Questions tagged [clamav]

Antivirus for UNIX-like systems primarily for mailserver integration.

Filter by
Sorted by
Tagged with
0 votes
1 answer
32 views

Why does status says it's dead and subsys locked, but it still running without issue?

Whenever I start Amavisd, the reports starting OK, but a status check says it's dead. $ service amavisd start Starting amavisd: [ OK ] $ service amavisd ...
user avatar
  • 148
0 votes
1 answer
38 views

What is the default file system for ClamAV scans?

I have just installed ClamAV on a Pi4 running Buster. I have looked at the configuration file and don't see where it specifies which file system it will scan automatically. I know if I use this sudo ...
user avatar
  • 1
0 votes
0 answers
56 views

Debian 11: ClamAV not working to listen on TCP 3310

I am using the Debian V11. PRETTY_NAME="Debian GNU/Linux 11 (bullseye)" NAME="Debian GNU/Linux" VERSION_ID="11" VERSION="11 (bullseye)" it's working fine with ...
user avatar
0 votes
0 answers
116 views

Amavis Configuration on Ubuntu 20.04 / Port 10025 already in use

i try to configure amavis on my ubuntu 20.04 with working postfix and kopano. Postfix crashes with the following error: Jan 10 11:23:52 mail postfix/postfix-script[143585]: fatal: cannot execute /usr/...
user avatar
0 votes
0 answers
145 views

clamdscan: Log verbose output to configurable file

When using clamdscan, I would like to have verbose output logged to a file. Specifically, the timestamp, file path and file name as well as the scan results should be logged to a specified file. At ...
user avatar
0 votes
0 answers
314 views

Clamav is very slow with tcp

I'm using clamonacc on my desktop computer and servers. I use a raspberry pi as clamd server. The clamd process only uses ~25% of all 4 cores so with htop I see it's using like ~100% and 400% is the ...
user avatar
  • 13
0 votes
1 answer
214 views

clamav - clamd error when setup as daemon (mac osx)

Issue: Setting up clamav as a daemon process in mac osx throws some cumbersome errors and warnings while doing the setup and the documentation is good, but not perfect. I ran into some permission ...
user avatar
1 vote
1 answer
182 views

Postfix not accepting recipient address: connect to private/policy: Connection refused

I thought I'd be clever and add amavis/spamassassin/clamav to my working Postfix installation. I got it working and then made a change. Walked away, had a beer, then found out I'd mucked up. This is ...
user avatar
  • 13
0 votes
1 answer
63 views

SELinux prevent connection clamd_port_t:tcp_socket

We have API Server (tomcat) which has clamAV configuration to scan any uploaded file to the system. clamAV configuration will require the API server to connect to clamAV server. SELinux is enabled on ...
user avatar
0 votes
0 answers
117 views

ClamAV monitoring docker exported mountpoint

I would need a general advice regarding ClamAV (v1.02+) setup in Docker environment. I got multiple containers running on Linux (currently Ubuntu 18.04 LTS) that export their persistent directories ...
user avatar
  • 3
0 votes
1 answer
363 views

ClamAV cannot access files

I've a server (CentOS 7) with ClamAV installed. clamdscan is running every 12 hours and for some files, I'm always getting the following message: ClamAV has failed to run. The return error message was:...
user avatar
  • 123
0 votes
0 answers
40 views

How does ClamAV secure its updates online?

Two questions, the second related to the first... How does ClamAV secure its update virus definition operations from its online servers? I will assume (?) that it uses HTTPS for security, but a ...
user avatar
  • 113
0 votes
1 answer
349 views

How it works content_filter in Postfix using spamassassin and clamav ( filtering order )?

How it works content_filter in case where is used spamassassin and clamav ? Here is example for one content_filter: http://www.postfix.org/FILTER_README.html And I see that sendmail command cant use ...
user avatar
  • 41
0 votes
1 answer
205 views

xlsx extension file blocked in zimbra

So the issue is that i have been trying to send a mail from my server with xlsx file extension attachment but zimbra rejects the mail giving a message content is band BANNED CONTENTS ALERT Our ...
user avatar
0 votes
1 answer
1k views

ClamD: cannot change socket location

Ubuntu 20.04.2 ClamAV 0.102.4 I want to use a different value for ClamD's LocalSocket directive but keep getting the following error: !LOCAL: Socket file /var/run/clamd.scan/clamd.sock could not be ...
user avatar
3 votes
1 answer
4k views

clamav-daemon start condition failed, /var/lib/clamav/daily.{c[vl]d,inc} was not met

After installing Modoboa(Open Source Mail Hosting), I Tried to start clamav-daemon, but i faced start condition failed. systemctl status clamav-daemon.service clamav-daemon.service - Clam ...
user avatar
0 votes
1 answer
378 views

