Questions tagged [clamav]
Antivirus for UNIX-like systems primarily for mailserver integration.
163
questions
2
votes
2
answers
391
views
Debian 12: can't get ClamAV to listen on TCP 3310
ClamAV seems to have a bug on Debian 12 (bookworm) making it difficult to get it listening on TCP 3310.
I tried the two approaches described in
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=...
-1
votes
1
answer
1k
views
ClamAV detected Win.Virus.Expiro-10004389-0 malware on Ubuntu instance in Conda package
Today clamAV scanned my AWS instances and detect infected files on each. It looks like false positive due to several reasons:
All these files are created in 2021 (why were they detected only
now?)
...
31
votes
3
answers
58k
views
How should I test Clam Anti-Virus?
I have setup a new email server and now I need to test that Clam Antivirus is scanning messages correctly.
How should I do this in a safe and controlled way?
7
votes
4
answers
12k
views
Is it possible to check the progress of of a currently running clamAV scan?
I have searched around but not found a possible solution to this so far.
I have an ongoing scan which I thought would've been finished at certain time, but unfortunately it has not. So I am wondering ...
4
votes
1
answer
376
views
How to make clamassassin prepend the X-Virus-* headers instead of appending them?
The email virus filter wrapper for ClamAV, clamassassin, appends its headers to the message headers.
X-Virus-Status: No
X-Virus-Checker-Version: clamassassin 1.2.4 with clamscan / ClamAV 1.0.3/27134/...
0
votes
0
answers
53
views
clamdscan returns "Clamav Daemon cannot be started" but clamd is running
I am using clamdscan to scan files uploaded to a website. If I run clamdscan from the command line it works fine. However, if I call from a PHP script it throws an exception:
App\Util\Exception\...
1
vote
0
answers
345
views
How to change ClamAV update repo? Error: "Your ClamAV installation is OUTDATED!"
I am running a Debian 11 bullseye server and every now and then clamav tells me that I am not using the current version. :
The ClamAV update process was started 25 time(s)
Last ClamAV update ...
0
votes
1
answer
136
views
Is it possible to clean up this procmail filtering a little
I have this procmail filter which seems to work, but which I'm really not proud of. I'm convinced that we can do much more optimized and clean with nested sections, but I can't achieve any functional ...
7
votes
2
answers
10k
views
clamav-daemon start condition failed, /var/lib/clamav/daily.{c[vl]d,inc} was not met
After installing Modoboa(Open Source Mail Hosting), I Tried to start clamav-daemon, but i faced start condition failed.
systemctl status clamav-daemon.service
clamav-daemon.service - Clam ...
2
votes
3
answers
6k
views
clamav "killed" with no explanation
On a Debian 10 server I have this problem with clamav:
root@vps:~# clamscan -r -v --stdout /
Killed
You see I use the verbose flag but that does not give me any information. In years of using clam ...
0
votes
0
answers
147
views
ClamAV didn't see virus inside an Archive
/home/folder/clam_daily.sh: OK
/home/folder/.sudo_as_admin_successful: Empty file
/home/folder/.selected_editor: OK
/home/folder/PROTECTAgentInstaller.tar.gz: OK
/home/folder/.bash_logout: OK
/home/...
10
votes
4
answers
7k
views
ClamAV detected Kaiji malware on Ubuntu instance
Today clamAV scanned my AWS instances and detect 24 infected files on each.
It looks like false positive due to several reasons:
All these files are created in October 2022 (why were they detected ...
4
votes
3
answers
17k
views
Where is ClamAV quarantine folder?
I want to restore some files from quarantine after I have executed clamscan some times. But I cannot find the quarantine folder in the configuration.
How should I find the address of the quarantined ...
2
votes
2
answers
8k
views
Sending a file to a remote clamd instance
I may be misunderstanding how to utilize clamd. I've got a situation where I have a media server that isn't quite powerfull enough to scan files as well as host the other services it is running (...
1
vote
0
answers
697
views
clamav-daemon doesn't create /var/run/clamd.ctl
I installed clamav-daemon on Debian 11 and when I try to start it, it doesn't create the LocalSocket /var/run/clamd.ctl.
LocalSocket in my /etc/clamav/clamd.conf:
LocalSocket /var/run/clamav/clamd....
0
votes
1
answer
134
views
Completely disable temp files/temp directory in ClamAV via clamd.conf
Is there a way to fully disable the temp files/temp directory feature in ClamAV via clamd.conf such that no files are written to disk, even transiently?
4
votes
1
answer
2k
views
How do I configure MailScanner to use a remote clamd?
