Filtering filenames without "" is prone to false positives, as you see from the following html mail content example.
It's a catch-22.
If you filter without the "", you're prone to false positives. *But*, if you filter with the "", you're prone to false negatives (not catching attachments that you want to catch). For example:
name="somename.ext"
and
name=somename.ext
are both valid, as are:
filename="somename.ext"
and
filename=somename.ext
depending on the context.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
