Re: [clamav-users] excluding a URL from "heueristics" scanning

On 8/11/2022 7:10 PM, joe a wrote: On 8/11/2022 6:34 PM, G.W. Haywood via clamav-users wrote: Hi there, On Thu, 11 Aug 2022, joe a wrote: I do not understand why, when entering more than one URL, the first line in my "exclude" file: "/var/lib/clamav/ImaOK2day.wdb" seems to be able to match w

Re: [clamav-users] excluding a URL from "heueristics" scanning

On 8/11/2022 6:34 PM, G.W. Haywood via clamav-users wrote: Hi there, On Thu, 11 Aug 2022, joe a wrote: I do not understand why, when entering more than one URL, the first line in my "exclude" file: "/var/lib/clamav/ImaOK2day.wdb" seems to be able to match when entered "in plain text", while s

Re: [clamav-users] excluding a URL from "heueristics" scanning

Hi there, On Thu, 11 Aug 2022, joe a wrote: I do not understand why, when entering more than one URL, the first line in my "exclude" file: "/var/lib/clamav/ImaOK2day.wdb" seems to be able to match when entered "in plain text", while subsequent lines seem to want actual "regex" notation (escap

Re: [clamav-users] excluding a URL from "heueristics" scanning

On 8/11/2022 2:02 PM, joe a wrote: On 8/11/2022 1:17 PM, G.W. Haywood via clamav-users wrote: Hi there, On Thu, 11 Aug 2022, joe a wrote: A while back discussed excluding some URL's from triggering the heueristics scan.   Seemed to work.  Postfix, spamassassin, clamav in use. Now seems som

Re: [clamav-users] False Positive?

Report Submitted! > On Aug 11, 2022, at 11:21 AM, Joel Esler via clamav-users > wrote: > > Exactly the only answer that is correct to this email. :) > >> On Aug 11, 2022, at 2:15 PM, Al Varnell via clamav-users >> wrote: >> >> Did you submit to >

Re: [clamav-users] False Positive?

Exactly the only answer that is correct to this email. :) > On Aug 11, 2022, at 2:15 PM, Al Varnell via clamav-users > wrote: > > Did you submit to ? > > -Al- > -- > ClamXAV user > > On Aug 11, 2022, at 11:01 AM, David Laxer

Re: [clamav-users] False Positive?

Did you submit to >? -Al- -- ClamXAV user On Aug 11, 2022, at 11:01 AM, David Laxer wrote: > Clamav 0.105.1 > > Xls.Downloader.Emotet-fe81817e7e81807e-9951541-0 FOUND > > /Applications/Keynote.app/Contents/SharedSupport/Te

Re: [clamav-users] excluding a URL from "heueristics" scanning

On 8/11/2022 1:17 PM, G.W. Haywood via clamav-users wrote: Hi there, On Thu, 11 Aug 2022, joe a wrote: A while back discussed excluding some URL's from triggering the heueristics scan.   Seemed to work.  Postfix, spamassassin, clamav in use. Now seems some addtional URL's are involved. Perh

[clamav-users] False Positive?

Clamav 0.105.1 Xls.Downloader.Emotet-fe81817e7e81807e-9951541-0 FOUND /Applications/Keynote.app/Contents/SharedSupport/Templates/New_Template9/Wide.kth: Xls.Downloader.Emotet-fe81817e7e81807e-9951541-0 FOUND /Applications/Keynote.app/Contents/SharedSupport/Templates/New_Template9_RTL/Wide.kth:

Re: [clamav-users] excluding a URL from "heueristics" scanning

Hi there, On Thu, 11 Aug 2022, joe a wrote: A while back discussed excluding some URL's from triggering the heueristics scan. Seemed to work. Postfix, spamassassin, clamav in use. Now seems some addtional URL's are involved. Perhaps I am doing something wrong here. Been determining (?)

[clamav-users] excluding a URL from "heueristics" scanning

A while back discussed excluding some URL's from triggering the heueristics scan. Seemed to work. Postfix, spamassassin, clamav in use. Now seems some addtional URL's are involved. Perhaps I am doing something wrong here. Been determining (?) the offending URL's by examining the entire ema