See the virscan command in the AIX Version 4.3 Commands Reference for the exact syntax. The virscan command uses the virus signatures found in the virsig.lst and the addenda.lst files, if present, to scan for viruses. The virscan command does not use these lines in its virus scan. Comment lines are used to give additional, human-readable comments about the information in the signature files. The body of the file consists of entries that tell the virscan command what to do for each virus.
Shorter signatures have a larger chance of leading to false reports of viruses.
Take the signature from a code area of the virus, rather than a data area, to minimize the possibility of false alarms. Test new signatures against a number of programs before using them widely to ensure that no common programs give false alarms for the signature. This indicates that the specified byte position in the signature string may have any value. The second entry should contain a message that is displayed if the string is found in the specified files. This message indicates that the virus was found.