On Fri, Feb 10, 2012 at 07:12:26PM +0100, Matus UHLAR - fantomas wrote: > How does clamd behave if it detects multiple viruses/phishes in a file? > Does it have some internal logic that tells which to report or does > it report just the first found?
Correct me if I am wrong, but ClamAV will detect the first match and continue to next file or stop if there is only one file (probably the case with your email-filter). There might be a way to control this, which is needed in case of for example scanning and removing infections from mbox. Years ago there has been --mbox -option http://lurker.clamav.net/message/20040105.064256.3e2f3b3b.fi.html > I'd like to prefer reporting phish over other viruses (different > handling in e-mail), or possibly reporting all of them Why do you want to do this? Don't you want to delete or quarantine infected emails if ClamAV detects any malware from emails? You can at least disable features when scanning. - Henri Salo _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
