Hi folks,
I've attached the output from 3 scans, all of which were started at root (/)
with no other volumes mounted on the system.
I'm running the scans with parameters -riv (recursive, print infected only,
verbose) as well as --debug. The verbose flag prints out the name of each file
being scanned, and I *believe* it prints this before attempting to start the
scan of that file.
For each run, I grabbed the console output from the last "Scanning <file path>"
to the end of the output. Of particular note is Run 2, where the last line of
output was the one saying which file was being scanned (prior to that point,
the output was as you would expect) - no debug output at all to hint at where
it went wrong.
As usual, all three scans stopped at different points. I've tried rescanning
those three files, and they all complete successfully. Happy to send them on
to you anyway if you think it would help. Just let me know where to send them -
presumably they shouldn't be sent to the list?
Mark
Scanning /Users/REDACTED/Library/Caches/com.apple.iTunes/WebKitCache/Version
11/Records/0263F8C913F192735CDDD8EE8B35A24936B42423/Resource/DD1190DCEF293D02AFBC495AC16E312F168F5459-blob
LibClamAV debug: in cli_magic_scandesc (reclevel: 0/16)
LibClamAV debug: Recognized ASCII text
LibClamAV debug: cache_check: 3fc5799f5fe8bad9232972eda77d7ce3 is negative
LibClamAV debug: Matched signature for file type HTML data at 82243
LibClamAV debug: Matched signature for file type HTML data
LibClamAV debug: Matched signature for file type HTML data
LibClamAV debug: Matched signature for file type HTML data
LibClamAV debug: Matched signature for file type HTML data
LibClamAV debug: matcher_run: performing regex matching on full map:
2077664+78843(2156507) >= 2156507
LibClamAV debug: cli_pcre_scanbuf: checking 0&1; running regex
/\x2epostMessage\s*\x28\s*([^\s]+)\x2edata\x2econcat\s*\x28\1\x2edata\s*\x29/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1; running regex
/\x2f\x2a\s+XPM\s+\x2a\x2f[^\x7b]*?\x7b\s*\x22\s*(\d+\s+){3}\d{4}/
LibClamAV debug: cli_pcre_scanbuf: checking (0>1)&(1>1)&(2>25); running regex
/.Write\s*\x28\s*vbCrlf[^\n\x29]+\x28\s*[\x22\x27][a-zA-Z0-9+/]{5,}[a-zA-Z0-9+/=]{1,2}[\x22\x27]\s*\x29\s*\x29\r\n/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1&(2>150); running regex /^(var
[a-z]{3,} = [\x22\x27].{1,3}[\x22\x27]\x3B\n)/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/ATF.{3}\xFF.{1}[\x80-\xFF].{4}[\x00-\x12][\x00-\x12][\x00-\x13]/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1&2; running regex
/\x28\x00\x00\x00[\x00-\xff][\x00-\xff]\x90[\x04-\xff]([\x00-\xff]{4})\x01\x00\x08\x00/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1; running regex
/(function\s[o0O]{6}\(\s*([o0O]{6})?(\s*,\s*[o0O]{6})*\s*\).*?){3,}/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/[\W_][a-z0-9]{4,16}\.js/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/SMG[\W_][0-9]{2,4}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/ATTACHMENT\-PP\.html/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/NEW\sOPEN\sTENDER\sREQUIREMENT\sFOR\sMIDDLE\sEAST\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/PTY\sLTD\-USD\s[\d]{2,5}\.[\d]{2}\-VALUE\.vbs/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{4,7}\s[a-zA-Z]{6,9}\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{4}\s[a-z]{4}\-[0-9]{3}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{5}\s[A-Z0-9]{8,12}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/SHIPPING\sDOCUMENT\sINV,\sPL,\sBL\s\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /P000041014\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/BL[\W_][\w]{0,16}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /HUD\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/0\.72077800\s1489544882\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Tax\sRefund\sForm\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/PROCESSO\s2\sVARA\.vbe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/DHL\sDelivery\sDocuments\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/49BHAGB\s398\#\sADVICE\sTT\s0477HF\sHSBC\sSLK\sBANK\.html/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/WF\.jar[\W_]JavaCrypt[\d]?\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/[A-Z]{2}[A-Z0-9]{4,20}\.js/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Contract\sWFALASMA\-05\-17\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /P[\d]{5,10}\.zip/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Shipment\sDocs_Customs\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{6}\s[A-Z]{7}\s[A-Z]{7}\s[A-Z]{3}\s[A-Z]{9}\.pif/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /TT1717\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/NFe\-[\d]{8,10}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/[a-z0-9]{4,15}[_\s\(\-]{1,2}[0-9\)]{3,9}(?![\d]).{0,14}\.js/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/REQUEST\sLIST\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /NBT20620\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/0\.0117363636366363636636363636366333631500\s1489646043\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/(Case|Paiement|dossier|remit|inquiry|proforma|bestellung).{0,20}\.(exe|scr)/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Demostrativo_IR_201[\d]\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/PROFORMA\sINVOICE\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/ENOSFRESHPUTA1858AF\.COM/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Informacoes\sPorto\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /HMRC201707\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/ODER\sREF\s2017\-[\d]{4}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Visualizar\-Anexo[\d]{12,18}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{7}[0-9]{4}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /SCDFRGGVF001\.vbs/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /scan.{6,20}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/SCB01215750191343\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Invoice\s&\spacking\slist\.\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[\d]{2},[\d]{3}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Kuji\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/201[0-9][\W_][0-9]{1,2}[\W_][0-9]{1,2}\sQU[0-9]{3,5}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/\b(FedEx|DHL|US?PS).{0,100}\.(exe|scr|js)/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RFQ\#[\d]{9,14}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Drawing\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/uk_confirmation_ph[\d]{8,12}\.zip/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[0-9]{8,12}\.[a-z]{3}\.wsf/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Q\-IA022017__OUTSTANDING\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /B\-CO\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/\x0A\x05\x01.\x00\x00\x00\x00.