Questions tagged [clamav]
Antivirus for UNIX-like systems primarily for mailserver integration.
158
questions
-1
votes
1
answer
272
views
ClamAV detected Win.Virus.Expiro-10004389-0 malware on Ubuntu instance in Conda package
Today clamAV scanned my AWS instances and detect infected files on each. It looks like false positive due to several reasons:
All these files are created in 2021 (why were they detected only
now?)
...
- 203
0
votes
0
answers
61
views
ClamAV didn't see virus inside an Archive
/home/folder/clam_daily.sh: OK
/home/folder/.sudo_as_admin_successful: Empty file
/home/folder/.selected_editor: OK
/home/folder/PROTECTAgentInstaller.tar.gz: OK
/home/folder/.bash_logout: OK
/home/...
10
votes
4
answers
6k
views
ClamAV detected Kaiji malware on Ubuntu instance
Today clamAV scanned my AWS instances and detect 24 infected files on each.
It looks like false positive due to several reasons:
All these files are created in October 2022 (why were they detected ...
- 203
1
vote
0
answers
497
views
clamav-daemon doesn't create /var/run/clamd.ctl
I installed clamav-daemon on Debian 11 and when I try to start it, it doesn't create the LocalSocket /var/run/clamd.ctl.
LocalSocket in my /etc/clamav/clamd.conf:
LocalSocket /var/run/clamav/clamd....
- 111
0
votes
1
answer
61
views
Completely disable temp files/temp directory in ClamAV via clamd.conf
Is there a way to fully disable the temp files/temp directory feature in ClamAV via clamd.conf such that no files are written to disk, even transiently?
- 469
0
votes
1
answer
542
views
Large test virus file for ClamAV
I need a test file larger than 10K that will trigger ClamAV
As per Large Virus File with EICAR-Test-Signature not identified by the clamav library , ClamAV will not detect the EICAR test virus when it ...
- 704
0
votes
1
answer
299
views
Why does status says it's dead and subsys locked, but it still running without issue?
Whenever I start Amavisd, the reports starting OK, but a status check says it's dead.
$ service amavisd start
Starting amavisd: [ OK ]
$ service amavisd ...
- 158
1
vote
1
answer
249
views
What is the default file system for ClamAV scans?
I have just installed ClamAV on a Pi4 running Buster. I have looked at the configuration file and don't see where it specifies which file system it will scan automatically. I know if I use this sudo ...
- 121
0
votes
0
answers
463
views
Amavis Configuration on Ubuntu 20.04 / Port 10025 already in use
i try to configure amavis on my ubuntu 20.04 with working postfix and kopano.
Postfix crashes with the following error:
Jan 10 11:23:52 mail postfix/postfix-script[143585]: fatal: cannot execute /usr/...
- 21
0
votes
0
answers
778
views
Clamav is very slow with tcp
I'm using clamonacc on my desktop computer and servers. I use a raspberry pi as clamd server. The clamd process only uses ~25% of all 4 cores so with htop I see it's using like ~100% and 400% is the ...
- 23
0
votes
1
answer
616
views
clamav - clamd error when setup as daemon (mac osx)
Issue:
Setting up clamav as a daemon process in mac osx throws some cumbersome errors and warnings while doing the setup and the documentation is good, but not perfect. I ran into some permission ...
- 1
1
vote
1
answer
782
views
Postfix not accepting recipient address: connect to private/policy: Connection refused
I thought I'd be clever and add amavis/spamassassin/clamav to my working Postfix installation. I got it working and then made a change. Walked away, had a beer, then found out I'd mucked up. This is ...
- 13
0
votes
1
answer
212
views
SELinux prevent connection clamd_port_t:tcp_socket
We have API Server (tomcat) which has clamAV configuration to scan any uploaded file to the system.
clamAV configuration will require the API server to connect to clamAV server.
SELinux is enabled on ...
0
votes
1
answer
1k
views
ClamAV cannot access files
I've a server (CentOS 7) with ClamAV installed. clamdscan is running every 12 hours and for some files, I'm always getting the following message:
ClamAV has failed to run. The return error message was:...
- 123
0
votes
0
answers
43
views
How does ClamAV secure its updates online?
Two questions, the second related to the first...
How does ClamAV secure its update virus definition operations from its online servers? I will assume (?) that it uses HTTPS for security, but a ...
- 145
0
votes
1
answer
996
views
How it works content_filter in Postfix using spamassassin and clamav ( filtering order )?
How it works content_filter in case where is used spamassassin and clamav ?
Here is example for one content_filter: http://www.postfix.org/FILTER_README.html
And I see that sendmail command cant use ...
