natan:
> Hi
> I gat many many e-mails with virus and double exstension like:
> *.jpg.img
> *.pdf.img
> *.*.img
>
> I try in header_checks.pcre
>
[broken regexp omitted]
>
> and not working
The following blocks a 'bad' extension before a 'good' one such
as 'name.exe.pdf'.
1) Take the example from the header_checks manpage
2) Insert ((\.|=2E)[a-z]+)? between vxd|ws[cfh]) and )(\?=)?"?\s*(;|$)/x
3) Replace $4 with $4$5
A much simpler rule would block all double extensions (such as
'name.pdf.jpg'), but I don't know if that would also block legitimate
mail.
Wietse
