>I've seen that mentioned a few times. In the two Swen mails I received, I >didn't see that string. Not sure why, though--encoding?
I confirm the sven sails right through that body check >I have had two rejects so far on my regexp above. > >Also, it looks like they use to following (at BOL but I've indented to >hopefully prevent rejections in case anyone if filtering this): > Content-type: application/x-msdownload; name=[filename] > >where [filename] is the name of the attachment so you could probably also >block on 'Content-type: application/x-msdownload; name=Qdfkx.exe' in a body >filter. why a specific filename? I've confirmed that this in header or body checks doesn't stop it. /^Content\-type\: application\/x\-msdownload\;.*\.exe/ REJECT sven Len
