People who code: we want your input. Take the Survey

Questions tagged [clamav]

Antivirus for UNIX-like systems primarily for mailserver integration.

Filter by
Sorted by
Tagged with
0
votes
0answers
30 views

How to fix ClamAV false positive hits

After migration to microservices I try to use each program (service) in separate container. That's the reason why I started to use clamd with TCP option. Shortly: when I scan the same file (legacy msi ...
0
votes
0answers
23 views

xlsx extension file blocked in zimbra

So the issue is that i have been trying to send a mail from my server with xlsx file extension attachment but zimbra rejects the mail giving a message content is band BANNED CONTENTS ALERT Our ...
0
votes
0answers
50 views

ClamD: cannot change socket location

Ubuntu 20.04.2 ClamAV 0.102.4 I want to use a different value for ClamD's LocalSocket directive but keep getting the following error: !LOCAL: Socket file /var/run/clamd.scan/clamd.sock could not be ...
2
votes
1answer
719 views

clamav-daemon start condition failed, /var/lib/clamav/daily.{c[vl]d,inc} was not met

After installing Modoboa(Open Source Mail Hosting), I Tried to start clamav-daemon, but i faced start condition failed. systemctl status clamav-daemon.service clamav-daemon.service - Clam ...
0
votes
1answer
247 views

Cloud bucket malware security

I have implemented an antivirus system using ClamAV on one of my apps which uses Google cloud storage for uploading files. Currently what I am doing is, listening to bucket upload, download it on one ...
0
votes
0answers
120 views

Clamd using +1GB of memory

I've searched around and few similar questions where it was said that a few 100MB memory is normal for clamd. Now actually I see it using more than 1GB and recently I have frequently that my system ...
0
votes
0answers
103 views

SpamAssassin and Amavis block by country/IP/ASN per-user

I have a spamassassin-3.4.4 install with amavisd-2.12 and postfix on fedora32 and would like to be able to block email from an entire country on a per-user or per-domain basis. What is the best way to ...
0
votes
0answers
209 views

Clamd performance issues in docker image

We observed performance issues using clamd docker image (https://hub.docker.com/r/mkodockx/docker-clamav/dockerfile) for virus scanning. Our application and clamd (side car deployment) resides on the ...
1
vote
1answer
72 views

Running clamscan with the file list function

I am trying to schedule some tasks using ClamAV but it cannot find the find the file that contains the directories I want it to scan.   *Using sudo doesn't work.   *The files are set with permissions ...
5
votes
2answers
72 views

avoid redundant writing of virus scan signatures in VMs on same disk [closed]

I have two VMs on the same disk that each have clamav installed. Both regularly run updates for the same virus scan signatures simultaneously which results in an unnecessary strain on the performance ...
0
votes
1answer
226 views

ClamAv + Microsoft Azure VM: Cannot connect to daemon from other VM

I got two VMs on Azure that are in the same subnet. One VM (10.1.0.6) has clamav daemon running, the other runs a Java Wildfly Application (10.1.0.5). I would like to send files from Java Application ...
1
vote
1answer
239 views

How to speed up clamd@amavisd launch / get it to “start” on Amazon Linux 2

I recently upgraded clamav from I'm not sure which version, but whatever was current on EPEL on February 13th, to 0.102.3. Under the previous version, I had to set TimeoutStartSec in the systemd conf ...
2
votes
1answer
53 views

How are systemd/system overrides supposed to work?

I'm messing around with some timeout settings, and am trying to figure out the correct way to set things for systemd/system daemons. Specifically, this is an underpowered server, and I keep timing out ...
0
votes
2answers
2k views

Sending a file to a remote clamd instance

I may be misunderstanding how to utilize clamd. I've got a situation where I have a media server that isn't quite powerfull enough to scan files as well as host the other services it is running (...
0
votes
1answer
146 views

ubuntu 18.04: clamav running, tomcat dying

Ubuntu 18.04. 2Gb RAM + 512mb swap. When running clamav, it consumes 800+mb of memory because it loads all the signatures into the memory. Because of that, I set it to run every day at 3am instead of ...
0
votes
1answer
1k views

Installing clamav on Amazon Linux 2

I have been trying to install clamav on Amazon Linux 2 using the following which works fine on Amazon Linux 1: curl -O http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm sudo yum ...
1
vote
1answer
614 views

Why does calling HEAD on this URL prevent the following error: ERROR: Message: SSL peer certificate or SSH remote key was not OK

