[clamav-users] Pdf.Exploit.CVE_2017_3039-6300177-0 only with clamd

Giuseppe Ravasio giuseppe_ravasio at ch.modiano.com
Fri Apr 28 10:47:05 EDT 2017

since this morning daily signature update 23337
and even with the latest one 23338
my amavis flags some emails with PDF attachments as virus:
Pdf.Exploit.CVE_2017_3039-6300177-0 FOUND

Checking the PDF with other AVs and even with clamscan (on the same
server) results in a clean file:

beppe at thot:/tmp$ clamscan TCA.pdf
TCA.pdf: OK

----------- SCAN SUMMARY -----------
Known viruses: 6272759
Engine version: 0.99.2
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.22 MB
Data read: 0.08 MB (ratio 2.71:1)
Time: 17.277 sec (0 m 17 s)

if I check the file with clamdscan I get the virus found:
beppe at thot:/tmp$ clamdscan TCA.pdf
/tmp/TCA.pdf: Pdf.Exploit.CVE_2017_3039-6300177-0 FOUND

----------- SCAN SUMMARY -----------
Infected files: 1
Time: 0.032 sec (0 m 0 s)

Any hints on how to solve the problem?


More information about the clamav-users mailing list