[clamav-users] clamav blocking libreoffice macro

[Hugo Boss]

Hello
Thanks for your answer. In fact we have issues with Emotet malware and we
have to block macro. No problem with OLE2 format MS office but no detection
with libreoffice macro format.

Le mar. 8 sept. 2020 à 18:17, Micah Snyder (micasnyd) <micasnyd at cisco.com>
a écrit :

> Hi Hugo,
>
>
>
> I don’t think ClamAV presently supports macro detection and macro blocking
> in libreoffice format documents, outside of the Microsoft office formats
> that libreoffice supports.
>
> As a side note, for VBA and Excel 4.0 style macros, ClamAV is getting some
> improved macro detection in the soon-to-be-released 0.103 version.
>
>
>
> Which office document formats exactly are you testing with?
>
>
>
> Ged’s idea to write signatures to detect the macros is one possible
> solution though ideally ClamAV’s macro-blocking feature would work for all
> document formats.
>
>
>
> Regards,
>
> Micah
>
>
>
> *From:* clamav-users <clamav-users-bounces at lists.clamav.net> *On Behalf
> Of *Hugo Boss via clamav-users
> *Sent:* Tuesday, September 8, 2020 5:41 AM
> *To:* clamav-users at lists.clamav.net
> *Cc:* Hugo Boss <momphh at gmail.com>
> *Subject:* [clamav-users] clamav blocking libreoffice macro
>
>
>
> Hello,
>
>
>
> I would to like to know how can I block with clamav libreoffice files with
> macro as MS Office files:
>
>
>
> I turn :
>
> OLE2BlockMacros yes
>
> DetectPUA yes
>
>
>
> But no result.
>
>
>
> Kind of regards.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20200909/7d75f31f/attachment.htm>