>>A .url link named "www.yahoo.com.url" has ".com" in it. Computers can't
>>distinguish between ".com" as in "Commercial top-level Internet domain"
>>and ".com" as in "COM file".
>straight from the knowledge base
>(http://support.ipswitch.com/kb/IM-19990609-DM06.htm):
>
>B~(name=".*\.vbs"\s|name=".*\.shs"\s|name=".*\.scr"\s):spambox
>B~(begin 6.*\.vbs\s|begin 6.*\.shs\s|begin 6.*\.scr\s):spambox
>
>These rules include the \s text pattern to search for "any white space"
>(spaces, tabs or Carriage Returns) after an attachment extension. Without
>this pattern, the number of false positives will rise, principally due to
>html attachments tripping up on the UUencoding rule.
Ah, but they will still catch those nasty filenames with ".com" in the
extension. If you use the above filter for .com attachments, you'll still
catch "www.yahoo.com.url" even though it isn't a .com file.
Another thing to watch out for with the above filter is that it assumes
there are quotes, which aren't always there.
-Scott
---
Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for
IMail. http://www.declude.com
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
