Re: [Exim] Generic VBS script detection

Top Page
Delete this message
Reply to this message
Author: Dirk Koopman
Date:  
To: Nigel Metheringham
CC: Exim
Subject: Re: [Exim] Generic VBS script detection
On 05-May-2000 Nigel Metheringham wrote:
>   (?:Content-                                   # start of content header
>   (?:Type: \s*                                  # rest of c/t header
>     application/octet-stream                    # content-type
>     |Disposition: \s*                           # content-disposition hdr
>     attachment)                                 # content-disposition
>   ;\s*                                          # space or newline
>   (?:file)?name=                                # filename=/name= 
>   |begin \s+ [0-7]{3,4} \s+)                    # begin octal-mode
>   (\"[^\"]+\.(?:vbs|vbe|wsh|js|jse)\"           # quoted filename.ext
>   |[\w.-]+\.(?:vbs|vbe|wsh|js|jse))             # unquoted filename.ext
>   [\s;]                                         # trailing ;/space/newline

>


add exe and com while are here?

Dirk
--
Dirk-Jan Koopman, Tobit Computer Co Ltd
At the source of every error which is blamed on the computer you will find
at least two human errors, including the error of blaming it on the computer.