On Thu, 5 Feb 2015 09:11:16 -0000, Steve Basford
<steveb_cla...@sanesecurity.com> wrote:
>
> So, using CL_TYPE_MAIL will hit a url/filename mentoned in an email too,
> which might not be a bad thing but though I'd mention it.
>
I did know that. But I guess it is worth mentioning. I am using those
rules in mail server, where exe attachments are blocked anyways. And it only
matches files attached to mail. It does not match urls inside the mail content.
Also, since regexes are actually case sensitive, it does not match *.EXE.
So there's that.
--
Virgo Pärna
virgo.pa...@mail.ee
_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
