Hi,I would like to match files that have signautre beginning with 4545, so I wrote the .ndb file like this- Worm.Test.A:0:0,2:4545?? But it does find all files that has 4545 sequence (even this sequence is present in the 8th byte position, not at the beginning). Also I tested with "Worm.Test.A:0:0:4545??" Why the offset "0,2" or "0" does not work? It should look for the sequence at the beginning, not in the later part? Am I missing something? Thank you for your support. /Khan
_______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
