Hi,
I am trying to create a signature that match a pattern, but it should not match
when a specific pattern is present.
>From the documentation:
. !(aa|bb|cc|..)
Match any byte except aa and bb and cc.. (ClamAV >0.96)
I have searched a lot, but can not find any example using this wildcard.
This is what I am trying to do:
This should not be a match:
string1 [10.11.12.13] this is string2
This should match regardless what ##.##.##.## contains (execept 10.11.12.13):
string1 [##.##.##.##] this is string2
I have created a signature like this:
Mysignature.ndb
Mysignature.01:0:*:string1{-2}!([10.11.|12.13]) this is string2
But I can't get it work.
Did I misunderstand how to use the wildcard "!" ?
Thank you for your help!
Best regards
Asle Skage
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
