ACM> However, TB! will search only the headers and text body for ACM> matching strings.
Yes, but Allie, those infected attachments are referenced in the header by the strings that Mitja defined. It's for those references that Mitja was setting up a filter. Looking at the source of some infected messages that just came in, I find strings like: "name=Rescue.bat" and "name=Wyugm.pif". Best, -Daan- ________________________________________________________ Current Ver: 1.60q FAQ : http://faq.thebat.dutaint.com Unsubscribe: mailto:[EMAIL PROTECTED] Archives : http://tbudl.thebat.dutaint.com Moderators : mailto:[EMAIL PROTECTED] TBTech List: mailto:[EMAIL PROTECTED] Bug Reports: https://bt.ritlabs.com