sb-dangerous.rc

这是一个从音频信号里提取特征参量的程序

# Hidden executables (typical of viruses)
#
#  This catches those file attachment names like IEEE802WAPTER.doc.pif,
#  hello.doc.bat, and readme.HTML.vbs.
#
:0 BH
* ^Content.*(file)?name=.+\..+\.(hta|vbs|exe|scr|pif|lnk|bat|com).*$
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Hidden Executable Attachment"

 :0
 { SPAMTAG=yes }

 :0
 { DANGEROUS=yes }
}


# Embedded IFRAME
#
#  This catches email with embedded IFRAMEs, which can run remote
#  executable content on some email programs and is very dangerous.
#
:0 BH
* -1000^0
*  1100^1    ()<iframe.*src=.*height=.*width=
*  1100^1      iframe>
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Embedded iframe"

 :0
 { BLOCKTAG=yes }

 :0
 { DANGEROUS=yes }
}


# Embedded Scripts
#
#  This catches HTML-based email with embedded Scripting code,
#  Javascript or others.
#
:0 BH
* -1000^0
*  1100^1    ()<SCRIPT language=
*  1100^1    ^function TripodShowPopup\(\)$
*   500^1     function validate\(string\)
*   500^1     if \(!string\) return
*   500^1     if \(Chars.indexOf\(string.charAt\(i\)\)
*   500^1     function check_empty
*   500^1     function validate_form\(\)
*   500^1     return \(text\.length
*    10^1.5   (^|[^0-9a-z])function([^0-9a-z]|$)
*    10^1.5   (^|[^0-9a-z])return([^0-9a-z]|$)
*    10^1.5   (^|[^0-9a-z{])var([^0-9a-z]|$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Embedded Script"

# :0
# { BLOCKTAG=yes }

 :0
 { DANGEROUS=yes }
}


# All executables (just too dangerous)
#
#  This catches any email with an executable attachment and puts it
#  in your ${BLOCKFOLDER}.  This filter should intercept most new
#  email viruses, since users are not aware that they are sending
#  them.
#
:0 BH
* EXECHECKING ?? yes
* !^Subject:.*${BYPASSWD}
*  ^(Content.*(file)?name=.+\.(hta|vbs|exe|scr|pif|lnk|bat).*$|\
     Content-Type:(.*$)+.*(file)?name=.+\.(hta|vbs|exe|scr|pif|lnk|bat).*$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Executable Attachment"

 :0
 { BLOCKTAG=yes }

 :0
 { DANGEROUS=yes }
}


# Document Files with Executable Code (also too dangerous)
#
#  This catches any email containing a document file of a type that
#  can contain executable macros, such as most Microsoft Office files
#  can, and puts it in your ${BLOCKFOLDER}.  This filter should
#  intercept many new email viruses.
#
:0 BH
* EXEDOCCHECKING ?? yes
* !^Subject:.*${BYPASSWD}
*  ^(Content.*(file)?name=.+\.(cd.|doc|pdf|ppt|prj|vs.|xl.).*$|\
     Content-Type:(.*$)+.*(file)?name=.+\.(cd.|doc|pdf|ppt|prj|vs.|xl.).*$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Executable Document"

 :0
 { BLOCKTAG=yes }

 :0
 { DANGEROUS=yes }
}