Questions tagged [clamav]
Antivirus for UNIX-like systems primarily for mailserver integration.
164
questions
0
votes
1
answer
2k
views
MailScanner error "Cannot find Socket"
CentOS 7, mail server. Messages stopped going in and out. Tried to debug, saw this in /var/log/maillog:
MailScanner[4786]: Cannot find Socket (/var/run/clamd.scan/clamd.sock) Exiting!
But the socket ...
- 112
6
votes
0
answers
6k
views
Socket access for clamdscan
On fc29 I have clamd installed and [email protected] is running fine. clamdscan runs for root but not for a regular user, even after addition to 'clamscan' group.
dnf list installed | grep clam
...
- 165
1
vote
0
answers
343
views
Block dangerous word and excel docs?
The newest craze, apparently, is to add garbage into Office '97 formatted *.doc and *.xls files so that when a user opens them, and ignores warnings from Defender or anything else, they get infected ...
- 348
0
votes
1
answer
769
views
(Can't load main.ndb) ClamAV Deamon Virus signature DB Error
I installed ClamAV as a "normal" application and inside the daemon mode. After the installation, the daemon status says the following part.
clamd[7425]: LibClamAV Error: cli_parseadd(): Problem ...
- 143
4
votes
2
answers
13k
views
Scan the full filesystem in parallel with clamscan
I run a clamav scan weekly on my servers. There is one server with a raid6 cluster of 30TB of disk space where the scan take more than 24h to run.
So I wonder how can I run clamscan on the whole ...
- 195
0
votes
1
answer
236
views
clamd: When has a signature reload completed?
One can send SIGUSR2 to a running clamd instance to reload the
signatures.
But how can I (from a script) determine, if the signatures
have been reloaded? I can of course try "sleep 30" which will ...
- 489
2
votes
1
answer
7k
views
subprocess installed pre-removal script returned error exit status 5
Trying to get clamav and clamav-daemon uninstalled but seems apt and dpkg are stuck and nothing can complete without this error:
dpkg --remove output:
(Reading database ... 385080 files and ...
- 123
1
vote
1
answer
16k
views
What is YARA.eval_post.UNOFFICIAL and what should I do about it?
My ClamAV scan keeps finding examples of this in my Apache logs: YARA.eval_post.UNOFFICIAL
Does anyone know what it is and what to do about it?
I tried contacting the folks at yararules.com, but I ...
- 111
1
vote
0
answers
98
views
Yara Rule Project signatures autoupdate
I'm using a CentOS SPAM filter appliance ( eFa Project ) and while Yara is included, it doesn't seem to be downloading new signatures as expected using ClamAV/freshclam.
Does anyone have any ...
- 228
0
votes
1
answer
300
views
Clam Unknown OSSEC Warning
There is a problem with Clam antivirus on my server. I am getting this notification from OSSEC once per day. I am not sure where to look or what the problem actually is. Could anyone point to the ...
- 509
2
votes
2
answers
10k
views
Error with clamd amavisd CentOS 7
I am getting issue with clamd and amavisd please see error message below
I am running an email server on CentOS 7.3..... amavisd and clamd seems working fine, but they keep jump up with errors every ...
- 21
0
votes
1
answer
877
views
postfix fails sending mails with clamav
I have a problem on my server running postfix with ClamAV, it doesn't send nor receives mails since yesterday, which is a really big deal for us..
So I checked the mail.log file and found out that ...
- 101
5
votes
1
answer
7k
views
ClamAV and MalDet - Are these quarantined or infected?
Learning about hardening my VPS, I installed ClamAV and MalDet, using both for a few months. Tonight, I decided that, instead of just checking home I'd check the entire VPS other than "/sys".
This ...
3
votes
1
answer
3k
views
ClamAV signature to ban office documents with macros
We are using custom signatures for ClamAV database to ban some types of files when they're attached to one email.
This it's done using clamd and clamassassin with procmail.
We're looking to add a ...
- 472
1
vote
0
answers
1k
views
Clamav TCP 3310 setup Debian
I've run into this problem which is weird. I'm using Debian jessie I have setup clamav to listen also on port 3310 with the TCPSocket 3310 option.
After saving the changes to the config file I ...
- 691
2
votes
2
answers
3k
views
Clamd won't start after update
Since updating clamd to 0.99.2-1.e15 on our RedHat 5 x86_64 system, it has failed to start successfully. The error we get is as follows:
LibClamAV Error: cli_pcre_compile: PCRE compilation failed at ...
0
votes
2
answers
1k
views
CenOS: Is clamAV scanning files of a compressed archive attachment inside emails?
Is clamAV scanning files insides compressed archive inside emails?
I was looking around to found an answer about this question.
Somebody wrote that on some ubuntu distribution this is the default ...
