Re: [Exim] Generic VBS script detection

Author: Jon Knight
Date:
To: Nigel Metheringham
CC: Exim
Subject: Re: [Exim] Generic VBS script detection

On Thu, 4 May 2000, Nigel Metheringham wrote:
> if ($message_body matches "^\\s+name=[A-Za-z0-9_-.]+.[vV][bB][sS]" or

That caused my copies of Exim to barf so I changed it to:

if ($message_body matches "^\\s+name=.+.[vV][bB][sS]" or
    $message_body matches "^begin \\d\\d\\d .+\\.[vV][bB][sS]")
then
  freeze text "Message appears to contain a VBS attachment - might be a virus\n"
endif

That should do the trick for a while... ;-)

Tatty bye,

Jim'll

This message is part of the following thread:
	the complete thread tree sorted by date
	Alan Thew at
	Peter Radcliffe at