On Fri, 26 Aug 2011 13:07:45 +0200 Asle Skage <asle.sk...@online.no> wrote: > Hi, > > I am trying to create a signature that match a pattern, but it should not > match > when a specific pattern is present. > > From the documentation: > . !(aa|bb|cc|..) > Match any byte except aa and bb and cc.. (ClamAV >0.96)
This only works for single bytes, not for strings. You need to use logical signatures, eg: SigName;Target:0;0&1=0;pattern0;pattern1 This signature will only be reported if pattern0 gets matched and pattern1 doesn't (1=0 means "pattern with ID 1 must be matched 0 times"). HTH, -- oo ..... Tomasz Kojm <tk...@clamav.net> (\/)\......... http://www.ClamAV.net/gpg/tkojm.gpg \..........._ 0DCA5A08407D5288279DB43454822DC8985A444B //\ /\ Fri Aug 26 13:08:48 CEST 2011 _______________________________________________ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
