Questions tagged [clamav]

Antivirus for UNIX-like systems primarily for mailserver integration.

Filter by
Sorted by
Tagged with
2 votes
2 answers
391 views

Debian 12: can't get ClamAV to listen on TCP 3310

ClamAV seems to have a bug on Debian 12 (bookworm) making it difficult to get it listening on TCP 3310. I tried the two approaches described in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=...
-1 votes
1 answer
1k views

ClamAV detected Win.Virus.Expiro-10004389-0 malware on Ubuntu instance in Conda package

Today clamAV scanned my AWS instances and detect infected files on each. It looks like false positive due to several reasons: All these files are created in 2021 (why were they detected only now?) ...
31 votes
3 answers
58k views

How should I test Clam Anti-Virus?

I have setup a new email server and now I need to test that Clam Antivirus is scanning messages correctly. How should I do this in a safe and controlled way?
7 votes
4 answers
12k views

Is it possible to check the progress of of a currently running clamAV scan?

I have searched around but not found a possible solution to this so far. I have an ongoing scan which I thought would've been finished at certain time, but unfortunately it has not. So I am wondering ...
4 votes
1 answer
376 views

How to make clamassassin prepend the X-Virus-* headers instead of appending them?

The email virus filter wrapper for ClamAV, clamassassin, appends its headers to the message headers. X-Virus-Status: No X-Virus-Checker-Version: clamassassin 1.2.4 with clamscan / ClamAV 1.0.3/27134/...
0 votes
0 answers
53 views

clamdscan returns "Clamav Daemon cannot be started" but clamd is running

I am using clamdscan to scan files uploaded to a website. If I run clamdscan from the command line it works fine. However, if I call from a PHP script it throws an exception: App\Util\Exception\...
1 vote
0 answers
345 views

How to change ClamAV update repo? Error: "Your ClamAV installation is OUTDATED!"

I am running a Debian 11 bullseye server and every now and then clamav tells me that I am not using the current version. : The ClamAV update process was started 25 time(s) Last ClamAV update ...
0 votes
1 answer
136 views

Is it possible to clean up this procmail filtering a little

I have this procmail filter which seems to work, but which I'm really not proud of. I'm convinced that we can do much more optimized and clean with nested sections, but I can't achieve any functional ...
7 votes
2 answers
10k views

clamav-daemon start condition failed, /var/lib/clamav/daily.{c[vl]d,inc} was not met

After installing Modoboa(Open Source Mail Hosting), I Tried to start clamav-daemon, but i faced start condition failed. systemctl status clamav-daemon.service clamav-daemon.service - Clam ...
2 votes
3 answers
6k views

clamav "killed" with no explanation

On a Debian 10 server I have this problem with clamav: root@vps:~# clamscan -r -v --stdout / Killed You see I use the verbose flag but that does not give me any information. In years of using clam ...
0 votes
0 answers
147 views

ClamAV didn't see virus inside an Archive

/home/folder/clam_daily.sh: OK /home/folder/.sudo_as_admin_successful: Empty file /home/folder/.selected_editor: OK /home/folder/PROTECTAgentInstaller.tar.gz: OK /home/folder/.bash_logout: OK /home/...
10 votes
4 answers
7k views

ClamAV detected Kaiji malware on Ubuntu instance

Today clamAV scanned my AWS instances and detect 24 infected files on each. It looks like false positive due to several reasons: All these files are created in October 2022 (why were they detected ...
4 votes
3 answers
17k views

Where is ClamAV quarantine folder?

I want to restore some files from quarantine after I have executed clamscan some times. But I cannot find the quarantine folder in the configuration. How should I find the address of the quarantined ...
2 votes
2 answers
8k views

Sending a file to a remote clamd instance

I may be misunderstanding how to utilize clamd. I've got a situation where I have a media server that isn't quite powerfull enough to scan files as well as host the other services it is running (...
1 vote
0 answers
697 views

clamav-daemon doesn't create /var/run/clamd.ctl

I installed clamav-daemon on Debian 11 and when I try to start it, it doesn't create the LocalSocket /var/run/clamd.ctl. LocalSocket in my /etc/clamav/clamd.conf: LocalSocket /var/run/clamav/clamd....
0 votes
1 answer
134 views

Completely disable temp files/temp directory in ClamAV via clamd.conf

Is there a way to fully disable the temp files/temp directory feature in ClamAV via clamd.conf such that no files are written to disk, even transiently?
4 votes
1 answer
2k views

How do I configure MailScanner to use a remote clamd?

