Loading...

clamav-devel@lists.clamav.net

[Prev] Thread [Next]  |  [Prev] Date [Next]

Re: [Clamav-devel] bad signatures? Török Edvin Mon Jan 01 12:10:29 2007

On 1/1/07, Amir Goldor <[EMAIL PROTECTED]> wrote:
Hi,

Hi, please see this thread:
http://lurker.clamav.net/message/20061030.185430.688d1f47.en.html


I think there is a bug in the cli_ac_addpatt() function.

in my kernel module version of clamav, I check for wildcard characters

Is it based on 0.88.x? 0.90 has an improved ac engine.


there are 2 examples I found in the clamav db for signatures that have
a wildcard character as the 2nd bytes of the pattern:

TK said (in that thread) range wildcards (*,{})). "(59|79)" is not a
range wildcard.


Trojan.Bat.DeltreeY-3:0:*:...{-1}2f(59|79)...
Trojan.IRC-Script-28:0:*:6e??...

Should work in 0.90rc.

Tomasz: please correct me if I am wrong.

Best regards,
Edwin
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html