{57}[\x80-\xFF]/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{7}[\W_][0-9]{4,8}[\W_][0-9]{4,8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RF[\W_][\d]{5,7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/WU[\d]{6,10}[\W_][\d]{8,12}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/\b(money|cash|details|document|confirm|warning)[\-_\s]?[\w]{0,20}\.js/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{3}\s[a-zA-Z]{8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /[a-z]{2,10}\.docx/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/0\.[0-9]{8}[\W_][0-9]{10}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Catalogue\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{5}\s\-\s[a-zA-Z0-9]{23}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/TT[\W_]EUR[0-9]{1,4}\.[0-9]{2,4}\.[0-9]{1,3}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{1,3}[\W_][A-Z]{2,4}[0-9]{1,3}\.[0-9]{2,4}\.[0-9]{1,3}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/PYMT_2017[\d]{4}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /[A-Z0-9]{12}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/(CANON|NIKON|photo|img|IMG|pic|SHOT|swift|EPSON)[a-z\d]{1,20}\.js/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{2,3}[0-9]{6,8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Za-z]{8}[\W_][A-Za-z]{7}&[A-Z]{2,4}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Remittance\.vbs/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Pending\sinvoice\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Shipping[\W_]docu[\W_]Output[0-9]{15,20}\.cmd/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/^.{32768}\x01CD001.{152}[\x00-\x16]\x00{7}/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/CTM\sBREAKDOWN\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RFQ\-785987\-SNC\-[\d]{12,14}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/DNPSING[\d]{5,10}\.pif/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Reservatio\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/TT\sBANK\sINVOICE\s[\d]{2}\.[\d]{2}\.2017\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Fatura\sPara\spagamento\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /DD06798E\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{5,7}[\W_][A-Z]{10,12}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{2,3}[\W_]{1,2}[0-9]{3,5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/SKMBT[\W_][\w]{0,16}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Required_denomination_\sCTM\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{10}\s\-\s[a-zA-Z0-9]{19,24}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Swift[\d]{10,15}\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/0\.[\d]{6,10}[\W_][\d]{8,12}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{2,4}[0-9]{7,9}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/HSBC2017[\d]{11}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{2,3}[\W_][0-9]{5,7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{8}\s[A-Z]{9}\s[A-Z]{2}[0-9]{6}[A-Z]{4}[0-9]{2}[A-Z]{2}\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Contract\s\#[\d]{4,8}17\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Purchase\sOrder\s\#[\d]{4,8}17\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1; running regex
/(?P<arrayName1>\w+)\s*=\s*new\s*(U?[Ii]nt|Float)(64|32|16|8)Array\s*\x28\s*[\x22\x27]?(?P<arrayName2>\w+).*?[^\.]postMessage\s*\x28.*?,\s*[\x22\x27]?\s*\x5b\s*((?P=arrayName1)|(?P=arrayName2))/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1; running regex
/\x06\x0a[\x00-\x79]{10}/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z0-9]{9,11}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /[A-Z0-9]{9}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /obc\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{6}\s[a-zA-Z]{7}\s[a-z]{6}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Target=(\x22|\x27|)(file|ftp|http|https)://(?!(10|172\.(1[6-9]|2[0-9]|3[0-2])|192\.168))(?:(?:2(?:[0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9])\.){3}(?:(?:2([0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9]))/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Target=(\x22|\x27|)(file|ftp|http|https)://(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{10}\s[a-z]{7}\s[a-z]{9}\.com/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/TT\sApplication\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z][a-z]{6}_[0-9]{5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{2}\#[A-Z0-9]{6}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{6,8}[\W_][A-Z]{2,4}\-[0-9]{1,3}\-[A-Z0-9]{5,7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{1,3}\#[A-Z]{1,3}[0-9]{3,5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{9}[\W_][a-z]\.[0-9]{4,6}\-[0-9]{6,8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{4}\s[a-z]{2}\s[a-z]{7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{2,4}[\W_][a-z]{4,6}[\W_][0-9]{5,7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{1,3}[\W_][0-9]{6,8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]BL[\d]{4}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RFQ\s[\d]{3,5}01[\d]\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{4,5}[\W_][a-z]{3,5}[\W_]{1,3}[a-zA-Z]{4}\.scr/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{1,3}\#[A-Z]{1,3}[0-9]{4,6}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Za-z]{5}[\W_][0-9]{1,3}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]\.[A-Z]\#\s[A-Z0-9]{11}\-[0-9]{2}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/lon2_output[A-Z0-9]{5,10}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Za-z]{5}[\W_][A-Za-z]{3}[\W_][A-Z]{2}[0-9]{2,6}[\W_][0-9]{1,3}[\W_][0-9]{1,5}[\W_]?[0-9]{1,5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z][a-z]{3}_[a-z]{7}\-[A-Z][a-z]{2}\#[0-9]{3}[A-Z]{4}[0-9]{4}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Needed.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /oww\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /hon\s[\d]\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /files\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RG[\d]{6,8}FJ\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /marc\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z][a-z]{7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{8}_[A-Z]{5}_[A-Z]{7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /londone\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{7}\s[A-Z]{3}\s[A-Z]{9},[a-zA-Z]{3}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{5}_[0-9]{10}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/BL,Invoice,Packing\slist\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{8}\s[a-zA-Z]{5}\s[a-zA-Z]{4}\s\#[0-9]{6}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /SWIFT\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /[a-f0-9]{37}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /telex\.vbs/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Spreadsheet\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /ob\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/TIM\.ORG\.TR\sExporters\sExcusive\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Total\sQuote\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RFQ\-Qoute\sRequest\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/pdf\.attachment\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{4}\s[A-Z]{7}\s[A-Z]{6}\s[A-Z]{4}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RFQ\-SPECIFICATION\.pif/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z][a-z]{7}\s[A-Z][a-z]{4}\s[0-9]{5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/required\sshipment\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{8}\s[a-z]{8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /REQUIREMENTS\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Case[\W_]File[\W_](No\.?|\#)[\d]{2,4}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking (0|1)&(2|3)&(4|5); running regex
