Hi Hugo,

 

I don’t think ClamAV presently supports macro detection and macro blocking in libreoffice format documents, outside of the Microsoft office formats that libreoffice supports.

As a side note, for VBA and Excel 4.0 style macros, ClamAV is getting some improved macro detection in the soon-to-be-released 0.103 version.

 

Which office document formats exactly are you testing with?

 

Ged’s idea to write signatures to detect the macros is one possible solution though ideally ClamAV’s macro-blocking feature would work for all document formats. 

 

Regards,

Micah

 

From: clamav-users <clamav-users-bounces@lists.clamav.net> On Behalf Of Hugo Boss via clamav-users
Sent: Tuesday, September 8, 2020 5:41 AM
To: clamav-users@lists.clamav.net
Cc: Hugo Boss <momphh@gmail.com>
Subject: [clamav-users] clamav blocking libreoffice macro

 

Hello,

 

I would to like to know how can I block with clamav libreoffice files with macro as MS Office files:

 

I turn :

OLE2BlockMacros yes

DetectPUA yes

 

But no result.

 

Kind of regards.