- 143
1
vote
0
answers
398
views
Outgoing mail runs into a series of spamd errors
I've got a mail setup using postfix and dovecot, with spamassassin, clamav and amavis. Incoming mail contains the correct X-Spam* headers and everything appears to be operating more or less correct, ...
- 350
0
votes
1
answer
992
views
Limit ClamAV resources on scan or alternative solution
Environment
Centos 6
Cpanel
32GB Ram
512gb SSD drive / about half used
Took on managing a server and installed ClamAV. Used CRON to schedule a scan @ 1am. I notice that sites on the host stopped ...
- 91
1
vote
2
answers
2k
views
Maldet with ClamAV missing PHP base64_decode() & eval() hacks
I've installed Linux Malware Detect and ClamAV in my CentOS 7 server and seems it's all ok as it hits on the EICAR malware test files and does scheduled scans without issues.
The problem comes when I ...
- 125
2
votes
1
answer
42
views
mpool_malloc error, cannot access shell
I'm getting spammed the following error on boot:
LibClamAC Error: mpool_malloc(): Attempt to allocate 8388608 bytes. Please report to http://bugs.clamav.net
I read that I will need to update... but ...
- 223
0
votes
0
answers
261
views
Postfix not sending, LibClamAV Error: mpool_malloc
This question is closely related this this one. However, in this case, clamav is going crazy and filling up boot.log, writing to it every second (and getting huge). Furthermore, postfix is totally ...
6
votes
5
answers
18k
views
clamav error: mpool_malloc(): Attempt to allocate 8388608 bytes
Following error is showed when starting clamd;
freshclam[26882]: [LibClamAV] mpool_malloc():Attempt to allocate
8388608 bytes. Please report to http://bugs.clamav.net
I have lots of RAM memory ...
- 71
-2
votes
2
answers
1k
views
Setup spammassin and clamav with Exim on ubuntu 16.04
I've been searching for help in setting up Spammassassin and ClamAV with Exim (on ubuntu-16.04), but all the guides are horribly out of date. Could anyone share their setup please?
- 154
0
votes
1
answer
1k
views
Clamav Error Internal Logger
I am running this cron job
30 01 * * * /usr/bin/freshclam --quiet; /usr/bin/clamscan --recursive --no-summary --infected / 2>/dev/null
but i am receiving a daily email with error:
ERROR: ...
- 509
6
votes
6
answers
21k
views
Debian 8: can't get ClamAV to listen on TCP 3310
I am trying to get Clamav-daemon running on a Debian 8 system so that it will listen on TCP port 3310. I have done the following:
aptitude install clamav-daemon
Then modified /etc/clamav/clamd.conf ...
- 191
1
vote
1
answer
7k
views
Postfix/Dovecot error: 4.7.1 Service Unavailable - Try Again Later
I'm having some issues with my mail server. I'm unable to send or receive any mail.
Here's what I see in /var/log/mail.info:
Aug 12 20:09:34 REDACTED postfix/submission/smtpd[23064]: connect from ...
- 11
0
votes
1
answer
219
views
Mail server - Amavis with 7zip
After 1,5 year with working mail server on Ubuntu 14.04 I've experienced strange amavis logs listed below: http://pastebin.com/RwbNw78f
Mail server is: Postfix + Dovecot + MySQL + Amavis + ClamAV + ...
- 43
6
votes
1
answer
3k
views
Integrating ClamAV with NGINX
We're using NGINX as our main web server, after moving away from Apache. We recently decided to test ClamAV integration, to make sure files uploaded by users are thoroughly scanned prior to transfer ...
1
vote
0
answers
75
views
Using tmpwatch in conjunction with ClamAV
I would like to use tmpwatch to regularly clear out old unused files that build up in our /tmp directory. I'd prefer to use the default tmpwatch settings where files in /tmp are deleted only if they ...
- 1,356
1
vote
0
answers
284
views
Sieve saved EICAR virus to Junk folder but also disregarded in the log
I have setup my own mail server by partially following the guide (series) here
The sieve filter rule is:
... truncated ...
# Trash messages with improperly formed message IDs
if not header :regex "...
- 338
1
vote
1
answer
2k
views
Postfix can not receive mail with error: amavis[15499]: () (!)DENIED ACCESS from IP x.x.x.x, policy bank
My mail server ran very well. But after my setting an OpenConnect VPN on the mail server, I found the server could not receive mails from outside.
For example, my host IP is 1.2.3.4
I did tail -f /...
- 239
1
vote
0
answers
1k
views
clamav installation with pcre in Amazon Linux
When we install ClamAV in our Amazon Linux ElasticBeanstalk instance with yum install clamav it gets installed without PCRE support, although the libraries are present in the instance.
LibClamAV ...
- 602
1
vote
1
answer
4k
views
Connection refused by AMAVISD-NEW
I found here many information to set a AWS server on my own.
I installed the DKIM patch and it's work great, but now I can't send mails.
I had already problems sending mails, but now are deeper.
Some ...
