[clamav-users] signature processing order

C.D. Cochrane cdc at post.com
Tue May 24 08:13:45 EDT 2016


Hmm, that's strange.  I have noted exactly the opposite behavior.  My customsig.ndb sigs
only get applied after official ClamAV detection has run.  I know this because I am
always watching for my UNOFFICIAL FOUNDs to be replaced by official ones and I then
delete the related sig from my customsig.ndb.  It does not happen often, but it does
happen (official detection, I mean)!
...Chris
 
>
> Sent: Tuesday, May 24, 2016 at 5:54 AM
> From: Axb <axb.lists at gmail.com>
> To: clamav-users at lists.clamav.net
> Subject: [clamav-users] signature processing order
> Good day,
>
> I've noticed that apparently third party (UNOFFICIAL) signatures get
> applied before the official ones.
>
> Depending on the signature types, we may never see any "official" sigs
> hitting, ever.
>
> Is there a scientific reason for this? (or am I missing something?)
>
> If no, could it be made switchable (via clamd.conf) and --switch for
> clamscan.
>
> Thanks
>
> Axb
>



More information about the clamav-users mailing list