Steven Morgan wrote: > Please try clamscan --scan-html=no to turn off normalization.
Mmmm. I suppose that's technically the functionality I'm asking for, but in its current form it's a pretty blunt instrument - it's all or nothing, especially if set for clamd with the "ScanHTML" option in clamd.conf. I don't want to *break* any stock or third-party signatures that assume that option is on; I just want a way to indicate, for a specific signature, "match this against the raw bitstream". This hasn't been a major problem so far, but I could see use cases where it might be. -kgd _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
