[clamav-users] Custom clamav rule to block exe and scr files in archive.

[Virgo Pärna]

On Thu, 5 Feb 2015 09:11:16 -0000, Steve Basford <steveb_clamav at sanesecurity.com> wrote:
>
> So, using CL_TYPE_MAIL will hit a url/filename mentoned in an email too,
> which might not be a bad thing but though I'd mention it.
>

    I did know that. But I guess it is worth mentioning. I am using those 
rules in mail server, where exe attachments are blocked anyways. And it only 
matches files attached to mail. It does not match urls inside the mail content.
    Also, since regexes are actually case sensitive, it does not match *.EXE. 
So there's that.

-- 
Virgo Pärna 
virgo.parna at mail.ee