----- Original Message -----
From: Tushar Burman <tb(a)freeos.com>
Subject: Re: [ILUG-BOM] [OT] Possible virus, can anyone confirm
> I have desktop scanners on all workstations as well, but this is far from
> sufficient in my case. I use IMAP instead of POP3, so all mails stay on
the
> Linux box. As a result, each time somebody goes back to an old,
> virus-infected mail, he's in trouble once again. It makes more sense to
stop
> the viruses on the mail server. It stops outgoing viruses too.
I having the same setup with using procmail, all mails are filtering
if there is any attachment with executable extensions & any mail containing
"<SCRIPT>" will move to "virus" folder.
the .procmailrc is like this
***********
:0 HB
* ^Content-Disposition: attachment;
*filename=".*\.(exe|vbs|shs|com|pif|bat|scr|hta)"
virus
:0 HB
* \<script\>
virus
***********
but SirCam doesn't mind it, it is coming directly to inbox with ".pif",
".bat" extensions.
If I forward the same once more, it is filtering.
and any other messages with the said condition is filtering.
why this SirCam is escaping procmail ? any Idea,
the mail header containing these lines.
"Content-Type: application/mixed; name=renewal_calls_sifynet_dec1.xls.pif
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename=renewal_calls_sifynet_dec1.xls.pif "
please let me know is the .procmailrc needs any other modifications.
Waiting for the some suggestions.
(Attn. Philip, Many thanks for your previous valuable mails...)
regards
Benoy