@@ -116,7 +116,7 @@ void clamd_virus_found_cb(int fd, const char *virname, void *ctx)

     if (d == NULL)

         return;

-    if (!(d->options & CL_SCAN_ALLMATCHES))

+    if (!(d->options & CL_SCAN_ALLMATCHES) && !(d->options & CL_SCAN_HEURISTIC_PRECEDENCE))

         return;

     if (virname == NULL)

         return;

@@ -124,6 +124,7 @@ void clamd_virus_found_cb(int fd, const char *virname, void *ctx)

     fname = (c && c->filename) ? c->filename : "(filename not set)";

     if (virname) {

+        d->infected++;

         conn_reply_virus(d->conn, fname, virname);

         if(c->virsize > 0 && optget(d->opts, "ExtendedDetectionInfo")->enabled)

             logg("~%s: %s(%s:%llu) FOUND\n", fname, virname, c->virhash, c->virsize);

@@ -274,19 +275,18 @@ int scan_callback(STATBUF *sb, char *filename, const char *msg, enum cli_ftw_rea

     }

     if (ret == CL_VIRUS) {

-        scandata->infected++;

-        if (scandata->options & CL_SCAN_ALLMATCHES) {

+         if (scandata->options & CL_SCAN_ALLMATCHES || (scandata->infected && scandata->options & CL_SCAN_HEURISTIC_PRECEDENCE)) {

             if(optget(scandata->opts, "PreludeEnable")->enabled){

                 prelude_logging(filename, virname, context.virhash, context.virsize);

             }

             virusaction(filename, virname, scandata->opts);

         } else {

+           scandata->infected++;

             if (conn_reply_virus(scandata->conn, filename, virname) == -1) {

                 free(filename);

                 return CL_ETIMEOUT;

             }

-

             if(optget(scandata->opts, "PreludeEnable")->enabled){

                 prelude_logging(filename, virname, context.virhash, context.virsize);

             }

@@ -108,11 +108,7 @@ int cli_7unz (cli_ctx *ctx, size_t offset) {

     res = SzArEx_Open(&db, &lookStream.s, &allocImp, &allocTempImp);

     if(res == SZ_ERROR_ENCRYPTED && DETECT_ENCRYPTED) {

 	cli_dbgmsg("cli_7unz: Encrypted header found in archive.\n");

-	cli_append_virus(ctx, "Heuristics.Encrypted.7Zip");

-	viruses_found++;

-	if(!SCAN_ALL) {

-	    found = CL_VIRUS;

-	}

+	found = cli_append_virus(ctx, "Heuristics.Encrypted.7Zip");

     } else if(res == SZ_OK) {

 	UInt32 i, blockIndex = 0xFFFFFFFF;

 	Byte *outBuffer = 0;

@@ -164,11 +160,13 @@ int cli_7unz (cli_ctx *ctx, size_t offset) {

 		encrypted = 1;

 		if(DETECT_ENCRYPTED) {

 		    cli_dbgmsg("cli_7unz: Encrypted files found in archive.\n");

-		    cli_append_virus(ctx, "Heuristics.Encrypted.7Zip");

-		    viruses_found++;

-		    if(!SCAN_ALL) {

-			found = CL_VIRUS;

-			break;

+		    found = cli_append_virus(ctx, "Heuristics.Encrypted.7Zip");

+                    if (found != CL_CLEAN) {

+                        if (found == CL_VIRUS) {

+                            if (SCAN_ALL)

+                                viruses_found++;

+                        } else

+                            break;

 		    }

 		}

 	    }

@@ -248,6 +248,7 @@ static int apm_prtn_intxn(cli_ctx *ctx, struct apm_partition_info *aptable, size

     int ret = CL_CLEAN, tmp = CL_CLEAN;

     off_t pos;

     uint32_t max_prtns = 0;

+    int virus_found = 0;

     prtn_intxn_list_init(&prtncheck);

@@ -286,35 +287,30 @@ static int apm_prtn_intxn(cli_ctx *ctx, struct apm_partition_info *aptable, size

         tmp = prtn_intxn_list_check(&prtncheck, &pitxn, apentry.pBlockStart, apentry.pBlockCount);

         if (tmp != CL_CLEAN) {

-            if ((ctx->options & CL_SCAN_ALLMATCHES) && (tmp == CL_VIRUS)) {

+            if (tmp == CL_VIRUS) {

                 apm_parsemsg("Name: %s\n", (char*)aptable.name);

                 apm_parsemsg("Type: %s\n", (char*)aptable.type);

                 cli_dbgmsg("cli_scanapm: detected intersection with partitions "

                            "[%u, %u]\n", pitxn, i);

-                cli_append_virus(ctx, PRTN_INTXN_DETECTION);

+                ret = cli_append_virus(ctx, PRTN_INTXN_DETECTION);

+                if (ret == CL_VIRUS)

+                    virus_found = 1;

+                if (SCAN_ALL || ret == CL_CLEAN)

+                    tmp = 0;

+                else

+                    goto leave;

+            } else {

                 ret = tmp;

-                tmp = 0;

-            }

-            else if (tmp == CL_VIRUS) {

-                apm_parsemsg("Name: %s\n", (char*)aptable.name);

-                apm_parsemsg("Type: %s\n", (char*)aptable.type);

-

-                cli_dbgmsg("cli_scanapm: detected intersection with partitions "

