>I'm trying to write a rule for the rules.ima file that will catch incoming
>mail where the body contains text similar to the following string...
>
><IFRAME height=0 src="cid:AbC123dEf456"; width=0></IFRAME>
>
>I've tried searching for pieces of this, like these two...
>
>B~IFRAME height=0:spambox
>B~width=0></IFRAME>:spambox
>
>and a half-dozen other variations but these messages just sail right past
>the rules. Any ideas about what I'm overlooking?
Most likely, the problem is that the message is "quoted-printable" encoded,
which means that the "=" would have to be translated to "=3C". It's also
possible that other characters could get translated, but the "=" is the
most likely one that would. So if you change your rules to use "=3C"
instead of "=", it should help.
FWIW, Declude Virus will detect the Outlook MIME headers exploit
automatically (no matter what encoding is used), which appears to be what
you are trying to catch.
-Scott
---
Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for
IMail. http://www.declude.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit the Knowledge Base for answers to frequently asked
questions: http://www.ipswitch.com/support/IMail/
