Re: [Clamav-devel] bad signatures?

On 1/1/07, Amir Goldor <[EMAIL PROTECTED]> wrote:
> Hi,

Hi, please see this thread:
http://lurker.clamav.net/message/20061030.185430.688d1f47.en.html

> I think there is a bug in the cli_ac_addpatt() function.
>
> in my kernel module version of clamav, I check for wildcard characters

Is it based on 0.88.x? 0.90 has an improved ac engine.

> there are 2 examples I found in the clamav db for signatures that have
> a wildcard character as the 2nd bytes of the pattern:

TK said (in that thread) range wildcards (*,{})). "(59|79)" is not a
range wildcard.

> Trojan.Bat.DeltreeY-3:0:*:...{-1}2f(59|79)...
> Trojan.IRC-Script-28:0:*:6e??...

Should work in 0.90rc.

Tomasz: please correct me if I am wrong.

Best regards,
Edwin
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html