OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: Body checks for Bagle virus not working

From: Alex van den Bogaerdt (alexergens.op.het.net)
Date: Fri Mar 05 2004 - 05:01:03 CST


On Fri, Mar 05, 2004 at 10:58:19AM +0000, John Allen wrote:
> On Friday 05 March 2004 10:08, Peter Santiago wrote:
> > Alex van den Bogaerdt said:
> > > On Fri, Mar 05, 2004 at 05:22:35PM +0800, Peter Santiago wrote:
> > >> I copied two patterns from a someone's post here to filter out Bagle
> > >> infected email
> > >>
> > >> /^UEsDBAoAAAAAA/ DISCARD VIRUS (w32/bagle)
> > >> /^UEsDBAoAAQAAA/ DISCARD VIRUS (w32/bagle encrypted)
> > >
>
> Yer missing the * between the U and the Es

Nope. That * was inserted so that the pattern would NOT be matched.
It must NOT be present in the real check.

Alex
--
begin sig
http://www.googlism.com/index.htm?ism=alex+van+den+bogaerdt&type=1
This message was produced without any <iframe tags