Hi Antony,
> Therefore my suggestion is that a third signature database file be created,
> in addition to viruses.db and viruses.db2, and this new file contains all the
> signatures of "damaged" viruses.
Currently it will be rather hard to create a signature for a damaged virus
that only matches the damaged file. It's far more easier to create a signature
that matches both - the original and damaged files. I think you're right and
new signatures should be more general.
> If the idea of having an extra database file is too much of an overhead to
> implement efficiently in ClamAV, then perhaps we could simply have an
> additional file which gets distributed, but has to be appended onto the end
> of viruses.db in order for it to become effective on a system - then there
> would be no changes to the code at all, and only those people who want to
> match broken samples will need to do an additional 'cat' at the end of their
> freshclam update.
ClamAV reads all the .db and .db2 files from the database directory. You
can create a signature yourself and put it to the somename.db file in that
directory.
Best regards,
Tomasz Kojm
--
oo ..... [EMAIL PROTECTED]
(\/)\......... http://www.konarski.edu.pl/~zolw
\..........._ I nie zapomnij kliknac w brzuszek...
//\ /\\ <- C. Amboinensis www.pajacyk.pl
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users
