Mailing List Archive

?First get the file's hash value:

sigtool --md5 /home/tmick/.config/libreoffice/4/user/basic/Standard/Module1.xba

Then copy the results to an fp.local file. You will probably have to create such a file and add it to the ClamAV database.

-Al-

> On Jun 7, 2023, at 11:45 AM, Tim McConnell via clamav-users <clamav-users@lists.clamav.net> wrote:
>
> Hi all,
> I get this in my report:
> /home/tmick/.config/libreoffice/4/user/basic/Standard/Module1.xba:
> PUA.Doc.Tool.LibreOfficeMacro-2 FOUND
> How do I request the macro be added to the safe list?
> Thanks!
>
> --
> Tim McConnell <tmcconnell168@gmail.com>

Thanks for that AL, now how do I add to the DB? Two things I'm not is a
programmer or DBA :-(

--
Tim McConnell <tmcconnell168@gmail.com>


On Thu, 2023-06-08 at 05:01 -0700, Al Varnell wrote:
> ?First get the file's hash value:
>
> sigtool --md5
> /home/tmick/.config/libreoffice/4/user/basic/Standard/Module1.xba
>
> Then copy the results to an fp.local file. You will probably have to
> create such a file and add it to the ClamAV database.
>
> -Al-
>
> > On Jun 7, 2023, at 11:45 AM, Tim McConnell via clamav-users
> > <clamav-users@lists.clamav.net> wrote:
> >
> > Hi all,
> > I get this in my report:
> > /home/tmick/.config/libreoffice/4/user/basic/Standard/Module1.xba:
> > PUA.Doc.Tool.LibreOfficeMacro-2 FOUND
> > How do I request the macro be added to the safe list?
> > Thanks!
> >
> > --
> > Tim McConnell <tmcconnell168@gmail.com>

What db do you think you want to add it to?

— Sent from my iPhone

On Jun 8, 2023, at 12:35, Tim McConnell via clamav-users <clamav-users@lists.clamav.net> wrote:

?Thanks for that AL, now how do I add to the DB? Two things I'm not is a programmer or DBA :-(
--
Tim McConnell <tmcconnell168@gmail.com>

On Thu, 2023-06-08 at 05:01 -0700, Al Varnell wrote:

?First get the file's hash value:
sigtool --md5 /home/tmick/.config/libreoffice/4/user/basic/Standard/Module1.xba
Then copy the results to an fp.local file. You will probably have to create such a file and add it to the ClamAV database.
-Al-

On Jun 7, 2023, at 11:45 AM, Tim McConnell via clamav-users <clamav-users@lists.clamav.net> wrote:
Hi all, I get this in my report:/home/tmick/.config/libreoffice/4/user/basic/Standard/Module1.xba:PUA.Doc.Tool.LibreOfficeMacro-2 FOUNDHow do I request the macro be added to the safe list? Thanks!
-- Tim McConnell <tmcconnell168@gmail.com>

_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat

Well I would assume the clam DB but I've no idea how or any of that. I
would think the new Macro for Libre Office Calc would be in there
already but I've been wrong before. 

On Thu, 2023-06-08 at 13:03 -0400, Joel Esler wrote:
> What db do you think you want to add it to?
>
> — 
> Sent from my iPhone
>
> > On Jun 8, 2023, at 12:35, Tim McConnell via clamav-users
> > <clamav-users@lists.clamav.net> wrote:
> >
> > ?
> > Thanks for that AL, now how do I add to the DB? Two things I'm not
> > is a programmer or DBA :-(
> >

If you wish to ignore the PUA.Doc.Tool.LibreOfficeMacro-2 signature, you can create a .ign2 signature file in your clamav database directory.

See https://docs.clamav.net/manual/Signatures/AllowLists.html#signature-ignore-lists for details.



Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.
________________________________
From: clamav-users <clamav-users-bounces@lists.clamav.net> on behalf of Tim McConnell via clamav-users <clamav-users@lists.clamav.net>
Sent: Thursday, June 8, 2023 10:12 AM
To: Joel Esler <joel.esler@me.com>; ClamAV users ML <clamav-users@lists.clamav.net>
Cc: Tim McConnell <tmcconnell168@gmail.com>
Subject: Re: [clamav-users] How do I get something added to the ignore list

Well I would assume the clam DB but I've no idea how or any of that. I would think the new Macro for Libre Office Calc would be in there already but I've been wrong before.

On Thu, 2023-06-08 at 13:03 -0400, Joel Esler wrote:
What db do you think you want to add it to?

—
Sent from my iPhone

On Jun 8, 2023, at 12:35, Tim McConnell via clamav-users <clamav-users@lists.clamav.net<mailto:clamav-users@lists.clamav.net>> wrote:

?
Thanks for that AL, now how do I add to the DB? Two things I'm not is a programmer or DBA :-(

Thank You Micah!!!

On Thu, 2023-06-08 at 20:20 +0000, Micah Snyder (micasnyd) wrote:
> If you wish to ignore the PUA.Doc.Tool.LibreOfficeMacro-2 signature,
> you can create a .ign2 signature file in your clamav database
> directory.
>
> See 
> https://docs.clamav.net/manual/Signatures/AllowLists.html#signature-
> ignore-lists for details.
>
>
>
> Micah Snyder
> ClamAV Development
> Talos
> Cisco Systems, Inc.
> From: clamav-users <clamav-users-bounces@lists.clamav.net> on behalf
> of Tim McConnell via clamav-users <clamav-users@lists.clamav.net>
> Sent: Thursday, June 8, 2023 10:12 AM
> To: Joel Esler <joel.esler@me.com>; ClamAV users ML
> <clamav-users@lists.clamav.net>
> Cc: Tim McConnell <tmcconnell168@gmail.com>
> Subject: Re: [clamav-users] How do I get something added to the
> ignore list
>  
> Well I would assume the clam DB but I've no idea how or any of that.
> I would think the new Macro for Libre Office Calc would be in there
> already but I've been wrong before. 
>
> On Thu, 2023-06-08 at 13:03 -0400, Joel Esler wrote:
> > What db do you think you want to add it to?
> >
> > — 
> > Sent from my iPhone
> >
> > > On Jun 8, 2023, at 12:35, Tim McConnell via clamav-users
> > > <clamav-users@lists.clamav.net> wrote:
> > >
> > > ?
> > > Thanks for that AL, now how do I add to the DB? Two things I'm
> > > not is a programmer or DBA :-(
> > >
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat