What you are getting is the .com in the URL's. the only way around this would to be not to search the bodies for the .com. If you are trying to use rules to avoid viruses you _will_ not be 100%. As you found out you will either let some through or trap in excess of what you want. The _only_ sure way to avoid infected files is an AV solution (IMail AV, Declude, etc).
Eric S ----- Original Message ----- From: "kevin" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, May 30, 2002 9:36 PM Subject: [IMail Forum] Attachement blocking false positives > Okay, so I have read as much of the archives as I could stand, and I > have been lurking on this list for a few months. > > I took the advice from this list for the blockage of attachments via a > rules.ima file for the entire virtual host. > > This is what I used: > > B~name=.*\.(bat|chm|cmd|com|exe|jse|lnk|pif|reg|scr|shs|vbs|wsf):viruses > B~name=.*\.(bat|chm|cmd|com|exe|jse|lnk|pif|reg|scr|shs|vbs|wsf)\s:virus > es > B~begin > 6.*\.(bat|chm|cmd|com|exe|jse|lnk|pif|reg|scr|shs|vbs|wsf):viruses > > I then have a viruses.fwd in all of the users mailboxes, so that the > attachement having messages get sent to me. :) > > I find myself with a lot of false positives, mainly from HTML e-mails. > For instance, this snippit of code from a message: > > ** SNIP ** > <map name="FPMap0"> <area > href="http://e-klk.com/r/r0.4?y3J1tRnoXlTLo1piq7IL7Lq8Uz-cfAfcP7Ur7gIx9M > xMyG0P9ESRX2b" title="Debt Consolidation" shape="rect" coords="0, 0, > 123, 20"> <area > href="http://e-klk.com/r/r0.4?y3J1tRnoXlTLo1piDujRuRDHsiwUydyUCusFumjo1X > oXYQNC1r7pS28" title="Home Equity Loans" shape="rect" coords="129, 0, > 253, 20"> <area > href="http://e-klk.com/r/r0.4?y3J1tRnoXlTLo1pijM42M2j0mrtgWQWgbMmZMS4Psa > PaKowbsDHk829" title="Refinancing" shape="rect" coords="261, 0, 340, > 20"> <area > href="http://e-klk.com/r/r0.4?y3J1tRnoXlTLo1piovPjvjoTKdgWEVEWNvK-vRPHY1 > H1r7UNYQk622e" title="Request Information Today!" shape="rect" > coords="345, 0, 519, 20"></map> > ** SNIP ** > > Manages to trip off the filter as though the message contained an > attachment. > > Any thoughts on how to avoid this? (and yes, I am working on setting up > some other antispam via IMGate or Declude, but this is a school district > I work for, we have very little money. ;) > > > Thanks! > > Kevin > > Kevin TeStrake > Assistant Network Administrator > School District of Fort Atkinson > 201 Park St. > Fort Atkinson, WI 53538 > (920)563-7813 > > > Please visit http://www.ipswitch.com/support/mailing-lists.html > to be removed from this list. > > An Archive of this list is available at: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > > Please visit the Knowledge Base for answers to frequently asked > questions: http://www.ipswitch.com/support/IMail/ > Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/
