Filtering filenames without "" is prone to false positives, as you see from
the following html mail content example.
<META NAME=3D"Generator" CONTENT=3D"Example Server Version 6.0.6249.1">
[*** snipped out several lines of html code here ***]
<P><FONT SIZE=3D2>THE COMMON NAME OF THIS CERTIFICATE: =
WWW.EXAMPLE.COM</FONT>
</P>
You could try a syntax like this, catching filenames up to 100 characters
long and reducing false positives due to the limited number of character
checked after "name=":
---- begin of file listing rules.ima
B~name=.{1,100}\.com\s:NUL
---- end of file listing rules.ima
I use the following syntax for some years now:
---- begin of file listing rules.ima
B~(name=".*\.vbs"\s|name=".*\.shs"\s|name=".*\.scr"\s|name=".*\.pif"\s|name=
".*\.exe"\s|name=".*\.chm"\s|name=".*\.com"\s|name=".*\.lnk"\s|name=".*\.vbe
"\s|name=".*\.hta"\s|name=".*\.sct"\s|name=".*\.swf"\s|name=".*\.cmd"\s|name
=".*\.bat"\s):NUL
B~(begin 6.*\.vbs\s|begin 6.*\.shs\s|begin 6.*\.scr\s|begin 6.*\.pif\s|begin
6.*\.exe\s|begin 6.*\.chm\s|begin 6.*\.com\s|begin 6.*\.lnk\s|begin
6.*\.vbe\s|begin 6.*\.hta\s|begin 6.*\.sct\s|begin 6.*\.swf\s|begin
6.*\.cmd\s|begin 6.*\.bat\s):NUL
---- end of file listing rules.ima
Marius
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
