Matt Kettler writes: > > At 10:23 AM 5/19/2004, Bryan Haase wrote: > >I have an email that didn't hit on anything. It had one sentence "Please > >read the attached file (Dkaufman.zip)." And of course a zip virus > >attached. The from is > ><mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED] with a message ID > >from Hotmail... I would assume that something should have hit. I have > >aggressively high scoring/rules so I have -5 to allow personal email to > >come thru. > > > >Does anyone have a way to block this email? (Header below) > >Is there a way to score zip attachments or score attachment by file size > >ie <50K? > > How about using a virus scanner to block it? clamav is free, and you can > implement it on the MTA level.
You could also use mimedefang. Add it to the list of evil attachment types if you want to block all zips. -- Ron
