[clamav-users] ArchiveBlockEncrypted and PDF

[Reindl Harald]

Am 13.09.2017 um 15:57 schrieb Gandalf Corvotempesta:
> So, the only way to block encrypted ZIP is also to block any encrypted or
> password protected PDF?

with one clamd instance yes

on a smart setup you run two instances and one is just used for scoring 
in spamassassin (or in my case i edited the sa-clamav plugin to support 
multiple instances instead the ugly hardcoding) - both are scoring high 
and at the end the second clamd is also wired with the milter and jectes 
undocnditional while the PDF stuff combined with a well mainatined bayes 
has no problems to distinct bewteen junk and ham

> Il 13 set 2017 3:49 PM, "Reindl Harald" <h.reindl at thelounge.net> ha scritto:
> 
>>
>>
>> Am 13.09.2017 um 15:45 schrieb Gandalf Corvotempesta:
>>
>>> Hi to all
>>> I would like to block any encrypted/password protected ZIP/RAR, ....
>>> and so on but *NOT* blocking any encrypted PDF.
>>> Currently, ClamAV is blocking any encrypted PDF with
>>> Heuristics.Encrypted.PDF
>>>
>>> How can I only block real archived and not PDF (that are not archives)
>>>
>>
>> short answer: you can't and you can stop seeking around - and yes that's
>> terrible as most of the Heuristics options which are thrwoing the child out
>> with the bath