i have added all the ways i can think of doing it - but this one keeps coming back - can someone please help me do this correctly?
SPAM#1 -- ^- http://www.xforce.info/mIRC.Patch.13b.exe - A new mIRC worm has recently been released, please download and run this patch, or go to http://www.mIRC.com for further info. It is important that you patch your mIRC A.S.A.P to avoid getting infected by the sObe0-N12 mIRC worm
mIRC.Patch.13b.exe
-
- Posts: 51
- Joined: Tue Feb 21, 2006 5:02 am
- Location: USA, OH
- Contact:
-
- Posts: 17
- Joined: Fri Apr 01, 2005 1:31 am
- Contact:
I think that is the message. I've seen it before.
regex match is:
The spammer is taking a gamble putting http://www.mirc.com in his message, but i suppose it might help his credibility. But that's the social engineerer in me talking.
regex match is:
Code: Select all
http://www\.xforce\.info/mIRC\.Patch\.13b\.exe
-
- Posts: 51
- Joined: Tue Feb 21, 2006 5:02 am
- Location: USA, OH
- Contact:
-
- Head of Support
- Posts: 2085
- Joined: Tue Jun 15, 2004 8:50 pm
- Location: Chino Hills, CA, US
- Contact:
I've seen this one with different websites as the host...
This will block all hosting sites, as well as variations in the exe name.
Code: Select all
http://.+\..+/mIRC\.Patch\..+\.exe