News About Features Documentation FAQ ChangeLog Mailinglist Download GIT Screenshots RRDtool MRTG WebQ Logwatch Reporter Latest stable: 2.0.2-1 Latest devel: 2.0.3-0.beta5 |
regexp_scan() Primitive regexp pattern scanner. There can be more patterns for one virus. All patterns in [] must match to assign an buffer as virus (AND opeator). There can also be more virnames in one dictionary. Usage: regexp_scan([['VirName', 'RegExp_Pattern...'], ...], size=0, flags=0) Where: 'VirName' is a string, which identifies defined virus 'RegExp_Pattern...' is a regexp pattern size is a number, which defines, how many bytes may be checked. If it is 0 or not defined, whole buffer is scanned. If it is -1, email header is scanned. flags is an integer, which defines regular expression flags. By default no flags are used. Example: regexp_scan([ # Scan for a part of EICAR virus test file pattern ['EICAR', '^X5O!P%@AP[4.*EICAR-STANDARD-ANTIVIRUS-TEST-FILE'], # Scan for a an EXE file pattern endoded as base64. ['UnknownEXE', '^TVqQ'] ]) |