News About Features Documentation FAQ ChangeLog Mailinglist Download GIT Screenshots RRDtool MRTG WebQ Logwatch Reporter Latest stable: 2.0.2-1 Latest devel: 2.0.3-0.beta5 |
string_scan() Primitive string pattern scanner. There can be more patterns for one virus. All patterns must match to assign an buffer as virus. There can also be more virnames in one dictionary. Usage: string_scan([['VirName', 'Pattern1...', ...], ...], size=0) Where: 'VirName' is a string, which identifies defined virus 'Pattern...' is a string pattern size is a number, which defines, how many bytes may be checked. If it is 0 or not defined, whole buffer is scanned. If it is -1, email header is scanned. Example: string_scan([ # Scan for a part of EICAR virus test file pattern ['EICAR', 'X5O!P%@AP[4', 'EICAR-STANDARD-ANTIVIRUS-TEST-FILE'], # Scan for a an EXE file pattern endoded as base64. ['UnknownEXE', 'TVqQ'] ]) |