Hot answers tagged clamav
10
First, if there's a rootkit, you're probably fighting a neverending fight. Take the server offline and reinstall and restore backups that are pre-infection. That's the "best" method of fixing.
Second, were you up to date on patches and such before the infection or did you patch after?
Third, what custom code is running on the server outside Plesk? How do ...
6
For a public facing server, I would say installing something like tripwire is not overkill.
ClamAV is a different matter. I would consider setting that up that if your visitors will be sharing files by uploading to, and downloading from, your website. PDFs can contain exploits.
On public facing servers, I have SSH not allow password authentication, only ...
5
Just send an email with the eicar test file attached. This file has a signature which any virus scanner should know and detect.
As for the monitoring of the clamd process itself, there are many possibilities. I personally prefer using monit for it.
5
The easiest way would be to us an EICAR test file. Create a text file and add in the following code:
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
More information here
4
Why not setup some sort of virtual machine and use snapshots to reset their machines regularly? This way any viri/trojans that get past the AV can be wiped out easily.
There is also more specialised software to do this aimed more at libraries/internet cafes if you want to take the idea further.
4
A few comments and things you can check:
I don't see anything obviously wrong in the log you posted. What makes you think the last line in the log is an issue?
Near 100% RAM utilization is actually a good thing in general. What you don't want to happen, though, is begin to use swap space which will kill your server's performance pretty quickly and may be ...
3
The defaut /etc/clamd.comnf (or equivalent on your distribution) should be fine. On CentOs, the antivirus (clamav), the update (clamav-db alais freshclam), and the deamon (clamd) are different packages.
/etc/freshclam.conf use the default 12 update checks a day.
Then, you need to figure out what you actually want to do with your AV: system-wide scan, ...
3
To use clamav in Debian squeeze you need to start by installing the exim4-daemon-heavy package instead of the default exim4-daemon-light version, the heavy daemon was compiled with more functionality including the ability to link into clamav. Just do an apt-get install exim4-daemon-heavy, it won't change much, and pretty safe to run.
After you have that ...
3
There is no generic approach - it's all hands-on. You typically would need to have configured extensive logging, preferably not only from the system you are inspecting but also from an independent IDS, which you are periodically archiving. Also, a good bunch of experience with computer security and forensics is required, otherwise you don't stand a chance.
...
3
Directory permissions on /var/spool/exim4/scan should be 750, and owned by the exim user and its primary group (on my FreeBSD systems, these are mailnull and mail, respectively).
If your clamav user has Debian-exim as a supplementary group - that is, if Debian-exim is not its primary group, then you need "AllowSupplementaryGroups yes" in your clamd.conf ...
3
try starting the server and then immediately log in and run top then press M (being actually a capital M to sort by memory usage) and watch your resources.
You should see your swap at 0 bytes used and your memory free either fully used as linux can use sometimes or little under but mainly watch the top of the light of processes consuming memory.
You should ...
3
Nope, you didn't go far enough.
1)You need a web application firewall like mod_security and make sure its configured to block attacks, not just log them.
2)Lock down php with phpsecinfo.
3)Lock down your web application's MySQL account, make sure your application doesn't have FILE privileges, its by far the most dangerous one in MySQL.
4)Firewall ...
3
You may want to check on the version of your ClamAV. Recently they stopped providing updated db files to version 0.94, so when your freshclam (the part that updates the definitions db) goes to download the update, instead of the expected result, if receives the error message, which may not play well with your freshclam and it tries to re-download the updates ...
3
Based on your real goal (I am building a web app where my user will be able to upload epubs files and I want to make sure they are no executable files.) ClamAV is probably overkill for your needs.
You can use the file utility (or various APIs that hook the same database of magic data) to determine what kind of file the user is trying to upload, and reject ...
2
NOTE: You should immediately consult a Linux system security professional regarding your question as your system may be compromised.
This looks like your system is likely compromised in some way.
The folder described is presenting itself as a Linux "dot file". "Dot files" are usually used to store configuration data for programs, however, as you see in ...
