All the viruses i have had over the last day (over 200 so far ) have not had
quote marks (") around the file name.
there for i have had to add new rules without the quote marks. If you put a
space behind the attachment it will reduce the false positive captures.
Les.
----- Original Message -----
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, July 26, 2001 6:43 PM
Subject: RE: [IMail Forum] W32/SirCam@mm
>
> >I have protected my users with three rules...
> >
> >B~filename=".*\pvbs":NUL
> >B~filename=".*\pscr":NUL
> >B~filename=".*\pbat":NUL
> >
> >And YES it does block all .VBS files, .SCR files, and .BAT files... But
> >my users are protected.
>
> You also need to add .EXE, .COM, .LNK, and .PIF, which Sircam sends out as
> well. And, you might also want to add just "name=" not just "filename="
to
> protect yourself further.
>
> -Scott
>
> Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for
> IMail. http://www.declude.com
>
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
>
**********************************************************************
Information in this mail is confidential and intended only for the use of the
individual or entity named above. If you are not the intended recipient, you are
hereby notified that any dissemination, distribution or copying of this communication
is strictly prohibited.
Montague L Meyer Ltd will accept no responsibility or liability in respect to this
email other than to the addressee. If you have received this email in error, please
notify MLM by telephone on 0208 4778000 or by email on [EMAIL PROTECTED]
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
