Filename Rules

[Paul Hamilton]

Hi all,

We recently wrote to the list asking for help in producing a pattern match
for allowing a certain 'EXE', contained within a 'zip', through MS without
being quarantined.

On receiving help and applying some tests and tweaks we managed to
get the pattern match to work, but only once. Everytime we remove and add
back in the pattern match and restart MS, MS will allow one message with
the attachment in question through no problem but subsequent ones it
quarantines.
Does any one know what is happening here?

Using MS 4.32.5 & SA 2.64 on Cobalt 550

The pattern match we're using is:

allow(tab)^xxxxx\_\d{8,8}_\d{6,6}\.exe$(tab)(tab)(tab)-(tab)-
allow(tab)^xxxxx\_\d{8,8}_\d{6,6}\.EXE$(tab)(tab)(tab)-(tab)-
allow(tab)^xxxxx\_\d{8,8}_\d{6,6}\.zip$(tab)(tab)(tab)-(tab)-
allow(tab)^xxxxx\_\d{8,8}_\d{6,6}\.ZIP$(tab)(tab)(tab)-(tab)-

The .zip and the enclosed .exe are made up in the following way:

 xxxxx_20040826_YYYYYY.zip
 xxxxx_20040826_YYYYYY.EXE

The only constant is the 'xxxxx' value.
The date changes daily and the 'YYYYYY' value also changes daily.

Both the 'x' and 'Y' values are numeric only, and include zero's.

Many thanks in advance.

Paul H

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).