broken regex? or something else...

[Ankara23]

This happened recently when someone on my network tried to send a pic to another:
08:53 [taphouse] !mnemosyne.taphouse.org [Spamfilter] somenick!~[email protected] matches filter 'C:\WINNT\system32\(notes|videos|xxx|ManualSeduccion|postal|hechizos|images|sex|avril)\.zip': [DCC magdalen: 'SexiKen1.jpg'] [Infected by Gaggle worm]

I understand that false positives can *happen* but this doesnt even match the regex (we are using the latest unreal and an *unchanged* spamfilter)

/spamfilter returns this:
> f d dccblock 0 125582 86400 Infected_by_Gaggle_worm mnemosyne.taphouse.org C:\WINNT\system32\(notes|videos|xxx|ManualSeduccion|postal|hechizos|images|sex|avril)\.zip

at first it was suggested that this regex was *underescaped* ...\\ instead of \
but it appears properly in the spamfilter.conf:
spamfilter {
regex "C:\\WINNT\\system32\\(notes|videos|xxx|ManualSeduccion|postal|hechizos|images|sex|avril)\.zip";
target dcc;
action dccblock;
reason "Infected by Gaggle worm";
};

so this should have only stopped a zip file correct?
thanks for any help you can provide.

Ankara
--no sig---=)

[Syzop]

Hmmm... could well be...
I remember escaping got implemented in 3.2.3 so that \\ -> \, so this would also affect all spamfilters which are now wrong, all \'s will have to be \\... fun.

[Stealth]

I remember escaping got implemented in 3.2.3 so that \\ -> \, so this would also affect all spamfilters which are now wrong, all \'s will have to be \\... fun.

For now, will it work if all the \\'s were \\\\'s?

[Syzop]

Yeah.
Btw, only \\ needs to become \\\\, the other things are unaffected (the config parser keeps for example \. as \.).
A fixed version is also in CVS (simply replacing \\ -> \\\\).