I appreciate the tip.  However, I don't know how to do that with Procmail filters.  It is supposed to work like grep.  In grep this: "\bname" (including the quotes) will find the line I want.  In the Procmail filters \bname (no quotes) does not find the line.

Is there something in the syntax I am not understanding so that Procmail will find that line with the leading tab?

Alan

At 06:00 PM 5/21/02 -0500, you wrote:
I think you need to look for the whitespace prior to 'name'.
That is, perhaps, the reason your "^" did not work?


On Tue, May 21, 2002 at 06:44:03PM -0400, alandd@mindspring.com wrote:
 The server is running Procmail v3.10.  I have a recipe in .procmailrc that drops emails with certain attachments:
 
 -----
 :0 B
 * ^Content.*(file)?name=.*\.(hta|vbs|exe|scr|pif|lnk|bat|com)
 /dev/null
 -----
 
 This catches most of them, but it misses the following email because "name=" is on a new line.  That's fine, but there's also a tab before "name=".
 
 -----
 Subject: A special  funny website
 Content-Type: multipart/alternative;
 	boundary=C2d7M23S9A7E2ydC8z8944PN8KdX73HX028b
 Date: 21 May 2002 10:27:42 -0400
 
 --C2d7M23S9A7E2ydC8z8944PN8KdX73HX028b
 Content-Type: text/html;
 Content-Transfer-Encoding: quoted-printable
 
 ...
 
 --C2d7M23S9A7E2ydC8z8944PN8KdX73HX028b
 Content-Type: application/octet-stream;
 	name=FACE.scr
 Content-Transfer-Encoding: base64
 Content-ID: <OOPXO49t4jYs9h>
 
 TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 AAAAAAAA2AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4g
 CjwvQk9EWT4NCjwvSFRNTD4NCj==
 --C2d7M23S9A7E2ydC8z8944PN8KdX73HX028b--
 
 -----
 
 
 I've tried to filter it out:
 
 * ^name=.*\.(hta|vbs|exe|scr|pif|lnk|bat|com)
 * ^\bname=.*\.(hta|vbs|exe|scr|pif|lnk|bat|com)
 * \bname=.*\.(hta|vbs|exe|scr|pif|lnk|bat|com)
 * "\bname=.*\.(hta|vbs|exe|scr|pif|lnk|bat|com)"
 
 But none of these work.  Any ideas?
 
 Alan