Questions tagged [clamav]

Antivirus for UNIX-like systems primarily for mailserver integration.

Filter by
Sorted by
Tagged with
2
votes
2answers
39 views

avoid redundant writing of virus scan signatures in VMs on same disk

I have two VMs on the same disk that each have clamav installed. Both regularly run updates for the same virus scan signatures simultaneously which results in an unnecessary strain on the performance ...
0
votes
1answer
42 views

ClamAv + Microsoft Azure VM: Cannot connect to daemon from other VM

I got two VMs on Azure that are in the same subnet. One VM (10.1.0.6) has clamav daemon running, the other runs a Java Wildfly Application (10.1.0.5). I would like to send files from Java Application ...
1
vote
1answer
21 views

How to speed up clamd@amavisd launch / get it to “start” on Amazon Linux 2

I recently upgraded clamav from I'm not sure which version, but whatever was current on EPEL on February 13th, to 0.102.3. Under the previous version, I had to set TimeoutStartSec in the systemd conf ...
2
votes
1answer
27 views

How are systemd/system overrides supposed to work?

I'm messing around with some timeout settings, and am trying to figure out the correct way to set things for systemd/system daemons. Specifically, this is an underpowered server, and I keep timing out ...
0
votes
1answer
442 views

Sending a file to a remote clamd instance

I may be misunderstanding how to utilize clamd. I've got a situation where I have a media server that isn't quite powerfull enough to scan files as well as host the other services it is running (...
0
votes
1answer
54 views

ubuntu 18.04: clamav running, tomcat dying

Ubuntu 18.04. 2Gb RAM + 512mb swap. When running clamav, it consumes 800+mb of memory because it loads all the signatures into the memory. Because of that, I set it to run every day at 3am instead of ...
0
votes
1answer
263 views

Installing clamav on Amazon Linux 2

I have been trying to install clamav on Amazon Linux 2 using the following which works fine on Amazon Linux 1: curl -O http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm sudo yum ...
1
vote
0answers
223 views

Why does calling HEAD on this URL prevent the following error: ERROR: Message: SSL peer certificate or SSH remote key was not OK

This is an issue I'm having with a specific package but it looks like the software is using a version of CURL for windows or something. I want to understand this specific behavior because it doesnt ...
1
vote
1answer
729 views

Clamav on Centos 8 installation

I have installed ClamAV on Centos 8, following the installation guide on their website. I have run freshclam and that works fine but if I try to do a scan I get the following error: clamdscan /home ...
0
votes
1answer
336 views

clamav “killed” with no explanation

On a Debian 10 server I have this problem with clamav: root@vps:~# clamscan -r -v --stdout / Killed You see I use the verbose flag but that does not give me any information. In years of using clam ...
0
votes
1answer
83 views

Large Virus File with EICAR-Test-Signature not identified by the clamav library

If I add the Eicar Test Signature at the beginning of a large text file, will that file turn out to be malicious? I opened a 5 MB binary file on Sublime Text and added the signatue at the beginning. ...
2
votes
0answers
208 views

ClamAV for the host running docker containers - inotify/fanotify limits

I'm implementing anti-virus solution for Linux with ClamAV daemon running in On-Access mode, watching the created/opened files for malicious content at the host system AND in docker containers, ...
0
votes
3answers
118 views

Can I use Ansible to get a version number from clamAV

I am new to Ansible and googleing around i see how to install ClamAV using Ansible , but is there a way to just get the current version , I know I could just run it remotely via ssh
0
votes
1answer
616 views

Your ClamAV installation is OUTDATED

I'm running Vesta on Centos 7 and recently I've got this error. server#: freshclam current working dir is /var/lib/clamav ClamAV update process started at Fri Dec 13 12:36:40 2019 Using IPv6 aware ...
0
votes
0answers
15 views

Postfix sending spam from localhost [duplicate]

My email server entered reclently on all mail blacklists possible. Reading the logs, all I can see is that the client is my own server. postfix/smtp/smtpd[8630]: C98A122201F: client=localhost....
0
votes
0answers
16 views

clamd on several ports with different databases

Is it possible to run a clamd on one machine with different ports and each of them hold another database? 3310 = official databases 3311 = unofficial databases 3312 = yara rules p.s. CentOS 6/7
0
votes
0answers
45 views

