>Without an address I can't add them to the KILL file. Their IP
>addresses change, but stay in the same general ranges -- they use
>different ISP's. So I'm looking to a global rule that checks the header
>for host names of "oemcomputer" and "bigired" (w/o quotes), my two bad
>boys. Going to drop it in NUL.
I'm guessing this is the "Snow White" virus? If so, you might want to try filtering
on the "From:" field, looking for "[EMAIL PROTECTED]". Even though the "MAIL FROM:"
in the SMTP Envelope is NULL ("<>"), there is a "From:" field in the headers that
IMail can filter on. All of the "Snow White" viruses should have that "From:" address.
--
-Scott
Declude: Anti-virus and Anti-spam solutions for IMail. http://www.declude.com
--
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