-                           "[%u, %u]\n", pitxn, i);

-                cli_append_virus(ctx, PRTN_INTXN_DETECTION);

-                prtn_intxn_list_free(&prtncheck);

-                return CL_VIRUS;

-            }

-            else {

-                prtn_intxn_list_free(&prtncheck);

-                return tmp;

+                goto leave;

             }

         }

-

         pos += sectorsize;

     }

+ leave:

     prtn_intxn_list_free(&prtncheck);

+    if (virus_found)

+        return CL_VIRUS;

     return ret;

 }

@@ -2810,11 +2810,10 @@ int cli_bytecode_runlsig(cli_ctx *cctx, struct cli_target_info *tinfo,

     if (ctx.virname) {

 	int rc;

 	cli_dbgmsg("Bytecode found virus: %s\n", ctx.virname);

-	cli_append_virus(cctx, ctx.virname);

 	if (!strncmp(ctx.virname, "BC.Heuristics", 13))

-	    rc = cli_found_possibly_unwanted(cctx);

-	else

-	    rc = CL_VIRUS;

+	    rc = cli_append_possibly_unwanted(cctx, ctx.virname);

+        else

+            rc = cli_append_virus(cctx, ctx.virname);

 	cli_bytecode_context_clear(&ctx);

 	return rc;

     }

@@ -80,6 +80,7 @@ struct cl_fmap {

     HANDLE fh;

     HANDLE mh;

 #endif

+    unsigned char maphash[16];

     uint32_t placeholder_for_bitmap;

 };

@@ -604,6 +604,7 @@ static int gpt_prtn_intxn(cli_ctx *ctx, struct gpt_header hdr, size_t sectorsize

     off_t pos;

     size_t maplen;

     uint32_t max_prtns = 0;

+    int virus_found = 0;

     maplen = (*ctx->fmap)->real_len;

@@ -647,23 +648,19 @@ static int gpt_prtn_intxn(cli_ctx *ctx, struct gpt_header hdr, size_t sectorsize

         else {

             tmp = prtn_intxn_list_check(&prtncheck, &pitxn, gpe.firstLBA, gpe.lastLBA - gpe.firstLBA + 1);

             if (tmp != CL_CLEAN) {

-                if ((ctx->options & CL_SCAN_ALLMATCHES) && (tmp == CL_VIRUS)) {

+                if (tmp == CL_VIRUS) {

                     cli_dbgmsg("cli_scangpt: detected intersection with partitions "

                                "[%u, %u]\n", pitxn, i);

-                    cli_append_virus(ctx, PRTN_INTXN_DETECTION);

+                    ret = cli_append_virus(ctx, PRTN_INTXN_DETECTION);

+                    if (ret == CL_VIRUS)

+                        virus_found = 1;

+                    if (SCAN_ALL || ret == CL_CLEAN)

+                        tmp = 0;

+                    else

+                        goto leave;

+                } else {

                     ret = tmp;

-                    tmp = 0;

-                }

-                else if (tmp == CL_VIRUS) {

-                    cli_dbgmsg("cli_scangpt: detected intersection with partitions "

-                               "[%u, %u]\n", pitxn, i);

-                    cli_append_virus(ctx, PRTN_INTXN_DETECTION);

-                    prtn_intxn_list_free(&prtncheck);

-                    return CL_VIRUS;

-                }

-                else {

-                    prtn_intxn_list_free(&prtncheck);

-                    return tmp;

+                    goto leave;

                 }

             }

         }

@@ -672,6 +669,9 @@ static int gpt_prtn_intxn(cli_ctx *ctx, struct gpt_header hdr, size_t sectorsize

         pos += hdr.tableEntrySize;

     }

+ leave:

     prtn_intxn_list_free(&prtncheck);

+    if (virus_found)

+        return CL_VIRUS;

     return ret;

 }

@@ -176,8 +176,8 @@ struct macho_fat_arch

     if(matcher)						    \

 	return -1;					    \

     if(DETECT_BROKEN) {					    \

-	cli_append_virus(ctx, "Heuristics.Broken.Executable"); \

-	return CL_VIRUS;				    \

+        if (CL_VIRUS == cli_append_virus(ctx, "Heuristics.Broken.Executable")) \

+            return CL_VIRUS;				    \

     }							    \

     return CL_EFORMAT

@@ -738,16 +738,15 @@ int cli_pcre_scanbuf(const unsigned char *buffer, uint32_t length, const char **

                         newres->offset = adjbuffer+p_res.match[0];

                         *res = newres;

                     } else {

-                        if (ctx && SCAN_ALL) {

-                            viruses_found = 1;

-                            cli_append_virus(ctx, (const char *)pm->virname);

-                        }

+                        ret = CL_CLEAN;

+                        viruses_found = 1;

+                        if (ctx)

+                            ret = cli_append_virus(ctx, (const char *)pm->virname);

                         if (virname)

                             *virname = pm->virname;

-                        if (!ctx || !SCAN_ALL) {

-                            ret = CL_VIRUS;

-                            break;

-                        }

+                        if (!ctx || !SCAN_ALL)

+                            if (ret != CL_CLEAN)

+                                break;

                     }

                 }

             }

@@ -157,8 +157,9 @@ static inline int matcher_run(const struct cli_matcher *root,

 	    if (SCAN_ALL)

 		viruses_found = 1;

 	    else {

-		cli_append_virus(ctx, *virname);

