Blocking email with an embedded attachment

Wed Feb 22 18:04:08 GMT 2006

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Why can't you just use filename.rules.conf to do it?
If you want to throw away the whole message then use "deny+delete" and 
not just "deny". Feel free to contribute some more/better documentation 
for the top of this file :-)

lester lasad wrote:
> Is it possible, and if so how do I block an email with
> an embedded attachment?  My users continue to receive
> the same email (from different addresses/hosts)on a
> daily basis, the only constant I am seeing is an
> attachment called "38.jpg" in the header.  I have
> included some of the header below, the last portion
> shows the attachment name.  Please let me know if
> there is anyway to stop this.  I have reviewed the
> filename.rules.conf and filetype.rules.conf but this
> does not seem to provide what I am looking for. 
> Thanks for the help.
>
> Fedora Core 1 
> MailScanner 4.49.7
> SpamAssassin 3.00
>
> --snip--
> Content-Type: multipart/related;
> 		
> boundary="----=_NextPart_000_0051_01C631DB.DA3C46A0";
>
>
> ------=_NextPart_000_0051_01C631DB.DA3C46A0
> Content-Type: multipart/alternative;
> 		
> boundary="----=_NextPart_001_0052_01C631DB.DA3C46A0"
>
>
> ------=_NextPart_001_0052_01C631DB.DA3C46A0
> Content-Transfer-Encoding: quoted-printable
> Content-Type: text/plain;
> 		 charset="us-ascii"
>
>
>  in their respective time zones facing the wrath of
> Rowling's publishers, if not the publishers'
> attorneys.
> ------=_NextPart_001_0052_01C631DB.DA3C46A0
> Content-Transfer-Encoding: quoted-printable
> Content-Type: text/html;
> 		 charset="us-ascii"
>
> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0
> Transitional//EN">
> <HTML><HEAD>
> <META http-equiv=3DContent-Type content=3D"text/html;
> charset=3Dus-ascii">
> <META content=3D"MSHTML 6.00.2900.2668"
> name=3DGENERATOR>
> <STYLE></STYLE>
> </HEAD>
> <BODY bgColor=3D#ffffff>
> <DIV align=3Dcenter><FONT face=3DArial size=3D2><A=20
> href=3D"http://qwomdk.purplguar.info/?23295343"><IMG
> alt=3D"" hspace=3D0 =
> src=3D"cid:005001c631a1$2ddafda0$6400a8c0 at VAIO"
> align=3Dbaseline=20
> border=3D0></A></FONT></DIV>
> <DIV align=3Dleft><FONT face=3DArial
> color=3D#ffffff=20
> size=3D2>The most anticipated of the bunch arrives
> July 16 with the sixth book in the Harry Potter
> series, "Harry Potter and the Half-Blood
> Prince."</FONT></DIV></BODY></HTML>
>
> ------=_NextPart_001_0052_01C631DB.DA3C46A0--
>
> ------=_NextPart_000_0051_01C631DB.DA3C46A0
> Content-Type: image/jpeg;
> 		 name="38.jpg"
> Content-ID: <005001c631a1$2ddafda0$6400a8c0 at VAIO>
> Content-Transfer-Encoding: base64
>
>
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam protection around 
> http://mail.yahoo.com 
>   

- -- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.0.5 (Build 5050)

iQA/AwUBQ/ynmRH2WUcUFbZUEQKqhQCghrsNvb8gECQla5ZdyewsUmwEWp0An2fE
oYwFhHB0XIgm3aNAQXM1iZ6S
=thlw
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.