
> > NT Admin. Customer Service
> > +=====================+
> > WebKorner Internet Services
> > [EMAIL PROTECTED]
> > www.webkorner.com
> >
> >
> >
> >
> > ----- Original Message -----
> > From: Bob Ferguson <[EMAIL PROTECTED]>
> > To: <[EMAIL PROTECTED]>
> > Sent: Thursday, December 02, 1999 2:21 PM
> > Subject: [IMail Forum] ExplorerZip Worm
> >
> >
> > > Per the NTSecurity.net Web site, the ExplorerZip Worm is out and
about.
> > > They state that the following is in the body of the message:
> > >
> > > I received your email and I shall send
> > > you a reply ASAP.
> > > Till then, take a look at the attached
> > > zipped docs.
> > >
> > > So, would the following, added to the rules.ima work to block the
> > > ExplorerZip Worm?
> > >
> > > B~I received your email and I shall send you a reply ASAP. Till then,
> take
> > a
> > > look at the attached zipped docs.:NUL
> > >
> > > Thanks.
> > >
> > > Bob
> > >
> > > Please visit http://www.ipswitch.com/support/mailing-lists.html
> > > to be removed from this list.
> > >
> >
> > Please visit http://www.ipswitch.com/support/mailing-lists.html
> > to be removed from this list.
> >
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
