Questions tagged [clamav]
Antivirus for UNIX-like systems primarily for mailserver integration.
163
questions
4
votes
1
answer
376
views
How to make clamassassin prepend the X-Virus-* headers instead of appending them?
The email virus filter wrapper for ClamAV, clamassassin, appends its headers to the message headers.
X-Virus-Status: No
X-Virus-Checker-Version: clamassassin 1.2.4 with clamscan / ClamAV 1.0.3/27134/...
2
votes
1
answer
337
views
Debian 12: can't get ClamAV to listen on TCP 3310
ClamAV seems to have a bug on Debian 12 (bookworm) making it difficult to get it listening on TCP 3310.
I tried the two approaches described in
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=...
0
votes
0
answers
53
views
clamdscan returns "Clamav Daemon cannot be started" but clamd is running
I am using clamdscan to scan files uploaded to a website. If I run clamdscan from the command line it works fine. However, if I call from a PHP script it throws an exception:
App\Util\Exception\...
1
vote
0
answers
328
views
How to change ClamAV update repo? Error: "Your ClamAV installation is OUTDATED!"
I am running a Debian 11 bullseye server and every now and then clamav tells me that I am not using the current version. :
The ClamAV update process was started 25 time(s)
Last ClamAV update ...
0
votes
1
answer
134
views
Is it possible to clean up this procmail filtering a little
I have this procmail filter which seems to work, but which I'm really not proud of. I'm convinced that we can do much more optimized and clean with nested sections, but I can't achieve any functional ...
-1
votes
1
answer
1k
views
ClamAV detected Win.Virus.Expiro-10004389-0 malware on Ubuntu instance in Conda package
Today clamAV scanned my AWS instances and detect infected files on each. It looks like false positive due to several reasons:
All these files are created in 2021 (why were they detected only
now?)
...
0
votes
0
answers
145
views
ClamAV didn't see virus inside an Archive
/home/folder/clam_daily.sh: OK
/home/folder/.sudo_as_admin_successful: Empty file
/home/folder/.selected_editor: OK
/home/folder/PROTECTAgentInstaller.tar.gz: OK
/home/folder/.bash_logout: OK
/home/...
10
votes
4
answers
7k
views
ClamAV detected Kaiji malware on Ubuntu instance
Today clamAV scanned my AWS instances and detect 24 infected files on each.
It looks like false positive due to several reasons:
All these files are created in October 2022 (why were they detected ...
1
vote
0
answers
686
views
clamav-daemon doesn't create /var/run/clamd.ctl
I installed clamav-daemon on Debian 11 and when I try to start it, it doesn't create the LocalSocket /var/run/clamd.ctl.
LocalSocket in my /etc/clamav/clamd.conf:
LocalSocket /var/run/clamav/clamd....
0
votes
1
answer
129
views
Completely disable temp files/temp directory in ClamAV via clamd.conf
Is there a way to fully disable the temp files/temp directory feature in ClamAV via clamd.conf such that no files are written to disk, even transiently?
0
votes
1
answer
885
views
Large test virus file for ClamAV
I need a test file larger than 10K that will trigger ClamAV
As per Large Virus File with EICAR-Test-Signature not identified by the clamav library , ClamAV will not detect the EICAR test virus when it ...
0
votes
1
answer
362
views
Why does status says it's dead and subsys locked, but it still running without issue?
Whenever I start Amavisd, the reports starting OK, but a status check says it's dead.
$ service amavisd start
Starting amavisd: [ OK ]
$ service amavisd ...
1
vote
1
answer
417
views
What is the default file system for ClamAV scans?
I have just installed ClamAV on a Pi4 running Buster. I have looked at the configuration file and don't see where it specifies which file system it will scan automatically. I know if I use this sudo ...
0
votes
0
answers
634
views
Amavis Configuration on Ubuntu 20.04 / Port 10025 already in use
i try to configure amavis on my ubuntu 20.04 with working postfix and kopano.
Postfix crashes with the following error:
Jan 10 11:23:52 mail postfix/postfix-script[143585]: fatal: cannot execute /usr/...
0
votes
0
answers
900
views
Clamav is very slow with tcp
I'm using clamonacc on my desktop computer and servers. I use a raspberry pi as clamd server. The clamd process only uses ~25% of all 4 cores so with htop I see it's using like ~100% and 400% is the ...
0
votes
1
answer
764
views
clamav - clamd error when setup as daemon (mac osx)
Issue:
Setting up clamav as a daemon process in mac osx throws some cumbersome errors and warnings while doing the setup and the documentation is good, but not perfect. I ran into some permission ...
