Hi Ken, We delete the usual dangerous attachments by using this rule file:
B~(name=".*\.vbs"\s|name=".*\.shs"\s|name=".*\.scr"\s|name=".*\.pif"\s|name= ".*\.exe"\s|name=".*\.chm"\s|name=".*\.com"\s|name=".*\.lnk"\s|name=".*\.vbe "\s|name=".*\.hta"\s|name=".*\.sct"\s):NUL B~(name=.*\.vbs\s|name=.*\.shs\s|name=.*\.scr\s|name=.*\.pif\s|name=.*\.exe\ s|name=.*\.chm\s|name=.*\.com\s|name=.*\.lnk\s|name=.*\.vbe\s|name=.*\.hta\s |name=.*\.sct\s):NUL B~(begin 6.*\.vbs\s|begin 6.*\.shs\s|begin 6.*\.scr\s|begin 6.*\.pif\s|begin 6.*\.exe\s|begin 6.*\.chm\s|begin 6.*\.com\s|begin 6.*\.lnk\s|begin 6.*\.vbe\s|begin 6.*\.hta\s|begin 6.*\.sct\s):NUL (note that the above should be "un-word-wrapped" to use just three lines) Marius -----Original Message----- From: Ken Imail [mailto:[EMAIL PROTECTED]] Sent: Friday, December 07, 2001 7:30 AM To: [EMAIL PROTECTED] Subject: RE: [IMail Forum] BadTrans and rules.ima Thanks, I'll try -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Thursday, December 06, 2001 8:12 PM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] BadTrans and rules.ima >I have a rules.ima file in the main IMail folder, supposedly protecting >all domains right ? Here are the first couple of lines. McAffee >reported that my webmaster's mailbox was infected with the badtrans.eml >virus.... how did that happen, and why didn't the rules.ima work. One possibility is that the filename wasn't in quotes: name=ME_NUDE.MP3.scr is just as legal as: name="ME_NUDE.MP3.scr" [snip] Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
