Virus quarantine empty

[Plamen Trifonov]

Dear all,
A non-typical issue has risen with our pmg: there are emails that the tracking center claims that are quarantined in virus quarantine, but the virus quarantine is empty for weeks. The problem seems to rose when I updated to the newest 5.2-3 build.

As an attachment to this post you will find a screenshot of the virus detector settings and the action rules.

 

[Stoiko Ivanov]

Hm - that's odd - nothing in particular changed that should affect that...

Could I ask you for:
* The log for the mail in question
* a screen-shot of the virus-quarantine

keep in mind that the virus-quarantine is only accessible by an Administrator and that it's separate from the Spamquarantine where each user can unblock their mails

Thanks!

 

[Plamen Trifonov]

Please accept my sincere apologies.

I forgot that I've tried to add an exception for clamav signature by creating a .ign2 database file in /var/lib/clamav. The signatures that I would like to exclude are: YARA.maldoc_getEIP_method_1.UNOFFICIAL and YARA.maldoc_indirect_function_call_3.UNOFFICIAL and my mistake was that I've added them with the .UNOFFICIAL extension. After removing the extension and restart clamav daemon the PMG virus quarantine populated, but the problem with the false positives of those signature persists - the whitelist.ign2 file doesn't seem to work.

Can you advice how to add exceptions for those signatures, because I've worked around the problem by commenting the whole rules in their native .yar rules database file?


Kind regards,
Plamen