#
# Start of ClamavSafepatterns
#
# The first entry matches all objects that contain only ASCII
# characters (0x20<=char<=0x74 qnd CR,LF,TAB) in the first
# 16 bytes. All other entries are derived from the magic
# patterns of the file(1) utility.
#
# (c) 2004 Andreas Steinmetz, contributed to the mod_clamav project
# $Id: safepatterns.conf,v 1.2 2004/03/18 23:36:20 afm Exp $
#
<IfModule mod_clamav.c>
# This pattern means that text is acceptable. This causes all .html (with
# java script included), all *.js and *.vbs to be bypassed. Maybe not
# very secure, hence switched of by default. BTW, with this enabled
# eicar.com will no longer be recognized, as eicar.com is a text file.
#ClamavSafepattern text

# with some paranoia, you will not trust a PDF, since at least in principle
# it has the ability to run certain scripts
ClamavSafepattern pdf "%PDF"
ClamavSafepattern dvi "\xf7\x02"
# image formats are quite safe
ClamavSafepattern jpeg-jfif "\xff\xf8\x00\x00\x00\x00JFIF" "\xff\xff\x00\x00\x00\x00"
ClamavSafepattern jpeg-exif "\xff\xf8\x00\x00\x00\x00Exif" "\xff\xff\x00\x00\x00\x00"
ClamavSafepattern jpeg-2000 "\x00\x00\x00\x0c\x6a\x50\x20\x20\x0d\x0a\x87\x0a"
ClamavSafepattern gif87a "GIF87a"
ClamavSafepattern gif89a "GIF89a"
ClamavSafepattern png "\x89PNG\x0d\x0a\x1a\x0a"

# streaming formats: they are a real pain with trend micro viruswall
ClamavSafepattern mpeg-video "\x00\x00\x01\xb3"
ClamavSafepattern mpeg-system "\x00\x00\x01\xba"
ClamavSafepattern mpeg-transport "\x47\x40\x00\x10" "\xff\x5f\xff\x1f"
ClamavSafepattern mpeg1-l3 "\xff\xfa" "\xff\xfe"
ClamavSafepattern mpeg1-l2 "\xff\xfc" "\xff\xfe"
ClamavSafepattern mpeg2-l3 "\xff\xf2" "\xff\xfa"
ClamavSafepattern mpeg2-l2 "\xff\xf4" "\xff\xfc"
ClamavSafepattern dif "\x1f\x07\x00"
ClamavSafepattern asf "\x30\x26\xb2\x75"
ClamavSafepattern mng "\x8aMNG\x0d\x0a\x1a\x0a"
ClamavSafepattern riff "RIFF"
ClamavSafepattern ogg "OggS"
ClamavSafepattern realaudio "\x2e\x72\x61\xfd"
ClamavSafepattern realmedia ".RMF"
ClamavSafepattern midi "MThd"
ClamavSafepattern quicktime "MOVI"
ClamavSafepattern quicktime "moov"
ClamavSafepattern quicktime "mdat"
ClamavSafepattern flash "FWS"
ClamavSafepattern smjpeg "\x00\x0aSMJPEG" 
ClamavSafepattern flac "fLaC"
ClamavSafepattern sunaudio ".snd"
ClamavSafepattern decaudio "\x2e\x73\x64\x00"
ClamavSafepattern mp3-id3v2 "ID3"
ClamavSafepattern nesaudio "NESM\x1a"
ClamavSafepattern ac3 "\x0b\x77"
ClamavSafepattern iff "FORM"
ClamavSafepattern tiff-le "II\x2a\x00"
ClamavSafepattern tiff-be "MM\x00\x2a"
ClamavSafepattern miff "id=ImageMagick"
ClamavSafepattern bmp "BM"

# There does exist some Java malware, so you may not want to enable this,
# it is turned of by default
#ClamavSafepattern java "\xca\xfe\xba\xbe"
</IfModule>
#
# End of ClamavSafepatterns
#