>> UNOFFICIAL means it did not come from ClamAV®. >> You need to take it up with whomever maintains the MBL database. >> MalwarePatrol? <http://malwarepatrol.com.br/> > I don't recall every subscribing to that service, and the clamav- > unofficial sigs database is not installed, and never has been. > > Now what? Shut down my daily scan?
Hi Gene, Malware Patrol databases used to be a free service and was included in most of the 3rd party download scripts, however, it's since changed to a subscription service. These databases aren't mirrored by Sanesecurity, so I don't have any real input, however, I have added the FP signature to Sanesecurity mirrored sigwhitelist.ign2 file. The databases to look for in your clamav database area are: mbl.db mbl.ndb Remove both and restart clamd If the above databases come back... you've got to check your download scripts and remove them. Alternatively, printf "MBL_343814" > localwhitelist.ign2 place localwhitelist.ign2 into your clamav database directory restart clamd. For future reference, here's the current FP report addresses: http://sanesecurity.com/support/false-positives/ Hope this helps a little... Cheers, Steve Sanesecurity _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/support/ml
