Out of curiosity, have you tried setting the rule in IMail Admin
(I'm using 6.02) *AND* testing your rule to be SURE the rule works.
Be sure to select BODY, CONTAINS, UNcheck Match Case, type in the
rule, then click APPLY. Next click TEST and test the rule by
slinging something like this at it:
filename="NastyLoveBug.vbs"
If you get "TRUE" in the upper left corner, then your rule correctly
caught that test. Click APPLY again, then exit. Assuming your
.FWD files are in place, send another test message WITH .VBS
ATTACHMENT from an external domain.
Gordon
-----
Dan Spangenberg wrote:
>
> OK, this is getting to be a pain now. I have tried the rules file both ways
> now and it still won't catch a .vbs attachment.
>
> B~attachment; filename=".*\.vbs":virus
> B~filename=".*\.vbs":virus
>
> I am doing it EXACTLY like Gordon is doing it, with a .fwd file in each
> users folder etc.
> What other variables may be affecting it?
>
> Any ideas?
>
> Dan
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Gerry Dalton
> Sent: Monday, May 08, 2000 6:28 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [IMail Forum] filtering for .vbs attachments
>
> After talking with TechSupport this morning I changed my rules to the
> following:
>
> B~attachment; filename=".*\.vbs":filtered_stuff
> B~attachment; filename="funny.htm":filtered_stuff
>
> Seems to work fine if it comes in via SMTP, not if you use the Imail Client
> and POP !
>
> I'm using IMFilter to spread rules out to all users....works great !
>
> I suggested to IMAIL tech support that they implement the following rule
> additons:
>
> A~ Attachments
> /x Extension
>
> Gerry
>
> At 12:12 PM 5/8/00 -0400, you wrote:
> >I tested the rule and it started catching all attachments... so I had to
> >take it out.
> >_Pete
> >
> >
> > > At 03:29 PM 5/5/2000 +0200, you wrote:
> > > >As variants of other .vbs viruses are turning up, I use a filter like
> > > >
> > > >B~filename=".*\.vbs":NUL
> > > >
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
