I found these rules on the mail archive that were suggested by someone, I'm sorry but I can't remember who it was and now I can't find the original message!
They work great in the fact they do not block an email if someone mentions .bat in an email body
B~Content-Disp [rest removed to bypass filters]
This will have minimal false positives, but doesn't cover just "name=", and won't work if no quotes are used.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
