UnrealIRCd Forums

This happened recently when someone on my network tried to send a pic to another:
08:53 [taphouse] !mnemosyne.taphouse.org [Spamfilter] somenick!~[email protected] matches filter 'C:\WINNT\system32\(notes|videos|xxx|ManualSeduccion|postal|hechizos|images|sex|avril)\.zip': [DCC magdalen: 'SexiKen1.jpg'] [Infected by Gaggle worm]

I understand that false positives can *happen* but this doesnt even match the regex (we are using the latest unreal and an *unchanged* spamfilter)

/spamfilter returns this:
> f d dccblock 0 125582 86400 Infected_by_Gaggle_worm mnemosyne.taphouse.org C:\WINNT\system32\(notes|videos|xxx|ManualSeduccion|postal|hechizos|images|sex|avril)\.zip

at first it was suggested that this regex was *underescaped* ...\\ instead of \
but it appears properly in the spamfilter.conf:
spamfilter {
regex "C:\\WINNT\\system32\\(notes|videos|xxx|ManualSeduccion|postal|hechizos|images|sex|avril)\.zip";
target dcc;
action dccblock;
reason "Infected by Gaggle worm";
};

so this should have only stopped a zip file correct?
thanks for any help you can provide.

Ankara
--no sig---=)

Hmmm... could well be...
I remember escaping got implemented in 3.2.3 so that \\ -> \, so this would also affect all spamfilters which are now wrong, all \'s will have to be \\... fun.

Syzop wrote:I remember escaping got implemented in 3.2.3 so that \\ -> \, so this would also affect all spamfilters which are now wrong, all \'s will have to be \\... fun.

For now, will it work if all the \\'s were \\\\'s?

Yeah.
Btw, only \\ needs to become \\\\, the other things are unaffected (the config parser keeps for example \. as \.).
A fixed version is also in CVS (simply replacing \\ -> \\\\).