1
vote
1
answer
955
views
Postfix not accepting recipient address: connect to private/policy: Connection refused
I thought I'd be clever and add amavis/spamassassin/clamav to my working Postfix installation. I got it working and then made a change. Walked away, had a beer, then found out I'd mucked up. This is ...
0
votes
1
answer
260
views
SELinux prevent connection clamd_port_t:tcp_socket
We have API Server (tomcat) which has clamAV configuration to scan any uploaded file to the system.
clamAV configuration will require the API server to connect to clamAV server.
SELinux is enabled on ...
0
votes
1
answer
1k
views
ClamAV cannot access files
I've a server (CentOS 7) with ClamAV installed. clamdscan is running every 12 hours and for some files, I'm always getting the following message:
ClamAV has failed to run. The return error message was:...
0
votes
0
answers
52
views
How does ClamAV secure its updates online?
Two questions, the second related to the first...
How does ClamAV secure its update virus definition operations from its online servers? I will assume (?) that it uses HTTPS for security, but a ...
0
votes
1
answer
1k
views
How it works content_filter in Postfix using spamassassin and clamav ( filtering order )?
How it works content_filter in case where is used spamassassin and clamav ?
Here is example for one content_filter: http://www.postfix.org/FILTER_README.html
And I see that sendmail command cant use ...
0
votes
1
answer
454
views
xlsx extension file blocked in zimbra
So the issue is that i have been trying to send a mail from my server with xlsx file extension attachment but zimbra rejects the mail giving a message content is band
BANNED CONTENTS ALERT
Our ...
0
votes
1
answer
3k
views
ClamD: cannot change socket location
Ubuntu 20.04.2
ClamAV 0.102.4
I want to use a different value for ClamD's LocalSocket directive but keep getting the following error:
!LOCAL: Socket file /var/run/clamd.scan/clamd.sock could not be ...
7
votes
2
answers
10k
views
clamav-daemon start condition failed, /var/lib/clamav/daily.{c[vl]d,inc} was not met
After installing Modoboa(Open Source Mail Hosting), I Tried to start clamav-daemon, but i faced start condition failed.
systemctl status clamav-daemon.service
clamav-daemon.service - Clam ...
0
votes
1
answer
548
views
Cloud bucket malware security
I have implemented an antivirus system using ClamAV on one of my apps which uses Google cloud storage for uploading files. Currently what I am doing is, listening to bucket upload, download it on one ...
0
votes
0
answers
915
views
Clamd using +1GB of memory
I've searched around and few similar questions where it was said that a few 100MB memory is normal for clamd.
Now actually I see it using more than 1GB and recently I have frequently that my system ...
1
vote
1
answer
807
views
Running clamscan with the file list function
I am trying to schedule some tasks using ClamAV but it cannot find the find the file that contains the directories I want it to scan.
*Using sudo doesn't work.
*The files are set with permissions ...
5
votes
2
answers
87
views
avoid redundant writing of virus scan signatures in VMs on same disk [closed]
I have two VMs on the same disk that each have clamav installed. Both regularly run updates for the same virus scan signatures
simultaneously which results in an unnecessary strain on the performance ...
0
votes
1
answer
782
views
ClamAv + Microsoft Azure VM: Cannot connect to daemon from other VM
I got two VMs on Azure that are in the same subnet. One VM (10.1.0.6) has clamav daemon running, the other runs a Java Wildfly Application (10.1.0.5).
I would like to send files from Java Application ...
1
vote
1
answer
993
views
How to speed up clamd@amavisd launch / get it to "start" on Amazon Linux 2
I recently upgraded clamav from I'm not sure which version, but whatever was current on EPEL on February 13th, to 0.102.3. Under the previous version, I had to set TimeoutStartSec in the systemd conf ...
4
votes
1
answer
2k
views
How are systemd/system overrides supposed to work?
I'm messing around with some timeout settings, and am trying to figure out the correct way to set things for systemd/system daemons. Specifically, this is an underpowered server, and I keep timing out ...
2
votes
2
answers
8k
views
Sending a file to a remote clamd instance
I may be misunderstanding how to utilize clamd. I've got a situation where I have a media server that isn't quite powerfull enough to scan files as well as host the other services it is running (...
0
votes
1
answer
533
views
ubuntu 18.04: clamav running, tomcat dying
Ubuntu 18.04. 2Gb RAM + 512mb swap.
When running clamav, it consumes 800+mb of memory because it loads all the signatures into the memory. Because of that, I set it to run every day at 3am instead of ...
