[clamav-users] Signature matching email Subject:

[Claudio Cuqui]

Helo Steve,

First at all, thanks for your promptly answer. It works flawlessly. 
After some tests I finally found what was wrong with my signatures. I 
was using sigtool --hex-dump to build my signatures. I took some time to 
realize that sigtool was adding \n to my signatures  (identified by the 
0a character at the end). After removing the 0a from my signatures they 
"magically" started to work.

Best regards, and, again, thank you for your time and help.

Claudio Cuqui


On 05/23/2014 04:06 PM, Steve Basford wrote:
> On Fri, May 23, 2014 4:25 pm, Claudio Cuqui wrote:
>> Hello there !
>>
>>
>> I would like to known if is it possible to create a virus signature that
>> match the subject of a mail message. I tried everything and the signature
>> only match when the pattern is located in the email body.
>>
> Something like this...
>
> Spam.Subject.001:4:*:5375626A6563743A{-50}4D617373205370616D205375626A656374
>
> Which will match...
>
> Subject: (any 50 chars)Mass Spam Subject
>
> Cheers,
>
> Steve
> Sanesecurity
>
> _______________________________________________
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> http://www.clamav.net/support/ml