This is an issue I'm having with a specific package but it looks like the software is using a version of CURL for windows or something. I want to understand this specific behavior because it doesnt ...
1
vote
1answer
3k views

Clamav on Centos 8 installation

I have installed ClamAV on Centos 8, following the installation guide on their website. I have run freshclam and that works fine but if I try to do a scan I get the following error: clamdscan /home ...
0
votes
1answer
1k views

clamav “killed” with no explanation

On a Debian 10 server I have this problem with clamav: root@vps:~# clamscan -r -v --stdout / Killed You see I use the verbose flag but that does not give me any information. In years of using clam ...
1
vote
1answer
465 views

Large Virus File with EICAR-Test-Signature not identified by the clamav library

If I add the Eicar Test Signature at the beginning of a large text file, will that file turn out to be malicious? I opened a 5 MB binary file on Sublime Text and added the signatue at the beginning. ...
2
votes
0answers
594 views

ClamAV for the host running docker containers - inotify/fanotify limits

I'm implementing anti-virus solution for Linux with ClamAV daemon running in On-Access mode, watching the created/opened files for malicious content at the host system AND in docker containers, ...
0
votes
3answers
256 views

Can I use Ansible to get a version number from clamAV

I am new to Ansible and googleing around i see how to install ClamAV using Ansible , but is there a way to just get the current version , I know I could just run it remotely via ssh
0
votes
1answer
927 views

Your ClamAV installation is OUTDATED

I'm running Vesta on Centos 7 and recently I've got this error. server#: freshclam current working dir is /var/lib/clamav ClamAV update process started at Fri Dec 13 12:36:40 2019 Using IPv6 aware ...
0
votes
0answers
17 views

clamd on several ports with different databases

Is it possible to run a clamd on one machine with different ports and each of them hold another database? 3310 = official databases 3311 = unofficial databases 3312 = yara rules p.s. CentOS 6/7
0
votes
1answer
66 views

Postfix (Maia Mailguard) relayhost update ignored

I have a postfix mail server used in conjunction with Maia Mailguard, Amavis, and clamav for spam. I've upgraded the primary mail server and it has a new IP address. I change main.cf and transport to ...
0
votes
0answers
469 views

ClamAV can't open/parse

I installed clamAV on an EC2 instance running CentOS, i made the install and when I go to run 'sudo freshclam' i get ERROR: Can't open/parse the config file /usr/local/etc/freshclam.conf However if ...
0
votes
0answers
104 views

ClamAV Anti-Virus not Classifying Virus Emails as Virus

I have installed Sendmail as my SMTP mail server, SpamAssassin as Spam Classifier and ClamAV Anti-Virus. I tested out sending my server a virus email eicar.txt Now I am receiving the virus email in ...
0
votes
2answers
972 views

clamd socket error in conjunction with amavisd (used for postfix) on CentOS 7

I can't seem to figure out a problem after a few hours of trouble-shooting and looking for similar cases. Like ohter email servers in the exact same configuration, the affected one is based on CentOS ...
3
votes
1answer
7k views

How to make `clamdscan` exclude folders and only log `--infected`?

My server is centos 7.4, with clamav 0.101.1-1.el7. When I run clamscan -r --infected --exclude-dir="^/sys" / through terminal, I always wait more than 6 hours to get output. And if I close ...
0
votes
1answer
102 views

Should `clamav-devel`, ` clamav-server-systemd`,`clamav-server` be installed if I only manual scan folder in one server?

In lots of how to install clamav in centos 7tutorial, all modules are installed,such like yum install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-...
1
vote
1answer
533 views

Send mail when ClamAV detects a threat using systemd

Most of the guides for ClamAV discuss integration with syslog, and it is possible to configure syslog to send a message on certain logs. But, my system is running systemd, with no active syslog....
0
votes
1answer
1k views

MailScanner error “Cannot find Socket”

CentOS 7, mail server. Messages stopped going in and out. Tried to debug, saw this in /var/log/maillog: MailScanner[4786]: Cannot find Socket (/var/run/clamd.scan/clamd.sock) Exiting! But the socket ...
4
votes
0answers
3k views

Socket access for clamdscan

On fc29 I have clamd installed and clamd@scan.service is running fine. clamdscan runs for root but not for a regular user, even after addition to 'clamscan' group. dnf list installed | grep clam ...
1
vote
0answers
214 views

Block dangerous word and excel docs?

