Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [clamav]

Antivirus for UNIX-like systems primarily for mailserver integration.

Clam AntiVirus is an open source (GPL) anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways. It provides a number of utilities including a flexible and scalable multi-threaded daemon, a command line scanner and advanced tool for automatic database updates. The core of the package is an anti-virus engine available in a form of shared library.

  • command-line scanner
  • fast, multi-threaded daemon with support for on-access scanning
  • milter interface for sendmail
  • advanced database updater with support for scripted updates and digital signatures
  • virus scanner C library
  • on-access scanning (Linux® and FreeBSD®)
  • virus database updated multiple times per day (see home page for total number of signatures)
  • built-in support for various archive formats, including Zip, RAR, Tar, Gzip, Bzip2, OLE2, Cabinet, CHM, BinHex, SIS and others
  • built-in support for almost all mail file formats
  • built-in support for ELF executables and Portable Executable files compressed with UPX, FSG, Petite, NsPack, wwpack32, MEW, Upack and obfuscated with SUE, Y0da Cryptor and others

Official site: www.clamav.net

158 questions
2
votes
2 answers

Sending a file to a remote clamd instance

I may be misunderstanding how to utilize clamd. I've got a situation where I have a media server that isn't quite powerfull enough to scan files as well as host the other services it is running (raspberry pi). While I was looking through clamd.conf…
BobserLuck
  • 131
  • 1
  • 6
2
votes
1 answer

Installing clamav on Amazon Linux 2

I have been trying to install clamav on Amazon Linux 2 using the following which works fine on Amazon Linux 1: curl -O http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm sudo yum install epel-release-latest-7.noarch.rpm sudo yum…
williamsdb
  • 493
  • 1
  • 8
  • 18
2
votes
3 answers

clamav "killed" with no explanation

On a Debian 10 server I have this problem with clamav: root@vps:~# clamscan -r -v --stdout / Killed You see I use the verbose flag but that does not give me any information. In years of using clam I have not had this problem. I know it's not a…
Jason Cotman
  • 132
  • 2
  • 7
2
votes
0 answers

ClamAV for the host running docker containers - inotify/fanotify limits

I'm implementing anti-virus solution for Linux with ClamAV daemon running in On-Access mode, watching the created/opened files for malicious content at the host system AND in docker containers, running at the host. What limitations I've found so…
mva
  • 141
  • 4
1
vote
1 answer

Send mail when ClamAV detects a threat using systemd

Most of the guides for ClamAV discuss integration with syslog, and it is possible to configure syslog to send a message on certain logs. But, my system is running systemd, with no active syslog.service. How could I configure ClamAV to send a message…
palswim
  • 442
  • 2
  • 6
  • 24
1
vote
0 answers

Block dangerous word and excel docs?

The newest craze, apparently, is to add garbage into Office '97 formatted *.doc and *.xls files so that when a user opens them, and ignores warnings from Defender or anything else, they get infected with something. Usually, a trojan horse or a…
DrDamnit
  • 348
  • 5
  • 18
1
vote
1 answer

How to monitor ClamAV?

I have a postfix mailserver with amavis as a content_filter setup successfully an now I wonder how I can monitor if clamav is working properly. The clamav logfile is empty and I can not see any trace that it is working. I don't have any clue that it…
tex
  • 889
  • 1
  • 9
  • 19
1
vote
1 answer

What is YARA.eval_post.UNOFFICIAL and what should I do about it?

My ClamAV scan keeps finding examples of this in my Apache logs: YARA.eval_post.UNOFFICIAL Does anyone know what it is and what to do about it? I tried contacting the folks at yararules.com, but I haven't heard anything back. My log entries look…
sanitycheck
  • 111
  • 1
  • 1
  • 5
1
vote
0 answers

Yara Rule Project signatures autoupdate

I'm using a CentOS SPAM filter appliance ( eFa Project ) and while Yara is included, it doesn't seem to be downloading new signatures as expected using ClamAV/freshclam. Does anyone have any experience configuring clamav to automagically download…
Stuart Smith
  • 228
  • 2
  • 7
1
vote
0 answers

Clamav TCP 3310 setup Debian

I've run into this problem which is weird. I'm using Debian jessie I have setup clamav to listen also on port 3310 with the TCPSocket 3310 option. After saving the changes to the config file I restart the daemon with service clamav-daemon restart…
Fabrizio Mazzoni
  • 671
  • 1
  • 9
  • 24
1
vote
0 answers

Outgoing mail runs into a series of spamd errors

I've got a mail setup using postfix and dovecot, with spamassassin, clamav and amavis. Incoming mail contains the correct X-Spam* headers and everything appears to be operating more or less correct, except for a few erros when sending outgoing…
Nick Jennings
  • 350
  • 2
  • 11
1
vote
2 answers

Maldet with ClamAV missing PHP base64_decode() & eval() hacks

I've installed Linux Malware Detect and ClamAV in my CentOS 7 server and seems it's all ok as it hits on the EICAR malware test files and does scheduled scans without issues. The problem comes when I upload a real malware PHP file that I kept from a…
campsjos
  • 125
  • 7
1
vote
1 answer

Postfix/Dovecot error: 4.7.1 Service Unavailable - Try Again Later

I'm having some issues with my mail server. I'm unable to send or receive any mail. Here's what I see in /var/log/mail.info: Aug 12 20:09:34 REDACTED postfix/submission/smtpd[23064]: connect from ***[***] Aug 12 20:09:34 REDACTED…
kn0wmad1c
  • 11
  • 1
  • 4
1
vote
0 answers

Using tmpwatch in conjunction with ClamAV

I would like to use tmpwatch to regularly clear out old unused files that build up in our /tmp directory. I'd prefer to use the default tmpwatch settings where files in /tmp are deleted only if they have not been accessed for the last 10 days. I…
Elliot B.
  • 1,356
  • 2
  • 18
  • 28
1
vote
0 answers

Sieve saved EICAR virus to Junk folder but also disregarded in the log

I have setup my own mail server by partially following the guide (series) here The sieve filter rule is: ... truncated ... # Trash messages with improperly formed message IDs if not header :regex "message-id" ".*@.*\\." { fileinto :create…
hlx98007
  • 338
  • 1
  • 4
  • 11
1 2 3
…
10 11