Kris Deugau wrote: > ImgSpam.Misc.5:0:0:474946383761??(01|00)??004400002c00000000??(01|00)??0084(00|48|53)(00|15)(00|30|1c)f0f0f0(f0|e0|c0)f0(e0|b0|f0|d0|c0)f0(00|f0|40)(00|d0|e0|60|70)(f0|90|00|c0)(e0|90|00|b0|70)f0??(00|90|40|7d|10)(f0|ea)??(f0|00|e0|d0|46)
Hi Kris, There are a number of problems with your sample sig. The most important rules you should obey are: 1) you always need at least 2 static bytes before and after a wildcard (though a serie of ?? is fine) 2) a static block must not start with 00 3) The alt syntax is (aa|bb), not (aa|bb|cc..) So, just looking at the begin of your sig: 474946383761 <= all fine, static ?? <= wildcard following a static block, fine (01|00) <= wildcard not following a static block, bad ?? <= wildcard not following a static block, bad 0044 <= static block starting with 00, bad So, this: 474946383761??(01|00)??0044 Should really read: 474946383761????????44 Take care, -aCaB _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
