text_combined: michael hutchinson ylwyrpjpsfrmanuxconz original message dave koontz mailtofcquqwdmbcedu sent sunday 24 february 2008 509 pm zqoqispamassassinapacheorg subject please help rule still getting storm worm messages caught even sane security clamav thought id write rule score url dot exe scr pif extension however rule working someone help advise wrong want pickup http https extensions body dangerous_url http1200exescrpifi describe dangerous_url dangerous url score dangerous_url 75 thanks advance dont know standard practise list attachment filtering simscan spamassassin using varqmailcontrolsimcontrol config reads amwmuficurourdomainnzclamyesspamno amwmuficurourtrusteddomainnzclamyesspamno clamyesspamyesspam_hits20attachvbslnkscrwshhtapif first two lines mean two domains listed spam checking spamassassin antivirus scanning clamav last line global configuration every site antivirus checking spamassasssin checking switched plus block listed attachments outright sorry dont run simscan thought id post 02 cheers michael hutchinson tgxmhanwhkmeavgmailcom sat apr 26 154855 2008 soiofdvxgperlorg tgxmhanwhkmeavgmailcom subject printing text two blank lines date fri 15 feb 2008 130424 0800 pst messageid mimeversion 10 contenttype textplain charsetcontenttransferencoding 7bit ive trying use regular expressions kind counter thing cant seem work right data text file important thing want extract two blank lines thats systematic way find useful lines itll go blank line important stuff blank line plenty lines text may blank line important ones simple way extractprint lines thanks llgnioiicamalacbdeio contenttype messagerfc822 contentdisposition inline filename fri 08 aug 2008 140140 1300 please help rule