I get quite a lot of empty zip files, I presume from viruses having failed to place themselves in them.
They always look like: UEsFBgAAAAAAAAAAAAAAAAAAAAAAAA== in base64. Do others get these emails? Could someone advice me as to what kind of rule I could write to block these? I presume a body rule with: body EMPTY_ZIP /UEsFBgAAAAAAAAAAAAAAAAAAAAAAAA==/i wouldn't work as it is in a separate mime part, or would it? Thanks Ben