I decided to decrease the workload on my mail gateway by moving anti-virus processing to a separate server. I created the server, installed clamav-daemon on it, and tested it by running clamdscan from ...
0 votes
1 answer
3k views

ClamD: cannot change socket location

Ubuntu 20.04.2 ClamAV 0.102.4 I want to use a different value for ClamD's LocalSocket directive but keep getting the following error: !LOCAL: Socket file /var/run/clamd.scan/clamd.sock could not be ...
7 votes
3 answers
22k views

How to make `clamdscan` exclude folders and only log `--infected`?

My server is centos 7.4, with clamav 0.101.1-1.el7. When I run clamscan -r --infected --exclude-dir="^/sys" / through terminal, I always wait more than 6 hours to get output. And if I close ...
0 votes
1 answer
911 views

Large test virus file for ClamAV

I need a test file larger than 10K that will trigger ClamAV As per Large Virus File with EICAR-Test-Signature not identified by the clamav library , ClamAV will not detect the EICAR test virus when it ...
0 votes
1 answer
2k views

clamd.amavisd Fails to start on CentOS

I have set up a CentOS cloud server but I am having issues getting clamd amavisd to run, when I call: /etc/init.d/clamd.amavisd start I get the following error: Starting clamd.amavisd: /etc/init....
0 votes
2 answers
10k views

CLAMAV on Centos Mail Server: Can't connect to UNIX socket clamd.sock

In my Centos 6.4 server, I am using Postfix and Dovecot with Amavis/ClamAV filter. Lately I have been trying to solve my spam problem(only occurs in Gmail and Hotmail) so I've been tailing logs. ...
0 votes
1 answer
365 views

Why does status says it's dead and subsys locked, but it still running without issue?

Whenever I start Amavisd, the reports starting OK, but a status check says it's dead. $ service amavisd start Starting amavisd: [ OK ] $ service amavisd ...
1 vote
1 answer
425 views

What is the default file system for ClamAV scans?

I have just installed ClamAV on a Pi4 running Buster. I have looked at the configuration file and don't see where it specifies which file system it will scan automatically. I know if I use this sudo ...
6 votes
6 answers
21k views

Debian 8: can't get ClamAV to listen on TCP 3310

I am trying to get Clamav-daemon running on a Debian 8 system so that it will listen on TCP port 3310. I have done the following: aptitude install clamav-daemon Then modified /etc/clamav/clamd.conf ...
0 votes
0 answers
640 views

Amavis Configuration on Ubuntu 20.04 / Port 10025 already in use

i try to configure amavis on my ubuntu 20.04 with working postfix and kopano. Postfix crashes with the following error: Jan 10 11:23:52 mail postfix/postfix-script[143585]: fatal: cannot execute /usr/...
3 votes
2 answers
493 views

Process 'clamd' "not monitored"

the output of monit summary says clamav is not monitored. The configuration says: check process clamd with pidfile /var/run/clamav/clamd.pid start program = "/etc/init.d/clamav-daemon start" ...
1 vote
2 answers
2k views

Why does calling HEAD on this URL prevent the following error: ERROR: Message: SSL peer certificate or SSH remote key was not OK

This is an issue I'm having with a specific package but it looks like the software is using a version of CURL for windows or something. I want to understand this specific behavior because it doesnt ...
0 votes
0 answers
904 views

Clamav is very slow with tcp

I'm using clamonacc on my desktop computer and servers. I use a raspberry pi as clamd server. The clamd process only uses ~25% of all 4 cores so with htop I see it's using like ~100% and 400% is the ...
0 votes
1 answer
772 views

clamav - clamd error when setup as daemon (mac osx)

Issue: Setting up clamav as a daemon process in mac osx throws some cumbersome errors and warnings while doing the setup and the documentation is good, but not perfect. I ran into some permission ...
1 vote
1 answer
969 views

Postfix not accepting recipient address: connect to private/policy: Connection refused

I thought I'd be clever and add amavis/spamassassin/clamav to my working Postfix installation. I got it working and then made a change. Walked away, had a beer, then found out I'd mucked up. This is ...
0 votes
1 answer
273 views

SELinux prevent connection clamd_port_t:tcp_socket

We have API Server (tomcat) which has clamAV configuration to scan any uploaded file to the system. clamAV configuration will require the API server to connect to clamAV server. SELinux is enabled on ...
9 votes
8 answers
20k views

Is it safe to disable clamd?

