Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [clamav]

Antivirus for UNIX-like systems primarily for mailserver integration.

0
votes
0answers
16 views

ClamAV can't open/parse

I installed clamAV on an EC2 instance running CentOS, i made the install and when I go to run 'sudo freshclam' i get ERROR: Can't open/parse the config file /usr/local/etc/freshclam.conf However if ...
0
votes
0answers
16 views

ClamAV Anti-Virus not Classifying Virus Emails as Virus

I have installed Sendmail as my SMTP mail server, SpamAssassin as Spam Classifier and ClamAV Anti-Virus. I tested out sending my server a virus email eicar.txt Now I am receiving the virus email in ...
0
votes
0answers
90 views

clamd socket error in conjunction with amavisd (used for postfix) on CentOS 7

I can't seem to figure out a problem after a few hours of trouble-shooting and looking for similar cases. Like ohter email servers in the exact same configuration, the affected one is based on CentOS ...
1
vote
0answers
42 views

How to make `clamdscan` exclude folders and only log `--infected`?

My server is centos 7.4, with clamav 0.101.1-1.el7. When I run clamscan -r --infected --exclude-dir="^/sys" / through terminal, I always wait more than 6 hours to get output. And if I close ...
0
votes
0answers
14 views

Should `clamav-devel`, ` clamav-server-systemd`,`clamav-server` be installed if I only manual scan folder in one server?

In lots of how to install clamav in centos 7tutorial, all modules are installed,such like yum install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-...
1
vote
0answers
62 views

Send mail when ClamAV detects a threat using systemd

Most of the guides for ClamAV discuss integration with syslog, and it is possible to configure syslog to send a message on certain logs. But, my system is running systemd, with no active syslog....
0
votes
1answer
163 views

MailScanner error “Cannot find Socket”

CentOS 7, mail server. Messages stopped going in and out. Tried to debug, saw this in /var/log/maillog: MailScanner[4786]: Cannot find Socket (/var/run/clamd.scan/clamd.sock) Exiting! But the socket ...
1
vote
0answers
457 views

Socket access for clamdscan

On fc29 I have clamd installed and clamd@scan.service is running fine. clamdscan runs for root but not for a regular user, even after addition to 'clamscan' group. dnf list installed | grep clam ...
1
vote
0answers
64 views

Block dangerous word and excel docs?

The newest craze, apparently, is to add garbage into Office '97 formatted *.doc and *.xls files so that when a user opens them, and ignores warnings from Defender or anything else, they get infected ...
0
votes
1answer
160 views

(Can't load main.ndb) ClamAV Deamon Virus signature DB Error

I installed ClamAV as a "normal" application and inside the daemon mode. After the installation, the daemon status says the following part. clamd[7425]: LibClamAV Error: cli_parseadd(): Problem ...
1
vote
2answers
931 views

Scan the full filesystem in parallel with clamscan

I run a clamav scan weekly on my servers. There is one server with a raid6 cluster of 30TB of disk space where the scan take more than 24h to run. So I wonder how can I run clamscan on the whole ...
0
votes
0answers
200 views

Clamav detecting false positive

I've just runned a clamscan on the entire disk and it logged the following: /usr/bin/systemd-mount: Unix.Trojan.Vali-6606621-0 FOUND ----------- SCAN SUMMARY ----------- Known viruses: 6578095 ...
0
votes
0answers
117 views

What are these ClamAV cPanel alerts? Are they real threats? [duplicate]

I just ran a complete ClamAV scan of a cPanel users files and detected a small number of potential real alerts and a large number of alerts in my mail folder. I'm looking for help determining primary ...
0
votes
1answer
55 views

clamd: When has a signature reload completed?

One can send SIGUSR2 to a running clamd instance to reload the signatures. But how can I (from a script) determine, if the signatures have been reloaded? I can of course try "sleep 30" which will ...
0
votes
1answer
1k views

subprocess installed pre-removal script returned error exit status 5

Trying to get clamav and clamav-daemon uninstalled but seems apt and dpkg are stuck and nothing can complete without this error: dpkg --remove output: (Reading database ... 385080 files and ...
0
votes
1answer
4k views

What is YARA.eval_post.UNOFFICIAL and what should I do about it?

