Page 1 of 1

Message Quarantine Report has a virus???!!! (SOLVED)

Posted: 01 May 2019 09:42
by keysteal
Hi,

I cannot send Message Quarantine Report to a couple of users has clamav find a virus into report html! Virus (Bofhland.Cracked.url.2672646.UNOFFICIAL)
How is it possible???

Re: Message Quarantine Report has a virus???!!!

Posted: 04 May 2019 06:28
by keysteal
Anyway, if anyone have a false positive when sending the Message Quarantine Report by Clamav, this is
what I did:
I found these files in Clamav that whitelisted signatures:

/var/lib/clamav/sigwhitelist.ign2
/var/lib/clamav-unofficial-sigs/dbs-ss/pit-whitelist.ign2
/var/lib/clamav-unofficial-sigs/dbs-ss/sigwhitelist.ign2

edit each of them and add the false positive virus. In my case the virus
found was Bofhland.Cracked.url.2672646.UNOFFICIAL, but don't add it as you
see it, remove the .UNOFFICIAL, so:
Bofhland.Cracked.url.2672646
Ok. Now restart the Clamav Service with
sudo service clamd restart