2
"Welcome aboard! On board of our new airliner you can enjoy restaurant, cinema, gym, sauna and swimming pool. Now fasten your seat belts, our captain is going to try to get all this shit airborne."
mod_security is a pain for both you and server. It's resources hungry and its rules need serious maintaining and it's going to be a neverending task. And no, it ...
2
You can probably safely install AIDE on a web server - adding and removing customers doesn't change too many configuration files, and you could probably filter out the normal chatter pretty easily.
But something that a lot of web server security guides don't mention is that you should turn noexec on on your /tmp partition in /etc/fstab. If you're offering ...
2
My view is that 5% is trivial. If your web server actually needs all 2GB of RAM and you really can't spare that 5% you should be looking elsewhere for improvements and not jumping on clamd. ClamAV will detect some non-virus malware, which is not included in the claim that there are no Linux viruses (yet).
Another consideration is email, regardless of the ...
2
if you installed clamav from the repository, using yum, then the scripts should have been installed and configured, when you installed the package.
you can do something like ln -s /etc/init.d/clamd /etc/rc3.d/S90clamd, or, like you said, using chkconfig
but again, if you installed from a package, all this should have been done for you.
2
There was a mismatch between the antivirus database directories used by freshclam and clamd. The /etc/freshclam.conf settingDatabaseDirectory was apparently pointing to /var/lib/clamav (which is default for the package), but the corresponding setting in /etc/clamd.conf was pointing to /usr/share/clamav. This mismatch may have been because the OP had ...
2
We have seen this on plesk 9.5 servers despite having Parallel's security patches installed from February.
Basically they are POSTing to the login page and getting in without auth, then going straight for the WYSIWYG file manager and appending the code to js files. Plesk are refusing to acknowledge this and the only option is to firewall plesk off and ...
2
In addition to SpamAssassin use amavisd-new and MailZu. This way you get easily manageable per-user SpamAssassin settings and a personal quarantine for each user which they can browse & manage over the web interface.
1
ClamAV doesn't do well in many tests of antivirus (percentage detected) - better to find a commercial antivirus with Linux version that has good ratings on independent tests. See http://www.av-comparatives.org/en/comparativesreviews - however http://www.shadowserver.org/wiki/pmwiki.php/Stats/VirusYearlyStats shows it's in about the middle of the pack.
...
1
(Converting my comment on question into an answer as it seemed to work - hope that's OK.)
Try killall clamscan, then stop whatever is starting those processes. The "D" under the S column means the processes are in "uninterruptible sleep" which could be due to various reasons but is probably due to paging to/from swap as your memory and swap space are ...
1
We use clamav as the standard scanner for linux. We update the signatures every hour and each clamav server polls the signature updates from a local installserver.
Since this is almost the last security line and we are in a well protected environment we never ever did see a real virus. But I have no doubt that clamav will do the job (we did some tests with ...
1
The technical feasibility of the setup put aside, you should abandon the thought that a virus scanner is going to bring you any kind of certainty of having malware-free data. Any virus scanner is only going to scan for the most visible and known malware patterns. Thus, a scanner can only be an "annoyance reducing facility", not a security measure.
That ...
1
Generally, 32bit systems will have trouble dealing with files larger than 2GB, however, having the download capped at 50MB would suggest ClamAV is at fault.
Couple of suggestions;
1) Ensure Squid has been compiled with '--with-large-files'
2) Test the download locally on the box using curl or wget (rules out browser/network issue)
3) Try increasing the ...
1
This sounds like your passwords have been leaked out some time ago and now are being used to install trojan dropper scripts. See following this and this for more detail.
1
After a couple of horror weeks loosing clients and being re-infected we received this reply from technical support at Parallels:
Please note that all of the vulnerability issues reported over the
Internet or our forums actually trace back to an old vulnerability in
Plesk, which is fully described in the following KB article:
...
1
If you're very new to this then the main metric you want to look at is the load average. Use the uptime command to display load average.
E.g.:
$ uptime
10:57 up 4 days, 23:25, 5 users, load averages: 0.56 0.58 0.53
The load average is displayed in 1, 5, and 15 minute averages. If the 1 minute average (i.e., the one on the left) is less then the number ...
Only top voted, non community-wiki answers of a minimum length are eligible
