Auto-delete viruses with rules GW5.5

[johnbb]

Due to many copies of Sobig-F I have tried to configure a rule to delete emails with certain types of attachments. I have seen this recommended in several articles. On our system, this rule does nothing (tried on different mailboxes). All other rules seem to work OK. The rule is as follows:
When new item is received, type is mail, conditions:

Include entries where ... Attachments contains '.pif' or Attachments contains '.scr' or Attachments contains '.vbs' or Attachments contains '.bat' or Attachments contains '.com'Include entries where ... Attachments contains '.pif' or Attachments contains '.scr' or Attachments contains '.vbs' or Attachments contains '.bat' or Attachments contains '.com'

Action is either "Delete/Decline.." or "Move to folder.."

I have tried *.pif and just pif in the conditions, but no luck. Any advice would be much appreciated.

 

[johncurtis]

Hi

I've tried this with a rule containing:

Attachments contain pif
Move to folder...

Works fine for me. Are there any other rules which may conflict with this? Have you tried just adding pif to the rule then gradually adding more conditions?

As a general point, it's much better to filter out viruses before they get to the mailboxes. there are a number of products which will do this. We use Mailsweeper (

http://www.mimesweeper.com/products/msw/smtp/default.asp)

which works great.

John

 

[johnbb]

Thanks for your reply. I still have the problem when this is the only rule configured and with only one condition (pif), so I don't think there is a conflict.
I hope we will have filtering at the gateway in the longer term, but would like to do something in the short term.

 

[johncurtis]

If you can't get the attachment rule to work you could try a rule based on subject lines:
Re: That movie
Re: Wicked screensaver
Re: Your application
Re: Approved
Re: Re: My details
Re: Details
Your details
Thank you!

This will only work for sobig-f plus some variants, but if you're getting as many as us (our filter stops 4 per minute) it's well worth doing. You may get a few false positives; it's your call whether you think it's a fair price to pay.

John