-		return ret;

+		ret = cli_append_virus(ctx, *virname);

+		if (ret != CL_CLEAN)

+                    return ret;

 	    }

 	}

     }

@@ -169,8 +170,9 @@ static inline int matcher_run(const struct cli_matcher *root,

             if (SCAN_ALL)

                 viruses_found = 1;

             else {

-                cli_append_virus(ctx, *virname);

-                return ret;

+                ret = cli_append_virus(ctx, *virname);

+                if (ret != CL_CLEAN)

+                    return ret;

             }

         } else if (ret > CL_TYPENO && acmode & AC_SCAN_VIR)

             saved_ret = ret;

@@ -227,7 +229,7 @@ static inline int matcher_run(const struct cli_matcher *root,

     /* end experimental fragment */

     if (ctx && !SCAN_ALL && ret == CL_VIRUS)

-        cli_append_virus(ctx, *virname);

+        return cli_append_virus(ctx, *virname);

     if (ctx && SCAN_ALL && viruses_found)

         return CL_VIRUS;

@@ -501,6 +503,11 @@ void cli_targetinfo(struct cli_target_info *info, unsigned int target, fmap_t *m

 int cli_checkfp(unsigned char *digest, size_t size, cli_ctx *ctx)

 {

+    return cli_checkfp_virus(digest, size, ctx, NULL);

+}

+

+int cli_checkfp_virus(unsigned char *digest, size_t size, cli_ctx *ctx, const char * vname)

+{

     char md5[33];

     unsigned int i;

     const char *virname=NULL;

@@ -525,11 +532,11 @@ int cli_checkfp(unsigned char *digest, size_t size, cli_ctx *ctx)

             sprintf(md5 + i * 2, "%02x", digest[i]);

         md5[32] = 0;

         cli_dbgmsg("FP SIGNATURE: %s:%u:%s\n", md5, (unsigned int) size,

-               cli_get_last_virus(ctx) ? cli_get_last_virus(ctx) : "Name");

+                   vname ? vname : "Name");

     }

-    if(cli_get_last_virus(ctx))

-        do_dsig_check = strncmp("W32S.", cli_get_last_virus(ctx), 5);

+    if(vname)

+        do_dsig_check = strncmp("W32S.", vname, 5);

     map = *ctx->fmap;

     have_sha1 = cli_hm_have_size(ctx->engine->hm_fp, CLI_HASH_SHA1, size)

@@ -586,7 +593,7 @@ int cli_checkfp(unsigned char *digest, size_t size, cli_ctx *ctx)

             for(i=0; i<SHA1_HASH_SIZE; i++)

                 sprintf((char *)shash1+i*2, "%02x", shash1[SHA1_HASH_SIZE+i]);

-            cli_errmsg("COLLECT:%s:%s:%u:%s:%s\n", shash256, shash1, size, cli_get_last_virus(ctx), ctx->entry_filename);

+            cli_errmsg("COLLECT:%s:%s:%u:%s:%s\n", shash256, shash1, size, vname?vname:"noname", ctx->entry_filename);

         } else

             cli_errmsg("can't compute sha\n!");

@@ -614,10 +621,10 @@ int cli_checkfp(unsigned char *digest, size_t size, cli_ctx *ctx)

     }

     if (ctx->engine->cb_hash)

-        ctx->engine->cb_hash(fmap_fd(*ctx->fmap), size, (const unsigned char *)md5, cli_get_last_virus(ctx), ctx->cb_ctx);

+        ctx->engine->cb_hash(fmap_fd(*ctx->fmap), size, (const unsigned char *)md5, vname?vname:"noname", ctx->cb_ctx);

     if (ctx->engine->cb_stats_add_sample)

-        ctx->engine->cb_stats_add_sample(cli_get_last_virus(ctx), digest, size, &sections, ctx->engine->stats_data);

+        ctx->engine->cb_stats_add_sample(vname?vname:"noname", digest, size, &sections, ctx->engine->stats_data);

     if (sections.sections)

         free(sections.sections);

@@ -768,8 +775,9 @@ static int lsig_eval(cli_ctx *ctx, struct cli_matcher *root, struct cli_ac_data

                 return CL_CLEAN;

             if(matchicon(ctx, &target_info->exeinfo, ac_lsig->tdb.icongrp1, ac_lsig->tdb.icongrp2) == CL_VIRUS) {

                 if(!ac_lsig->bc_idx) {

-                    cli_append_virus(ctx, ac_lsig->virname);

-                    return CL_VIRUS;

+                    rc = cli_append_virus(ctx, ac_lsig->virname);

+                    if (rc != CL_CLEAN)

+                        return rc;

                 } else if(cli_bytecode_runlsig(ctx, target_info, &ctx->engine->bcs, ac_lsig->bc_idx, acdata->lsigcnt[lsid], acdata->lsigsuboff_first[lsid], map) == CL_VIRUS) {

                     return CL_VIRUS;

                 }

@@ -777,8 +785,9 @@ static int lsig_eval(cli_ctx *ctx, struct cli_matcher *root, struct cli_ac_data

             return CL_CLEAN;

         }

         if(!ac_lsig->bc_idx) {

-            cli_append_virus(ctx, ac_lsig->virname);

