Hello Brian,
The rule you are using will catch many MIME-encoded attachments, but not
UUencoded or MIME attachments from Outlook Express, each of which has a
different signature.
In order to catch MIMEs from Outlook Express and other email clients, we
are now using the following rule, eliminating the quotations marks and
substituting 'filename' for 'name':
B~(filename=.*\.ext1\s|filename=.*\.ext2\s|and so on):quarantine
For UUencoded attachments:
B~(begin 6.*\.ext1\s|begin 6.*\.ext2\s|and so on):quarantine
Using these 2 basic rules, we filter extensions of the types vbs, shs, scr,
pif, exe, bat, and lnk. The com extension will trigger numerous false
positives from html code when used in a MIME rule, but seems fine to use in
filtering UUencoded attachments.
Some other mail clients are sending out Sircam-laden attachments
characterized by a different signature that we filter with the following
rule:
B~(name="ATT.*\.dat"\s.*name="ATT.*\.txt"\s|begin 6.*ATT.*\.dat\s.*begin
6.*ATT.*\.txt\s):quarantine
Always test before committing to new rules. I do not recommend piping
filtered messages to NUL. Your mileage may vary.
Michael
> ----------------------------------------------------------------------
>
> From: "Brian Andrus" <[EMAIL PROTECTED]>
> Subject: [IMail Forum] Rules.ima passing files
> Date: Mon, 6 Aug 2001 20:34:37 -0700
> Reply-To: [EMAIL PROTECTED]
> I just received a file attachment that was named book1.xls.pif
>
> I have a rules.ima with the following line:
> B~name=".*\.ext"\s:NUL
>
>
>
> So why is it that the message got thru? What should my rules.ima
> contain to
> prevent such attachments?
>
>
>
> Brian Andrus
>
>
> ----------------------------------------------------------------------
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
