TransWikia.com

ClamAV exclude on some signature does not work

Super User Asked by Kalib Zen on December 9, 2020

I use ClamAV with 3rd party signature. So, in order to exclude some virus signature from scanning, I followed the official documentation to add a new .ign2 file like below:

cd /usr/local/share/clamav/
touch whitelist.ign2
chmod 644 whitelist.ign2

When doing the scan I got a false positive signature like this:

/mysql/mysql_backups-02-08-2020_04-30-01/databasedbs.sql.gz: YARA.eval_post.UNOFFICIAL FOUND

So, I included the signature like this in the whitelist.ign2. Here are some of other exclude signatures:

$ cat /usr/local/share/clamav/whitelist.ign2
{HEX}Malware.Expert.generic.eval.post.2
{HEX}php.malware.magento.594
{HEX}Malware.Expert.malware.url.hastebin.com.0
{multi}Malware.Expert.wget.curl.lwp-download.exec.system.signature
YARA.php_malware_hexinject
YARA.shankar_php_php
YARA.Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php
{HEX}Malware.Expert.generic.eval.gzinflate.base64.9
{HEX}Malware.Expert.generic.malware.127
YARA.r57shell_php_php
YARA.eval_post

From my tests, some signature are excluded like

{HEX}php.malware.magento.594, {HEX}Malware.Expert.generic.eval.post.2

but some signatures are not excluded and still found by clamav eventhough I have included in the excluded list example:

YARA.eval_post, YARA.r57shell_php_php

Anyone experience this problem ? What do you do to solve this.

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP