Tag Info

Hot answers tagged

10

First, if there's a rootkit, you're probably fighting a neverending fight. Take the server offline and reinstall and restore backups that are pre-infection. That's the "best" method of fixing. Second, were you up to date on patches and such before the infection or did you patch after? Third, what custom code is running on the server outside Plesk? How do ...


6

For a public facing server, I would say installing something like tripwire is not overkill. ClamAV is a different matter. I would consider setting that up that if your visitors will be sharing files by uploading to, and downloading from, your website. PDFs can contain exploits. On public facing servers, I have SSH not allow password authentication, only ...


5

Just send an email with the eicar test file attached. This file has a signature which any virus scanner should know and detect. As for the monitoring of the clamd process itself, there are many possibilities. I personally prefer using monit for it.


5

The easiest way would be to us an EICAR test file. Create a text file and add in the following code: X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* More information here


4

The clamd server doesn't appear to be running. Try starting it.


4

Why not setup some sort of virtual machine and use snapshots to reset their machines regularly? This way any viri/trojans that get past the AV can be wiped out easily. There is also more specialised software to do this aimed more at libraries/internet cafes if you want to take the idea further.


4

A few comments and things you can check: I don't see anything obviously wrong in the log you posted. What makes you think the last line in the log is an issue? Near 100% RAM utilization is actually a good thing in general. What you don't want to happen, though, is begin to use swap space which will kill your server's performance pretty quickly and may be ...


3

The defaut /etc/clamd.comnf (or equivalent on your distribution) should be fine. On CentOs, the antivirus (clamav), the update (clamav-db alais freshclam), and the deamon (clamd) are different packages. /etc/freshclam.conf use the default 12 update checks a day. Then, you need to figure out what you actually want to do with your AV: system-wide scan, ...


3

To use clamav in Debian squeeze you need to start by installing the exim4-daemon-heavy package instead of the default exim4-daemon-light version, the heavy daemon was compiled with more functionality including the ability to link into clamav. Just do an apt-get install exim4-daemon-heavy, it won't change much, and pretty safe to run. After you have that ...


3

Nope, you didn't go far enough. 1)You need a web application firewall like mod_security and make sure its configured to block attacks, not just log them. 2)Lock down php with phpsecinfo. 3)Lock down your web application's MySQL account, make sure your application doesn't have FILE privileges, its by far the most dangerous one in MySQL. 4)Firewall ...


3

Directory permissions on /var/spool/exim4/scan should be 750, and owned by the exim user and its primary group (on my FreeBSD systems, these are mailnull and mail, respectively). If your clamav user has Debian-exim as a supplementary group - that is, if Debian-exim is not its primary group, then you need "AllowSupplementaryGroups yes" in your clamd.conf ...


3

Look for /script/clamav-off to disable clamav in Kloxo environment


3

try starting the server and then immediately log in and run top then press M (being actually a capital M to sort by memory usage) and watch your resources. You should see your swap at 0 bytes used and your memory free either fully used as linux can use sometimes or little under but mainly watch the top of the light of processes consuming memory. You should ...


3

You can limit disk usage of the temporary files when running clamscan, by using the --max-space flag like this clamscan --max-space=50m --tempdir=/tmp/ --infected --recursive /home/


3

You may want to check on the version of your ClamAV. Recently they stopped providing updated db files to version 0.94, so when your freshclam (the part that updates the definitions db) goes to download the update, instead of the expected result, if receives the error message, which may not play well with your freshclam and it tries to re-download the updates ...


3

download the EICAR test file and scan it. it was made exactly for this purpose


3

Since you want to disable virus checking entirely, the easiest way to do so is find the @bypass_virus_checks_maps line in the Amavis configuration files (amavis.conf or conf.d/50-user) and change it to this; bypass_virus_checks_maps => [1];


3

There is no generic approach - it's all hands-on. You typically would need to have configured extensive logging, preferably not only from the system you are inspecting but also from an independent IDS, which you are periodically archiving. Also, a good bunch of experience with computer security and forensics is required, otherwise you don't stand a chance. ...


3

Based on your real goal (I am building a web app where my user will be able to upload epubs files and I want to make sure they are no executable files.) ClamAV is probably overkill for your needs. You can use the file utility (or various APIs that hook the same database of magic data) to determine what kind of file the user is trying to upload, and reject ...


2

NOTE: You should immediately consult a Linux system security professional regarding your question as your system may be compromised. This looks like your system is likely compromised in some way. The folder described is presenting itself as a Linux "dot file". "Dot files" are usually used to store configuration data for programs, however, as you see in ...


2

There was a mismatch between the antivirus database directories used by freshclam and clamd. The /etc/freshclam.conf settingDatabaseDirectory was apparently pointing to /var/lib/clamav (which is default for the package), but the corresponding setting in /etc/clamd.conf was pointing to /usr/share/clamav. This mismatch may have been because the OP had ...


2

We have seen this on plesk 9.5 servers despite having Parallel's security patches installed from February. Basically they are POSTing to the login page and getting in without auth, then going straight for the WYSIWYG file manager and appending the code to js files. Plesk are refusing to acknowledge this and the only option is to firewall plesk off and ...


2

You could try to mail the test virus file see http://www.eicar.org/86-0-Intended-use.html


2

if you installed clamav from the repository, using yum, then the scripts should have been installed and configured, when you installed the package. you can do something like ln -s /etc/init.d/clamd /etc/rc3.d/S90clamd, or, like you said, using chkconfig but again, if you installed from a package, all this should have been done for you.


2

You might want to have a look at MailCleaner commercial or Open Source.


2

My view is that 5% is trivial. If your web server actually needs all 2GB of RAM and you really can't spare that 5% you should be looking elsewhere for improvements and not jumping on clamd. ClamAV will detect some non-virus malware, which is not included in the claim that there are no Linux viruses (yet). Another consideration is email, regardless of the ...


2

All of the other answers for some reason seem to assume that clamd actually scans your system automatically. In reality, clamd does not scan your system on its own. All it does is wait for another process to ask it to scan the system, and thus doesn't do much more then speed up the "clamscan" procedure (since it doesn't have to reload virus definitions on ...


2

"Welcome aboard! On board of our new airliner you can enjoy restaurant, cinema, gym, sauna and swimming pool. Now fasten your seat belts, our captain is going to try to get all this shit airborne." mod_security is a pain for both you and server. It's resources hungry and its rules need serious maintaining and it's going to be a neverending task. And no, it ...


2

You can probably safely install AIDE on a web server - adding and removing customers doesn't change too many configuration files, and you could probably filter out the normal chatter pretty easily. But something that a lot of web server security guides don't mention is that you should turn noexec on on your /tmp partition in /etc/fstab. If you're offering ...


2

In addition to SpamAssassin use amavisd-new and MailZu. This way you get easily manageable per-user SpamAssassin settings and a personal quarantine for each user which they can browse & manage over the web interface.



Only top voted, non community-wiki answers of a minimum length are eligible