I decided to decrease the workload on my mail gateway by moving anti-virus processing to a separate server. I created the server, installed clamav-daemon on it, and tested it by running clamdscan from ...
0
votes
1
answer
3k
views
ClamD: cannot change socket location
Ubuntu 20.04.2
ClamAV 0.102.4
I want to use a different value for ClamD's LocalSocket directive but keep getting the following error:
!LOCAL: Socket file /var/run/clamd.scan/clamd.sock could not be ...
7
votes
3
answers
22k
views
How to make `clamdscan` exclude folders and only log `--infected`?
My server is centos 7.4, with clamav 0.101.1-1.el7.
When I run clamscan -r --infected --exclude-dir="^/sys" / through terminal, I always wait more than 6 hours to get output.
And if I close ...
0
votes
1
answer
911
views
Large test virus file for ClamAV
I need a test file larger than 10K that will trigger ClamAV
As per Large Virus File with EICAR-Test-Signature not identified by the clamav library , ClamAV will not detect the EICAR test virus when it ...
0
votes
1
answer
2k
views
clamd.amavisd Fails to start on CentOS
I have set up a CentOS cloud server but I am having issues getting clamd amavisd to run, when I call:
/etc/init.d/clamd.amavisd start
I get the following error:
Starting clamd.amavisd: /etc/init....
0
votes
2
answers
10k
views
CLAMAV on Centos Mail Server: Can't connect to UNIX socket clamd.sock
In my Centos 6.4 server, I am using Postfix and Dovecot with Amavis/ClamAV filter. Lately I have been trying to solve my spam problem(only occurs in Gmail and Hotmail) so I've been tailing logs.
...
0
votes
1
answer
365
views
Why does status says it's dead and subsys locked, but it still running without issue?
Whenever I start Amavisd, the reports starting OK, but a status check says it's dead.
$ service amavisd start
Starting amavisd: [ OK ]
$ service amavisd ...
1
vote
1
answer
425
views
What is the default file system for ClamAV scans?
I have just installed ClamAV on a Pi4 running Buster. I have looked at the configuration file and don't see where it specifies which file system it will scan automatically. I know if I use this sudo ...
6
votes
6
answers
21k
views
Debian 8: can't get ClamAV to listen on TCP 3310
I am trying to get Clamav-daemon running on a Debian 8 system so that it will listen on TCP port 3310. I have done the following:
aptitude install clamav-daemon
Then modified /etc/clamav/clamd.conf ...
0
votes
0
answers
640
views
Amavis Configuration on Ubuntu 20.04 / Port 10025 already in use
i try to configure amavis on my ubuntu 20.04 with working postfix and kopano.
Postfix crashes with the following error:
Jan 10 11:23:52 mail postfix/postfix-script[143585]: fatal: cannot execute /usr/...
3
votes
2
answers
493
views
Process 'clamd' "not monitored"
the output of monit summary says clamav is not monitored.
The configuration says:
check process clamd with pidfile /var/run/clamav/clamd.pid
start program = "/etc/init.d/clamav-daemon start"
...
1
vote
2
answers
2k
views
Why does calling HEAD on this URL prevent the following error: ERROR: Message: SSL peer certificate or SSH remote key was not OK
This is an issue I'm having with a specific package but it looks like the software is using a version of CURL for windows or something. I want to understand this specific behavior because it doesnt ...
0
votes
0
answers
904
views
Clamav is very slow with tcp
I'm using clamonacc on my desktop computer and servers. I use a raspberry pi as clamd server. The clamd process only uses ~25% of all 4 cores so with htop I see it's using like ~100% and 400% is the ...
0
votes
1
answer
772
views
clamav - clamd error when setup as daemon (mac osx)
Issue:
Setting up clamav as a daemon process in mac osx throws some cumbersome errors and warnings while doing the setup and the documentation is good, but not perfect. I ran into some permission ...
1
vote
1
answer
969
views
Postfix not accepting recipient address: connect to private/policy: Connection refused
I thought I'd be clever and add amavis/spamassassin/clamav to my working Postfix installation. I got it working and then made a change. Walked away, had a beer, then found out I'd mucked up. This is ...
0
votes
1
answer
273
views
SELinux prevent connection clamd_port_t:tcp_socket
We have API Server (tomcat) which has clamAV configuration to scan any uploaded file to the system.
clamAV configuration will require the API server to connect to clamAV server.
SELinux is enabled on ...
9
votes
8
answers
20k
views
Is it safe to disable clamd?
Clamd is taking up about 5% of my memory (2GB) on my dedicated server (running linux) and I'm wondering if I can disable it without any security risks.
