On Wed, 21 Jun 2006 19:11:44 -0400 Nicolas Riendeau <[EMAIL PROTECTED]> wrote:
> >>[eg Joke.local.EricssonHoax:0:*:(61|41)(6e|4e)(6e|4e)(61|41)... ] > > > > > > This thingy's not going to work, sorry. > > It doesn't work but the thing I don't understand is why... According to the > docs that syntax is supposedly acceptable and some stock signatures even > seem to be built in a similar way... The first two bytes must be 'static', so "(61|41)(6e|4e)" must be replaced with two hex numbers (so you may need to use four separate signatures or rely on the normaliser as suggested by aCaB). This limitation should be removed with the next major version of ClamAV (0.90). -- oo ..... Tomasz Kojm <[EMAIL PROTECTED]> (\/)\......... http://www.ClamAV.net/gpg/tkojm.gpg \..........._ 0DCA5A08407D5288279DB43454822DC8985A444B //\ /\ Thu Jun 22 09:42:25 CEST 2006
signature.asc
Description: PGP signature
_______________________________________________ http://lurker.clamav.net/list/clamav-users.html
