sorry for all the typos - guess I need more coffee... Chris
----- Original Message ----- From: Chris Langsenkamp To: [EMAIL PROTECTED] Sent: Friday, April 30, 2004 11:59 AM Subject: Re: [IMail Forum] Help understanding a rule - Please! Probably the HTML an embedded image, with would have been marked with a multipart seperator with the word 'name' in it someplace, and an image attachment that contained the letters 'zIp' someplace in the binary data of the embedded or attached file. Those attachment rules are terribly weak and often throw a false positives because it doesn't 'read' the body like a human does, but rather does a string search of the whole body content for the pattern name*zip and that can match spanned over huge chunks of a message, not just a single line. Chris ----- Original Message ----- From: Laura Bhandari To: [EMAIL PROTECTED] Sent: Friday, April 30, 2004 11:47 AM Subject: [IMail Forum] Help understanding a rule - Please! I can't see why this email got caught by the following rule: H~name=.*\zip!OR!B~name=.*\zip The intent of the rule is to block zip attachments. I have them forward to a different mailbox for review. I see the reason it gives for being caught - but I don't understand where it sees it: Data- zIp5/k/qHXv8Aqv6qrP3mFaCfTcaau This is the header for the email that got caught by the rule: ------ begin header ---- Received: from NTSERVER.ad.mezrahfinancial.com [64.31.185.70] by mail.mediacareerlink.com with ESMTP (SMTPD32-8.05) id AA6DE70110; Thu, 29 Apr 2004 16:49:49 -0400 content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="----_=_NextPart_001_01C42E2A.A4C75ED0" Subject: 2004 13 Ugly Men White Party E-vite X-MimeOLE: Produced By Microsoft Exchange V6.0.4417.0 Date: Thu, 29 Apr 2004 16:43:36 -0400 Message-ID: <[EMAIL PROTECTED]> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: 2004 13 Ugly Men White Party E-vite Thread-Index: AcQguxfCbqSwvEYTT2CyVfP70alDSQNa7otwAABPQgA= X-Priority: 1 Priority: Urgent Importance: high From: "Lee Mezrah" <[EMAIL PROTECTED]> To: "Lee Mezrah" <[EMAIL PROTECTED]> X-RCPT-TO: <[EMAIL PROTECTED]> Status: R X-IMail-Rule: H~name=.*\zip!OR!B~name=.*\zip:[EMAIL PROTECTED] Data- zIp5/k/qHXv8Aqv6qrP3mFaCfTcaau X-UIDL: 383189512 ----- end header ----- and this is the body of the email (which was in html): ---- begin email ---- othis This is the first of 3 major upcoming 13 Ugly Men events over the next 5 weeks. Hope you can attend & I encourage you to visit our website at www.13uglymen.com to see what's next. Your continued support by attending our events is truly appreciated & makes it possible for us to continue making large donations to local Tampa charities. Take care Lee For complete details visit www.13uglymen.com ---- end email ---- To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
