Remove Obfuscated Code [20081221b]

[DarthTrader]

Here is a modified version (please don't laugh!)

Code:

[Patterns]
Name = "<script>: Remove Obfuscated Code [20081219]"
Active = TRUE
URL = "($TYPE(htm)|$TYPE(js)|$TYPE(vbs))"
Bounds = "$NEST(<script,</script*>)"
Limit = 4096
Match = "*(\\[#000:255])+{15}*"
        "|*((%|\\x)\0([a-f]|[0-9])([a-f]|[0-9]))+{15}*"
        "|*(((%|\\)u)\0([a-f]|[0-9])([a-f]|[0-9])([a-f]|[0-9])([a-f]|[0-9]))+{15}*"
        "|*[^_a-Z0-9]eval \( ((([_a-Z0-9]+)(\+|))+{3,*}*)"
Replace = "$ALERT(Obfuscated code detected and removed from:\r\n\r\n\u\r\n\r\n)"

Comments and corrections welcome!
DarthTrader