On Mon, 30 Oct 2006 19:35:13 +0100 aCaB <[EMAIL PROTECTED]> wrote: > Kris Deugau wrote: > > ImgSpam.Misc.5:0:0:474946383761??(01|00)??004400002c00000000??(01|00)??0084(00|48|53)(00|15)(00|30|1c)f0f0f0(f0|e0|c0)f0(e0|b0|f0|d0|c0)f0(00|f0|40)(00|d0|e0|60|70)(f0|90|00|c0)(e0|90|00|b0|70)f0??(00|90|40|7d|10)(f0|ea)??(f0|00|e0|d0|46) > > Hi Kris, > There are a number of problems with your sample sig. > The most important rules you should obey are:
A few corrections :-) > 1) you always need at least 2 static bytes before and after a wildcard > (though a serie of ?? is fine) with 0.9x it's enough to have a block of 2 static bytes somewhere in a part of signature (by 'part' I mean a sequence delimited by range wildcards (*, {})). > 2) a static block must not start with 00 it can start with 00 :-) > 3) The alt syntax is (aa|bb), not (aa|bb|cc..) (aa|bb|cc..) is just fine > So, just looking at the begin of your sig: The above sig looks OK to me. -- oo ..... Tomasz Kojm <[EMAIL PROTECTED]> (\/)\......... http://www.ClamAV.net/gpg/tkojm.gpg \..........._ 0DCA5A08407D5288279DB43454822DC8985A444B //\ /\ Mon Oct 30 19:53:57 CET 2006 _______________________________________________ http://lurker.clamav.net/list/clamav-users.html