/regsvr32(\x2Eexe)*\s+(\x2F(u|n|s)\s+){2,3}\x2Fi:http:\x2F{2}/
LibClamAV debug: cli_pcre_scanbuf: checking (0|1)&(2|3)&(4|5); running regex
/r\x00e\x00g\x00s\x00v\x00r\x003\x002\x00(\x2E\x00e\x00x\x00e\x00)*(\s\x00)+(\x2F\x00(u\x00|n\x00|s\x00)(\s\x00)+){2,3}\x2F\x00i\x00:\x00h\x00t\x00t\x00p\x00:\x00(\x2F\x00){2}/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1&2; running regex
/certutil(\x2Eexe)*\s+((-urlcache|-f|-split)\s+){3}http:\x2F{2}/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1&2; running regex
/c\x00e\x00r\x00t\x00u\x00t\x00i\x00l\x00(\x2E\x00e\x00x\x00e\x00)*(\s\x00)+((-\x00u\x00r\x00l\x00c\x00a\x00c\x00h\x00e\x00|-\x00f\x00|-\x00s\x00p\x00l\x00i\x00t\x00)(\s\x00)+){3}h\x00t\x00t\x00p\x00:\x00(\x2F\x00){2}/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{7,9}\-[0-9]{6,8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /ggh\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/lon_output[0-9A-F]{6,8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{7}_[0-9]{7,9}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /my\sfull\scv\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{4}\s[A-Z]{11}\s&\s[A-Z]{4}\s[A-Z]{8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Bunker\sDetails\.vbs/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Time\sSheets\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Payment\scopy\.rar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]BL\s[\d]{3,5}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Orbit\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /player\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Dpto\.Financeiro\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/ATO\sPenalty\sNotice\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /TR\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/\x2ff\s*?\x28\s*?((ht|f)tps?:\x2f\x2f)[^\x29]*?#@[^\x29]/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/PDF\-Boleto\-[\d]{2}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z0-9]{5,6}_[A-Z0-9]{13}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[0-9]{5,7}\-[A-Z]{2,4}\s[A-Z]{1,3}\s?\#[0-9]{5,7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Company\sDetails\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Approved\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[\d]{1,2}[\W_][\d]{1,2}[\W_]201[\d]\.z/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Za-z]{8}\s[A-Za-z]{8}\s[A-Za-z]{7}\s[A-Za-z]{8}\s\#[0-9]{4,6}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/MT[\d]{2,4}wire\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Za-z]{6}[0-9]{3,5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/powershell\s*?-e\s*?[A-Za-z0-9+\/=]{20}/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /[a-z]{9}\.scr/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Quotation\son\s{1,3}Conection\s[\d]\sVCP\sPipe\s[0-9a-f]{36}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{3,5}\s[A-Z]{10,12}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Q88\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{3,5}\-[A-Z]{2,4}\-[A-Z]{1,3}\-[0-9]{3,5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /[a-z]{6}\.scr/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{8,10}\s[A-Z]{2,4}\s[0-9]{8,10}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Request\sfor\sqoutation\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/QF[\d]{4,6}\-GT[\d]{5,10}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/<w:instrText[^\x3c]*?dde(auto|\s)[^\x3c]*?\x2eexe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/\x13DDE(auto|\s).{0,250}?\x2eexe/
LibClamAV debug: hashtab: Freeing hashset, elements: 0, capacity: 0
LibClamAV debug: in cli_scanhtml()
LibClamAV debug: cli_scanhtml: using tempdir
/var/folders/62/pr11dqhx71b5syzmj03hhkq80000gn/T//clamav-8b08fb27ce806bf1c2c6a7c6e293401a.tmp
LibClamAV debug: matcher_run: performing regex matching on full map:
2077664+78960(2156624) >= 2156624
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/willReadFrequently.*?(?P<source_img>(\w+|\w+\x5B\w+\x5D))\.createImageData.*?(?P<target_img>(\w+|\w+\x5B\w+\x5D))\s*\x3D\s*(?P=source_img)\.getImageData.*?(?P=source_img)\.putImageData\s*\x28\s*(?P=target_img)/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1; running regex
/string[\x28\s]+(\x26[oh])?[a-f0-9]{5}/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/function\s+?(?P<funcname>[^\s\x28]+?)\x28.*?msSaveBlob.*?try.*?(?P=funcname)\x28.*?catch/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/\x5Cn\x3B[a-z0-9]+x0=/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1&2; running regex
/object.defineproperty\x28.{0,250}newIntl\.(NumberFormat|Collator|DateTimeFormat)/
LibClamAV debug: cli_pcre_scanbuf: checking 2; running regex
/var.*?=.*?[\x22\x27].*?#([^\x22\x27])\1{100,}?/
LibClamAV debug: cli_pcre_scanbuf: triggered 2; running regex
/var.*?=.*?[\x22\x27].*?#([^\x22\x27])\1{100,}?/
LibClamAV debug: cli_pcre_match: pcre_exec: match limit exceeded
LibClamAV debug:
LibClamAV debug: cli_pcre_report: PCRE Execution Report:
LibClamAV debug: cli_pcre_report: running regex
/var.*?=.*?[\x22\x27].*?#([^\x22\x27])\1{100,}?/ returns -8
LibClamAV debug: cli_pcre_report: error occurred in pcre_match: -8
LibClamAV debug: cli_pcre_report: PCRE Execution Report End
LibClamAV debug:
LibClamAV debug: cli_pcre_scanbuf: checking 0&1; running regex
/style\s*?=[^\x3e]*?(animation\s*?\x3a.*?\d+?(s|ms))/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1&2&3; running regex
/<script.+var.{0,50}function\(\).{0,50}Symbol\.species\]\(\).{1,400}\.constructor.{1,100}\.concat.{1,50}<\x2fscript>/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1; running regex
/__definesetter__\s*\x28[\x22\x27](?P<prop>\w+)[\x22\x27].*let\s*(?P=prop).*\.defineproperty\s*\x28[^\x29\x2C]+?\x2C\s*[\x22\x27]\s*(?P=prop)[\x22\x27]\s*\x2C/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/function\s+?(?P<funcname>[^\s\x28]+?)\x28.*?msSaveBlob.*?try.*?(?P=funcname)\x28.*?catch/