Cloud bucket malware security

I have implemented an antivirus system using ClamAV on one of my apps which uses Google cloud storage for uploading files. Currently what I am doing is, listening to bucket upload, download it on one ...
user avatar
0 votes
0 answers
388 views

Clamd using +1GB of memory

I've searched around and few similar questions where it was said that a few 100MB memory is normal for clamd. Now actually I see it using more than 1GB and recently I have frequently that my system ...
user avatar
1 vote
1 answer
297 views

Running clamscan with the file list function

I am trying to schedule some tasks using ClamAV but it cannot find the find the file that contains the directories I want it to scan.   *Using sudo doesn't work.   *The files are set with permissions ...
user avatar
  • 123
5 votes
2 answers
78 views

avoid redundant writing of virus scan signatures in VMs on same disk [closed]

I have two VMs on the same disk that each have clamav installed. Both regularly run updates for the same virus scan signatures simultaneously which results in an unnecessary strain on the performance ...
user avatar
0 votes
1 answer
535 views

ClamAv + Microsoft Azure VM: Cannot connect to daemon from other VM

I got two VMs on Azure that are in the same subnet. One VM (10.1.0.6) has clamav daemon running, the other runs a Java Wildfly Application (10.1.0.5). I would like to send files from Java Application ...
user avatar
1 vote
1 answer
486 views

How to speed up clamd@amavisd launch / get it to "start" on Amazon Linux 2

I recently upgraded clamav from I'm not sure which version, but whatever was current on EPEL on February 13th, to 0.102.3. Under the previous version, I had to set TimeoutStartSec in the systemd conf ...
user avatar
3 votes
1 answer
733 views

How are systemd/system overrides supposed to work?

I'm messing around with some timeout settings, and am trying to figure out the correct way to set things for systemd/system daemons. Specifically, this is an underpowered server, and I keep timing out ...
user avatar
1 vote
2 answers
4k views

Sending a file to a remote clamd instance

I may be misunderstanding how to utilize clamd. I've got a situation where I have a media server that isn't quite powerfull enough to scan files as well as host the other services it is running (...
user avatar
0 votes
1 answer
309 views

ubuntu 18.04: clamav running, tomcat dying

Ubuntu 18.04. 2Gb RAM + 512mb swap. When running clamav, it consumes 800+mb of memory because it loads all the signatures into the memory. Because of that, I set it to run every day at 3am instead of ...
user avatar
  • 237
2 votes
1 answer
3k views

Installing clamav on Amazon Linux 2

I have been trying to install clamav on Amazon Linux 2 using the following which works fine on Amazon Linux 1: curl -O http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm sudo yum ...
user avatar
1 vote
2 answers
1k views

Why does calling HEAD on this URL prevent the following error: ERROR: Message: SSL peer certificate or SSH remote key was not OK

This is an issue I'm having with a specific package but it looks like the software is using a version of CURL for windows or something. I want to understand this specific behavior because it doesnt ...
user avatar
  • 3,979
1 vote
1 answer
5k views

Clamav on Centos 8 installation

I have installed ClamAV on Centos 8, following the installation guide on their website. I have run freshclam and that works fine but if I try to do a scan I get the following error: clamdscan /home ...
user avatar
  • 225
1 vote
2 answers
3k views

clamav "killed" with no explanation

On a Debian 10 server I have this problem with clamav: root@vps:~# clamscan -r -v --stdout / Killed You see I use the verbose flag but that does not give me any information. In years of using clam ...
user avatar
1 vote
1 answer
925 views

Large Virus File with EICAR-Test-Signature not identified by the clamav library

If I add the Eicar Test Signature at the beginning of a large text file, will that file turn out to be malicious? I opened a 5 MB binary file on Sublime Text and added the signatue at the beginning. ...
user avatar
2 votes
0 answers
867 views

ClamAV for the host running docker containers - inotify/fanotify limits

I'm implementing anti-virus solution for Linux with ClamAV daemon running in On-Access mode, watching the created/opened files for malicious content at the host system AND in docker containers, ...
user avatar
  • 141
0 votes
3 answers
450 views

Can I use Ansible to get a version number from clamAV

I am new to Ansible and googleing around i see how to install ClamAV using Ansible , but is there a way to just get the current version , I know I could just run it remotely via ssh
user avatar
  • 127
0 votes
1 answer
2k views

Your ClamAV installation is OUTDATED

I'm running Vesta on Centos 7 and recently I've got this error. server#: freshclam current working dir is /var/lib/clamav ClamAV update process started at Fri Dec 13 12:36:40 2019 Using IPv6 aware ...
user avatar
0 votes
0 answers
21 views

clamd on several ports with different databases

Is it possible to run a clamd on one machine with different ports and each of them hold another database? 3310 = official databases 3311 = unofficial databases 3312 = yara rules p.s. CentOS 6/7
user avatar
  • 1
0 votes
1 answer
110 views

