next up previous
Next: Problem solving Up: Usage Previous: FreshClam

Signature Tool

sigtool automates signature creation. If you have a infected file, which isn't detected by ClamAV, but is by another anti-virus scanner working in the console you can create the signature easily. Example of usage: Create a file and put the eicar.com content into it. We will use clamscan to generate the signature, it's just an example. Scan it with clamscan -stdout testfile, the output is
	testfile: Eicar-Test-Signature FOUND

	----------- SCAN SUMMARY -----------
	Known viruses: 1773
	Scanned directories: 0
	Scanned files: 1
	Data scanned: 0.95 Mb
	Infected files: 1
	I/O buffer size: 131072 bytes
	Time: 0.245 sec (0 m 0 s)
The unique string in this output is "Eicar-Test-Signature". Run sigtool with the following parameters:
	$ sigtool -c "clamscan --stdout" -f testfile -s "Eicar-Test"
The program will concatenate arguments for -c (-command) and -f (-file), that's why the scanner's options must be given in the proper order. At the end it will generate a file testfile.sig, which should contain 80 bytes in our example. It contains the proper signature.



Tomasz Kojm 2002-08-22