Dan,

All RegEx's are to be enclosed in parenthesis anywhere they are allowed. Since all lists allow the use of RegEx and normal text search, the parser needs to be able to identify which is a RegEx and which is a normal string. The way it does this is by considering anything enclosed by parenthesis a RegEx.

If it doesn't work this way you may have just found a new bug... Please let us know if so.

Roberto Franceschetti
LogSat Software

I will try this one.

I did see your latest post, I'm currently tracking down an error from one of the regex I just added from an earlier post..

The error I'm getting is the generic "string matching error."

 I *think* it's this one, but I'm still putting them back in one at a time to be sure.

(http://\w{0,6}%[\d])

OK, I'm perplexed.  I removed and re-added one at a time, each of the following:

(http://\w{0,6}%[\d])
(<[!--]+[\x20]{0,1}[a-zA-Z0-9]{10,}[\x20]{0,1}[!--])
(<[!--]+[a-zA-Z0-9]{13,}(-->))
(href="http://+[\d])
((<font color="#ffffff">.*){3,8})

For a while I was convinced it was (http://\w{0,6}%[\d]) causing the error, but I added it back in just to make sure - no errors.  So now they are all in, and still no errors.  Strange.

I'll keep an eye on the log though to to be sure.

Jack,

Also try putting GSC-100 in you keyword list.  At least for now, it blocks something I can's seem to get with a RegEx ... ans a lot of them!

For all the good it will do, here is my current, very small, keyword list. I am still trying to disect the ones I don't get with my expressions.  I also do not want any false positives if I can help it and literal keywords seem to yield the most false blocks.

(<[!--]+[\x20]{0,1}[a-zA-Z0-9]{10,}[\x20]{0,1}[!--])
(href="http://+[\d])
(http://\w{0,6}%[\d])
(<[!--]+[a-zA-Z0-9]{2}(-->))
((<font color="#ffffff">.*){3,8})
text-decoration: blink
98207.biz
herbalpillsonline
pillsavings
CLICK HERE TO START
thousands of other email providers
GSC-100
img src=3D"http://ww
is a one time mailing
Generic Viagara
Generic V1agara

Dan