LibClamAV debug: matcher_run: performing regex matching on full map:
2077664+78960(2156624) >= 2156624
LibClamAV debug: cli_pcre_scanbuf: checking 0&1; running regex
/\x2epostMessage\s*\x28\s*([^\s]+)\x2edata\x2econcat\s*\x28\1\x2edata\s*\x29/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1; running regex
/\x2f\x2a\s+XPM\s+\x2a\x2f[^\x7b]*?\x7b\s*\x22\s*(\d+\s+){3}\d{4}/
LibClamAV debug: cli_pcre_scanbuf: checking (0>1)&(1>1)&(2>25); running regex
/.Write\s*\x28\s*vbCrlf[^\n\x29]+\x28\s*[\x22\x27][a-zA-Z0-9+/]{5,}[a-zA-Z0-9+/=]{1,2}[\x22\x27]\s*\x29\s*\x29\r\n/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1&(2>150); running regex /^(var
[a-z]{3,} = [\x22\x27].{1,3}[\x22\x27]\x3B\n)/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/ATF.{3}\xFF.{1}[\x80-\xFF].{4}[\x00-\x12][\x00-\x12][\x00-\x13]/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1&2; running regex
/\x28\x00\x00\x00[\x00-\xff][\x00-\xff]\x90[\x04-\xff]([\x00-\xff]{4})\x01\x00\x08\x00/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1; running regex
/(function\s[o0O]{6}\(\s*([o0O]{6})?(\s*,\s*[o0O]{6})*\s*\).*?){3,}/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/[\W_][a-z0-9]{4,16}\.js/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/SMG[\W_][0-9]{2,4}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/ATTACHMENT\-PP\.html/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/NEW\sOPEN\sTENDER\sREQUIREMENT\sFOR\sMIDDLE\sEAST\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/PTY\sLTD\-USD\s[\d]{2,5}\.[\d]{2}\-VALUE\.vbs/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{4,7}\s[a-zA-Z]{6,9}\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{4}\s[a-z]{4}\-[0-9]{3}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{5}\s[A-Z0-9]{8,12}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/SHIPPING\sDOCUMENT\sINV,\sPL,\sBL\s\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /P000041014\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/BL[\W_][\w]{0,16}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /HUD\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/0\.72077800\s1489544882\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Tax\sRefund\sForm\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/PROCESSO\s2\sVARA\.vbe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/DHL\sDelivery\sDocuments\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/49BHAGB\s398\#\sADVICE\sTT\s0477HF\sHSBC\sSLK\sBANK\.html/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/WF\.jar[\W_]JavaCrypt[\d]?\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/[A-Z]{2}[A-Z0-9]{4,20}\.js/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Contract\sWFALASMA\-05\-17\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /P[\d]{5,10}\.zip/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Shipment\sDocs_Customs\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{6}\s[A-Z]{7}\s[A-Z]{7}\s[A-Z]{3}\s[A-Z]{9}\.pif/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /TT1717\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/NFe\-[\d]{8,10}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/[a-z0-9]{4,15}[_\s\(\-]{1,2}[0-9\)]{3,9}(?![\d]).{0,14}\.js/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/REQUEST\sLIST\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /NBT20620\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/0\.0117363636366363636636363636366333631500\s1489646043\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/(Case|Paiement|dossier|remit|inquiry|proforma|bestellung).{0,20}\.(exe|scr)/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Demostrativo_IR_201[\d]\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/PROFORMA\sINVOICE\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/ENOSFRESHPUTA1858AF\.COM/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Informacoes\sPorto\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /HMRC201707\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/ODER\sREF\s2017\-[\d]{4}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Visualizar\-Anexo[\d]{12,18}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{7}[0-9]{4}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /SCDFRGGVF001\.vbs/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /scan.{6,20}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/SCB01215750191343\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Invoice\s&\spacking\slist\.\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[\d]{2},[\d]{3}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Kuji\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/201[0-9][\W_][0-9]{1,2}[\W_][0-9]{1,2}\sQU[0-9]{3,5}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/\b(FedEx|DHL|US?PS).{0,100}\.(exe|scr|js)/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RFQ\#[\d]{9,14}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Drawing\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/uk_confirmation_ph[\d]{8,12}\.zip/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[0-9]{8,12}\.[a-z]{3}\.wsf/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Q\-IA022017__OUTSTANDING\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /B\-CO\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/\x0A\x05\x01.\x00\x00\x00\x00.{57}[\x80-\xFF]/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{7}[\W_][0-9]{4,8}[\W_][0-9]{4,8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RF[\W_][\d]{5,7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/WU[\d]{6,10}[\W_][\d]{8,12}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/\b(money|cash|details|document|confirm|warning)[\-_\s]?[\w]{0,20}\.js/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{3}\s[a-zA-Z]{8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /[a-z]{2,10}\.docx/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/0\.[0-9]{8}[\W_][0-9]{10}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Catalogue\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{5}\s\-\s[a-zA-Z0-9]{23}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/TT[\W_]EUR[0-9]{1,4}\.[0-9]{2,4}\.[0-9]{1,3}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{1,3}[\W_][A-Z]{2,4}[0-9]{1,3}\.[0-9]{2,4}\.[0-9]{1,3}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/PYMT_2017[\d]{4}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /[A-Z0-9]{12}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/(CANON|NIKON|photo|img|IMG|pic|SHOT|swift|EPSON)[a-z\d]{1,20}\.js/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{2,3}[0-9]{6,8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Za-z]{8}[\W_][A-Za-z]{7}&[A-Z]{2,4}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Remittance\.vbs/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Pending\sinvoice\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Shipping[\W_]docu[\W_]Output[0-9]{15,20}\.cmd/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/^.