Question about an existing rule.

General discussion about PopTray. You love it? You hate it? Talk about it here.

Moderators: KY Dave, jojobear99, Rdsok

Post Reply
User avatar
Irmax
Still here
Posts: 17
Joined: Sat Oct 12, 2002 3:50 pm
Location: The Netherlands

Question about an existing rule.

Post by Irmax » Mon Jun 21, 2004 6:58 pm

Hi,

I'm a big fan of PopTray since version 2.00 and I'm very glad with RegExpr in the rules-section.
I'm trying to make good, sound rules with and without RegExpr, but I think I've got a little problem with RegExpr.
Could someone take a look at the following rule, I have a feeling that it doesn't work as I think it should!

Rulename = "sex"
Subject > RegExpr > ((sex[^y]|porn|blow[^i]).*)+

....Body > RegExpr > ((sex[^y]|porn|blow[^i]).*)+

Actions = checked:
Mark as Spam
Ignore (don't notify)
Log rule
Play Sound
Tray Color


Even e-mails from the dutch site alert@virusalert.nl and the Lavasoft-site for Reference File Notification
are marked in the log with the rulename "sex".

What's wrong in the above expression?

(BTW, I'm using the very last version of PopTray: v3.10-beta6)  
-[ Irmax ® ]---
"Where there is a will, there is a way! Undeniably so!"

Borgtex
Groupie
Posts: 52
Joined: Mon Mar 08, 2004 1:32 pm

Post by Borgtex » Mon Jun 21, 2004 8:35 pm

maybe because it reacts with false positives like "Essex", "Blow-fish" or the messages contain that words (the name of a virus, i.e.)

also, the regexp is formally correct, but it doesn't makes too much sense the ".*)+" part, as it doesn't really matters if there is more than one of that words: the rule will already give a positive result with the first one

Maybe you can try with this one (still not perfect, however):

(^|\s|\W)(sex($|[^y])|porn|blow($|[^i]))

Post Reply

Who is online

Users browsing this forum: No registered users and 5 guests