Bugzilla – Bug 11930
multi-byte alternate AC filters
Last modified: 2017-12-15 13:16:07 EST
An issue was reported to the ClamAV users mailing list to state that the signature: Win.Trojan.Dovs-6343034-0 fails to generate a filter. ----Win.Trojan.Dovs-6343034-0 Win.Trojan.Dovs-6343034-0;Target:1;(0|1|3|4)&2;89(4c24|0c)??88d9(8b7424|89)??d3(e6|e2)88d9{-11}0fa5(c7|fa|c6){-3}f6c3200f45(fe|d6|f2)0f45(f0|f1|d0);8b4424??8b(74|54)24??0fa5(f0|d0)*d3(e6|e2)31(db|f6|ff)f6(c1|c2)200f45(c6|c2)0f45(f3|d6|f7);5c726567656469742e657865;6d636971747a33322e646c6c;7162316a786c4545 ---- ----clamscan -ir LibClamAV Warning: Don't know how to create filter for: Win.Trojan.Dovs-6343034-0 LibClamAV Warning: cli_ac_addpatt: cannot use filter for trie ---- The issue ultimately is that the filter system is unable to handle alternates consisting of sequences with two or more bytes, affecting both fixed multi-byte and variable alternates. The effected code is found at libclamav/filtering.c:(491 in 0.99.2). Note that while issue is noisy, it does not affect detection beyond whatever filters are doing with the pattern.