[clamav-users] Match on raw .wsf file?

[Kris Deugau]

Steven Morgan wrote:
> Please try clamscan --scan-html=no to turn off normalization.

Mmmm.  I suppose that's technically the functionality I'm asking for,
but in its current form it's a pretty blunt instrument - it's all or
nothing, especially if set for clamd with the "ScanHTML" option in
clamd.conf.

I don't want to *break* any stock or third-party signatures that assume
that option is on;  I just want a way to indicate, for a specific
signature, "match this against the raw bitstream".

This hasn't been a major problem so far, but I could see use cases where
it might be.

-kgd