xue wen wrote:
> To whom it may concern,
>
> Thanks for the help from Edwin, kgd and guenther, I have solved the problem
> with wildcards, such as *, ??, {n}, {n-}, {-n}, etc, in ClamAV's signatures.
> But there is still a problem. When I tried to build a signature with the
> wildcard of |, I still didn't succeed. The signature of mine is like this:
>
> Worm.Yawen (Clam)=(6161|6262)
>
The syntax is wrong for a .ndb file, see signatures.pdf, section 2.3.4
"Extended signature format".
So to correct the syntax:
Worm.Yawen:0:*:(6161|6262)
This will still not load:
LibClamAV Error: cli_ac_addsig: Can't find a static subpattern of length 2
LibClamAV Error: cli_parse_add(): Problem adding signature (3).
LibClamAV Error: Problem parsing signature at line 1
LibClamAV Error: Problem parsing database at line 1
So you need to add more bytes to your signature.
And of course change the signature type to something more appropiate,
see signatures.pdf.
Best regards,
--Edwin
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html