- 41
0
votes
1
answer
383
views
xlsx extension file blocked in zimbra
So the issue is that i have been trying to send a mail from my server with xlsx file extension attachment but zimbra rejects the mail giving a message content is band
BANNED CONTENTS ALERT
Our ...
- 23
0
votes
1
answer
3k
views
ClamD: cannot change socket location
Ubuntu 20.04.2
ClamAV 0.102.4
I want to use a different value for ClamD's LocalSocket directive but keep getting the following error:
!LOCAL: Socket file /var/run/clamd.scan/clamd.sock could not be ...
6
votes
2
answers
8k
views
clamav-daemon start condition failed, /var/lib/clamav/daily.{c[vl]d,inc} was not met
After installing Modoboa(Open Source Mail Hosting), I Tried to start clamav-daemon, but i faced start condition failed.
systemctl status clamav-daemon.service
clamav-daemon.service - Clam ...
- 223
0
votes
1
answer
510
views
Cloud bucket malware security
I have implemented an antivirus system using ClamAV on one of my apps which uses Google cloud storage for uploading files. Currently what I am doing is, listening to bucket upload, download it on one ...
google-cloud-platform
0
votes
0
answers
703
views
Clamd using +1GB of memory
I've searched around and few similar questions where it was said that a few 100MB memory is normal for clamd.
Now actually I see it using more than 1GB and recently I have frequently that my system ...
1
vote
1
answer
635
views
Running clamscan with the file list function
I am trying to schedule some tasks using ClamAV but it cannot find the find the file that contains the directories I want it to scan.
*Using sudo doesn't work.
*The files are set with permissions ...
- 123
5
votes
2
answers
86
views
avoid redundant writing of virus scan signatures in VMs on same disk [closed]
I have two VMs on the same disk that each have clamav installed. Both regularly run updates for the same virus scan signatures
simultaneously which results in an unnecessary strain on the performance ...
- 59
0
votes
1
answer
732
views
ClamAv + Microsoft Azure VM: Cannot connect to daemon from other VM
I got two VMs on Azure that are in the same subnet. One VM (10.1.0.6) has clamav daemon running, the other runs a Java Wildfly Application (10.1.0.5).
I would like to send files from Java Application ...
- 101
1
vote
1
answer
859
views
How to speed up clamd@amavisd launch / get it to "start" on Amazon Linux 2
I recently upgraded clamav from I'm not sure which version, but whatever was current on EPEL on February 13th, to 0.102.3. Under the previous version, I had to set TimeoutStartSec in the systemd conf ...
- 409
4
votes
1
answer
1k
views
How are systemd/system overrides supposed to work?
I'm messing around with some timeout settings, and am trying to figure out the correct way to set things for systemd/system daemons. Specifically, this is an underpowered server, and I keep timing out ...
- 409
2
votes
2
answers
7k
views
Sending a file to a remote clamd instance
I may be misunderstanding how to utilize clamd. I've got a situation where I have a media server that isn't quite powerfull enough to scan files as well as host the other services it is running (...
- 131
0
votes
1
answer
488
views
ubuntu 18.04: clamav running, tomcat dying
Ubuntu 18.04. 2Gb RAM + 512mb swap.
When running clamav, it consumes 800+mb of memory because it loads all the signatures into the memory. Because of that, I set it to run every day at 3am instead of ...
- 267
2
votes
1
answer
5k
views
Installing clamav on Amazon Linux 2
I have been trying to install clamav on Amazon Linux 2 using the following which works fine on Amazon Linux 1:
curl -O http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
sudo yum ...
- 493
1
vote
2
answers
2k
views
Why does calling HEAD on this URL prevent the following error: ERROR: Message: SSL peer certificate or SSH remote key was not OK
This is an issue I'm having with a specific package but it looks like the software is using a version of CURL for windows or something. I want to understand this specific behavior because it doesnt ...
- 4,193
1
vote
1
answer
6k
views
Clamav on Centos 8 installation
I have installed ClamAV on Centos 8, following the installation guide on their website.
I have run freshclam and that works fine but if I try to do a scan I get the following error:
clamdscan /home
...
- 225
2
votes
3
answers
5k
views
clamav "killed" with no explanation
On a Debian 10 server I have this problem with clamav:
root@vps:~# clamscan -r -v --stdout /
Killed
You see I use the verbose flag but that does not give me any information. In years of using clam ...
- 132
3
votes
1
answer
1k
views
Large Virus File with EICAR-Test-Signature not identified by the clamav library
If I add the Eicar Test Signature at the beginning of a large text file, will that file turn out to be malicious? I opened a 5 MB binary file on Sublime Text and added the signatue at the beginning. ...