{32768}\x01CD001.{152}[\x00-\x16]\x00{7}/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/CTM\sBREAKDOWN\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RFQ\-785987\-SNC\-[\d]{12,14}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/DNPSING[\d]{5,10}\.pif/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Reservatio\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/TT\sBANK\sINVOICE\s[\d]{2}\.[\d]{2}\.2017\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Fatura\sPara\spagamento\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /DD06798E\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{5,7}[\W_][A-Z]{10,12}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{2,3}[\W_]{1,2}[0-9]{3,5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/SKMBT[\W_][\w]{0,16}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Required_denomination_\sCTM\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{10}\s\-\s[a-zA-Z0-9]{19,24}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Swift[\d]{10,15}\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/0\.[\d]{6,10}[\W_][\d]{8,12}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{2,4}[0-9]{7,9}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/HSBC2017[\d]{11}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{2,3}[\W_][0-9]{5,7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{8}\s[A-Z]{9}\s[A-Z]{2}[0-9]{6}[A-Z]{4}[0-9]{2}[A-Z]{2}\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Contract\s\#[\d]{4,8}17\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Purchase\sOrder\s\#[\d]{4,8}17\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1; running regex
/(?P<arrayName1>\w+)\s*=\s*new\s*(U?[Ii]nt|Float)(64|32|16|8)Array\s*\x28\s*[\x22\x27]?(?P<arrayName2>\w+).*?[^\.]postMessage\s*\x28.*?,\s*[\x22\x27]?\s*\x5b\s*((?P=arrayName1)|(?P=arrayName2))/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1; running regex
/\x06\x0a[\x00-\x79]{10}/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z0-9]{9,11}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /[A-Z0-9]{9}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /obc\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{6}\s[a-zA-Z]{7}\s[a-z]{6}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Target=(\x22|\x27|)(file|ftp|http|https)://(?!(10|172\.(1[6-9]|2[0-9]|3[0-2])|192\.168))(?:(?:2(?:[0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9])\.){3}(?:(?:2([0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9]))/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Target=(\x22|\x27|)(file|ftp|http|https)://(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{10}\s[a-z]{7}\s[a-z]{9}\.com/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/TT\sApplication\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z][a-z]{6}_[0-9]{5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{2}\#[A-Z0-9]{6}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{6,8}[\W_][A-Z]{2,4}\-[0-9]{1,3}\-[A-Z0-9]{5,7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{1,3}\#[A-Z]{1,3}[0-9]{3,5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{9}[\W_][a-z]\.[0-9]{4,6}\-[0-9]{6,8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{4}\s[a-z]{2}\s[a-z]{7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{2,4}[\W_][a-z]{4,6}[\W_][0-9]{5,7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{1,3}[\W_][0-9]{6,8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]BL[\d]{4}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RFQ\s[\d]{3,5}01[\d]\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{4,5}[\W_][a-z]{3,5}[\W_]{1,3}[a-zA-Z]{4}\.scr/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{1,3}\#[A-Z]{1,3}[0-9]{4,6}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Za-z]{5}[\W_][0-9]{1,3}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]\.[A-Z]\#\s[A-Z0-9]{11}\-[0-9]{2}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/lon2_output[A-Z0-9]{5,10}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Za-z]{5}[\W_][A-Za-z]{3}[\W_][A-Z]{2}[0-9]{2,6}[\W_][0-9]{1,3}[\W_][0-9]{1,5}[\W_]?[0-9]{1,5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z][a-z]{3}_[a-z]{7}\-[A-Z][a-z]{2}\#[0-9]{3}[A-Z]{4}[0-9]{4}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Needed.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /oww\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /hon\s[\d]\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /files\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RG[\d]{6,8}FJ\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /marc\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z][a-z]{7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{8}_[A-Z]{5}_[A-Z]{7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /londone\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{7}\s[A-Z]{3}\s[A-Z]{9},[a-zA-Z]{3}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{5}_[0-9]{10}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/BL,Invoice,Packing\slist\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{8}\s[a-zA-Z]{5}\s[a-zA-Z]{4}\s\#[0-9]{6}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /SWIFT\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /[a-f0-9]{37}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /telex\.vbs/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Spreadsheet\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /ob\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/TIM\.ORG\.TR\sExporters\sExcusive\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Total\sQuote\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RFQ\-Qoute\sRequest\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/pdf\.attachment\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{4}\s[A-Z]{7}\s[A-Z]{6}\s[A-Z]{4}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RFQ\-SPECIFICATION\.pif/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z][a-z]{7}\s[A-Z][a-z]{4}\s[0-9]{5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/required\sshipment\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{8}\s[a-z]{8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /REQUIREMENTS\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Case[\W_]File[\W_](No\.?|\#)[\d]{2,4}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking (0|1)&(2|3)&(4|5); running regex
/regsvr32(\x2Eexe)*\s+(\x2F(u|n|s)\s+){2,3}\x2Fi:http:\x2F{2}/
LibClamAV debug: cli_pcre_scanbuf: checking (0|1)&(2|3)&(4|5); running regex
/r\x00e\x00g\x00s\x00v\x00r\x003\x002\x00(\x2E\x00e\x00x\x00e\x00)*(\s\x00)+(\x2F\x00(u\x00|n\x00|s\x00)(\s\x00)+){2,3}\x2F\x00i\x00:\x00h\x00t\x00t\x00p\x00:\x00(\x2F\x00){2}/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1&2; running regex
/certutil(\x2Eexe)*\s+((-urlcache|-f|-split)\s+){3}http:\x2F{2}/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1&2; running regex
