[clamav-users] Custom clamav rule to block exe and scr files in archive.

[Steve Basford]

On Thu, February 5, 2015 9:30 am, Virgo Pärna wrote:
> On Thu, 5 Feb 2015 09:11:16 -0000, Steve Basford

>It does not match urls inside the
> mail content. Also, since regexes are actually case sensitive, it does not
> match *.EXE. So there's that.
Hi Virgo,

(?i) will sort that case bit out...

eg...

Sanesecurity.blockexe:*:*:(?i)\.exe$:*:*:*:*:*:*

or the long way...

Sanesecurity.blockexe:*:*:\.[Ee][Xx][Ee]$:*:*:*:*:*:*

Cheers,

Steve
Web : sanesecurity.com
Blog: sanesecurity.blogspot.com