Hi, I took a quick look at the code. The "Heuristics.Encrypted.PDF" is off by default. Try clamscan --block-encrypted. If you have 'ArchiveBlockEncrypted yes' in your clamd.conf, it would explain the results you are seeing with milter.
Is testfile.pdf encrypted? Check these things out and if it still does not make sense, please open a bug report at bugzilla.clamav.net. Heuristic signatures cannot be whitelisted. There is a bugzilla enhancement request for this already. May be in a future release. Steve _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
