|
Remove Obfuscated Code [20081221b]
|
|
Dec. 20, 2008, 07:06 PM
Post: #15
|
|||
|
|||
|
RE: Remove Obfuscated Code [20081216]
That's not intentional; that simply translates to "foobar" (or so I'd hope so).
I'll be revising the filter today; I came across some false positives, and I'll implement z12's ideas into the filter to make it more readable. Thanks! EDIT: Updated. Got rid of the "foobar" replacement texts, updated the octal and hex matching expressions (thanks z12), and I also added $TYPE(vbs). I should have fixed most/all false positives by simply ensuring there is a double/single quote at the beginning (I had to increase the byte size to 91 to accommodate for this additional byte). |
|||
|
« Next Oldest | Next Newest »
|

Search
Member List
Calendar
Help






![[-]](images/ONi/collapse.gif)