Are you trying to add those exact strings?
Signatures in ClamAV are in hexadecimal format. The strings that you are
trying to add are composed of characters instead.
So instead of having for example "Vigra", what you need is "5669677261",
which is the hexadecimal representation of "Vigra".
Your first signature only has one character ("$") between the "{-20}" and
"*" wildcards. If I'm not mistaken, you need at least two characters
between wildcards.
I'm not sure about your second signature.
Regards,
-Alexandre Dias
2012/7/26 Pierre Dehaen <[email protected]>
> Hi,
>
> What does it mean when a signature you add is said to be too short ? The
> error is:
>
> LibClamAV Error: cli_ac_addsig: Signature for Sanesecurity.Pierre.35 is
> too short
> LibClamAV Error: cli_parse_add(): Problem adding signature (1).
> LibClamAV Error: Problem parsing database at line 35
> LibClamAV Error: Can't load /tmp/pierre.ndb: Malformed database
> ERROR: Malformed database
>
> In the source code I found:
>
> if(strlen(hexsig) / 2 < root->ac_mindepth) {
> cli_errmsg("cli_ac_addsig: Signature for %s is too short\n",
> virname);
> return CL_EMALFDB;
> }
>
> That happens to me now and then but I already successfully added shorter
> signatures into
> the ndb file. Is it the signature that is too short, or is it a string of
> it, or is it related to other
> signatures ?
>
> The signature I am trying to add is:
> Vigra{-20}$*http://{-20}doctor.ru
> but this does not work neither:
> Vigra*http://{-20}doctor.ru
>
> Thanks for any advice,
> Pierre
>
> _______________________________________________
> Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
> http://www.clamav.net/support/ml
>
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml
