To add my two cents worth, I recommend expanding your rule to include other
common worm and virus-laden attachments such as .shs (scrap object, used by
VXXXBS.stages.A and arriving as the attachment LIFESXXXTAGES.TXT.SHS),and .scr
(screen saver - frequently used by the W95.HyXXXbris.worm AKA SnXXXow White). As
we have discussed recently on the list, the first of the following two rules
checks for MIME attachments, while the second checks for Uuencoded
attachments.
B~(name=".*\pvXbs|name=".*\psXhs|name=".*\pXscr):quarantine
B~(Begin 6.*\pvXbs|Begin 6.*\psXhs|Begin 6.*\pXscr):quarantine
------------------
My combined rule would not work so I split into separate lines
Chris
At 04:43 PM 5/9/01 -0400, you wrote:
Chris:
What's the 6 for?
Mike
