summaryrefslogtreecommitdiffstats
path: root/contrib/file/Magdir/fsav
blob: 4218936e4845956518bed890dc0faca617b16d0a (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

#------------------------------------------------------------------------------
# fsav:  file(1) magic for datafellows fsav virus definition files
# Anthon van der Neut (anthon@mnt.org)
0	beshort		0x1575		fsav (linux) macro virus
>8	leshort		>0		(%d-
>11	byte		>0		\b%02d-
>10	byte		>0		\b%02d)

# comment this out for now because it regognizes every file where
# the eighth character is \n
#8	byte		0x0a
#>12	byte		0x07
#>11	leshort		>0		fsav (linux) virus (%d-
#>10	byte		0		\b01-
#>10	byte		1		\b02-
#>10	byte		2		\b03-
#>10	byte		3		\b04-
#>10	byte		4		\b05-
#>10	byte		5		\b06-
#>10	byte		6		\b07-
#>10	byte		7		\b08-
#>10	byte		8		\b08-
#>10	byte		9		\b10-
#>10	byte		10		\b11-
#>10	byte		11		\b12-
#>9	byte		>0		\b%02d)
OpenPOWER on IntegriCloud