Suspicious “clam” process on Debian 10

Using sudo htop I'm seeing 2 unusual processes named clamd on my Debian 10 VPS. Unusual because I don't remember installing ClamAV and they take 20% of my 4GB memory (htop screenshot below): ...
0
votes
0answers
84 views

clamav timing out when scanning stream for large file

Have a React/Django app that a small group of clients use to submit files to us. Using react-dropzone for the file upload, without any maxSize specified, so it should be react-dropzone causing the ...
0
votes
0answers
98 views

ClamAV permissions keep changing

Every 3-4 weeks, or so, the ClamAV permissions get changed which prevents the web app that utilizes it from working properly. It is just in a test environment, so the permissions are being modified ...
0
votes
1answer
47 views

Postfix (Maia Mailguard) relayhost update ignored

I have a postfix mail server used in conjunction with Maia Mailguard, Amavis, and clamav for spam. I've upgraded the primary mail server and it has a new IP address. I change main.cf and transport to ...
0
votes
0answers
272 views

ClamAV can't open/parse

I installed clamAV on an EC2 instance running CentOS, i made the install and when I go to run 'sudo freshclam' i get ERROR: Can't open/parse the config file /usr/local/etc/freshclam.conf However if ...
0
votes
0answers
53 views

ClamAV Anti-Virus not Classifying Virus Emails as Virus

I have installed Sendmail as my SMTP mail server, SpamAssassin as Spam Classifier and ClamAV Anti-Virus. I tested out sending my server a virus email eicar.txt Now I am receiving the virus email in ...
0
votes
2answers
663 views

clamd socket error in conjunction with amavisd (used for postfix) on CentOS 7

I can't seem to figure out a problem after a few hours of trouble-shooting and looking for similar cases. Like ohter email servers in the exact same configuration, the affected one is based on CentOS ...
2
votes
1answer
3k views

How to make `clamdscan` exclude folders and only log `--infected`?

My server is centos 7.4, with clamav 0.101.1-1.el7. When I run clamscan -r --infected --exclude-dir="^/sys" / through terminal, I always wait more than 6 hours to get output. And if I close ...
0
votes
1answer
63 views

Should `clamav-devel`, ` clamav-server-systemd`,`clamav-server` be installed if I only manual scan folder in one server?

In lots of how to install clamav in centos 7tutorial, all modules are installed,such like yum install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-...
1
vote
1answer
343 views

Send mail when ClamAV detects a threat using systemd

Most of the guides for ClamAV discuss integration with syslog, and it is possible to configure syslog to send a message on certain logs. But, my system is running systemd, with no active syslog....
0
votes
1answer
893 views

MailScanner error “Cannot find Socket”

CentOS 7, mail server. Messages stopped going in and out. Tried to debug, saw this in /var/log/maillog: MailScanner[4786]: Cannot find Socket (/var/run/clamd.scan/clamd.sock) Exiting! But the socket ...
4
votes
0answers
2k views

Socket access for clamdscan

On fc29 I have clamd installed and clamd@scan.service is running fine. clamdscan runs for root but not for a regular user, even after addition to 'clamscan' group. dnf list installed | grep clam ...
1
vote
0answers
152 views

Block dangerous word and excel docs?

The newest craze, apparently, is to add garbage into Office '97 formatted *.doc and *.xls files so that when a user opens them, and ignores warnings from Defender or anything else, they get infected ...
0
votes
1answer
366 views

(Can't load main.ndb) ClamAV Deamon Virus signature DB Error

I installed ClamAV as a "normal" application and inside the daemon mode. After the installation, the daemon status says the following part. clamd[7425]: LibClamAV Error: cli_parseadd(): Problem ...
1
vote
2answers
3k views

Scan the full filesystem in parallel with clamscan

I run a clamav scan weekly on my servers. There is one server with a raid6 cluster of 30TB of disk space where the scan take more than 24h to run. So I wonder how can I run clamscan on the whole ...
0
votes
1answer
97 views

clamd: When has a signature reload completed?

One can send SIGUSR2 to a running clamd instance to reload the signatures. But how can I (from a script) determine, if the signatures have been reloaded? I can of course try "sleep 30" which will ...
2
votes
1answer
3k views

subprocess installed pre-removal script returned error exit status 5

Trying to get clamav and clamav-daemon uninstalled but seems apt and dpkg are stuck and nothing can complete without this error: dpkg --remove output: (Reading database ... 385080 files and ...
1
vote
1answer
10k views

What is YARA.eval_post.UNOFFICIAL and what should I do about it?

