>Use AV at the Imgate machine?
IMGate header/body/mime checks blocking attachments will stop most attachments, but some still slip through. That's why you need a real AV scanner after IMGate. >That's what I do, and I stopped about 85 of them so far. the novarg storm is typical. most are stopped by IMGate (pif, scr, exe), but our next box running kaspersky has stopped 300 since yesterday. We normally allow only .zip attachments, but we started blocking .zip as soon as we heard about novarg zip, and before we were sure Kaspersky had a novarg signature. Now that Kaspersky is blocking novarg, we re-allowed .zip at IMGate. Len
