On 15:59 03/02/2001 -0600, it would appear that Keith Purtell wrote:
>Help! My users are irate! I installed a rule to catch vbs, shs and scr
>attachments and forward them to a virusbox. Unfortunately it seems to be
>catching all email attachments. Our sales staff first discovered this
>problem when an ACT file they were trying to distribute was intercepted by
>the IMail server. The file has a dat extension. I tried taking their ACT
>file and changing the extension to doc and htm; both were intercepted. Only
>a zipped version got through. The actual language for my rule was taken
>straight from the Ipswitch knowledgebase ...
>
>B~(name=".*\pv!bs|name=".*\ps!hs|name=".*\ps!cr):virusbox
>B~(Begin 6.*\pv!bs|Begin 6.*\ps!hs|Begin 6.*\ps!cr):virusbox
What version of Imail are you running? If it is prior to 6.04 (I believe,
can't remember the version exactly) then you are basically stuck with the
above as they are as narrow as the earlier version can be. If you are
running 6.04 or greater then change the rules as follows (minus the ! of
course):
B~(name=".\.v!bs|name=".\.s!hs|name=".\.s!cr):virusbox
B~(Begin 6.\.v!bs|Begin 6.\.s!hs|Begin 6.\.s!cr):virusbox
The reason your versions are catching so many attachments is that they are
looking the following basic condition: name=" + any number of characters +
(zero or more punctuation marks & three letter target), this means that
even if your three letter extension is buried 50,000 characters into a mime
encoded jpg it will still be intercepted, if it happens to be preceded by
any punctuation mark.
The revised rules require a period to precede the three letter target,
again these only function in 6.04 or later. If the revised rules are used
in a pre 6.04 system they will actually catch more files than the original
rules you've listed.
Tyran Ormond
Programmer/LAN Technician
Central Valley Water
[EMAIL PROTECTED]
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
