In the clamav.cf plugin file the CLAMAV rule is set at default priority=0, with a score of 0.001
Its other rules are supposed to get really high prioritites, priority __CLAMAV_PHISH 9999 priority __CLAMAV_PHISH_HEUR 9999 priority __CLAMAV_SANE 9999 priority __CLAMAV_MBL 9999 priority __CLAMAV_MSRBL 9999 priority __CLAMAV_VX 9999 the main rule CLAMAV_VIRUS is defined as a meta rule, meta CLAMAV_VIRUS (CLAMAV && !__CLAMAV_PHISH && !__CLAMAV_SANE && !__CLAMAV_MBL && !__CLAMAV_MSRBL && !__CLAMAV_VX) so to execute is has to wait until all those late priority=9999 rules are triggered. Shortcircuit rules are supposed to get low priorities to fire early ifplugin Mail::SpamAssassin::Plugin::Shortcircuit # ClamAV support: no need to scan viruses/malware priority CLAMAV -9999 shortcircuit CLAMAV spam score CLAMAV 100 endif # Mail::SpamAssassin::Plugin::Shortcircuit I want to use the shortcircuit rule to stop processing early and immediately reject (e.g., at score >=20) only if CLAMAV_VIRUS or CLAMAV_SANE hit. for any of the other rules, I want to keep processing, and just add scores. So in Shortcircuit I'd need to use something lile, meta SC_MULTI_CLAMAV (CLAMAV_VIRUS||CLAMAV_SANE) priority SC_HAM -2000 But, how do I fix the conflict of needing the rules EARLY for shortcircuit, but at the same time needing them LATE for the CLAMAV plugin? --Bob