Logical signatures in ClamAV 0.94
Summary: ClamAV 0.94 added logical signatures, stored in .ldb files, that combine sub-signatures with boolean expressions instead of the single-expression format used through 0.93. The article illustrates this with the VBS mass-mailer worm Godog, whose four sub-signatures detect attempts to disable Kaspersky, Antiviral Toolkit Pro, AVPersonal and Trend PC-cillin 98, and a fifth detects its Outlook MAPI routine that sends itself to the first 8,000 address-book contacts.
Bottom line: Before 0.94, covering a variant that disabled only one of those AV tools required a separate signature per case; the logical form Worm.Godog;Target:0;((0|1|2|3)&(4)) matches when the spreading routine appears alongside any one of the four disable attempts, cutting the signature count needed to cover a malware family's variants.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026