----- Original Message ----- From: Tushar Burman tb@freeos.com Subject: Re: [ILUG-BOM] [OT] Possible virus, can anyone confirm

I have desktop scanners on all workstations as well, but this is far from sufficient in my case. I use IMAP instead of POP3, so all mails stay on

the

Linux box. As a result, each time somebody goes back to an old, virus-infected mail, he's in trouble once again. It makes more sense to

stop

the viruses on the mail server. It stops outgoing viruses too.

I having the same setup with using procmail, all mails are filtering if there is any attachment with executable extensions & any mail containing "<SCRIPT>" will move to "virus" folder. the .procmailrc is like this *********** :0 HB * ^Content-Disposition: attachment; *filename=".*.(exe|vbs|shs|com|pif|bat|scr|hta)" virus

:0 HB * <script> virus *********** but SirCam doesn't mind it, it is coming directly to inbox with ".pif", ".bat" extensions. If I forward the same once more, it is filtering. and any other messages with the said condition is filtering. why this SirCam is escaping procmail ? any Idea, the mail header containing these lines. "Content-Type: application/mixed; name=renewal_calls_sifynet_dec1.xls.pif Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename=renewal_calls_sifynet_dec1.xls.pif "

please let me know is the .procmailrc needs any other modifications. Waiting for the some suggestions. (Attn. Philip, Many thanks for your previous valuable mails...)

regards Benoy