The question remains as to why the signature correctly leads to a match in Windows but not Linux. If carriage return linefeed handling differences between the two OSes are to blame, then I suggest a two pronged approach. Correct the signatures, AND patch clamav so that the signatures as written are processed the same way. Even if they are suboptimal signatures, I'd suggest they should be processed the same way on all platforms.
That's a lot of signatures that may not be working. Perhaps I'm stating the obvious, but if CR/LF are involved, it means these are likely scripts and such... just the kind of signatures that would be important to catch in Linux. _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
