This shows you the differences between two versions of the page.
fuss:clamav [2017/04/06 07:39] (current)
|Line 1:||Line 1:|
|+||====== Ignoring Signatures ======|
|+||Unfortunately, some clamav signatures generate a lot of false positives such as the YARA docx_macro signature that just checks whether an office document contains macros regardless whether the macro is intentional or a virus.|
|+||To disable signatures, create a file in the clamav signature database directory (to be found on Debian at ''/var/lib/clamav/local.ign2'') containing signature names line-by-line. For instance, to stop YARA from flagging office documents with macros as viruses, add the line:|
|+||to the newly created file.|