procmail
[Top] [All Lists]

update your generic exe filters..

2003-02-02 15:31:42
the new trojan/worm "Sadhound" as stated in:
http://vil.nai.com/vil/content/v_100011.htm
uses a filename like: Missingyou.htm.%Number of spaces%pif.htm

so update your recipes to catch the .[   ]extension
any number of spaces------------------^^^

I've changed mine to:
*
name[tab+spc]*=.*\.[tab+spc]*(bat|pif|vb[as]|scr|lnk|com|exe|{[-0-9a-f]+})(\
.....?)?"?[tab+spc]*$


Cheers
Nikos
___________________________
signature text:
  Nikos K. Kantarakias
  URLs:  http://www.nikant.tk/
         http://www.skiathos.tk/
         http://agriroot.aua.gr/



_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>
  • update your generic exe filters.., Nikos K. Kantarakias <=