Hi Damian,
This is a great example of why it is important not to send filtered messages
to NUL. You now have a the opportunity to examine why your rules are not
functioning as expected.
It's obvious that the message that is being trapped contains one of the
strings you are filtering, probably in the .csv attachment, but possibly
elsewhere in the message body or in the header. By the way, you should
remove all the rules that are searching for attachment information in the
header (e.g., H~filename=".*\.xxx":virusbox). This will only produce false
hits as the intent is to look for attachment encoding information that
appears only in the body of a message.
On our system, the virus account that receives filtered messages has been
set up as IMAP4. When a message shows up in this location without apparent
reason (in the "quarantine" folder), I can simply open up the mailbox file
on the server (IMail\users\virus\quarantine.mbx) using a text editor, and
search for my filter strings. This has helped in fine-tuning our filters so
that it is now extremely rare to encounter a false positive. When a false
positive is encountered, it is easy to move the file to a user's account
with the Imail Client utility.
With IMail version 6.04 and up, I've had success with the following two
simple rules to trap virus-laden MIME and UUencoded attachments (where ext1,
ext2, ext3 are replaced by vbs, shs, scr, pif and exe at the minimum):
B~(name=".*\.ext1"\s|name=".*\.ext2"\s|name=".*\.ext3"\s|etc...):quarantine
B~(begin 6.*\.ext1\s|begin 6.*\.ext2\s|begin 6.*\.ext3\s|etc...):quarantine
Rules shown on the Ipswitch IMail Knowledgebase do not include the \s text
pattern to search for "any white space" (spaces, tabs or Carriage Returns)
after an attachment extension. Without this pattern, the number of false
positives will rise, principally due to html attachments tripping up on the
UUencoding rule. With rules, the more exact the better.
http://support.ipswitch.com/kb/IM-19980116-DD08.htm
http://support.ipswitch.com/kb/IM-19990609-DM06.htm
The rules for earlier versions of IMail differ only in that the text pattern
for a period (\.) is not supported, and is replaced by a broader search for
"any punctuation" (\p). I don't know about the \s text pattern.
Michael
> ----------------------------------------------------------------------
>
> From: "Damian Sanguine" <[EMAIL PROTECTED]>
> Subject: [IMail Forum] Rules.ima and files
> Date: Wed, 16 May 2001 13:48:58 -0300
> Reply-To: [EMAIL PROTECTED]
>
> Hi,
>
> This is my rules.ima (attached)
>
> Someone send a CSV file called "correos.csv" and it goes to the virus box.
> can anyone there tell me why? I do not understand 100% the syntax of those
> files.
>
> Thank you very much,
>
> Damian
>
> ------=_NextPart_000_01BD_01C0DE0E.F4CC44F0
> Content-Type: application/octet-stream;
> name="rules.ima"
> Content-Transfer-Encoding: 7bit
> Content-Disposition: attachment;
> filename="rules.ima"
>
> B~filename=".*\.v9bs":virusbox
> H~filename=".*\.v9bs":virusbox
> B~filename=".*\.e9xe":virusbox
> H~filename=".*\.e9xe":virusbox
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
