2 #------------------------------------------------------------------------------
3 # $File: fsav,v 1.11 2009/09/19 16:28:09 christos Exp $
4 # fsav: file(1) magic for datafellows fsav virus definition files
5 # Anthon van der Neut (anthon@mnt.org)
7 # ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
8 0 beshort 0x1575 fsav macro virus signatures
12 # ftp://ftp.f-prot.com/pub/sign.zip
17 #>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d-
30 #>>>>9 ubyte >0 \b%02d)
31 # ftp://ftp.f-prot.com/pub/sign2.zip
37 #>>>>>13 ubyte >0 fsav virus signatures
38 #>>>>>>11 ubyte x size 0x%02x
39 #>>>>>>12 ubyte x \b%02x
40 #>>>>>>13 ubyte x \b%02x bytes
42 # Joerg Jenderek: joerg dot jenderek at web dot de
43 # http://www.clamav.net/doc/latest/html/node45.html
44 # .cvd files start with a 512 bytes colon separated header
45 # ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
46 # + gzipped tarball files
48 >11 string >\0 Clam AntiVirus database %-.23s
50 >>>35 string !: \b, version
51 >>>>35 string x \b%-.1s
53 >>>>>>36 string x \b%-.1s
55 >>>>>>>>37 string x \b%-.1s
57 >>>>>>>>>>38 string x \b%-.1s
58 >512 string \037\213 \b, gzipped
59 >769 string ustar\0 \b, tarred
61 # Type: Grisoft AVG AntiVirus
62 # From: David Newgas <david@newgas.net>
63 0 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data