/c\x00e\x00r\x00t\x00u\x00t\x00i\x00l\x00(\x2E\x00e\x00x\x00e\x00)*(\s\x00)+((-\x00u\x00r\x00l\x00c\x00a\x00c\x00h\x00e\x00|-\x00f\x00|-\x00s\x00p\x00l\x00i\x00t\x00)(\s\x00)+){3}h\x00t\x00t\x00p\x00:\x00(\x2F\x00){2}/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{7,9}\-[0-9]{6,8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /ggh\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/lon_output[0-9A-F]{6,8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{7}_[0-9]{7,9}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /my\sfull\scv\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{4}\s[A-Z]{11}\s&\s[A-Z]{4}\s[A-Z]{8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Bunker\sDetails\.vbs/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Time\sSheets\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Payment\scopy\.rar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]BL\s[\d]{3,5}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Orbit\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /player\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Dpto\.Financeiro\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/ATO\sPenalty\sNotice\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /TR\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/\x2ff\s*?\x28\s*?((ht|f)tps?:\x2f\x2f)[^\x29]*?#@[^\x29]/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/PDF\-Boleto\-[\d]{2}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z0-9]{5,6}_[A-Z0-9]{13}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[0-9]{5,7}\-[A-Z]{2,4}\s[A-Z]{1,3}\s?\#[0-9]{5,7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Company\sDetails\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Approved\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[\d]{1,2}[\W_][\d]{1,2}[\W_]201[\d]\.z/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Za-z]{8}\s[A-Za-z]{8}\s[A-Za-z]{7}\s[A-Za-z]{8}\s\#[0-9]{4,6}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/MT[\d]{2,4}wire\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Za-z]{6}[0-9]{3,5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/powershell\s*?-e\s*?[A-Za-z0-9+\/=]{20}/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /[a-z]{9}\.scr/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Quotation\son\s{1,3}Conection\s[\d]\sVCP\sPipe\s[0-9a-f]{36}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{3,5}\s[A-Z]{10,12}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Q88\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{3,5}\-[A-Z]{2,4}\-[A-Z]{1,3}\-[0-9]{3,5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /[a-z]{6}\.scr/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{8,10}\s[A-Z]{2,4}\s[0-9]{8,10}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Request\sfor\sqoutation\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/QF[\d]{4,6}\-GT[\d]{5,10}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/<w:instrText[^\x3c]*?dde(auto|\s)[^\x3c]*?\x2eexe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/\x13DDE(auto|\s).{0,250}?\x2eexe/
LibClamAV debug: hashtab: Freeing hashset, elements: 0, capacity: 0
LibClamAV debug: cli_scanhtml: skipping notags (normalized size over
MaxHTMLNoTags)
LibClamAV debug: cli_magic_scandesc: returning 0 at line 2685
LibClamAV debug: cache_add: 3fc5799f5fe8bad9232972eda77d7ce3 (level 0)
Scanning /Library/Application Support/GarageBand/Instrument Library/Plug-In
Settings/Track Echo/Short.pst
Scanning /System/Library/CoreServices/Expansion Slot
Utility.app/Contents/Resources/ru.lproj/Localizable.strings
LibClamAV debug: in cli_magic_scandesc (reclevel: 0/16)
LibClamAV debug: Recognized UTF-16BE character data
LibClamAV debug: cache_check: 44b6dfcdf2739b8a20874aa766d461f0 is negative
LibClamAV debug: in cli_check_mydoom_log()
LibClamAV debug: matcher_run: performing regex matching on full map:
0+1230(1230) >= 1230
LibClamAV debug: cli_pcre_scanbuf: checking 0&1; running regex
/\x2epostMessage\s*\x28\s*([^\s]+)\x2edata\x2econcat\s*\x28\1\x2edata\s*\x29/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1; running regex
/\x2f\x2a\s+XPM\s+\x2a\x2f[^\x7b]*?\x7b\s*\x22\s*(\d+\s+){3}\d{4}/
LibClamAV debug: cli_pcre_scanbuf: checking (0>1)&(1>1)&(2>25); running regex
/.Write\s*\x28\s*vbCrlf[^\n\x29]+\x28\s*[\x22\x27][a-zA-Z0-9+/]{5,}[a-zA-Z0-9+/=]{1,2}[\x22\x27]\s*\x29\s*\x29\r\n/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1&(2>150); running regex /^(var
[a-z]{3,} = [\x22\x27].{1,3}[\x22\x27]\x3B\n)/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/ATF.{3}\xFF.{1}[\x80-\xFF].{4}[\x00-\x12][\x00-\x12][\x00-\x13]/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1&2; running regex
/\x28\x00\x00\x00[\x00-\xff][\x00-\xff]\x90[\x04-\xff]([\x00-\xff]{4})\x01\x00\x08\x00/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1; running regex
/(function\s[o0O]{6}\(\s*([o0O]{6})?(\s*,\s*[o0O]{6})*\s*\).*?){3,}/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/[\W_][a-z0-9]{4,16}\.js/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/SMG[\W_][0-9]{2,4}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/ATTACHMENT\-PP\.html/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/NEW\sOPEN\sTENDER\sREQUIREMENT\sFOR\sMIDDLE\sEAST\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/PTY\sLTD\-USD\s[\d]{2,5}\.[\d]{2}\-VALUE\.vbs/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{4,7}\s[a-zA-Z]{6,9}\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{4}\s[a-z]{4}\-[0-9]{3}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{5}\s[A-Z0-9]{8,12}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/SHIPPING\sDOCUMENT\sINV,\sPL,\sBL\s\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /P000041014\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/BL[\W_][\w]{0,16}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /HUD\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/0\.72077800\s1489544882\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Tax\sRefund\sForm\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/PROCESSO\s2\sVARA\.vbe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/DHL\sDelivery\sDocuments\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/49BHAGB\s398\#\sADVICE\sTT\s0477HF\sHSBC\sSLK\sBANK\.html/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/WF\.jar[\W_]JavaCrypt[\d]?\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/[A-Z]{2}[A-Z0-9]{4,20}\.js/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Contract\sWFALASMA\-05\-17\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /P[\d]{5,10}\.zip/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Shipment\sDocs_Customs\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{6}\s[A-Z]{7}\s[A-Z]{7}\s[A-Z]{3}\s[A-Z]{9}\.pif/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /TT1717\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/NFe\-[\d]{8,10}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/[a-z0-9]{4,15}[_\s\(\-]{1,2}[0-9\)]{3,9}(?![\d]).