Thank you!
That worked as expected.
The same story: Reading the manual more thoroughly cold have told me
the same!
Best regards
Asle Skage
----- Original Message -----
From: "Tomasz Kojm" <tk...@clamav.net>
To: "ClamAV Development" <clamav-devel@lists.clamav.net>
Sent: Friday, August 26, 2011 1:13 PM
Subject: Re: [Clamav-devel] Creating signature excluding part of string
On Fri, 26 Aug 2011 13:07:45 +0200 Asle Skage <asle.sk...@online.no>
wrote:
Hi,
I am trying to create a signature that match a pattern, but it should not
match
when a specific pattern is present.
From the documentation:
. !(aa|bb|cc|..)
Match any byte except aa and bb and cc.. (ClamAV >0.96)
This only works for single bytes, not for strings. You need to use
logical signatures, eg:
SigName;Target:0;0&1=0;pattern0;pattern1
This signature will only be reported if pattern0 gets matched and
pattern1 doesn't (1=0 means "pattern with ID 1 must be matched 0 times").
HTH,
--
oo ..... Tomasz Kojm <tk...@clamav.net>
(\/)\......... http://www.ClamAV.net/gpg/tkojm.gpg
\..........._ 0DCA5A08407D5288279DB43454822DC8985A444B
//\ /\ Fri Aug 26 13:08:48 CEST 2011
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