The server just hosts a few of my own websites. ...
0
votes
1
answer
1k
views
ClamAV cannot access files
I've a server (CentOS 7) with ClamAV installed. clamdscan is running every 12 hours and for some files, I'm always getting the following message:
ClamAV has failed to run. The return error message was:...
0
votes
0
answers
53
views
How does ClamAV secure its updates online?
Two questions, the second related to the first...
How does ClamAV secure its update virus definition operations from its online servers? I will assume (?) that it uses HTTPS for security, but a ...
0
votes
1
answer
456
views
xlsx extension file blocked in zimbra
So the issue is that i have been trying to send a mail from my server with xlsx file extension attachment but zimbra rejects the mail giving a message content is band
BANNED CONTENTS ALERT
Our ...
0
votes
1
answer
1k
views
How it works content_filter in Postfix using spamassassin and clamav ( filtering order )?
How it works content_filter in case where is used spamassassin and clamav ?
Here is example for one content_filter: http://www.postfix.org/FILTER_README.html
And I see that sendmail command cant use ...
1
vote
1
answer
4k
views
Connection refused by AMAVISD-NEW
I found here many information to set a AWS server on my own.
I installed the DKIM patch and it's work great, but now I can't send mails.
I had already problems sending mails, but now are deeper.
Some ...
-1
votes
2
answers
5k
views
run_av (ClamAV-clamd) and ClamAV-clamd av-scanner FAILED - unexpected
I get a strange error when scanning email.
Sep 17 15:13:26 mail amavis[616]: (00616-02) (!)run_av (ClamAV-clamd) FAILED - unexpected , output="/var/lib/amavis/tmp/amavis-20140917T141903-00616-...
0
votes
1
answer
553
views
Cloud bucket malware security
I have implemented an antivirus system using ClamAV on one of my apps which uses Google cloud storage for uploading files. Currently what I am doing is, listening to bucket upload, download it on one ...
0
votes
0
answers
920
views
Clamd using +1GB of memory
I've searched around and few similar questions where it was said that a few 100MB memory is normal for clamd.
Now actually I see it using more than 1GB and recently I have frequently that my system ...
5
votes
1
answer
2k
views
Squid + ClamAV + i-cap: Scanning proxy for uploaded files?
I'm trying to configure a virus scanning proxy server specifically to scan files being uploaded. Scanning flies being downloaded seems to be the common use case, and seems to be well documented.
Not ...
1
vote
1
answer
817
views
Running clamscan with the file list function
I am trying to schedule some tasks using ClamAV but it cannot find the find the file that contains the directories I want it to scan.
*Using sudo doesn't work.
*The files are set with permissions ...
-2
votes
2
answers
1k
views
Setup spammassin and clamav with Exim on ubuntu 16.04
I've been searching for help in setting up Spammassassin and ClamAV with Exim (on ubuntu-16.04), but all the guides are horribly out of date. Could anyone share their setup please?
5
votes
2
answers
88
views
avoid redundant writing of virus scan signatures in VMs on same disk [closed]
I have two VMs on the same disk that each have clamav installed. Both regularly run updates for the same virus scan signatures
simultaneously which results in an unnecessary strain on the performance ...
0
votes
1
answer
784
views
ClamAv + Microsoft Azure VM: Cannot connect to daemon from other VM
I got two VMs on Azure that are in the same subnet. One VM (10.1.0.6) has clamav daemon running, the other runs a Java Wildfly Application (10.1.0.5).
I would like to send files from Java Application ...
4
votes
1
answer
2k
views
How are systemd/system overrides supposed to work?
I'm messing around with some timeout settings, and am trying to figure out the correct way to set things for systemd/system daemons. Specifically, this is an underpowered server, and I keep timing out ...
1
vote
1
answer
1k
views
How to speed up clamd@amavisd launch / get it to "start" on Amazon Linux 2
I recently upgraded clamav from I'm not sure which version, but whatever was current on EPEL on February 13th, to 0.102.3. Under the previous version, I had to set TimeoutStartSec in the systemd conf ...
0
votes
3
answers
3k
views
enable fanotify on oracle redhat linux kernel 2.6.39-400
As a newbie in linux environment, I am trying to install clamav daemon, which is clamd, on oracle redhat linux 6 kernel EUK 2.6.39-400. It needs to have fanotify enabled in the kernel. As I see there ...
6
votes
3
answers
11k
views
How to scan multiple directories with clamav
I know how to scan one directory:
clamscan -r /home
but for the life of me I cannot seem to get multiple directories working and I cannot seem to Google this simple problem.
I have tried:
clamscan ...