UnrealIRCd Forums

Posted: **Mon May 29, 2006 1:37 am**

i have added all the ways i can think of doing it - but this one keeps coming back - can someone please help me do this correctly?

SPAM#1 -- ^- http://www.xforce.info/mIRC.Patch.13b.exe - A new mIRC worm has recently been released, please download and run this patch, or go to http://www.mIRC.com for further info. It is important that you patch your mIRC A.S.A.P to avoid getting infected by the sObe0-N12 mIRC worm

Posted: **Mon May 29, 2006 6:25 am**

Do you have examples of past messages?

Posted: **Mon May 29, 2006 6:44 am**

I think that is the message. I've seen it before.

regex match is:

Code: Select all

http://www\.xforce\.info/mIRC\.Patch\.13b\.exe

The spammer is taking a gamble putting http://www.mirc.com in his message, but i suppose it might help his credibility. But that's the social engineerer in me talking.

Posted: **Mon May 29, 2006 12:53 pm**

thanks

Posted: **Mon May 29, 2006 3:50 pm**

I've seen this one with different websites as the host...

Code: Select all

http://.+\..+/mIRC\.Patch\..+\.exe

This will block all hosting sites, as well as variations in the exe name.