2
votes
1
answer
6k
views
Installing clamav on Amazon Linux 2
I have been trying to install clamav on Amazon Linux 2 using the following which works fine on Amazon Linux 1:
curl -O http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
sudo yum ...
1
vote
2
answers
2k
views
Why does calling HEAD on this URL prevent the following error: ERROR: Message: SSL peer certificate or SSH remote key was not OK
This is an issue I'm having with a specific package but it looks like the software is using a version of CURL for windows or something. I want to understand this specific behavior because it doesnt ...
1
vote
1
answer
6k
views
Clamav on Centos 8 installation
I have installed ClamAV on Centos 8, following the installation guide on their website.
I have run freshclam and that works fine but if I try to do a scan I get the following error:
clamdscan /home
...
2
votes
3
answers
6k
views
clamav "killed" with no explanation
On a Debian 10 server I have this problem with clamav:
root@vps:~# clamscan -r -v --stdout /
Killed
You see I use the verbose flag but that does not give me any information. In years of using clam ...
3
votes
1
answer
2k
views
Large Virus File with EICAR-Test-Signature not identified by the clamav library
If I add the Eicar Test Signature at the beginning of a large text file, will that file turn out to be malicious? I opened a 5 MB binary file on Sublime Text and added the signatue at the beginning. ...
2
votes
0
answers
1k
views
ClamAV for the host running docker containers - inotify/fanotify limits
I'm implementing anti-virus solution for Linux with ClamAV daemon running in On-Access mode, watching the created/opened files for malicious content at the host system AND in docker containers, ...
0
votes
3
answers
780
views
Can I use Ansible to get a version number from clamAV
I am new to Ansible and googleing around i see how to install ClamAV using Ansible , but is there a way to just get the current version , I know I could just run it remotely via ssh
0
votes
1
answer
3k
views
Your ClamAV installation is OUTDATED
I'm running Vesta on Centos 7 and recently I've got this error.
server#: freshclam
current working dir is /var/lib/clamav
ClamAV update process started at Fri Dec 13 12:36:40 2019
Using IPv6 aware ...
0
votes
0
answers
46
views
clamd on several ports with different databases
Is it possible to run a clamd on one machine with different ports and each of them hold another database?
3310 = official databases
3311 = unofficial databases
3312 = yara rules
p.s. CentOS 6/7
0
votes
1
answer
155
views
Postfix (Maia Mailguard) relayhost update ignored
I have a postfix mail server used in conjunction with Maia Mailguard, Amavis, and clamav for spam. I've upgraded the primary mail server and it has a new IP address. I change main.cf and transport to ...
0
votes
0
answers
1k
views
ClamAV can't open/parse
I installed clamAV on an EC2 instance running CentOS, i made the install and when I go to run 'sudo freshclam' i get
ERROR: Can't open/parse the config file /usr/local/etc/freshclam.conf
However if ...
0
votes
0
answers
356
views
ClamAV Anti-Virus not Classifying Virus Emails as Virus
I have installed Sendmail as my SMTP mail server, SpamAssassin as Spam Classifier and ClamAV Anti-Virus. I tested out sending my server a virus email eicar.txt
Now I am receiving the virus email in ...
0
votes
2
answers
2k
views
clamd socket error in conjunction with amavisd (used for postfix) on CentOS 7
I can't seem to figure out a problem after a few hours of trouble-shooting and looking for similar cases.
Like ohter email servers in the exact same configuration, the affected one is based on CentOS ...
7
votes
3
answers
22k
views
How to make `clamdscan` exclude folders and only log `--infected`?
My server is centos 7.4, with clamav 0.101.1-1.el7.
When I run clamscan -r --infected --exclude-dir="^/sys" / through terminal, I always wait more than 6 hours to get output.
And if I close ...
0
votes
1
answer
211
views
Should `clamav-devel`, ` clamav-server-systemd`,`clamav-server` be installed if I only manual scan folder in one server?
In lots of how to install clamav in centos 7tutorial, all modules are installed,such like yum install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-...
1
vote
1
answer
2k
views
Send mail when ClamAV detects a threat using systemd
Most of the guides for ClamAV discuss integration with syslog, and it is possible to configure syslog to send a message on certain logs. But, my system is running systemd, with no active syslog....
0
votes
1
answer
2k
views
MailScanner error "Cannot find Socket"
CentOS 7, mail server. Messages stopped going in and out. Tried to debug, saw this in /var/log/maillog:
MailScanner[4786]: Cannot find Socket (/var/run/clamd.scan/clamd.sock) Exiting!
But the socket ...