[clamav-users] signature processing order

Groach groachmail-stopspammingme at yahoo.com
Tue May 24 07:23:58 EDT 2016


Out of interest, what does it matter?  Why is it important that an 
official CLAM definition stops the virus before the 3rd party definition 
stops the same virus (if they both have the same criteria)?  Surely a 
goal is a goal and it doesnt matter who kicked the ball.



On 24/05/2016 11:54, Axb wrote:
> Good day,
>
> I've noticed that apparently third party (UNOFFICIAL) signatures get 
> applied before the official ones.
>
> Depending on the signature types, we may never see any "official" sigs 
> hitting, ever.
>
> Is there a scientific reason for this? (or am I missing something?)
>
> If no, could it be made switchable (via clamd.conf) and  --switch for 
> clamscan.
>
> Thanks
>
> Axb
> _______________________________________________
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml




More information about the clamav-users mailing list