ClamAV, in order to optimize the AC algorithm execution, runs the filetype signatures alongside the malware detection signatures. ClamAV is set to immediately return after AC execution if a filetype signature detection occurs. This unfortunately causes the engine to skip PCRE signature execution.
On Wed, Apr 13, 2016 at 1:00 PM, Steven Morgan <smor...@sourcefire.com> wrote: > Hi, > > Thanks for the example. I've opened bug > https://bugzilla.clamav.net/show_bug.cgi?id=11552 to track. > > Thanks again, > Steve > _______________________________________________ > Help us build a comprehensive ClamAV guide: > https://github.com/vrtadmin/clamav-faq > > http://www.clamav.net/contact.html#ml > _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