2
votes
0
answers
1k
views
ClamAV for the host running docker containers - inotify/fanotify limits
I'm implementing anti-virus solution for Linux with ClamAV daemon running in On-Access mode, watching the created/opened files for malicious content at the host system AND in docker containers, ...
- 141
0
votes
3
answers
690
views
Can I use Ansible to get a version number from clamAV
I am new to Ansible and googleing around i see how to install ClamAV using Ansible , but is there a way to just get the current version , I know I could just run it remotely via ssh
- 127
0
votes
1
answer
3k
views
Your ClamAV installation is OUTDATED
I'm running Vesta on Centos 7 and recently I've got this error.
server#: freshclam
current working dir is /var/lib/clamav
ClamAV update process started at Fri Dec 13 12:36:40 2019
Using IPv6 aware ...
0
votes
0
answers
36
views
clamd on several ports with different databases
Is it possible to run a clamd on one machine with different ports and each of them hold another database?
3310 = official databases
3311 = unofficial databases
3312 = yara rules
p.s. CentOS 6/7
- 1
0
votes
1
answer
145
views
Postfix (Maia Mailguard) relayhost update ignored
I have a postfix mail server used in conjunction with Maia Mailguard, Amavis, and clamav for spam. I've upgraded the primary mail server and it has a new IP address. I change main.cf and transport to ...
- 113
0
votes
0
answers
1k
views
ClamAV can't open/parse
I installed clamAV on an EC2 instance running CentOS, i made the install and when I go to run 'sudo freshclam' i get
ERROR: Can't open/parse the config file /usr/local/etc/freshclam.conf
However if ...
- 3
0
votes
0
answers
316
views
ClamAV Anti-Virus not Classifying Virus Emails as Virus
I have installed Sendmail as my SMTP mail server, SpamAssassin as Spam Classifier and ClamAV Anti-Virus. I tested out sending my server a virus email eicar.txt
Now I am receiving the virus email in ...
- 81
0
votes
2
answers
1k
views
clamd socket error in conjunction with amavisd (used for postfix) on CentOS 7
I can't seem to figure out a problem after a few hours of trouble-shooting and looking for similar cases.
Like ohter email servers in the exact same configuration, the affected one is based on CentOS ...
- 182
7
votes
3
answers
19k
views
How to make `clamdscan` exclude folders and only log `--infected`？
My server is centos 7.4, with clamav 0.101.1-1.el7.
When I run clamscan -r --infected --exclude-dir="^/sys" / through terminal, I always wait more than 6 hours to get output.
And if I close ...
- 945
0
votes
1
answer
192
views
Should `clamav-devel`, ` clamav-server-systemd`,`clamav-server` be installed if I only manual scan folder in one server?
In lots of how to install clamav in centos 7tutorial, all modules are installed,such like yum install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-...
- 945
1
vote
1
answer
1k
views
Send mail when ClamAV detects a threat using systemd
Most of the guides for ClamAV discuss integration with syslog, and it is possible to configure syslog to send a message on certain logs. But, my system is running systemd, with no active syslog....
- 442
0
votes
1
answer
2k
views
MailScanner error "Cannot find Socket"
CentOS 7, mail server. Messages stopped going in and out. Tried to debug, saw this in /var/log/maillog:
MailScanner[4786]: Cannot find Socket (/var/run/clamd.scan/clamd.sock) Exiting!
But the socket ...
- 112
6
votes
0
answers
5k
views
Socket access for clamdscan
On fc29 I have clamd installed and [email protected] is running fine. clamdscan runs for root but not for a regular user, even after addition to 'clamscan' group.
dnf list installed | grep clam
...
- 165
1
vote
0
answers
331
views
Block dangerous word and excel docs?
The newest craze, apparently, is to add garbage into Office '97 formatted *.doc and *.xls files so that when a user opens them, and ignores warnings from Defender or anything else, they get infected ...
- 348
0
votes
1
answer
747
views
(Can't load main.ndb) ClamAV Deamon Virus signature DB Error
I installed ClamAV as a "normal" application and inside the daemon mode. After the installation, the daemon status says the following part.
clamd[7425]: LibClamAV Error: cli_parseadd(): Problem ...
- 143
4
votes
2
answers
11k
views
Scan the full filesystem in parallel with clamscan
I run a clamav scan weekly on my servers. There is one server with a raid6 cluster of 30TB of disk space where the scan take more than 24h to run.
So I wonder how can I run clamscan on the whole ...
- 195
0
votes
1
answer
226
views
clamd: When has a signature reload completed?
One can send SIGUSR2 to a running clamd instance to reload the
signatures.
But how can I (from a script) determine, if the signatures
have been reloaded? I can of course try "sleep 30" which will ...
- 489