Mailcow-dockerized: CLAMAV false positive

[develth]

Hi there,

i try to send a Mail that contains a Excel Document where a password is set.

rspamd says, Virus, so i checked the logs and found that:

rspamd-mailcow_1     | 2018-07-06 07:38:22 #20(normal) <a86d18>; lua; antivirus.lua:106: clamav: virus found: "PUA.Doc.Packed.EncryptedDoc-65637"

So i set following in ```data/conf/clamav/clamd.conf````

DetectPUA no
ExcludePua Packed
OLE2BlockMacros no

But it still blocks with the same message.

Any Ideas?

Thanks & Cheers,
Thomas

[andryyy]

Did you restart clamd-mailcow? :-)
Ah, it probably is cached in Redis, too. Sec...

[develth]

Hehe, yeah forgot to mention - i even restarted rspamd

[andryyy]

I think it caches the result for 3600s.

# docker-compose exec redis-mailcow  /bin/sh
/data # redis-cli KEYS rs_cl* | xargs redis-cli DEL
/data # exit

[develth]

Purrfect! Thanks!