[clamav-users] Daily 23161 broke Clam (workaround)

[Adam Gibson]

I had email domain issues which kept me from posting this the day of the
problem unfortunately so this info is just for future reference I guess.

If a problem like this comes up again, I found that you can create a
whitelist file to ignore some signatures.

I put the following file in the virus database directory (/var/lib/clamav/
for my system)...

Created a file called whitelist.ign2

Put the following content in it...

Doc.Macro.GenericHeuristic-5931846-1
Doc.Macro.GenericHeuristic-5901772-0

This whitelists those patterns so they do not even get processed to cause
the crash in the regexp engine that clamd uses.  Clamd started up fine for
me with CentOS 5 after doing that.