Re: [Exim] Filter to match two-extension file attachments?

On Tue, 2001-12-04 at 23:05, Dave C. wrote:
>
> I am aware of the Generic Executable Filter that Nigel has published.
>
> I'm wondering if anyone has written or attempted to write a filter which
> only blocks attachments disguised with two extensions, where the second
> (hidden) extension is an executable one (eg xxxxx.gif.exe or
> xxxxx.doc.pif)

Modify the regexp to have something like \.[A-Z0-9]{1,3} ahead of the
extension. [you will need to modify the \ quoting to work in that
filter.

Note this will then ignore the latest and not so greatest varient which
just uses gone.scr as the name.

> We are an ISP, and cant quite block all executable content outright, but
> I can't think of too many cases where a legit attachment would have two
> extensions with the second as a windows-executable one..

Policy is obviously up to you.

    Nigel.
-- 
[ Nigel Metheringham           Nigel.Metheringham@??? ]
[ Phone: +44 1423 850000                         Fax +44 1423 858866 ]
[ - Comments in this message are my own and not ITO opinion/policy - ]