Hi,
to test optoin I created a simply Word (2016) document containing a simple test macro.
ClamWin does not detect it.

Any ideas?

Greetings Harry

If your macro doesn't appear malicious, ClamWin (with the Clam AV scan engine and virus signatures) will not detect it. Try the EICAR virus instead--download it from the European web site.

If ClamWin is scanning okay, it will detect any file for which there is a signature in the Clam AV virus signature database. If you have set up your own custom file extensions to scan, it will only scan files with those extensions.

Regards,

Hi,
thanks for your reply.
EICAR works fine and some "real" virus are detected.
But the option "OLE2BlockMacros" promisses to set any document containing a VBA macros as virus even if no signature applies:



Best regards,

Harald Binkle

I see. ClamWin uses the Clam AV scan engine and virus signatures, but, for some time now, not all of the Clam AV configuration options are available in ClamWin. This started with version .95, I believe.

Thanks for using ClamWin!

Regards,

Hi,
I assume the problem is no general windows issue or a missing option.
I can see "Heuristics.OLE2.ContainsMacros" matching on some mails, but it looks to me as if it only applies to the old office formats.
For office documents created by 2007 and newer the VBA detection seem to fail. (the zip format simply containing the vbaProject.bin file)

Regards,
Harald

Hello binkle.

Please file this over at ClamAV's Bugzilla here: https://bugzilla.clamav.net/.