text_combined: dave koontz fcquqwdmbcedu still getting storm worm messages caught even sane security clamav thought id write rule score url dot exe scr pif extension however rule working someone help advise wrong want pickup http https extensions body dangerous_url http1200exescrpifi describe dangerous_url dangerous url score dangerous_url 75 thanks advance tue 05 aug 2008 235254 0500 please help rule