My ClamAV scan keeps finding examples of this in my Apache logs: YARA.eval_post.UNOFFICIAL Does anyone know what it is and what to do about it? I tried contacting the folks at yararules.com, but I ...
1
vote
0answers
64 views

Yara Rule Project signatures autoupdate

I'm using a CentOS SPAM filter appliance ( eFa Project ) and while Yara is included, it doesn't seem to be downloading new signatures as expected using ClamAV/freshclam. Does anyone have any ...
0
votes
1answer
174 views

Clam Unknown OSSEC Warning

There is a problem with Clam antivirus on my server. I am getting this notification from OSSEC once per day. I am not sure where to look or what the problem actually is. Could anyone point to the ...
1
vote
1answer
4k views

Error with clamd amavisd CentOS 7

I am getting issue with clamd and amavisd please see error message below I am running an email server on CentOS 7.3..... amavisd and clamd seems working fine, but they keep jump up with errors every ...
0
votes
1answer
273 views

postfix fails sending mails with clamav

I have a problem on my server running postfix with ClamAV, it doesn't send nor receives mails since yesterday, which is a really big deal for us.. So I checked the mail.log file and found out that ...
3
votes
1answer
4k views

ClamAV and MalDet - Are these quarantined or infected?

Learning about hardening my VPS, I installed ClamAV and MalDet, using both for a few months. Tonight, I decided that, instead of just checking home I'd check the entire VPS other than "/sys". This ...
0
votes
1answer
1k views

ClamAV signature to ban office documents with macros

We are using custom signatures for ClamAV database to ban some types of files when they're attached to one email. This it's done using clamd and clamassassin with procmail. We're looking to add a ...
0
votes
0answers
334 views

Clamav TCP 3310 setup Debian

I've run into this problem which is weird. I'm using Debian jessie I have setup clamav to listen also on port 3310 with the TCPSocket 3310 option. After saving the changes to the config file I ...
2
votes
2answers
2k views

Clamd won't start after update

Since updating clamd to 0.99.2-1.e15 on our RedHat 5 x86_64 system, it has failed to start successfully. The error we get is as follows: LibClamAV Error: cli_pcre_compile: PCRE compilation failed at ...
0
votes
2answers
188 views

CenOS: Is clamAV scanning files of a compressed archive attachment inside emails?

Is clamAV scanning files insides compressed archive inside emails? I was looking around to found an answer about this question. Somebody wrote that on some ubuntu distribution this is the default ...
1
vote
0answers
75 views

Outgoing mail runs into a series of spamd errors

I've got a mail setup using postfix and dovecot, with spamassassin, clamav and amavis. Incoming mail contains the correct X-Spam* headers and everything appears to be operating more or less correct, ...
0
votes
1answer
430 views

Limit ClamAV resources on scan or alternative solution

Environment Centos 6 Cpanel 32GB Ram 512gb SSD drive / about half used Took on managing a server and installed ClamAV. Used CRON to schedule a scan @ 1am. I notice that sites on the host stopped ...
1
vote
2answers
662 views

Maldet with ClamAV missing PHP base64_decode() & eval() hacks

I've installed Linux Malware Detect and ClamAV in my CentOS 7 server and seems it's all ok as it hits on the EICAR malware test files and does scheduled scans without issues. The problem comes when I ...
2
votes
1answer
28 views

mpool_malloc error, cannot access shell

I'm getting spammed the following error on boot: LibClamAC Error: mpool_malloc(): Attempt to allocate 8388608 bytes. Please report to http://bugs.clamav.net I read that I will need to update... but ...
0
votes
0answers
211 views

Postfix not sending, LibClamAV Error: mpool_malloc

This question is closely related this this one. However, in this case, clamav is going crazy and filling up boot.log, writing to it every second (and getting huge). Furthermore, postfix is totally ...
6
votes
5answers
16k views

clamav error: mpool_malloc(): Attempt to allocate 8388608 bytes

Following error is showed when starting clamd; freshclam[26882]: [LibClamAV] mpool_malloc():Attempt to allocate 8388608 bytes. Please report to http://bugs.clamav.net I have lots of RAM memory ...
-2
votes
1answer
859 views

Setup spammassin and clamav with Exim on ubuntu 16.04

I've been searching for help in setting up Spammassassin and ClamAV with Exim (on ubuntu-16.04), but all the guides are horribly out of date. Could anyone share their setup please?
0
votes
1answer
629 views

Clamav Error Internal Logger

I am running this cron job 30 01 * * * /usr/bin/freshclam --quiet; /usr/bin/clamscan --recursive --no-summary --infected / 2>/dev/null but i am receiving a daily email with error: ERROR: ...
1
vote
5answers
6k views

Debian 8: can't get ClamAV to listen on TCP 3310

I am trying to get Clamav-daemon running on a Debian 8 system so that it will listen on TCP port 3310. I have done the following: aptitude install clamav-daemon Then modified /etc/clamav/clamd.conf ...
1
vote
1answer
2k views