{0,14}\.js/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/REQUEST\sLIST\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /NBT20620\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/0\.0117363636366363636636363636366333631500\s1489646043\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/(Case|Paiement|dossier|remit|inquiry|proforma|bestellung).{0,20}\.(exe|scr)/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Demostrativo_IR_201[\d]\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/PROFORMA\sINVOICE\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/ENOSFRESHPUTA1858AF\.COM/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Informacoes\sPorto\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /HMRC201707\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/ODER\sREF\s2017\-[\d]{4}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Visualizar\-Anexo[\d]{12,18}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{7}[0-9]{4}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /SCDFRGGVF001\.vbs/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /scan.{6,20}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/SCB01215750191343\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Invoice\s&\spacking\slist\.\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[\d]{2},[\d]{3}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Kuji\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/201[0-9][\W_][0-9]{1,2}[\W_][0-9]{1,2}\sQU[0-9]{3,5}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/\b(FedEx|DHL|US?PS).{0,100}\.(exe|scr|js)/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RFQ\#[\d]{9,14}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Drawing\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/uk_confirmation_ph[\d]{8,12}\.zip/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[0-9]{8,12}\.[a-z]{3}\.wsf/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Q\-IA022017__OUTSTANDING\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /B\-CO\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/\x0A\x05\x01.\x00\x00\x00\x00.{57}[\x80-\xFF]/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{7}[\W_][0-9]{4,8}[\W_][0-9]{4,8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RF[\W_][\d]{5,7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/WU[\d]{6,10}[\W_][\d]{8,12}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/\b(money|cash|details|document|confirm|warning)[\-_\s]?[\w]{0,20}\.js/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{3}\s[a-zA-Z]{8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /[a-z]{2,10}\.docx/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/0\.[0-9]{8}[\W_][0-9]{10}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Catalogue\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{5}\s\-\s[a-zA-Z0-9]{23}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/TT[\W_]EUR[0-9]{1,4}\.[0-9]{2,4}\.[0-9]{1,3}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{1,3}[\W_][A-Z]{2,4}[0-9]{1,3}\.[0-9]{2,4}\.[0-9]{1,3}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/PYMT_2017[\d]{4}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /[A-Z0-9]{12}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/(CANON|NIKON|photo|img|IMG|pic|SHOT|swift|EPSON)[a-z\d]{1,20}\.js/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{2,3}[0-9]{6,8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Za-z]{8}[\W_][A-Za-z]{7}&[A-Z]{2,4}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Remittance\.vbs/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Pending\sinvoice\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Shipping[\W_]docu[\W_]Output[0-9]{15,20}\.cmd/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/^.{32768}\x01CD001.{152}[\x00-\x16]\x00{7}/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/CTM\sBREAKDOWN\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RFQ\-785987\-SNC\-[\d]{12,14}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/DNPSING[\d]{5,10}\.pif/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Reservatio\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/TT\sBANK\sINVOICE\s[\d]{2}\.[\d]{2}\.2017\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Fatura\sPara\spagamento\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /DD06798E\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{5,7}[\W_][A-Z]{10,12}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{2,3}[\W_]{1,2}[0-9]{3,5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0|1; running regex
/SKMBT[\W_][\w]{0,16}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Required_denomination_\sCTM\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{10}\s\-\s[a-zA-Z0-9]{19,24}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Swift[\d]{10,15}\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/0\.[\d]{6,10}[\W_][\d]{8,12}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{2,4}[0-9]{7,9}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/HSBC2017[\d]{11}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{2,3}[\W_][0-9]{5,7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{8}\s[A-Z]{9}\s[A-Z]{2}[0-9]{6}[A-Z]{4}[0-9]{2}[A-Z]{2}\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Contract\s\#[\d]{4,8}17\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Purchase\sOrder\s\#[\d]{4,8}17\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1; running regex
/(?P<arrayName1>\w+)\s*=\s*new\s*(U?[Ii]nt|Float)(64|32|16|8)Array\s*\x28\s*[\x22\x27]?(?P<arrayName2>\w+).*?[^\.]postMessage\s*\x28.*?,\s*[\x22\x27]?\s*\x5b\s*((?P=arrayName1)|(?P=arrayName2))/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1; running regex
/\x06\x0a[\x00-\x79]{10}/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z0-9]{9,11}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /[A-Z0-9]{9}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /obc\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{6}\s[a-zA-Z]{7}\s[a-z]{6}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Target=(\x22|\x27|)(file|ftp|http|https)://(?!(10|172\.(1[6-9]|2[0-9]|3[0-2])|192\.168))(?:(?:2(?:[0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9])\.){3}(?:(?:2([0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9]))/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Target=(\x22|\x27|)(file|ftp|http|https)://(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{10}\s[a-z]{7}\s[a-z]{9}\.com/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/TT\sApplication\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z][a-z]{6}_[0-9]{5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{2}\#[A-Z0-9]{6}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{6,8}[\W_][A-Z]{2,4}\-[0-9]{1,3}\-[A-Z0-9]{5,7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{1,3}\#[A-Z]{1,3}[0-9]{3,5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{9}[\W_][a-z]\.