Clamd is taking up about 5% of my memory (2GB) on my dedicated server (running linux) and I'm wondering if I can disable it without any security risks. The server just hosts a few of my own websites. ...
0 votes
1 answer
1k views

ClamAV cannot access files

I've a server (CentOS 7) with ClamAV installed. clamdscan is running every 12 hours and for some files, I'm always getting the following message: ClamAV has failed to run. The return error message was:...
0 votes
0 answers
53 views

How does ClamAV secure its updates online?

Two questions, the second related to the first... How does ClamAV secure its update virus definition operations from its online servers? I will assume (?) that it uses HTTPS for security, but a ...
0 votes
1 answer
456 views

xlsx extension file blocked in zimbra

So the issue is that i have been trying to send a mail from my server with xlsx file extension attachment but zimbra rejects the mail giving a message content is band BANNED CONTENTS ALERT Our ...
0 votes
1 answer
1k views

How it works content_filter in Postfix using spamassassin and clamav ( filtering order )?

How it works content_filter in case where is used spamassassin and clamav ? Here is example for one content_filter: http://www.postfix.org/FILTER_README.html And I see that sendmail command cant use ...
1 vote
1 answer
4k views

Connection refused by AMAVISD-NEW

I found here many information to set a AWS server on my own. I installed the DKIM patch and it's work great, but now I can't send mails. I had already problems sending mails, but now are deeper. Some ...
-1 votes
2 answers
5k views

run_av (ClamAV-clamd) and ClamAV-clamd av-scanner FAILED - unexpected

I get a strange error when scanning email. Sep 17 15:13:26 mail amavis[616]: (00616-02) (!)run_av (ClamAV-clamd) FAILED - unexpected , output="/var/lib/amavis/tmp/amavis-20140917T141903-00616-...
0 votes
1 answer
553 views

Cloud bucket malware security

I have implemented an antivirus system using ClamAV on one of my apps which uses Google cloud storage for uploading files. Currently what I am doing is, listening to bucket upload, download it on one ...
0 votes
0 answers
920 views

Clamd using +1GB of memory

I've searched around and few similar questions where it was said that a few 100MB memory is normal for clamd. Now actually I see it using more than 1GB and recently I have frequently that my system ...
5 votes
1 answer
2k views

Squid + ClamAV + i-cap: Scanning proxy for uploaded files?

I'm trying to configure a virus scanning proxy server specifically to scan files being uploaded. Scanning flies being downloaded seems to be the common use case, and seems to be well documented. Not ...
1 vote
1 answer
817 views

Running clamscan with the file list function

I am trying to schedule some tasks using ClamAV but it cannot find the find the file that contains the directories I want it to scan.   *Using sudo doesn't work.   *The files are set with permissions ...
-2 votes
2 answers
1k views

Setup spammassin and clamav with Exim on ubuntu 16.04

I've been searching for help in setting up Spammassassin and ClamAV with Exim (on ubuntu-16.04), but all the guides are horribly out of date. Could anyone share their setup please?
5 votes
2 answers
88 views

avoid redundant writing of virus scan signatures in VMs on same disk [closed]

I have two VMs on the same disk that each have clamav installed. Both regularly run updates for the same virus scan signatures simultaneously which results in an unnecessary strain on the performance ...
0 votes
1 answer
784 views

ClamAv + Microsoft Azure VM: Cannot connect to daemon from other VM

I got two VMs on Azure that are in the same subnet. One VM (10.1.0.6) has clamav daemon running, the other runs a Java Wildfly Application (10.1.0.5). I would like to send files from Java Application ...
4 votes
1 answer
2k views

How are systemd/system overrides supposed to work?

I'm messing around with some timeout settings, and am trying to figure out the correct way to set things for systemd/system daemons. Specifically, this is an underpowered server, and I keep timing out ...
1 vote
1 answer
1k views

How to speed up clamd@amavisd launch / get it to "start" on Amazon Linux 2

I recently upgraded clamav from I'm not sure which version, but whatever was current on EPEL on February 13th, to 0.102.3. Under the previous version, I had to set TimeoutStartSec in the systemd conf ...
0 votes
3 answers
3k views

enable fanotify on oracle redhat linux kernel 2.6.39-400

As a newbie in linux environment, I am trying to install clamav daemon, which is clamd, on oracle redhat linux 6 kernel EUK 2.6.39-400. It needs to have fanotify enabled in the kernel. As I see there ...
6 votes
3 answers
11k views

How to scan multiple directories with clamav

I know how to scan one directory: clamscan -r /home but for the life of me I cannot seem to get multiple directories working and I cannot seem to Google this simple problem. I have tried: clamscan ...