-            return CL_VIRUS;

+            rc = cli_append_virus(ctx, ac_lsig->virname);

+            if (rc != CL_CLEAN)

+                return rc;

         }

         if(cli_bytecode_runlsig(ctx, target_info, &ctx->engine->bcs, ac_lsig->bc_idx, acdata->lsigcnt[lsid], acdata->lsigsuboff_first[lsid], map) == CL_VIRUS) {

             return CL_VIRUS;

@@ -808,7 +817,7 @@ static int yara_eval(cli_ctx *ctx, struct cli_matcher *root, struct cli_ac_data

         if (ac_lsig->flag & CLI_LSIG_FLAG_PRIVATE) {

             rc = CL_CLEAN;

         } else {

-            cli_append_virus(ctx, ac_lsig->virname);

+            rc = cli_append_virus(ctx, ac_lsig->virname);

         }

     }

     return rc;

@@ -1172,19 +1181,18 @@ int cli_fmap_scandesc(cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struct cli

             /* If matched size-based hash ... */

             if (found % 2) {

                 viruses_found = 1;

-                cli_append_virus(ctx, virname);

-                if (!SCAN_ALL)

+                ret = cli_append_virus(ctx, virname);

+                if (!SCAN_ALL || ret != CL_CLEAN)

                     break;

                 virname = NULL;

             }

             /* If matched size-agnostic hash ... */

             if (found > 1) {

                 viruses_found = 1;

-                cli_append_virus(ctx, virname_w);

-

-                if (!SCAN_ALL)

+                ret = cli_append_virus(ctx, virname_w);

+                if (!SCAN_ALL || ret != CL_CLEAN)

                     break;

-            }

+             }

         }

     }

@@ -1228,6 +1236,7 @@ int cli_matchmeta(cli_ctx *ctx, const char *fname, size_t fsizec, size_t fsizer,

 {

 	const struct cli_cdb *cdb;

 	unsigned int viruses_found = 0;

+        int ret = CL_CLEAN;

     cli_dbgmsg("CDBNAME:%s:%llu:%s:%llu:%llu:%d:%u:%u:%p\n",

 	       cli_ftname(cli_get_container_type(ctx, -1)), (long long unsigned)fsizec, fname, (long long unsigned)fsizec, (long long unsigned)fsizer,

@@ -1237,10 +1246,10 @@ int cli_matchmeta(cli_ctx *ctx, const char *fname, size_t fsizec, size_t fsizer,

 	if (ctx->engine->cb_meta(cli_ftname(cli_get_container_type(ctx, -1)), fsizec, fname, fsizer, encrypted, filepos, ctx->cb_ctx) == CL_VIRUS) {

 	    cli_dbgmsg("inner file blacklisted by callback: %s\n", fname);

-	    cli_append_virus(ctx, "Detected.By.Callback");

+	    ret = cli_append_virus(ctx, "Detected.By.Callback");

 	    viruses_found++;

-	    if(!SCAN_ALL)

-		return CL_VIRUS;

+	    if(!SCAN_ALL || ret != CL_CLEAN)

+		return ret;

 	}

     if(!ctx->engine || !(cdb = ctx->engine->cdb))

@@ -1273,10 +1282,10 @@ int cli_matchmeta(cli_ctx *ctx, const char *fname, size_t fsizec, size_t fsizer,

 	if(cdb->name.re_magic && (!fname || cli_regexec(&cdb->name, fname, 0, NULL, 0) == REG_NOMATCH))

 	    continue;

-	cli_append_virus(ctx, cdb->virname);

+	ret = cli_append_virus(ctx, cdb->virname);

 	viruses_found++;

-	if(!SCAN_ALL)

-	    return CL_VIRUS;

+	if(!SCAN_ALL || ret != CL_CLEAN)

+	    return ret;

     } while((cdb = cdb->next));

@@ -208,6 +208,7 @@ int cli_exp_eval(cli_ctx *ctx, struct cli_matcher *root, struct cli_ac_data *acd

 int cli_caloff(const char *offstr, const struct cli_target_info *info, unsigned int target, uint32_t *offdata, uint32_t *offset_min, uint32_t *offset_max);

 int cli_checkfp(unsigned char *digest, size_t size, cli_ctx *ctx);

+int cli_checkfp_virus(unsigned char *digest, size_t size, cli_ctx *ctx, const char * vname);

 int cli_matchmeta(cli_ctx *ctx, const char *fname, size_t fsizec, size_t fsizer, int encrypted, unsigned int filepos, int res1, void *res2);

@@ -590,9 +590,8 @@ cli_parse_mbox(const char *dir, cli_ctx *ctx)

 	if((retcode == CL_CLEAN) && ctx->found_possibly_unwanted &&

 	   (*ctx->virname == NULL || SCAN_ALL)) {

-	    cli_append_virus(ctx, "Heuristics.Phishing.Email");

+	    retcode = cli_append_virus(ctx, "Heuristics.Phishing.Email");

 	    ctx->found_possibly_unwanted = 0;

-	    retcode = CL_VIRUS;

 	}

 	cli_dbgmsg("cli_mbox returning %d\n", retcode);

