Anyway, I set up logging, and a "copy box" for this client (I put a copy of every email going to that domain into a single mailbox). Sure enough, he got another one. So, I looked in my "copy box" and it was in there - .scr file and all. I also check the headers and tracked it in my log files. Sure enough, the message was accepted and delivered. So, I then sent a few test emails to that user with a .scr attachment - and it was rejected by the rule! I then saved the infected file on my desktop, attached it to an email to that user - and it was rejected by the rule! Finally, I forwarded the original infected message to that user - and it was rejected by the rule! So, basically, everything seems to work, but it really doesn't...Have you read RFC1521? You've fallen into a trap that lots of the "dot bombs" fell into -- assuming that by looking at E-mail headers, you know how E-mail headers are supposed to look. While your rule may work fine for one E-mail, it may not work for another one, even though they both have .scr attachments. There are lots of little things that can throw off a script, such as spaces where you don't expect them (or where they shouldn't even be). In this case, you need to look at the raw MIME headers of the E-mail that wasn't caught to see why it didn't get caught by your rule. With Klez, you at least don't have to worry that it will come in uuencoded format (which there is no RFC for, if I recall correctly).
Anyone see this before?? Please let me know, because it's driving me nuts...
Or, you can run software designed specifically to catch viruses or block certain file extensions. :)
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches both viruses and vulnerabilities in E-mail, with no annual licensing fees.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
