On 09:02 AM 7/25/2001 -0400, it would appear that Ajay Tikoo wrote:
>Hi everyone,
>I am using the following rules to filter out the mails with certain type of
>attachments:
> B~n+ame=".*\pv+bs":Virus
> H~n+ame=".*\pv+bs":Virus
> B~n+ame=".*\ph+ta":Virus
> H~n+ame=".*\ph+ta":Virus
> B~n+ame=".*\pe+xe":Virus
> H~n+ame=".*\pe+xe":Virus
> B~n+ame=".*\pp+if":Virus
> H~n+ame=".*\pp+if":Virus
> B~n+ame=".*\ps+cr":Virus
> H~n+ame=".*\ps+cr":Virus
> B~n+ame=".*\pl+nk":Virus
> H~n+ame=".*\pl+nk":Virus
> B~n+ame=".*\pb+at":Virus
> H~n+ame=".*\pb+at":Virus
> B~n+ame=".*\pc+om":Virus
> H~n+ame=".*\pc+om":Virus
>
>NOTE: The plus (+) signs in the above rules have been added so that this
>message manages to reach to your mailbox.
>
>I was wondering why some of the mails that have no attachments also go to
>the virus box!
>Is there anything wrong with these rules? Kindly help.
The problem is that the rules are not actually applied to the attachment
but to the body of the message (nothing you can do about that). The other
part of the problem is the \p as that means ANY punctuation. If you're
using anything lower than 6.04 (I think that's the correct one) you have no
option but to use \p. If you are running 6.04+ use \. (that's a period
there next to the slash) and you'll cut down your false positives.
Tyran Ormond
Programmer/LAN Technician
Central Valley Water
[EMAIL PROTECTED]
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