@@ -502,23 +502,17 @@ static int mbr_primary_prtn_intxn(cli_ctx *ctx, struct mbr_boot_record mbr, size

             tmp = prtn_intxn_list_check(&prtncheck, &pitxn, mbr.entries[i].firstLBA,

                                         mbr.entries[i].numLBA);

             if (tmp != CL_CLEAN) {

-                if ((ctx->options & CL_SCAN_ALLMATCHES) && (tmp == CL_VIRUS)) {

+                if (tmp == CL_VIRUS) {

                     cli_dbgmsg("cli_scanmbr: detected intersection with partitions "

                                "[%u, %u]\n", pitxn, i);

-                    cli_append_virus(ctx, PRTN_INTXN_DETECTION);

+                    ret = cli_append_virus(ctx, PRTN_INTXN_DETECTION);

+                    if (SCAN_ALL || ret == CL_CLEAN)

+                        tmp = 0;

+                    else

+                        goto leave;

+                } else {

                     ret = tmp;

-                    tmp = 0;

-                }

-                else if (tmp == CL_VIRUS) {

-                    cli_dbgmsg("cli_scanmbr: detected intersection with partitions "

-                               "[%u, %u]\n", pitxn, i);

-                    cli_append_virus(ctx, PRTN_INTXN_DETECTION);

-                    prtn_intxn_list_free(&prtncheck);

-                    return CL_VIRUS;

-                }

-                else {

-                    prtn_intxn_list_free(&prtncheck);

-                    return tmp;

+                    goto leave;

                 }

             }

@@ -547,6 +541,7 @@ static int mbr_primary_prtn_intxn(cli_ctx *ctx, struct mbr_boot_record mbr, size

         }

     }

+leave:

     prtn_intxn_list_free(&prtncheck);

     return ret;

 }

@@ -559,6 +554,7 @@ static int mbr_extended_prtn_intxn(cli_ctx *ctx, unsigned *prtncount, off_t extl

     unsigned i, pitxn;

     int ret = CL_CLEAN, tmp = CL_CLEAN, mbr_base = 0;

     off_t pos = 0, logiclba = 0;

+    int virus_found = 0;

     mbr_base = sectorsize - sizeof(struct mbr_boot_record);

@@ -585,23 +581,19 @@ static int mbr_extended_prtn_intxn(cli_ctx *ctx, unsigned *prtncount, off_t extl

         /* assume that logical record is first and extended is second */

         tmp = prtn_intxn_list_check(&prtncheck, &pitxn, logiclba, ebr.entries[0].numLBA);

         if (tmp != CL_CLEAN) {

-            if ((ctx->options & CL_SCAN_ALLMATCHES) && (tmp == CL_VIRUS)) {

+            if (tmp == CL_VIRUS) {

                 cli_dbgmsg("cli_scanebr: detected intersection with partitions "

                            "[%u, %u]\n", pitxn, i);

-                cli_append_virus(ctx, PRTN_INTXN_DETECTION);

+                ret = cli_append_virus(ctx, PRTN_INTXN_DETECTION);

+                if (ret == CL_VIRUS)

+                    virus_found = 1;

+                if (SCAN_ALL || ret == CL_CLEAN)

+                    tmp = 0;

+                else

+                    goto leave;

+            } else {

                 ret = tmp;

-                tmp = 0;

-            }

-            else if (tmp == CL_VIRUS) {

-                cli_dbgmsg("cli_scanebr: detected intersection with partitions "

-                           "[%u, %u]\n", pitxn, i);

-                cli_append_virus(ctx, PRTN_INTXN_DETECTION);

-                prtn_intxn_list_free(&prtncheck);

-                return CL_VIRUS;

-            }

-            else {

-                prtn_intxn_list_free(&prtncheck);

-                return tmp;

+                goto leave;

             }

         }

@@ -616,6 +608,9 @@ static int mbr_extended_prtn_intxn(cli_ctx *ctx, unsigned *prtncount, off_t extl

         ++i;

     } while (logiclba != 0 && (*prtncount) < ctx->engine->maxpartitions);

-    prtn_intxn_list_free(&prtncheck);    

+ leave:

+    prtn_intxn_list_free(&prtncheck);

+    if (virus_found)

+        return CL_VIRUS;

     return ret;

 }

@@ -1088,15 +1088,39 @@ int cli_unlink(const char *pathname)

 	return 0;

 }

-void cli_append_virus(cli_ctx * ctx, const char * virname)

+void cli_virus_found_cb(cli_ctx * ctx)

+{

+    if (ctx->engine->cb_virus_found)

+        ctx->engine->cb_virus_found(fmap_fd(*ctx->fmap), (const char *)*ctx->virname, ctx->cb_ctx);

+}

+

+int cli_append_possibly_unwanted(cli_ctx * ctx, const char * virname)

+{

+    if (SCAN_ALL)

+        return cli_append_virus(ctx, virname);

+    else if (ctx->options & CL_SCAN_HEURISTIC_PRECEDENCE)

+        return cli_append_virus(ctx, virname);

+    else if (ctx->num_viruses == 0 && ctx->virname != NULL && *ctx->virname == NULL) {

+        ctx->found_possibly_unwanted = 1;

+        ctx->num_viruses++;

+        *ctx->virname = virname;

+    }

+    return CL_CLEAN;

+}

+

+int cli_append_virus(cli_ctx * ctx, const char * virname)

 {

     if (ctx->virname == NULL)

-        return;

+        return CL_CLEAN;

