RE: [cobalt-users] PWS-gen.Hooker Trojan

["Sim Ayers" <sim@xxxxxxxxxxxx>]

>> Sim,
> > The line that specifies which file types to remove or defangle is:
> >
> >    *filename=".*\.(vbs|wsf|eml|shs|exe|nws|chm|pif|vbe|hta|scr)"
>                                                  ^^^
> >
> > To add pif to the list it should look like this
> >    *filename=".*\.(vbs|wsf|eml|shs|exe|nws|chm|pif|vbe|hta|scr|pif)"
>                                                  ^^^             ^^^
> Am I the only one seeing this oddly?


pif is already added to the list of filenames to match on. What I need is
the
correct syntax to match on "images.doc.pif" .

Currently the line
*filename=".*\.(vbs|wsf|eml|shs|exe|nws|chm|pif|vbe|hta|scr)"

stops images.pif , but it does not stop ".doc.pif" , which has double dots.

Sim