I just want to learn the format of ClamAV's signature. So I tried to build a signature containing a wildcard by myself. The example I used is as follows:
I have made up a signature of: Worm.Yawen (Clam)=61*7c62 where "617c62" means "a|b". Then I put this signature into a .db file. When I didn't add the * in the signature, it can be used to match the string of a|b. But once I added the * into the signature, there was an error like this: LibClamAV Error: cli_parse_add(): Problem adding signatures (2). Problem parsing signature at line 1 Problem parsing database at line 1 Can't load daily.db: Malformed database ERROR: Malformed database What is wrong in my method of building the signature with wildcard? Best regards, Xue Wen _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
