I'll give it a whirl and see what happens. We get falses every few days right now so I'll know within a week or so if it helped.
Thanks! -----Original Message----- From: Doug Anderson [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 20, 2004 10:40 AM To: [EMAIL PROTECTED] Subject: Re: Filtering executables (was: RE: [IMail Forum] New "BAGLE" virus in the wild!!) Jason, try this. you'll have to replace the dot-com with a period com B~Content-Disposition\:\sattachment;\s*filename=".{0,100}\dot-com"\s{1,1 0}:c [EMAIL PROTECTED] do your exes, vbs, bat's, cmd normal and for com files use this. we haven't had any sneek through but it doesn't get false positives I posted it awhile back ----- Original Message ----- From: "Jason Loven" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, January 20, 2004 8:59 AM Subject: Filtering executables (was: RE: [IMail Forum] New "BAGLE" virus in the wild!!) We have tried setting up Imail rules for filtering executable content. We found that it would inadvertently trap some good emails because of the .com extension on urls. I emailed Imail support and the tech's response was that the rules work most of the time but Imail wasn't designed to filter attachments and therefore the rules couldn't be counted on to work for this purpose. We still have the rules in there due to the danger of executable file types but I would like to hear from anyone that has rules that work without occasionally nailing good messages. -----Original Message----- From: Len Conrad [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 20, 2004 9:44 AM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] New "BAGLE" virus in the wild!! Bagle's arrival apparently before the major AV databases were updated is an excellent argument for rejecting all .exe's and other executable email content with non-AV filtering rules before passing the msgs to AV. Again, it's playing the averages and being prudent. Out 1000 .exe's (and other executable email content) that arrive attached to/inside of email these days, how many are not malicious? Len _____________________________________________________________________ http://MenAndMice.com/DNS-training : San Jose; Chicago; Wash DC; Atlanta http://IMGate.MEIway.com : free anti-spam gateway, runs on 1000's of sites To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
