Page 1 of 1
Hidden iframes
Posted: 13 May 2013, 17:54
by bendix
Hi,
Can you please add hidden iframes on "Regular expression match"?
I found this:
Code: Select all
<iframe src="http://boogyman.biz.ua/?1" width="0" height="0" frameborder="0"></iframe>
and was not detected in any way by cxs.
Thank you.
Re: Hidden iframes
Posted: 13 May 2013, 19:30
by Sergio
I would add the following command to my CXS.XTRA file:
and that will quarantine any file that contains that word.
Sergio
Re: Hidden iframes
Posted: 14 May 2013, 13:33
by peterelsner
Sergio,
Don't you also have to put the word quarantine in the file to force the quarantine?
regll:quarantine:boogyman\.
Re: Hidden iframes
Posted: 14 May 2013, 14:03
by Sergio
Peter:
you are right, you can write the command as you say.
But in my CXS configuration I have set that everything that is contained in my CXS.XTRA file is quarantined, so, I don't use the :quarantine: prefix, I have been using -qoptions=mMfSGchexv where "m = regex pattern match" instead.