Postfix/Dovecot error: 4.7.1 Service Unavailable - Try Again Later

I'm having some issues with my mail server. I'm unable to send or receive any mail. Here's what I see in /var/log/mail.info: Aug 12 20:09:34 REDACTED postfix/submission/smtpd[23064]: connect from ...
0
votes
1answer
122 views

Mail server - Amavis with 7zip

After 1,5 year with working mail server on Ubuntu 14.04 I've experienced strange amavis logs listed below: http://pastebin.com/RwbNw78f Mail server is: Postfix + Dovecot + MySQL + Amavis + ClamAV + ...
6
votes
1answer
1k views

Integrating ClamAV with NGINX

We're using NGINX as our main web server, after moving away from Apache. We recently decided to test ClamAV integration, to make sure files uploaded by users are thoroughly scanned prior to transfer ...
1
vote
0answers
57 views

Using tmpwatch in conjunction with ClamAV

I would like to use tmpwatch to regularly clear out old unused files that build up in our /tmp directory. I'd prefer to use the default tmpwatch settings where files in /tmp are deleted only if they ...
1
vote
0answers
163 views

Sieve saved EICAR virus to Junk folder but also disregarded in the log

I have setup my own mail server by partially following the guide (series) here The sieve filter rule is: ... truncated ... # Trash messages with improperly formed message IDs if not header :regex "...
0
votes
1answer
870 views

Postfix can not receive mail with error: amavis[15499]: () (!)DENIED ACCESS from IP x.x.x.x, policy bank

My mail server ran very well. But after my setting an OpenConnect VPN on the mail server, I found the server could not receive mails from outside. For example, my host IP is 1.2.3.4 I did tail -f /...
1
vote
0answers
760 views

clamav installation with pcre in Amazon Linux

When we install ClamAV in our Amazon Linux ElasticBeanstalk instance with yum install clamav it gets installed without PCRE support, although the libraries are present in the instance. LibClamAV ...
0
votes
1answer
1k views

Connection refused by AMAVISD-NEW

I found here many information to set a AWS server on my own. I installed the DKIM patch and it's work great, but now I can't send mails. I had already problems sending mails, but now are deeper. Some ...
5
votes
1answer
2k views

Is it possible to check the progress of of a currently running clamAV scan?

I have searched around but not found a possible solution to this so far. I have an ongoing scan which I thought would've been finished at certain time, but unfortunately it has not. So I am wondering ...
1
vote
1answer
444 views

clamav: cannot scan from a file list on Windows?

salt win8 grains.item osfullname win8: ---------- osfullname: Microsoft Windows 8.1 Enterprise Evaluation salt win8 cmd.run shell='powershell' '& "C:\\Program Files\\ClamAV-x64\...
-1
votes
1answer
58 views

CentOS 6 ClamAV scan unexpected results

I am trying to scan whole server with below command using clamav. However I already installed Malware detector. The server scans for upto a minute or two and found some unexpected scanning results ...
4
votes
1answer
1k views

correct order for Postfix milters

I use the following milters with Postfix: ClamAV, OpenDKIM, OpenDMARC, Rspamd This is also the order they are being called via smtpd_milters. What would be the best order for them regarding ...
3
votes
2answers
3k views

How to scan multiple directories with clamav

I know how to scan one directory: clamscan -r /home but for the life of me I cannot seem to get multiple directories working and I cannot seem to Google this simple problem. I have tried: clamscan ...
2
votes
1answer
2k views

ClamAV Milter service will not start after updating clamav-milter

I recently updated ClamAV. Here are the packages that were updated: clamav-db-0.99-3.el6.x86_64 clamav-0.99-3.el6.x86_64 clamd-0.99-3.el6.x86_64 clamav-milter-0.99-3.el6.x86_64 libpng-1.2.49-2.el6_7....
8
votes
3answers
5k views

Is there a way to keep ClamAV updated on Debian 8?

Since upgrading to Debian 8 my syslog is full of ...freshclam[17851]: WARNING: Your ClamAV installation is OUTDATED! ...freshclam[17851]: WARNING: Local version: 0.98.7 Recommended version: 0.99 ......
-1
votes
1answer
117 views

Ubuntu Mysql stop working after outofmemory in a clamscan, mysqld.sock

I'm having daily problems with postman with autentification througth mysql on my Ubuntu14LTS Server. I think the problem arrise after a clamscan scron that breaks in an Out of Memory. In some way ...