On Mon, 13 Jan 2003 01:44:19 +0200, "Nikos K. Kantarakias" wrote:
=> * name[ ]*=.*\.(bat|pif|vb[as]|scr|lnk|com|exe|{[-0-9a-f]+})"?[ ]*$
Apologies for what may be a stupid question, but I'm a
bit confused as to why you'd be trapping for an "extention" that
is apparently a hexadecimal number. Can you say more about that?
I may be overly paranoid; I use the following string of
potentially "active" extensions to block:
(bat|chm|com|cpl|dll|exe|hlp|hta|jse?|key|lnk|ocx|pif|reg|scr|sh[bs]|vb[se]?|ws[fhe])
but haven't included your hex test. Being paranoid, I guess I'd
like know if I should.
One other question: in developing my more complex [using
several variables] virus program test, I ran across problems with
the double quote and I note that you use it "naked" above. I got
into the habit of using ["] in cases like this just to be sure I
didn't have that problem in future.
Thanks,
- Don
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail