mIRC.Patch.13b.exe

DragonRyder · Post by **DragonRyder** » Mon May 29, 2006 1:37 am

i have added all the ways i can think of doing it - but this one keeps coming back - can someone please help me do this correctly?

SPAM#1 -- ^- http://www.xforce.info/mIRC.Patch.13b.exe - A new mIRC worm has recently been released, please download and run this patch, or go to http://www.mIRC.com for further info. It is important that you patch your mIRC A.S.A.P to avoid getting infected by the sObe0-N12 mIRC worm

Stealth · Post by **Stealth** » Mon May 29, 2006 6:25 am

Do you have examples of past messages?

ARcanUSNUMquam · Post by **ARcanUSNUMquam** » Mon May 29, 2006 6:44 am

I think that is the message. I've seen it before.

regex match is:

Code: Select all

http://www\.xforce\.info/mIRC\.Patch\.13b\.exe

The spammer is taking a gamble putting http://www.mirc.com in his message, but i suppose it might help his credibility. But that's the social engineerer in me talking.

DragonRyder · Post by **DragonRyder** » Mon May 29, 2006 12:53 pm

thanks

Stealth · Post by **Stealth** » Mon May 29, 2006 3:50 pm

I've seen this one with different websites as the host...

Code: Select all

http://.+\..+/mIRC\.Patch\..+\.exe

This will block all hosting sites, as well as variations in the exe name.