Signatures based on container metadata

ClamAV 0.96 allows creating generic signatures matching files stored inside different container types which meet specific conditions. The signature format is:

    VirusName:ContainerType:ContainerSize:FileNameREGEX:
    FileSizeInContainer:FileSizeReal:IsEncrypted:FilePos:
    Res1:Res2[:MinFL[:MaxFL]]

where the corresponding fields are:

Use * as a wild card to indicate that container type may be any file type.
For a full list of ClamAV file types, see the ClamAV File Types Reference.

The signatures for container files are stored inside .cdb files.