Postfix (Maia Mailguard) relayhost update ignored

I have a postfix mail server used in conjunction with Maia Mailguard, Amavis, and clamav for spam. I've upgraded the primary mail server and it has a new IP address. I change main.cf and transport to ...
user avatar
  • 113
0 votes
0 answers
821 views

ClamAV can't open/parse

I installed clamAV on an EC2 instance running CentOS, i made the install and when I go to run 'sudo freshclam' i get ERROR: Can't open/parse the config file /usr/local/etc/freshclam.conf However if ...
user avatar
  • 3
0 votes
0 answers
141 views

ClamAV Anti-Virus not Classifying Virus Emails as Virus

I have installed Sendmail as my SMTP mail server, SpamAssassin as Spam Classifier and ClamAV Anti-Virus. I tested out sending my server a virus email eicar.txt Now I am receiving the virus email in ...
user avatar
0 votes
2 answers
1k views

clamd socket error in conjunction with amavisd (used for postfix) on CentOS 7

I can't seem to figure out a problem after a few hours of trouble-shooting and looking for similar cases. Like ohter email servers in the exact same configuration, the affected one is based on CentOS ...
user avatar
  • 162
6 votes
3 answers
13k views

How to make `clamdscan` exclude folders and only log `--infected`?

My server is centos 7.4, with clamav 0.101.1-1.el7. When I run clamscan -r --infected --exclude-dir="^/sys" / through terminal, I always wait more than 6 hours to get output. And if I close ...
user avatar
  • 845
0 votes
1 answer
155 views

Should `clamav-devel`, ` clamav-server-systemd`,`clamav-server` be installed if I only manual scan folder in one server?

In lots of how to install clamav in centos 7tutorial, all modules are installed,such like yum install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-...
user avatar
  • 845
1 vote
1 answer
884 views

Send mail when ClamAV detects a threat using systemd

Most of the guides for ClamAV discuss integration with syslog, and it is possible to configure syslog to send a message on certain logs. But, my system is running systemd, with no active syslog....
user avatar
  • 412
0 votes
1 answer
2k views

MailScanner error "Cannot find Socket"

CentOS 7, mail server. Messages stopped going in and out. Tried to debug, saw this in /var/log/maillog: MailScanner[4786]: Cannot find Socket (/var/run/clamd.scan/clamd.sock) Exiting! But the socket ...
user avatar
  • 112
5 votes
0 answers
4k views

Socket access for clamdscan

On fc29 I have clamd installed and clamd@scan.service is running fine. clamdscan runs for root but not for a regular user, even after addition to 'clamscan' group. dnf list installed | grep clam ...
user avatar
  • 155
1 vote
0 answers
279 views

Block dangerous word and excel docs?

The newest craze, apparently, is to add garbage into Office '97 formatted *.doc and *.xls files so that when a user opens them, and ignores warnings from Defender or anything else, they get infected ...
user avatar
  • 348
0 votes
1 answer
648 views

(Can't load main.ndb) ClamAV Deamon Virus signature DB Error

I installed ClamAV as a "normal" application and inside the daemon mode. After the installation, the daemon status says the following part. clamd[7425]: LibClamAV Error: cli_parseadd(): Problem ...
user avatar
  • 23
4 votes
2 answers
8k views

Scan the full filesystem in parallel with clamscan

I run a clamav scan weekly on my servers. There is one server with a raid6 cluster of 30TB of disk space where the scan take more than 24h to run. So I wonder how can I run clamscan on the whole ...
user avatar
  • 155
0 votes
1 answer
151 views

clamd: When has a signature reload completed?

One can send SIGUSR2 to a running clamd instance to reload the signatures. But how can I (from a script) determine, if the signatures have been reloaded? I can of course try "sleep 30" which will ...
user avatar
2 votes
1 answer
5k views

subprocess installed pre-removal script returned error exit status 5

Trying to get clamav and clamav-daemon uninstalled but seems apt and dpkg are stuck and nothing can complete without this error: dpkg --remove output: (Reading database ... 385080 files and ...
user avatar
  • 123
1 vote
1 answer
14k views

What is YARA.eval_post.UNOFFICIAL and what should I do about it?

My ClamAV scan keeps finding examples of this in my Apache logs: YARA.eval_post.UNOFFICIAL Does anyone know what it is and what to do about it? I tried contacting the folks at yararules.com, but I ...
user avatar
1 vote
0 answers
83 views

Yara Rule Project signatures autoupdate

I'm using a CentOS SPAM filter appliance ( eFa Project ) and while Yara is included, it doesn't seem to be downloading new signatures as expected using ClamAV/freshclam. Does anyone have any ...
user avatar