Did you know that if you do a manual scan of a file with ClamWin, the extension does not matter? Even if you use a custom set of extensions to scan and that particular file's extension is not in your custom set of extensions, ClamWin will still scan it by design. That is nice to know in case your extension set does not include that particular extension. Lately we are seeing some unusual extensions used by malware--JPEG, CHM are a couple of them.

Your custom set of extensions to scan are used in automated scans and manual scans of folders.

Regards,

Aren't all AVs like this, though? When you scan an individual file, the AV ignores limits in order to scan the selected file.

Some AVs give you an option to scan for specific extensions. For others, you have to live with whatever default they have. Some seem to scan everything in real-time and use an extension set for the manual/scheduled scan. The Clam Sentinel developer uses a pretty thorough set of about 120 extensions as the default. I've seen some commercial AVs only use about 50 extensions.

What scares me is malware that is injected into an ongoing process that never gets into a file, so there is no extension.

Regards,