+    if (ctx->fmap != NULL && (*ctx->fmap) != NULL && CL_VIRUS != cli_checkfp_virus((*ctx->fmap)->maphash, (*ctx->fmap)->len, ctx, virname))

+        return CL_CLEAN;

+    if (!SCAN_ALL && ctx->num_viruses != 0)

+        if (ctx->options & CL_SCAN_HEURISTIC_PRECEDENCE)

+            return CL_CLEAN;

     if (ctx->limit_exceeded == 0 || SCAN_ALL) { 

-        if (ctx->engine->cb_virus_found)

-            ctx->engine->cb_virus_found(fmap_fd(*ctx->fmap), virname, ctx->cb_ctx);

         ctx->num_viruses++;

         *ctx->virname = virname;

+        cli_virus_found_cb(ctx);

     }

 #if HAVE_JSON

     if (SCAN_PROPERTIES && ctx->wrkproperty) {

@@ -1105,17 +1129,18 @@ void cli_append_virus(cli_ctx * ctx, const char * virname)

             arrobj = json_object_new_array();

             if (NULL == arrobj) {

                 cli_errmsg("cli_append_virus: no memory for json virus array\n");

-                return;

+                return CL_EMEM;

             }

             json_object_object_add(ctx->wrkproperty, "Viruses", arrobj);

         }

         virobj = json_object_new_string(virname);

         if (NULL == virobj) {

             cli_errmsg("cli_append_virus: no memory for json virus name object\n");

-            return;

+            return CL_EMEM;

         }

         json_object_array_add(arrobj, virobj);

     }

+    return CL_VIRUS;

 #endif

 }

@@ -601,9 +601,10 @@ static inline void cli_writeint32(void *offset, uint32_t value)

 }

 #endif

-void cli_append_virus(cli_ctx *ctx, const char *virname);

+int cli_append_virus(cli_ctx *ctx, const char *virname);

 const char *cli_get_last_virus(const cli_ctx *ctx);

 const char *cli_get_last_virus_str(const cli_ctx *ctx);

+void cli_virus_found_cb(cli_ctx *ctx);

 void cli_set_container(cli_ctx *ctx, cli_file_t type, size_t size);

 cli_file_t cli_get_container_type(cli_ctx *ctx, int index);

@@ -2458,10 +2458,10 @@ int cli_pdf(const char *dir, cli_ctx *ctx, off_t offset)

         pdf_parseobj(&pdf, obj);

         if (SCAN_ALGO && obj->numfilters > PDF_FILTER_DTRIGGER) {

-            cli_append_virus(ctx, "Heuristic.PDF.TooManyFilters");

+            rc = cli_append_virus(ctx, "Heuristic.PDF.TooManyFilters");

             alerts++;

-            if (!SCAN_ALL)

-                rc = CL_VIRUS;

+            if (SCAN_ALL && rc == CL_VIRUS)

+                rc = CL_CLEAN;

         }

     }

@@ -2479,8 +2479,8 @@ int cli_pdf(const char *dir, cli_ctx *ctx, off_t offset)

          * a password to decrypt */

         cli_append_virus(ctx, "Heuristics.Encrypted.PDF");

         alerts++;

-        if (!SCAN_ALL)

-            rc = CL_VIRUS;

+        if (SCAN_ALL && rc == CL_VIRUS)

+            rc = CL_CLEAN;

     }

     if (!rc) {

@@ -2547,8 +2547,7 @@ int cli_pdf(const char *dir, cli_ctx *ctx, off_t offset)

         if (!rc && SCAN_ALGO && (ctx->dconf->other & OTHER_CONF_PDFNAMEOBJ)) {

             if (pdf.flags & (1 << ESCAPED_COMMON_PDFNAME)) {

                 /* for example /Fl#61te#44#65#63#6f#64#65 instead of /FlateDecode */

-                cli_append_virus(ctx, "Heuristics.PDF.ObfuscatedNameObject");

-                rc = cli_found_possibly_unwanted(ctx);

+                cli_append_possibly_unwanted(ctx, "Heuristics.PDF.ObfuscatedNameObject");

             }

         }

 #if 0

@@ -555,7 +555,7 @@ static int scan_pe_mdb (cli_ctx * ctx, struct cli_exe_section *exe_section)

     if (cli_debug_flag) {

         md5 = hashset[CLI_HASH_MD5];

         if (md5) {

-            cli_dbgmsg("MDB: %u:%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n",

+            cli_dbgmsg("MDB hashset: %u:%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n",

                 exe_section->rsz, md5[0], md5[1], md5[2], md5[3], md5[4], md5[5], md5[6], md5[7],

                 md5[8], md5[9], md5[10], md5[11], md5[12], md5[13], md5[14], md5[15]);

         } else if (cli_always_gen_section_hash) {

@@ -589,17 +589,21 @@ static int scan_pe_mdb (cli_ctx * ctx, struct cli_exe_section *exe_section)

     /* Do scans */

     for(type = CLI_HASH_MD5; type < CLI_HASH_AVAIL_TYPES; type++) {

        if(foundsize[type] && cli_hm_scan(hashset[type], exe_section->rsz, &virname, mdb_sect, type) == CL_VIRUS) {

-            cli_append_virus(ctx, virname);

-            ret = CL_VIRUS;

-            if (!SCAN_ALL) {

-                break;

+            ret = cli_append_virus(ctx, virname);

