[clamav-users] Problem with extended signature format

khan rrsuj at yahoo.com
Mon Mar 9 12:31:18 EDT 2015


Hi,I would like to match files that have signautre beginning with 4545, so I wrote the .ndb file like this-
Worm.Test.A:0:0,2:4545??
But it does find all files that has 4545 sequence (even this sequence is present in the 8th byte position, not at the beginning). Also I tested with "Worm.Test.A:0:0:4545??"
Why the offset "0,2" or "0" does not work? It should look for the sequence at the beginning, not in the later part? Am I missing something?
Thank you for your support.
/Khan





More information about the clamav-users mailing list