Firetrust Support Forums

I have a filter from my old version of MW that looks for

doc.scr|doc.pif|mp3.pif|doc.pif|zip.pif|zip.scr|mp3.scr

in the header and

.lnk|.bat|.vbs|.vbe|.jse

in the body of an email. Is this done correctly? It flagged an email that as far as I can tell contains none of these, except for lnk without the leading dot.

AJ

That looks like a regex filter, if it is the dot isn't a search character but a wildcard meaning any character. Replace the . everywhere you really want a dot and not a wildcard with \. and you should have it working right.

http://www.regexlab.com/en/deelx/syntax.htm main page

http://www.regexlab.com/en/deelx/syntax/bas_sesc.htm on the dot

Match any character except newline(\n). Use "\." to match "." itself

So the way it was before, 'lnk' preceded by anything at all would trip the filter. Thanks.