[0-9]{4,6}\-[0-9]{6,8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{4}\s[a-z]{2}\s[a-z]{7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{2,4}[\W_][a-z]{4,6}[\W_][0-9]{5,7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{1,3}[\W_][0-9]{6,8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]BL[\d]{4}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RFQ\s[\d]{3,5}01[\d]\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{4,5}[\W_][a-z]{3,5}[\W_]{1,3}[a-zA-Z]{4}\.scr/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{1,3}\#[A-Z]{1,3}[0-9]{4,6}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Za-z]{5}[\W_][0-9]{1,3}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]\.[A-Z]\#\s[A-Z0-9]{11}\-[0-9]{2}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/lon2_output[A-Z0-9]{5,10}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Za-z]{5}[\W_][A-Za-z]{3}[\W_][A-Z]{2}[0-9]{2,6}[\W_][0-9]{1,3}[\W_][0-9]{1,5}[\W_]?[0-9]{1,5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z][a-z]{3}_[a-z]{7}\-[A-Z][a-z]{2}\#[0-9]{3}[A-Z]{4}[0-9]{4}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Needed.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /oww\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /hon\s[\d]\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /files\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RG[\d]{6,8}FJ\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /marc\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z][a-z]{7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{8}_[A-Z]{5}_[A-Z]{7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /londone\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{7}\s[A-Z]{3}\s[A-Z]{9},[a-zA-Z]{3}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{5}_[0-9]{10}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/BL,Invoice,Packing\slist\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{8}\s[a-zA-Z]{5}\s[a-zA-Z]{4}\s\#[0-9]{6}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /SWIFT\.bat/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /[a-f0-9]{37}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /telex\.vbs/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Spreadsheet\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /ob\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/TIM\.ORG\.TR\sExporters\sExcusive\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Total\sQuote\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RFQ\-Qoute\sRequest\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/pdf\.attachment\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{4}\s[A-Z]{7}\s[A-Z]{6}\s[A-Z]{4}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/RFQ\-SPECIFICATION\.pif/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z][a-z]{7}\s[A-Z][a-z]{4}\s[0-9]{5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/required\sshipment\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{8}\s[a-z]{8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /REQUIREMENTS\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Case[\W_]File[\W_](No\.?|\#)[\d]{2,4}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking (0|1)&(2|3)&(4|5); running regex
/regsvr32(\x2Eexe)*\s+(\x2F(u|n|s)\s+){2,3}\x2Fi:http:\x2F{2}/
LibClamAV debug: cli_pcre_scanbuf: checking (0|1)&(2|3)&(4|5); running regex
/r\x00e\x00g\x00s\x00v\x00r\x003\x002\x00(\x2E\x00e\x00x\x00e\x00)*(\s\x00)+(\x2F\x00(u\x00|n\x00|s\x00)(\s\x00)+){2,3}\x2F\x00i\x00:\x00h\x00t\x00t\x00p\x00:\x00(\x2F\x00){2}/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1&2; running regex
/certutil(\x2Eexe)*\s+((-urlcache|-f|-split)\s+){3}http:\x2F{2}/
LibClamAV debug: cli_pcre_scanbuf: checking 0&1&2; running regex
/c\x00e\x00r\x00t\x00u\x00t\x00i\x00l\x00(\x2E\x00e\x00x\x00e\x00)*(\s\x00)+((-\x00u\x00r\x00l\x00c\x00a\x00c\x00h\x00e\x00|-\x00f\x00|-\x00s\x00p\x00l\x00i\x00t\x00)(\s\x00)+){3}h\x00t\x00t\x00p\x00:\x00(\x2F\x00){2}/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-z]{7,9}\-[0-9]{6,8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /ggh\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/lon_output[0-9A-F]{6,8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[a-zA-Z]{7}_[0-9]{7,9}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /my\sfull\scv\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{4}\s[A-Z]{11}\s&\s[A-Z]{4}\s[A-Z]{8}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Bunker\sDetails\.vbs/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Time\sSheets\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Payment\scopy\.rar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]BL\s[\d]{3,5}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Orbit\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /player\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Dpto\.Financeiro\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/ATO\sPenalty\sNotice\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /TR\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/\x2ff\s*?\x28\s*?((ht|f)tps?:\x2f\x2f)[^\x29]*?#@[^\x29]/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/PDF\-Boleto\-[\d]{2}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z0-9]{5,6}_[A-Z0-9]{13}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[0-9]{5,7}\-[A-Z]{2,4}\s[A-Z]{1,3}\s?\#[0-9]{5,7}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Company\sDetails\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Approved\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[\d]{1,2}[\W_][\d]{1,2}[\W_]201[\d]\.z/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Za-z]{8}\s[A-Za-z]{8}\s[A-Za-z]{7}\s[A-Za-z]{8}\s\#[0-9]{4,6}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/MT[\d]{2,4}wire\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Za-z]{6}[0-9]{3,5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/powershell\s*?-e\s*?[A-Za-z0-9+\/=]{20}/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /[a-z]{9}\.scr/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Quotation\son\s{1,3}Conection\s[\d]\sVCP\sPipe\s[0-9a-f]{36}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{3,5}\s[A-Z]{10,12}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /Q88\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{3,5}\-[A-Z]{2,4}\-[A-Z]{1,3}\-[0-9]{3,5}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex /[a-z]{6}\.scr/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/[A-Z]{8,10}\s[A-Z]{2,4}\s[0-9]{8,10}\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/Request\sfor\sqoutation\.exe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/QF[\d]{4,6}\-GT[\d]{5,10}\.jar/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/<w:instrText[^\x3c]*?dde(auto|\s)[^\x3c]*?\x2eexe/
LibClamAV debug: cli_pcre_scanbuf: checking 0; running regex
/\x13DDE(auto|\s).{0,250}?\x2eexe/
LibClamAV debug: hashtab: Freeing hashset, elements: 0, capacity: 0
LibClamAV debug: in cli_scanscript()
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
http://www.clamav.net/contact.html#ml
