On Mon, 30 Oct 2006 19:35:13 +0100
aCaB <[EMAIL PROTECTED]> wrote:

> Kris Deugau wrote:
> > ImgSpam.Misc.5:0:0:474946383761??(01|00)??004400002c00000000??(01|00)??0084(00|48|53)(00|15)(00|30|1c)f0f0f0(f0|e0|c0)f0(e0|b0|f0|d0|c0)f0(00|f0|40)(00|d0|e0|60|70)(f0|90|00|c0)(e0|90|00|b0|70)f0??(00|90|40|7d|10)(f0|ea)??(f0|00|e0|d0|46)
> 
> Hi Kris,
> There are a number of problems with your sample sig.
> The most important rules you should obey are:

A few corrections :-)

> 1) you always need at least 2 static bytes before and after a wildcard
> (though a serie of ?? is fine)

with 0.9x it's enough to have a block of 2 static bytes somewhere in a part
of signature (by 'part' I mean a sequence delimited by range wildcards (*,
{})).

> 2) a static block must not start with 00

it can start with 00 :-)

> 3) The alt syntax is (aa|bb), not (aa|bb|cc..)

(aa|bb|cc..) is just fine

> So, just looking at the begin of your sig:

The above sig looks OK to me.

-- 
   oo    .....         Tomasz Kojm <[EMAIL PROTECTED]>
  (\/)\.........         http://www.ClamAV.net/gpg/tkojm.gpg
     \..........._         0DCA5A08407D5288279DB43454822DC8985A444B
       //\   /\              Mon Oct 30 19:53:57 CET 2006
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html

Reply via email to