[clamav-users] false positive on MBL_85256034.UNOFFICIAL with Google Drive links

[Olivier]

Robert Kudyba <rkudyba at fordham.edu> writes:


>  >> next if /^MBL_\d+:0:\*:68747470733a2f2f64726976652e676f6f676c652e636f6d$/;
>  next if /^MBL_\d+:0:\*:68747470733a2f2f646f63732e676f6f676c652e636f6d$/;
>
>  You could do better with a regex, see the excellent Perl documentation.
>
> So what's the syntax to use || (or) with this? Something like this?
>
> next if /^MBL_\d+:0:\*:68747470733a2f2f64726976652e676f6f676c652e636f6d$/ ||
> /^MBL_\d+:0:\*:68747470733a2f2f646f63732e676f6f676c652e636f6d$/;

I would make it more simple:

next if /^MBL_\d+:0:\*:123.../;
next if /^MBL_\d+:0:\*:abc.../;
next if /^MBL_\d+:0:\*:097.../;

That way you can comment on each individual line what they code for and
if you need to remove one test, you only need to comment out the
corresponding line without messing up with the regex or the condition.

This script is only run once each time you update the ClamAV unofficial
signatures and each test is run once per line, that makes not much sense
to try to optimize the run time of the script.

Olivier
>
> [2:text/plain Hide]
>
>
> _______________________________________________
>
> clamav-users mailing list
> clamav-users at lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml

--