To add my two cents worth, I recommend expanding your rule to include other
common worm and virus-laden attachments such as .shs (scrap object, used by
VBS.stages.A and arriving as the attachment LIFESTAGES.TXT.SHS),and .scr
(screen saver - frequently used by the W95.Hybris.worm AKA Snow White). As
we have discussed recently on the list, the first of the following two rules
checks for MIME attachments, while the second checks for Uuencoded
attachments.
B~(name=".*\pvbs|name=".*\pshs|name=".*\pscr):quarantine
B~(Begin 6.*\pvbs|Begin 6.*\pshs|Begin 6.*\pscr):quarantine
The vertical bars (|) stand for "or" thus testing for several conditions.
As confirmed by consultation with Ipswitch tech support (and checking the
IMail User's Guide, p. 78 under "Limits") Rules will only check the first
32K of a message (which is usually, but not always sufficient to filter an
attachment).
I prefer using the option of redirecting filtered messages to "quarantine"
with a forward file (quarantine.fwd) in each user's directory sending these
messages to a single account. This allows me to monitor the quantity and
source of the viruses, and to be sure that nothing gets filtered
erroneously. I use a batch file to propagate the forward file to all users
as necessary.
Michael
> From: Tejinder Saini <[EMAIL PROTECTED]>
> Subject: [IMail Forum] How can I create RULE to block .vbs
> attachments??????
> Date: Thu, 22 Feb 2001 13:44:45 -0500
> Reply-To: [EMAIL PROTECTED]
> Hello. I need your urgent help. I want to create a RULE to block all the
> emails with "vbs" attachments. I have searched the Knowledge Base
> also, and
> I found the document number IM-19990609-DM06. It does tells me about the
> RULE, but when I add the same lines in my RULE, it does not work.
> I stopped
> and then restarted the SMTP service also, but it did not helped.
>
> I write this line in my RULE:
> B~(name=".*\pvbs):NUL
>
>
> Thanks
>
> TJ
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
