You might be able to add a validation rule that checks the filename and fails if it doesn't match your criteria. qRules lets you access attachment name info so you could just set a rule on the field that checks and removes it if the file doesn't have the right extension. To do this without qRules will require adding a little code to get at the filename and extension.
Patrick Halstead
Project Manager at Qdabra