[clamav-users] No notice of OLE2.ContainsMacros

[Reindl Harald]

Am 21.12.2016 um 01:32 schrieb Mark Foley:
> I did not know about clamdscan! Thanks for that info. I've replaced clamscan
> with clamdscan in my script for 2 reasons: First, while clamscan with the
> --block-macros=yes switch did work for .doc[x|m] quarantined messaged, it found
> macro enabled .xls files to be OK -- clamd quarantined these as well. Therefore,
> clamdscan does a better job of finding these macro-enabled files. Secondly,
> clamdscan *will* use the /usr/local/etc/clamd.conf, so I have only one place to
> worry about config settings

and it's magnitudes faster

clamscan in combinaton with large 3rd party signatures is terrible slow 
because it needs to do the full initalization for every call - that's 
the same why you use spamd instead pipe every mail to a spamassassin 
call because your server will mostly spend it#s resources for startup 
stuff which can be long running