On Wed, Apr 16, 2008 at 04:11:25PM +0200, Benny Pedersen wrote:
> > header MG_LINK2 Content-Disposition =~ /filename\=\"as\.zip\"/
>
> header MG_LINK2 Content-Disposition =~ /^filename\=\"[a-z]{2}\.zip\"/i
If you're trying to match the filename in an attachment, "header" isn't going
to get you anywhere.
Look at the MIMEHeader plugin, and corresponding "mimeheader" rule type.
Also, for this type of thing, I would probably use a plugin. AntiVirus has
some good examples for this type of thing.
--
Randomly Selected Tagline:
"Can I tell you something? The seventy virgins thing -- is overdone.
Because around four or five virgins in, you're looking for a pro."
- Dennis Miller, Politically Incorrect 2002/06/19
pgp2QugTh97Hu.pgp
Description: PGP signature