My ClamAV scan keeps finding examples of this in my Apache logs: YARA.eval_post.UNOFFICIAL Does anyone know what it is and what to do about it? I tried contacting the folks at yararules.com, but I ...
1
vote
0answers
74 views

Yara Rule Project signatures autoupdate

I'm using a CentOS SPAM filter appliance ( eFa Project ) and while Yara is included, it doesn't seem to be downloading new signatures as expected using ClamAV/freshclam. Does anyone have any ...
0
votes
1answer
216 views

Clam Unknown OSSEC Warning

There is a problem with Clam antivirus on my server. I am getting this notification from OSSEC once per day. I am not sure where to look or what the problem actually is. Could anyone point to the ...
2
votes
1answer
7k views

Error with clamd amavisd CentOS 7

I am getting issue with clamd and amavisd please see error message below I am running an email server on CentOS 7.3..... amavisd and clamd seems working fine, but they keep jump up with errors every ...
0
votes
1answer
401 views

postfix fails sending mails with clamav

I have a problem on my server running postfix with ClamAV, it doesn't send nor receives mails since yesterday, which is a really big deal for us.. So I checked the mail.log file and found out that ...
4
votes
1answer
5k views

ClamAV and MalDet - Are these quarantined or infected?

Learning about hardening my VPS, I installed ClamAV and MalDet, using both for a few months. Tonight, I decided that, instead of just checking home I'd check the entire VPS other than "/sys". This ...
2
votes
1answer
2k views

ClamAV signature to ban office documents with macros

We are using custom signatures for ClamAV database to ban some types of files when they're attached to one email. This it's done using clamd and clamassassin with procmail. We're looking to add a ...
0
votes
0answers
468 views

Clamav TCP 3310 setup Debian

I've run into this problem which is weird. I'm using Debian jessie I have setup clamav to listen also on port 3310 with the TCPSocket 3310 option. After saving the changes to the config file I ...
2
votes
2answers
2k views

Clamd won't start after update

Since updating clamd to 0.99.2-1.e15 on our RedHat 5 x86_64 system, it has failed to start successfully. The error we get is as follows: LibClamAV Error: cli_pcre_compile: PCRE compilation failed at ...
0
votes
2answers
301 views

CenOS: Is clamAV scanning files of a compressed archive attachment inside emails?

Is clamAV scanning files insides compressed archive inside emails? I was looking around to found an answer about this question. Somebody wrote that on some ubuntu distribution this is the default ...
1
vote
0answers
120 views

Outgoing mail runs into a series of spamd errors

I've got a mail setup using postfix and dovecot, with spamassassin, clamav and amavis. Incoming mail contains the correct X-Spam* headers and everything appears to be operating more or less correct, ...
0
votes
1answer
613 views

Limit ClamAV resources on scan or alternative solution

Environment Centos 6 Cpanel 32GB Ram 512gb SSD drive / about half used Took on managing a server and installed ClamAV. Used CRON to schedule a scan @ 1am. I notice that sites on the host stopped ...
1
vote
2answers
947 views

Maldet with ClamAV missing PHP base64_decode() & eval() hacks

I've installed Linux Malware Detect and ClamAV in my CentOS 7 server and seems it's all ok as it hits on the EICAR malware test files and does scheduled scans without issues. The problem comes when I ...
2
votes
1answer
32 views

mpool_malloc error, cannot access shell

I'm getting spammed the following error on boot: LibClamAC Error: mpool_malloc(): Attempt to allocate 8388608 bytes. Please report to http://bugs.clamav.net I read that I will need to update... but ...
0
votes
0answers
226 views

Postfix not sending, LibClamAV Error: mpool_malloc

This question is closely related this this one. However, in this case, clamav is going crazy and filling up boot.log, writing to it every second (and getting huge). Furthermore, postfix is totally ...
6
votes
5answers
17k views

clamav error: mpool_malloc(): Attempt to allocate 8388608 bytes

Following error is showed when starting clamd; freshclam[26882]: [LibClamAV] mpool_malloc():Attempt to allocate 8388608 bytes. Please report to http://bugs.clamav.net I have lots of RAM memory ...
-1
votes
1answer
1k views

Setup spammassin and clamav with Exim on ubuntu 16.04

I've been searching for help in setting up Spammassassin and ClamAV with Exim (on ubuntu-16.04), but all the guides are horribly out of date. Could anyone share their setup please?