Hmm, that's strange. I have noted exactly the opposite behavior. My customsig.ndb sigs only get applied after official ClamAV detection has run. I know this because I am always watching for my UNOFFICIAL FOUNDs to be replaced by official ones and I then delete the related sig from my customsig.ndb. It does not happen often, but it does happen (official detection, I mean)! ...Chris > > Sent: Tuesday, May 24, 2016 at 5:54 AM > From: Axb <axb.li...@gmail.com> > To: clamav-users@lists.clamav.net > Subject: [clamav-users] signature processing order > Good day, > > I've noticed that apparently third party (UNOFFICIAL) signatures get > applied before the official ones. > > Depending on the signature types, we may never see any "official" sigs > hitting, ever. > > Is there a scientific reason for this? (or am I missing something?) > > If no, could it be made switchable (via clamd.conf) and --switch for > clamscan. > > Thanks > > Axb > _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