The newest craze, apparently, is to add garbage into Office '97 formatted *.doc and *.xls files so that when a user opens them, and ignores warnings from Defender or anything else, they get infected ...
0
votes
1answer
524 views

(Can't load main.ndb) ClamAV Deamon Virus signature DB Error

I installed ClamAV as a "normal" application and inside the daemon mode. After the installation, the daemon status says the following part. clamd[7425]: LibClamAV Error: cli_parseadd(): Problem ...
2
votes
2answers
6k views

Scan the full filesystem in parallel with clamscan

I run a clamav scan weekly on my servers. There is one server with a raid6 cluster of 30TB of disk space where the scan take more than 24h to run. So I wonder how can I run clamscan on the whole ...
0
votes
1answer
116 views

clamd: When has a signature reload completed?

One can send SIGUSR2 to a running clamd instance to reload the signatures. But how can I (from a script) determine, if the signatures have been reloaded? I can of course try "sleep 30" which will ...
2
votes
1answer
4k views

subprocess installed pre-removal script returned error exit status 5

Trying to get clamav and clamav-daemon uninstalled but seems apt and dpkg are stuck and nothing can complete without this error: dpkg --remove output: (Reading database ... 385080 files and ...
1
vote
1answer
12k views

What is YARA.eval_post.UNOFFICIAL and what should I do about it?

My ClamAV scan keeps finding examples of this in my Apache logs: YARA.eval_post.UNOFFICIAL Does anyone know what it is and what to do about it? I tried contacting the folks at yararules.com, but I ...
1
vote
0answers
80 views

Yara Rule Project signatures autoupdate

I'm using a CentOS SPAM filter appliance ( eFa Project ) and while Yara is included, it doesn't seem to be downloading new signatures as expected using ClamAV/freshclam. Does anyone have any ...
0
votes
1answer
233 views

Clam Unknown OSSEC Warning

There is a problem with Clam antivirus on my server. I am getting this notification from OSSEC once per day. I am not sure where to look or what the problem actually is. Could anyone point to the ...
2
votes
1answer
8k views

Error with clamd amavisd CentOS 7

I am getting issue with clamd and amavisd please see error message below I am running an email server on CentOS 7.3..... amavisd and clamd seems working fine, but they keep jump up with errors every ...
0
votes
1answer
494 views

postfix fails sending mails with clamav

I have a problem on my server running postfix with ClamAV, it doesn't send nor receives mails since yesterday, which is a really big deal for us.. So I checked the mail.log file and found out that ...
4
votes
1answer
5k views

ClamAV and MalDet - Are these quarantined or infected?

Learning about hardening my VPS, I installed ClamAV and MalDet, using both for a few months. Tonight, I decided that, instead of just checking home I'd check the entire VPS other than "/sys". This ...
2
votes
1answer
2k views

ClamAV signature to ban office documents with macros

We are using custom signatures for ClamAV database to ban some types of files when they're attached to one email. This it's done using clamd and clamassassin with procmail. We're looking to add a ...
0
votes
0answers
652 views

Clamav TCP 3310 setup Debian

I've run into this problem which is weird. I'm using Debian jessie I have setup clamav to listen also on port 3310 with the TCPSocket 3310 option. After saving the changes to the config file I ...
2
votes
2answers
3k views

Clamd won't start after update

Since updating clamd to 0.99.2-1.e15 on our RedHat 5 x86_64 system, it has failed to start successfully. The error we get is as follows: LibClamAV Error: cli_pcre_compile: PCRE compilation failed at ...
0
votes
2answers
464 views

CenOS: Is clamAV scanning files of a compressed archive attachment inside emails?

Is clamAV scanning files insides compressed archive inside emails? I was looking around to found an answer about this question. Somebody wrote that on some ubuntu distribution this is the default ...
1
vote
0answers
170 views

Outgoing mail runs into a series of spamd errors

I've got a mail setup using postfix and dovecot, with spamassassin, clamav and amavis. Incoming mail contains the correct X-Spam* headers and everything appears to be operating more or less correct, ...
0
votes
1answer
699 views

Limit ClamAV resources on scan or alternative solution

Environment Centos 6 Cpanel 32GB Ram 512gb SSD drive / about half used Took on managing a server and installed ClamAV. Used CRON to schedule a scan @ 1am. I notice that sites on the host stopped ...