Hot answers tagged

11

First, if there's a rootkit, you're probably fighting a neverending fight. Take the server offline and reinstall and restore backups that are pre-infection. That's the "best" method of fixing. Second, were you up to date on patches and such before the infection or did you patch after? Third, what custom code is running on the server outside Plesk? How do ...


11

The easiest way would be to us an EICAR test file. Create a text file and add in the following code: X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* More information here


7

Directory permissions on /var/spool/exim4/scan should be 750, and owned by the exim user and its primary group (on my FreeBSD systems, these are mailnull and mail, respectively). If your clamav user has Debian-exim as a supplementary group - that is, if Debian-exim is not its primary group, then you need "AllowSupplementaryGroups yes" in your clamd.conf ...


7

Please check if you're using any configuration management system, e.g Puppet, Chef, CFEngine, etc. They can interfere with services at a regular interval. For the exact action to be taken to rectify this depends upon how the service is used in the config management system.


6

For a public facing server, I would say installing something like tripwire is not overkill. ClamAV is a different matter. I would consider setting that up that if your visitors will be sharing files by uploading to, and downloading from, your website. PDFs can contain exploits. On public facing servers, I have SSH not allow password authentication, only ...


6

Just send an email with the eicar test file attached. This file has a signature which any virus scanner should know and detect. As for the monitoring of the clamd process itself, there are many possibilities. I personally prefer using monit for it.


6

download the EICAR test file and scan it. it was made exactly for this purpose


5

Note to myself. The output from job cache: ---------- ID: clamav-daemon Function: service.running Result: True Comment: Service restarted Started: 06:27:52.736890 Duration: 12997.632 ms Changes: ---------- clamav-daemon: True Look at the clamav formula: clamav-daemon: ...


4

You can limit disk usage of the temporary files when running clamscan, by using the --max-space flag like this clamscan --max-space=50m --tempdir=/tmp/ --infected --recursive /home/


4

A few comments and things you can check: I don't see anything obviously wrong in the log you posted. What makes you think the last line in the log is an issue? Near 100% RAM utilization is actually a good thing in general. What you don't want to happen, though, is begin to use swap space which will kill your server's performance pretty quickly and may be ...


4

Why not setup some sort of virtual machine and use snapshots to reset their machines regularly? This way any viri/trojans that get past the AV can be wiped out easily. There is also more specialised software to do this aimed more at libraries/internet cafes if you want to take the idea further.


4

The clamd server doesn't appear to be running. Try starting it.


4

Since you want to disable virus checking entirely, the easiest way to do so is find the @bypass_virus_checks_maps line in the Amavis configuration files (amavis.conf or conf.d/50-user) and change it to this; bypass_virus_checks_maps => [1];


4

In clamd.conf AllowSupplementaryGroups is default false try this: AllowSupplementaryGroups true


3

You may want to check on the version of your ClamAV. Recently they stopped providing updated db files to version 0.94, so when your freshclam (the part that updates the definitions db) goes to download the update, instead of the expected result, if receives the error message, which may not play well with your freshclam and it tries to re-download the updates ...


3

Nope, you didn't go far enough. 1)You need a web application firewall like mod_security and make sure its configured to block attacks, not just log them. 2)Lock down php with phpsecinfo. 3)Lock down your web application's MySQL account, make sure your application doesn't have FILE privileges, its by far the most dangerous one in MySQL. 4)Firewall ...


3

try starting the server and then immediately log in and run top then press M (being actually a capital M to sort by memory usage) and watch your resources. You should see your swap at 0 bytes used and your memory free either fully used as linux can use sometimes or little under but mainly watch the top of the light of processes consuming memory. You should ...


3

All of the other answers for some reason seem to assume that clamd actually scans your system automatically. In reality, clamd does not scan your system on its own. All it does is wait for another process to ask it to scan the system, and thus doesn't do much more then speed up the "clamscan" procedure (since it doesn't have to reload virus definitions on ...


3

The defaut /etc/clamd.comnf (or equivalent on your distribution) should be fine. On CentOs, the antivirus (clamav), the update (clamav-db alais freshclam), and the deamon (clamd) are different packages. /etc/freshclam.conf use the default 12 update checks a day. Then, you need to figure out what you actually want to do with your AV: system-wide scan, ...


3

To use clamav in Debian squeeze you need to start by installing the exim4-daemon-heavy package instead of the default exim4-daemon-light version, the heavy daemon was compiled with more functionality including the ability to link into clamav. Just do an apt-get install exim4-daemon-heavy, it won't change much, and pretty safe to run. After you have that ...


3

In addition to SpamAssassin use amavisd-new and MailZu. This way you get easily manageable per-user SpamAssassin settings and a personal quarantine for each user which they can browse & manage over the web interface.


3

There is no generic approach - it's all hands-on. You typically would need to have configured extensive logging, preferably not only from the system you are inspecting but also from an independent IDS, which you are periodically archiving. Also, a good bunch of experience with computer security and forensics is required, otherwise you don't stand a chance. ...


3

Based on your real goal (I am building a web app where my user will be able to upload epubs files and I want to make sure they are no executable files.) ClamAV is probably overkill for your needs. You can use the file utility (or various APIs that hook the same database of magic data) to determine what kind of file the user is trying to upload, and reject ...


3

You could try to mail the test virus file see http://www.eicar.org/86-0-Intended-use.html


3

I had the same problem. I down some digging read The Perfect Server - Debian Wheezy (Apache2, BIND, Dovecot, ISPConfig 3) - Page 3 This sorted my "Your ClamAV installation is OUTDATED!" First make sure that your /etc/apt/sources.list contains the wheezy-updates repository (this makes sure you always get the newest updates for the ClamAV virus scanner - this ...


3

It turns out that there's a LOT to this. First, someone NOT familiar with this exact problem pointed out that maybe I didn't have enough of the software installed. What I had installed is listed in the question above. However, I did a yum list clamav-* and found there were packages available I did not have installed, including a milter, among other things. ...


3

The clamd socket file /var/run/clamd.scan/clamd.sock has somehow gotten mislabeled. It has the type var_run_t, but it should be antivirus_var_run_t in current SELinux policy. Anything matching /var/run/clamd.* should be labeled antivirus_var_run_t. This could be because the socket was created while an older version of the policy was installed, or a program ...


3

OpenDKIM, OpenDMARC, Rspamd, ClamAV I assume you have OpenDMARC configured to do SPF itself? You'll want to disable SPF/DKIM/DMARC checking in Rspamd then as well. you need openDKIM before openDMARC so that the DMARC check can be done based on the Auth-Results: header set by openDKIM. You want openDMARC before Rspamd so it can send DMARC reports on all ...


2

You might want to have a look at MailCleaner commercial or Open Source.


2

You will increase risk of infection, but you need to weigh things up. If you are running Linux, the server is for your own use you are not passing on email or files to Windows machines, you need back the 5% due to limited resources. Then stop clamd. However, I have found recently Joomla exploits using cross site scripting running on Linux servers ...



Only top voted, non community-wiki answers of a minimum length are eligible