And some do not include the quote marks! So I believe it is more
"universal" to omit the quotes and "file" from "filename"
I use the following rules (remove the + characters):
H~name=.*\.v+bs:virusbox (or NUL)
B~name=.*\.v+bs:virusbox (or NUL)
Or to specifically catch the Anna virus:
H~name=.*AnnaKour+nakova.j+pg.v+bs:virusbox (or NUL)
B~name=.*AnnaKour+nakova.j+pg.v+bs:virusbox (or NUL)
Substitute \p for \. if your IMail is older than 6.05. The .*
following the equal sign is a wildcard for any number (including
None) of any characters, so it "accepts" the presence or absence of
a leading quote mark (covering all bases). Since "filename"
includes the word "name" - why not cover all bases by dropping the
"file" portion and cover all scenarios!
The syntax used above ( name=.*\.v+bs:virusbox ) has worked
beautifully for me for the past year. I use rules like these as a
second-level defense after Declude & McAfee NetShield SCAN.EXE have
done their thing. This strategy saved my carcass today when
NetShield SCAN failed to detect ANY of over 800 of the sweet Anna's
inbound.
Thank you, IMail architects, for the RULES features!
Gordon Williams
Michigan State University
-----
Scott Perry wrote:
>
> >B~filename="AnnaKournakova.jpgvbs":NUL
>
> You just want to make sure that there is a "." between the "jpg" and "vbs".
>
> > It is appearantly important to have the header entry also as
> > some mail readers will only see the name of the file in the
> > mime header. This way both bases are covered.
>
> Actually, some mail clients will send the attachment as the E-mail itself (no text
>piece), in which case the filename appears in the headers. Normally, though, there
>is at least a blank text section, in which case the filename appears in the body.
>
> Also, some mail clients may just send the "name=", and not "filename=".
>
> --
> -Scott
>
> Declude: Anti-virus and Anti-spam solutions for IMail. http://www.declude.com
> --
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
