not necessarily...If there is a string "name=" (like generator name = MS
FrontPage) then a url that ends in <dot>com then this has a good chance of
being caught by your filters.... I would at least change the * to a {1,64}
to limit the number of characters the rule will look at...Or look for a
certain "Content Type" like application or octet stream or whatever else is
applicable. Hope this helps
Eric S
----- Original Message -----
From: "Chris Moore" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, August 17, 2004 10:11 AM
Subject: [IMail Forum] spam frittered
> Hello List,
>
>
> I have looked on the knowledge base, but I simply cannot understand why my
> inbound rule has started to misbehave.
>
> I want to block attachments,
>
> so here is my rule :
>
B~(name=".*\.ade"|name=".*\.adp"|name=".*\.bas"|name=".*\.bat"|name=".*\.chm
"|name=".*\.cmd"|name=".*\.com"|name=".*\.cpl"|name=".*\.crt"|name=".*\.exe"
|name=".*\.hlp"|name=".*\.hta"|name=".*\.inf"|name=".*\.ins"|name=".*\.isp"|
name=".*\.js"|name=".*\.jse"|name=".*\.lnk"|name=".*\.mdb"|name=".*\.mde"|na
me=".*\.msc"|name=".*\.msi"|name=".*\.msp"|name=".*\.mst"|name=".*\.pcd"|nam
e=".*\.pif"|name=".*\.reg"|name=".*\.scr"|name=".*\.sct"|name=".*\.shs"|name
=".*\.url"|name=".*\.vb"|name=".*\.vbe"|name=".*\.vbs"|name=".*\.wsc"|name="
.*\.wsf"|name=".*\.wsh"):NUL
>
> So you would expect a mail with an attachment xxx.com to be deleted, but
> mail from xxx.com to be delivered right?
>
> So why is this happening:
> <* log snippet start *>
> 20040817 142535 127.0.0.1 SMTPD (0BD1023C) [127.0.0.1]
> D:\IMail\spool\D074f0bd1023c6ae3.SMD 15722
> 20040817 142535 127.0.0.1 SMTP (00000000) Info - Adding Queue file
> D:\IMail\spool\Q074f0bd1023c6ae3.SMD
> 20040817 142535 127.0.0.1 SMTP (03C809C4) processing
> D:\IMail\spool\Q074f0bd1023c6ae3.SMD
> 20040817 142535 127.0.0.1 SMTP (03C809C4) Inbound X-IMail-Rule:
>
>
B~(name=".*\.ade"|name=".*\.adp"|name=".*\.bas"|name=".*\.bat"|name=".*\.chm
"|name=".*\.cmd"|name=".*\.com"|name=".*\.cpl"|name=".*\.crt"|name=".*\.exe"
|name=".*\.hlp"|name=".*\.hta"|name=".*\.inf"|n
> Data- .com">Dilbert.com</A>.</FONT><
>
> 20040817 142535 127.0.0.1 SMTP (03C809C4) ldeliver
> mailhost.biuk.co.uk chris_moore-NUL (1) <[EMAIL PROTECTED]> 0
> 20040817 142535 127.0.0.1 SMTP (03C809C4) finished
> D:\IMail\spool\Q074f0bd1023c6ae3.SMD status=1
> <* log snippet end *>
>
> I have only recently been deprived of my daily Dilbert, the above rule
> having worked for years. What is going on??
>
> Cheers - Chris
>
> FYI IMail v8.03, I do not use any of IMails anti spam tools
>
>
> Mr Chris Moore
> Systems Engineer
>
> Brother Industries (UK) Limited
> Tel: +44(0) 1978 813 425
> Fax: +44(0) 1978 813 495
>
>
>
>
>
> To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
> List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
>
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
