<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<br>
<div class="moz-signature">
<div>I recently started using the 'clamav-unofficial-sigs' script
(<a class="moz-txt-link-freetext" href="https://github.com/extremeshok/clamav-unofficial-sigs/">https://github.com/extremeshok/clamav-unofficial-sigs/</a>) and
noticed, that some 'unofficial' detections are blocked properly,
while others are just '<i>turned into a spam report</i>'.</div>
<div><br>
</div>
<div>Here's a part of the log for one that's blocked:</div>
<div>
<pre>(07385-19) run_av (ClamAV-clamd): /var/spool/amavis/tmp/amavis-20201015T100234-07385-bZgYJcQq/parts INFECTED: Porcupine.Junk.40702.UNOFFICIAL
(07385-19) virus_scan: (Porcupine.Junk.40702.UNOFFICIAL), detected by 1 scanners: ClamAV-clamd
(07385-19) Blocked INFECTED (Porcupine.Junk.40702.UNOFFICIAL) {DiscardedInbound,Quarantined}, ...</pre>
And here's a part of the log for one that's merely converted to
a spam report:</div>
<div>
<pre>(20911-18) run_av (ClamAV-clamd): /var/spool/amavis/tmp/amavis-20201015T110518-20911-6Oyb0AUP/parts INFECTED: Sanesecurity.Badmacro.Doc.ArrWind1.UNOFFICIAL, Sanesecurity.Badmacro.Doc.ArrWind1.UNOFFICIAL
(20911-18) Turning AV infection into a spam report: score=0.1, AV:Sanesecurity.Badmacro.Doc.ArrWind1.UNOFFICIAL=0.1</pre>
</div>
<div><br>
</div>
<div>Why is that? What setting controls that?</div>
<div><br>
</div>
<div><br>
</div>
<div> Regards,</div>
<div><br>
</div>
<div> Danilo</div>
<div><br>
</div>
</div>
</body>
</html>