Mail contains virus ? MBL_162040584.UNOFFICIAL

[Th-Barth]

Hello,

I use the ClamAV unofficial tool and it seems that I get a false positiv, I m not sure. A known person with a gmail-address tries to send me a mail with a link to google docs (Google Sheets) and amavis refuses to accept this mail. The message is:

X-Quarantine-ID: <P67_HouGWPtU>
X-Amavis-Alert: INFECTED, message contains virus: MBL_162040584.UNOFFICIAL
X-Spam-Flag: NO
X-Spam-Score: 0

I checked if there is an update for ClamAV unofficial but no changes.

clamav-unofficial-sigs.sh --upgrade

################################################################################
eXtremeSHOK.com ClamAV Unofficial Signature Updater
Version: v7.2.5 (2021-03-20)
Required Configuration Version: v96
Copyright (c) Adrian Jon Kriel ::
################################################################################
Loading config: /etc/clamav-unofficial-sigs/master.conf
Loading config: /etc/clamav-unofficial-sigs/os.conf
Loading config: /etc/clamav-unofficial-sigs/user.conf
Checking for updates ...
No updates available

Any idea how to resolve this problem?

[perplexityjeff]

Hi @Th-Barth,

I'd recommend to disable MBL's signatures currently as it gives a lot of false positives especially when dealing with Google Drive or Gmail attachments.

See here as well:
#381
4aa0569

It is currently only merged into dev and we currently do not know if or when the original maintainer will give us a big update.