That does not appear to be a well anchored regex.

dp

On 3/12/19 9:15 PM, Al Varnell via clamav-users wrote:
All I can add is some technical information about the signature. I have no idea what kind of infection it causes and on what platform.

The signature was added to the database by daily - 25386 earlier today as an .ldb. Looking for a single ascii string in any type of file:

sigtool -fTxt.Trojan.Kryptik-6887991-0|sigtool --decode-sigs
VIRUS NAME: Txt.Trojan.Kryptik-6887991-0
TDB: Engine:51-255,FileSize:262144-1048576,Target:0
LOGICAL EXPRESSION: 0
 * SUBSIG ID 0
 +-> OFFSET: ANY
 +-> SIGMOD: NONE
 +-> DECODED SUBSIGNATURE:
1/g,"");if(!/^[-_a-zA-Z0-9#.:* ,>+~[\]()=^$|]+$/.test(c))throw  E


_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Reply via email to