Sieve Filter to Capture the W32/Bagle.aq Virus If you currently do not have a valid Anti-Virus subscription with our new "Kaspersky" AV engine included in MailSite 6.1.x you may want to create the following SIEVE Script to prevent the new Bagle worm (W32/Bagle.aq@MM) from getting through. Open the MailSite console Security/Sieve Filter Server Receive Script Create a "New" Filter called: W32/Bagle.aq@MM *Description: Filter designed to capture/reject the new ZIP file with the name variant of: Price.zip Click Next and click Cancel on the "creating a new criterion" Click the Advanced Button on the right side In "The condition:" window delete "true" and PASTE the following text: anyof ( x_body :regex "name=\"price.zip\"", x_body :regex "name=\"price.+\\.zip\"", x_body :regex "name=\"price+.*\\+\\.zip\"" ) CLICK OK Click Next To keep a Quarantined Copy of these messages select the option to Copy the message to a local directory Next click the radio button to: Discard Message Click Next and enable this rule and Finish