ClamAV has 3 options for handling bytecode signatures:
  1. Built-in LLVM (based on LLVM 2.8)
  2. Built-in bytecode interpreter
  3. System-installed LLVM (support limited to LLVM 3.6 at this time, although Debian has had success with a set of patches that enabled support up to 3.9).

With 0.99 the built-in LLVM was preferred over the bytecode interpreter. 
With 0.100, the built-in LLVM (2.8) feature was deprecated in favor of either the interpreter or system-installed LLVM (when available).  It's still there, but we are hoping to remove it in a future version. 

If you don't provide the older LLVM 3.6 for ClamAV, it will use it's built-interpreter rather than just-in-time-compile the signatures. 

 
Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.


On Jul 17, 2018, at 6:05 AM, Sergey <a_s_y@sama.ru> wrote:

On Tuesday 17 July 2018, Al Varnell wrote:

It's best to use the bytecode interpreter for ClamAV
bytecode signatures, but if for some reason you feel
you must use LLVM-JIT  

I thought it was necessary to use llvm to use bytecode
signatures. Was I wrong? Is ClamAV not lost functionality
without LLVM?

--
Regards, Sergey
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml