testfile: ClamAV-Test-Signature FOUND ----------- SCAN SUMMARY ----------- Known viruses: 2033 Scanned directories: 0 Scanned files: 1 Data scanned: 0.95 Mb Infected files: 1 I/O buffer size: 131072 bytes Time: 0.245 sec (0 m 0 s)The unique string in this output is "ClamAV-Test-Signature". Run sigtool with the following parameters:
$ sigtool -c "clamscan --stdout" -f testfile -s "ClamAV-Test"The program will concatenate arguments for -c (-command) and -f (-file), that's why the scanner's options must be given in the proper order. At the end it will generate a file testfile.sig, which should contain 100 bytes in our example. It contains the proper signature.
... ... Detected at 12103, moving backward. Detected at 11983, moving backward. Detected at 11923, moving backward. Not detected, increasing pos 11893 -> 11923 Detected at 11923, moving backward. Not detected, increasing pos 11908 -> 11923 Detected at 11923, moving backward. Not detected, increasing pos 11915 -> 11923 Detected at 11923, moving backward. Detected at 11919, moving backward. Detected at 11917, moving backward. Detected at 11916, moving backward. Starting precise loop *** Found signature end at 11916 The scanner was executed 46 times. Signature length is 50, so length of hex string should be 100 Saving signature in testfile.sig file.