zip only spam

[Rob Freeman]

I see instead of using pdf spam, they have switched to zip spam.  I have a
rule to block the pdf only spam, but when I changed it to zip, it is not
working:

# ZIP only spam
full     ZIP_ONLY_SPAM
/encoding\:\s+7bit(\n?)+[\-0-9]+.{1,40}type\:\s+application\/zip\;.{1,40}name\=.{1,40}\.zip.{1,50}disposition\:\s+inline\;.{1,40}filename\=.{1,40}\.zip/is
describe ZIP_ONLY_SPAM   ZIP only Message, no text in message body
score ZIP_ONLY_SPAM 6.0

I am unable to block zip files as we have customers who send them to us.
What are other people doing to prevent this latest spam attack?

Thanks in advance

Rob
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070731/29d60067/attachment.html