ALL PDF files are blocked due to antivirus false positive

[BOOZy]

Virus (YARA.invalid_trailer_structure.UNOFFICIAL)

and Virus (YARA.possible_includes_base64_packed_functions.UNOFFICIAL)

Is there an workaround or update yet?

[BOOZy]

Fixed, I have disabled YARA rules in master.conf.

[kicou]

Encountered the exact same issue today.

Instead of disabling Yara rules altogether (I use them),

in /etc/clamav-unofficial-sigs/user.conf commented out the line

Code: Select all

#yararulesproject_dbs_rating="HIGH"

and restarted clamscan

Code: Select all

systemctl restart clamd@scan