@@ -1,3 +1,8 @@

+Sun Sep 23 13:49:12 BST 2007 (njh)

+----------------------------------

+  * libclamav/mbox.c:	MailFollowURLS: Prefer .exes for download, catches

+  				Trojan.IRC-Script-33

+

 Sat Sep 22 18:14:49 EEST 2007 (edwin)

 -------------------------------------

   * libclamav/cvd.c: seek on the underlying file descriptor and not FILE*.

@@ -36,6 +36,8 @@ static	char	const	rcsid[] = "$Id: mbox.c,v 1.381 2007/02/15 12:26:44 njh Exp $";

 #endif

 #endif

+#define _GNU_SOURCE

+

 #include <stdio.h>

 #include <stdlib.h>

 #include <errno.h>

@@ -156,7 +158,7 @@ typedef	enum {

 #endif

 #endif

-#if	(!defined(C_WINDOWS)) && !defined(C_BEOS)

+#ifndef	C_WINDOWS

 #define	closesocket(s)	close(s)

 #define	SOCKET	int

 #endif

@@ -184,6 +186,10 @@ typedef	unsigned	int	in_addr_t;

 #define EISCONN	WSAEISCONN

 #endif

+#ifdef	C_WINDOWS

+#define	strcasestr(h, n)	strstr(h, n)	/* This will cause isBounceMessage() to match too much */

+#endif

+

 /*

  * Define this to handle messages covered by section 7.3.2 of RFC1341.

  *	This is experimental code so it is up to YOU to (1) ensure it's secure

@@ -2835,7 +2841,7 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

 					 * Don't bother with text/plain or

 					 * text/html

 					 */

-					if(strstr(s, "text/plain") != NULL)

+					if(strcasestr(s, "text/plain") != NULL)

 						/*

 						 * Don't bother to save the

 						 * unuseful part, read past

@@ -2845,7 +2851,7 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

 						 */

 						continue;

 					if((!doPhishingScan) &&

-					   (strstr(s, "text/html") != NULL))

+					   (strcasestr(s, "text/html") != NULL))

 						continue;

 					break;

 				}

@@ -3993,6 +3999,31 @@ do_checkURLs(const char *dir, tag_arguments_t *hrefs)

 	n = 0;

+	/*

+	 * Sort .exes higher up so that there's more chance they'll be

+	 * downloaded and scanned

+	 */

+	for(i = FOLLOWURLS; (i < hrefs->count) && (n < FOLLOWURLS); i++) {

+		const char *url = (const char *)hrefs->value[i];

+		const char *ptr;

+

+		if(strncasecmp("http://", url, 7) != 0)

+			continue;

+

+		ptr = strrchr(url, '.');

+		if(ptr == NULL)

+			continue;

+		if(strcasecmp(ptr, ".exe") == 0) {

+			/* FIXME: Could be swapping with another .exe */

+			cli_dbgmsg("swap %s %s\n", hrefs->value[n], hrefs->value[i]);

+			ptr = hrefs->value[n];

+			hrefs->value[n++] = url;

+			hrefs->value[i] = ptr;

+		}

+	}

+

+	n = 0;

+

 	for(i = 0; i < hrefs->count; i++) {

 		const char *url = (const char *)hrefs->value[i];