Hi Alain Thanks Alain.
Is the "FileSize" or "PESectionSize" used as a pre-processing(or filtering) step while scanning files? What I mean is does ClamAV use the size of the file to filter out all virus patterns that dont have the same filesize as that of the file under inspection? After finding a subset of virus patterns(using the FileSize field in HDB) that do match the size of the file does it then proceed to actual signature matching using WM or AC string matching algorithms? Is the same true with PESectionSize for a MDB file? Just that it would probably get PESectionSize information in the Header/SectionTable fields of the PE file under inspection? Thanks a lot! _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
