Okay, so I have read as much of the archives as I could stand, and I have been lurking on this list for a few months.
I took the advice from this list for the blockage of attachments via a rules.ima file for the entire virtual host. This is what I used: B~name=.*\.(bat|chm|cmd|com|exe|jse|lnk|pif|reg|scr|shs|vbs|wsf):viruses B~name=.*\.(bat|chm|cmd|com|exe|jse|lnk|pif|reg|scr|shs|vbs|wsf)\s:virus es B~begin 6.*\.(bat|chm|cmd|com|exe|jse|lnk|pif|reg|scr|shs|vbs|wsf):viruses I then have a viruses.fwd in all of the users mailboxes, so that the attachement having messages get sent to me. :) I find myself with a lot of false positives, mainly from HTML e-mails. For instance, this snippit of code from a message: ** SNIP ** <map name="FPMap0"> <area href="http://e-klk.com/r/r0.4?y3J1tRnoXlTLo1piq7IL7Lq8Uz-cfAfcP7Ur7gIx9M xMyG0P9ESRX2b" title="Debt Consolidation" shape="rect" coords="0, 0, 123, 20"> <area href="http://e-klk.com/r/r0.4?y3J1tRnoXlTLo1piDujRuRDHsiwUydyUCusFumjo1X oXYQNC1r7pS28" title="Home Equity Loans" shape="rect" coords="129, 0, 253, 20"> <area href="http://e-klk.com/r/r0.4?y3J1tRnoXlTLo1pijM42M2j0mrtgWQWgbMmZMS4Psa PaKowbsDHk829" title="Refinancing" shape="rect" coords="261, 0, 340, 20"> <area href="http://e-klk.com/r/r0.4?y3J1tRnoXlTLo1piovPjvjoTKdgWEVEWNvK-vRPHY1 H1r7UNYQk622e" title="Request Information Today!" shape="rect" coords="345, 0, 519, 20"></map> ** SNIP ** Manages to trip off the filter as though the message contained an attachment. Any thoughts on how to avoid this? (and yes, I am working on setting up some other antispam via IMGate or Declude, but this is a school district I work for, we have very little money. ;) Thanks! Kevin Kevin TeStrake Assistant Network Administrator School District of Fort Atkinson 201 Park St. Fort Atkinson, WI 53538 (920)563-7813 Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/
