I am still having trouble with Rules and HTML messages. The problem is that if I receive a message (as I often do) that discusses an executable by name (i.e., wscript.e x e, without the spaces), that message gets caught by my rules and thrown into the virusbox - IF the sender used HTML. But the same message sent plain text is acceptable.
The offending rule is one of the following: (I put spaces in so it will not get trapped in someone else's overactive filter). B~name=".*\.e x e"\s:virusbox B~name=.*\.e x e\s:virusbox B~begin 6.*\.e x e\s:virusbox I know that HTML messages often include a line like this in the header: <META content="MSHTML 5.50.4807.2300" name=GENERATOR></HEAD> That line is, of course, way before the line in the body that contains the offending extension. Does the asterisk in these expression mean that once you see the phrase "name=", if you see the offending extension anywhere thereafter, zap it? That appears to be what is happening. Is there a way to stop this behavior? It is catching way too many false positives. Thanks, Joseph Marlin Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
