Hi, in order to clean all bounce backs originated from Klez, etc we have created a email filter/rule to discard all emails that body matches

"This message has been rejected because it has a potentially executable attachment"

If we make a test to a created/ existing email adress it works but as the bounce backs are adressed to the main account filters get by passed.
Default email is set to :blackhole:

Any help ?