Am 13.09.2017 um 15:57 schrieb Gandalf Corvotempesta:
So, the only way to block encrypted ZIP is also to block any encrypted or
password protected PDF?
with one clamd instance yes
on a smart setup you run two instances and one is just used for scoring
in spamassassin (or in my case i edited the sa-clamav plugin to support
multiple instances instead the ugly hardcoding) - both are scoring high
and at the end the second clamd is also wired with the milter and jectes
undocnditional while the PDF stuff combined with a well mainatined bayes
has no problems to distinct bewteen junk and ham
Il 13 set 2017 3:49 PM, "Reindl Harald" <h.rei...@thelounge.net> ha scritto:
Am 13.09.2017 um 15:45 schrieb Gandalf Corvotempesta:
Hi to all
I would like to block any encrypted/password protected ZIP/RAR, ....
and so on but *NOT* blocking any encrypted PDF.
Currently, ClamAV is blocking any encrypted PDF with
Heuristics.Encrypted.PDF
How can I only block real archived and not PDF (that are not archives)
short answer: you can't and you can stop seeking around - and yes that's
terrible as most of the Heuristics options which are thrwoing the child out
with the bath
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
