Tomasz Kojm wrote:
> A few corrections :-)
Ah! The Voice of Authority! <g>
> aCaB <[EMAIL PROTECTED]> wrote:
>> 1) you always need at least 2 static bytes before and after a wildcard
>> (though a serie of ?? is fine)
>
> with 0.9x it's enough to have a block of 2 static bytes somewhere in a part
> of signature (by 'part' I mean a sequence delimited by range wildcards (*,
> {})).
FWIW, the sig above is working fine, with 0.88.2 (haven't been inspired
enough to get 0.88.5 backported to Debian woody).
> The above sig looks OK to me.
And aside from the fact that it's not hitting new traffic any more, Clam
has been happy with it too.
I'm still curious about what seem to be inconsistencies in what's valid
and what's not, though.
-kgd
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