+            if (ret != CL_CLEAN) {

+                if (ret != CL_VIRUS)

+                    break;

+                else if (!SCAN_ALL)

+                    break;

             }

        }

        if(foundwild[type] && cli_hm_scan_wild(hashset[type], &virname, mdb_sect, type) == CL_VIRUS) {

-            cli_append_virus(ctx, virname);

-            ret = CL_VIRUS;

-            if (!SCAN_ALL) {

-                break;

+            ret = cli_append_virus(ctx, virname);

+            if (ret != CL_CLEAN) {

+                if (ret != CL_VIRUS)

+                    break;

+                else if (!SCAN_ALL)

+                    break;

             }

        }

     }

@@ -2209,10 +2213,10 @@ static int validate_impname(const char *name, uint32_t length, int dll)

 static inline int hash_impfns(cli_ctx *ctx, void **hashctx, uint32_t *impsz, struct pe_image_import_descriptor *image, const char *dllname, struct cli_exe_section *exe_sections, uint16_t nsections, uint32_t hdr_size, int pe_plus, int *first)

 {

-    uint32_t thuoff, offset;

+    uint32_t thuoff = 0, offset;

     fmap_t *map = *ctx->fmap;

     size_t dlllen = 0, fsize = map->len;

-    int i, j, err, num_fns = 0, ret = CL_SUCCESS;

+    int i, j, err = 0, num_fns = 0, ret = CL_SUCCESS;

     const char *buffer;

     enum CLI_HASH_TYPE type;

 #if HAVE_JSON

@@ -2557,17 +2561,23 @@ static int scan_pe_imp(cli_ctx *ctx, struct pe_image_data_dir *dirs, struct cli_

     /* Do scans */

     for(type = CLI_HASH_MD5; type < CLI_HASH_AVAIL_TYPES; type++) {

         if(cli_hm_scan(hashset[type], impsz, &virname, imp, type) == CL_VIRUS) {

-            cli_append_virus(ctx, virname);

-            ret = CL_VIRUS;

-            if(!SCAN_ALL)

-                break;

+            ret = cli_append_virus(ctx, virname);

+            if (ret != CL_CLEAN) {

+                if (ret != CL_VIRUS)

+                    break;

+                else if (!SCAN_ALL)

+                    break;

+            }

         }

         if(cli_hm_scan_wild(hashset[type], &virname, imp, type) == CL_VIRUS) {

             cli_append_virus(ctx, virname);

-            ret = CL_VIRUS;

-            if(!SCAN_ALL)

-                break;

-        }

+            if (ret != CL_CLEAN) {

+                if (ret != CL_VIRUS)

+                    break;

+                else if (!SCAN_ALL)

+                    break;

+            }

+       }

     }

     for(type = CLI_HASH_MD5; type < CLI_HASH_AVAIL_TYPES; type++)

@@ -2759,8 +2769,8 @@ int cli_scanpe(cli_ctx *ctx)

         cli_dbgmsg("Can't read new header address\n");

         /* truncated header? */

         if(DETECT_BROKEN_PE) {

-            cli_append_virus(ctx,"Heuristics.Broken.Executable");

-            return CL_VIRUS;

+            ret = cli_append_virus(ctx,"Heuristics.Broken.Executable");

+            return ret;

         }

         return CL_CLEAN;

@@ -2775,7 +2785,7 @@ int cli_scanpe(cli_ctx *ctx)

     if(fmap_readn(map, &file_hdr, e_lfanew, sizeof(struct pe_image_file_hdr)) != sizeof(struct pe_image_file_hdr)) {

         /* bad information in e_lfanew - probably not a PE file */

-        cli_dbgmsg("Can't read file header\n");

+        cli_dbgmsg("cli_scanpe: Can't read file header\n");

         return CL_CLEAN;

     }

@@ -2908,8 +2918,8 @@ int cli_scanpe(cli_ctx *ctx)

         pe_add_heuristic_property(ctx, "BadNumberOfSections");

 #endif

         if(DETECT_BROKEN_PE) {

-            cli_append_virus(ctx,"Heuristics.Broken.Executable");

-            return CL_VIRUS;

+            ret = cli_append_virus(ctx,"Heuristics.Broken.Executable");

+            return ret;

         }

         if(!ctx->corrupted_input) {

@@ -2945,8 +2955,8 @@ int cli_scanpe(cli_ctx *ctx)

 #endif

         cli_dbgmsg("SizeOfOptionalHeader too small\n");

         if(DETECT_BROKEN_PE) {

-            cli_append_virus(ctx,"Heuristics.Broken.Executable");

-            return CL_VIRUS;

+            ret = cli_append_virus(ctx,"Heuristics.Broken.Executable");

+            return ret;

         }

         return CL_CLEAN;

@@ -2956,8 +2966,8 @@ int cli_scanpe(cli_ctx *ctx)

     if(fmap_readn(map, &optional_hdr32, at, sizeof(struct pe_image_optional_hdr32)) != sizeof(struct pe_image_optional_hdr32)) {

         cli_dbgmsg("Can't read optional file header\n");

         if(DETECT_BROKEN_PE) {

-            cli_append_virus(ctx,"Heuristics.Broken.Executable");

-            return CL_VIRUS;

+            ret = cli_append_virus(ctx,"Heuristics.Broken.Executable");

