[clamav-users] Hint for creating signatures

[Steve Basford]

On Mon, September 8, 2014 3:04 pm, Hajo Locke wrote:

>
> What should i do now? Is there a trick to find a signature which fits
> for all samples or i have to create a different signature for every
> sample?


Hi,

Tricky :(

Copy this into@ not_tested.ndb

test.ercynpr:7:*:3D7374725F726F74313328??636572745F657263796E7072??293B2024
test.cryptbot:7:*:3D22{12}225E22{40}3B2024

You might have to change :3: to :7: to make it work...

Disclaimer: not had enough coffee, so not fully tested etc.

Cheers,

Steve
Sanesecurity.com