Helo Steve,
First at all, thanks for your promptly answer. It works flawlessly.
After some tests I finally found what was wrong with my signatures. I
was using sigtool --hex-dump to build my signatures. I took some time to
realize that sigtool was adding \n to my signatures (identified by the
0a character at the end). After removing the 0a from my signatures they
"magically" started to work.
Best regards, and, again, thank you for your time and help.
Claudio Cuqui
On 05/23/2014 04:06 PM, Steve Basford wrote:
On Fri, May 23, 2014 4:25 pm, Claudio Cuqui wrote:
Hello there !
I would like to known if is it possible to create a virus signature that
match the subject of a mail message. I tried everything and the signature
only match when the pattern is located in the email body.
Something like this...
Spam.Subject.001:4:*:5375626A6563743A{-50}4D617373205370616D205375626A656374
Which will match...
Subject: (any 50 chars)Mass Spam Subject
Cheers,
Steve
Sanesecurity
_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/support/ml
_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/support/ml