+            return ret;

         }

         return CL_CLEAN;

@@ -2974,8 +2984,8 @@ int cli_scanpe(cli_ctx *ctx)

             cli_dbgmsg("Incorrect SizeOfOptionalHeader for PE32+\n");

             if(DETECT_BROKEN_PE) {

-                cli_append_virus(ctx,"Heuristics.Broken.Executable");

-                return CL_VIRUS;

+                ret = cli_append_virus(ctx,"Heuristics.Broken.Executable");

+                return ret;

             }

             return CL_CLEAN;

@@ -3044,8 +3054,8 @@ int cli_scanpe(cli_ctx *ctx)

             if(fmap_readn(map, &optional_hdr32 + 1, at, sizeof(struct pe_image_optional_hdr64) - sizeof(struct pe_image_optional_hdr32)) != sizeof(struct pe_image_optional_hdr64) - sizeof(struct pe_image_optional_hdr32)) {

             cli_dbgmsg("Can't read optional file header\n");

             if(DETECT_BROKEN_PE) {

-                cli_append_virus(ctx,"Heuristics.Broken.Executable");

-                return CL_VIRUS;

+                ret = cli_append_virus(ctx,"Heuristics.Broken.Executable");

+                return ret;

             }

             return CL_CLEAN;

@@ -3168,14 +3178,14 @@ int cli_scanpe(cli_ctx *ctx)

     if (DETECT_BROKEN_PE && !native && (!(pe_plus?EC32(optional_hdr64.SectionAlignment):EC32(optional_hdr32.SectionAlignment)) || (pe_plus?EC32(optional_hdr64.SectionAlignment):EC32(optional_hdr32.SectionAlignment))%0x1000)) {

         cli_dbgmsg("Bad virtual alignment\n");

-        cli_append_virus(ctx,"Heuristics.Broken.Executable");

-        return CL_VIRUS;

+        ret = cli_append_virus(ctx,"Heuristics.Broken.Executable");

+        return ret;

     }

     if (DETECT_BROKEN_PE && !native && (!(pe_plus?EC32(optional_hdr64.FileAlignment):EC32(optional_hdr32.FileAlignment)) || (pe_plus?EC32(optional_hdr64.FileAlignment):EC32(optional_hdr32.FileAlignment))%0x200)) {

         cli_dbgmsg("Bad file alignment\n");

-        cli_append_virus(ctx, "Heuristics.Broken.Executable");

-        return CL_VIRUS;

+        ret = cli_append_virus(ctx, "Heuristics.Broken.Executable");

+        return ret;

     }

     fsize = map->len;

@@ -3206,8 +3216,8 @@ int cli_scanpe(cli_ctx *ctx)

         free(exe_sections);

         if(DETECT_BROKEN_PE) {

-            cli_append_virus(ctx,"Heuristics.Broken.Executable");

-            return CL_VIRUS;

+            ret = cli_append_virus(ctx,"Heuristics.Broken.Executable");

+            return ret;

         }

         return CL_CLEAN;

@@ -3251,8 +3261,8 @@ int cli_scanpe(cli_ctx *ctx)

                         free(exe_sections);

                         if(DETECT_BROKEN_PE) {

-                            cli_append_virus(ctx, "Heuristics.Broken.Executable");

-                            return CL_VIRUS;

+                            ret = cli_append_virus(ctx, "Heuristics.Broken.Executable");

+                            return ret;

                         }

                         return CL_CLEAN; /* no ninjas to see here! move along! */

@@ -3324,10 +3334,10 @@ int cli_scanpe(cli_ctx *ctx)

         if (DETECT_BROKEN_PE && (!valign || (exe_sections[i].urva % valign))) { /* Bad virtual alignment */

             cli_dbgmsg("VirtualAddress is misaligned\n");

             cli_dbgmsg("------------------------------------\n");

-            cli_append_virus(ctx, "Heuristics.Broken.Executable");

+            ret = cli_append_virus(ctx, "Heuristics.Broken.Executable");

             free(section_hdr);

             free(exe_sections);

-            return CL_VIRUS;

+            return ret;

         }

         if (exe_sections[i].rsz) { /* Don't bother with virtual only sections */

@@ -3355,8 +3365,8 @@ int cli_scanpe(cli_ctx *ctx)

             free(section_hdr);

             free(exe_sections);

             if(DETECT_BROKEN_PE) {

-                cli_append_virus(ctx, "Heuristics.Broken.Executable");

-                return CL_VIRUS;

+                ret = cli_append_virus(ctx, "Heuristics.Broken.Executable");

+                return ret;

             }

             return CL_CLEAN;

@@ -3365,10 +3375,10 @@ int cli_scanpe(cli_ctx *ctx)

         if(!i) {

             if (DETECT_BROKEN_PE && exe_sections[i].urva!=hdr_size) { /* Bad first section RVA */

                 cli_dbgmsg("First section is in the wrong place\n");

-                cli_append_virus(ctx, "Heuristics.Broken.Executable");

+                ret = cli_append_virus(ctx, "Heuristics.Broken.Executable");

                 free(section_hdr);

                 free(exe_sections);

-                return CL_VIRUS;

+                return ret;

             }

             min = exe_sections[i].rva;

@@ -3376,10 +3386,10 @@ int cli_scanpe(cli_ctx *ctx)

         } else {