ClamAV 0.96 allows creating generic signatures matching files stored inside different container types which meet specific conditions. The signature format is:
VirusName:ContainerType:ContainerSize:FileNameREGEX: FileSizeInContainer:FileSizeReal:IsEncrypted:FilePos: Res1:Res2[:MinFL[:MaxFL]]
where the corresponding fields are:
VirusName:
Virus name to be displayed when signature matches.
ContainerType:
The file type containing the target file. For example:CL_TYPE_ZIP
,CL_TYPE_RAR
,CL_TYPE_ARJ
,CL_TYPE_MSCAB
,CL_TYPE_7Z
,CL_TYPE_MAIL
,CL_TYPE_(POSIX|OLD)_TAR
,CL_TYPE_CPIO_(OLD|ODC|NEWC|CRC)
Use *
as a wild card to indicate that container type may be any file type.
For a full list of ClamAV file types, see the ClamAV File Types Reference.
ContainerSize:
size of the container file itself (eg. size of the zip archive) specified in bytes as absolute value or range x-y
.
FileNameREGEX:
regular expression describing name of the target file
FileSizeInContainer:
usually compressed size; for MAIL, TAR and CPIO == FileSizeReal
; specified in bytes as absolute value or range.
FileSizeReal:
usually uncompressed size; for MAIL, TAR and CPIO == FileSizeInContainer
; absolute value or range.
IsEncrypted:
1 if the target file is encrypted, 0 if it’s not and *
to ignore
FilePos:
file position in container (counting from 1); absolute value or range.
Res1:
when ContainerType
is CL_TYPE_ZIP
or CL_TYPE_RAR
this field is treated as a CRC sum of the target file specified in hexadecimal format; for other container types it’s ignored.
Res2:
not used as of ClamAV 0.96.
The signatures for container files are stored inside .cdb
files.