Karsten Bräckelmann wrote: > > The main purpose was, to keep ClamAV from scanning the entire, possibly > large file (err, mail). And maybe even speed it up. It's good practice > to bound your REs or wildcards anyway. > > I wonder, if this indeed would speed up scanning, however small, of > large-ish files. Or would the additional constraint actually impose more > CPU cycles spent?
The sigs are full of unbound RE's. That's why scanning mbox mail files is pointless. dp _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
