We receive many messages with executable attached file, for example: Content-Disposition: attachment; filename="SITUATIE ORDINE 01.2003.xls.scr" or Content-Disposition: attachment; filename="Jeux de mots et de mémoire.htm.exe"
I tried to catch these files with the following rules: rawbody UF_DBL_EXT_1 /Content.Disposition. attachment. filename....*\....\.(exe|scr|pif)/ or rawbody UF_DBL_EXT_T /\....\.(exe|scr|pif)/i But these rules get never trigged ! Has somebody a good advise how to catch double extension files ? JP Vorlet ------------------------------------------------------- This SF.net email is sponsored by: Etnus, makers of TotalView, The best thread debugger on the planet. Designed with thread debugging features you've never dreamed of, try TotalView 6 free at www.etnus.com. _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