7
votes
4
answers
12k
views
Is it possible to check the progress of of a currently running clamAV scan?
I have searched around but not found a possible solution to this so far.
I have an ongoing scan which I thought would've been finished at certain time, but unfortunately it has not. So I am wondering ...
- 1,435
1
vote
1
answer
963
views
clamav: cannot scan from a file list on Windows?
salt win8 grains.item osfullname
win8:
----------
osfullname:
Microsoft Windows 8.1 Enterprise Evaluation
salt win8 cmd.run shell='powershell' '& "C:\\Program Files\\ClamAV-x64\...
- 51.8k
-1
votes
1
answer
78
views
CentOS 6 ClamAV scan unexpected results
I am trying to scan whole server with below command using clamav. However I already installed Malware detector. The server scans for upto a minute or two and found some unexpected scanning results ...
- 3
4
votes
1
answer
2k
views
correct order for Postfix milters
I use the following milters with Postfix:
ClamAV, OpenDKIM, OpenDMARC, Rspamd
This is also the order they are being called via smtpd_milters.
What would be the best order for them regarding ...
- 313
6
votes
3
answers
11k
views
How to scan multiple directories with clamav
I know how to scan one directory:
clamscan -r /home
but for the life of me I cannot seem to get multiple directories working and I cannot seem to Google this simple problem.
I have tried:
clamscan ...
- 719
2
votes
1
answer
3k
views
ClamAV Milter service will not start after updating clamav-milter
I recently updated ClamAV. Here are the packages that were updated:
clamav-db-0.99-3.el6.x86_64
clamav-0.99-3.el6.x86_64
clamd-0.99-3.el6.x86_64
clamav-milter-0.99-3.el6.x86_64
libpng-1.2.49-2.el6_7....
- 141
8
votes
3
answers
7k
views
Is there a way to keep ClamAV updated on Debian 8?
Since upgrading to Debian 8 my syslog is full of
...freshclam[17851]: WARNING: Your ClamAV installation is OUTDATED!
...freshclam[17851]: WARNING: Local version: 0.98.7 Recommended version: 0.99
......
- 3,129
-2
votes
1
answer
280
views
Ubuntu Mysql stop working after outofmemory in a clamscan, mysqld.sock
I'm having daily problems with postman with autentification througth mysql on my Ubuntu14LTS Server.
I think the problem arrise after a clamscan scron that breaks in an Out of Memory. In some way ...
-1
votes
1
answer
806
views
Clamd cannot start
I am using Centos 6 and clamd (clamav daemon) cannot start:
Here is the error message:
Starting Clam AntiVirus Daemon: LibClamAV Error: cli_load(): Can't open file /var/clamav/lmd.user.hdb
LibClamAV ...
- 153
-5
votes
1
answer
4k
views
Spam and Virus filtering not working with amavis, Spamassasin and ClamAV using Postfix on Ubuntu
I have setup mailserver using Postfix and Dovecot. Sending is receiving mail is working perfectly. This is email server is running from last couple of years without any issue. Recently we started ...
- 143
1
vote
1
answer
192
views
Gmail (Google Apps) filtering capabilities plus local clamav+spamassassin?
Scenario: My company is going to move all the mail accounts from the current local (and ancient) POP-only provider to gmail, via google apps for work.
Current status: Currently we are using a ...
- 664
10
votes
2
answers
954
views
Is there a way to know why a service is restarted and who did it?
Ubuntu 14.04
clamav 0.98.7
The problem is clamav-daemon is restarted nearly daily:
Sep 1 06:30:00 x-master clamd[6778]: Pid file removed.
clamd[6778]: --- Stopped at Tue Sep 1 06:30:00 2015
clamd[...
- 51.8k
1
vote
1
answer
3k
views
Creating an SELINUX allow rule for sockets error with clamd
I've got a CentOS 7 box configured as a Squid proxy, with clamav and Squidclamav. Normally I would just disable SELINUX, but I am attempting to understand and setup allow rules properly. I've managed ...
- 684
1
vote
2
answers
2k
views
Clamdscan error when launched by apache user "No file descriptor received. ERROR"
We're trying to use clamav on a centos 7 server in order to scan directly files on our web apps (Moodle for example).
When trying to execute a clamdscan from apache, we got this error (the file belong ...
- 13
2
votes
2
answers
2k
views
Can I get clamav-daemon to run without first updating with freshclam?
It's painfully slow to run freshclam, but clamav-daemon won't start without it:
$ sudo service clamav-daemon start
* Clamav signatures not found in /var/lib/clamav
* Please retrieve them using ...
- 946
1
vote
1
answer
2k
views
Configuration of ClamAV on Fedora Core 21 with Postfix
I was unable to find any help anywhere on installing Clamav on a modern Fedora system. All the advice out there is old and doesn't apply - so far as I found anyway.
And, it's not enough straight-...
- 1,262