RE: [Exim] Bombarded by pif attachments

Segree, Gareth
> This message is in MIME format. Since your mail reader does
> not understand this format, some or all of this message may
> not be legible.
> --
> [ Picked text/plain from multipart/alternative ]

Should send plain text mail..

> I have been bombarded with pif attachments over the past
> week. How can I do the following
> 1) tell exim not to launch spam assassin for mails > than a
> certail size
> 2) delete mails with pif/exe/com/scr/vbs attachments

I've been doing a double dash TZ zone date check first and discarding there.
As a result, few of the virus/spam messages get to the point where spam
assassin even gets to check them.

I first check for double dash TZ and discard if found.

Then check for pif and scr and discard if found

Then I do the rest of the normal deny attachments

After that I check with ClamAV followed by SpamAssassin if it gets that far.

The virus checker almost never catches anything anymore due to the other
checks.

Double dash stops most of them.