ClamAV

keat63

• July 14, 2015 04:40

Today, my internal UTM has detected 5 Virus. One of which was an email Virus. I'm assuming the possibility that the other four were the same. I have ClamAV on my server, does ClamAV do any live virus scanning ?

• 

  24x7server

  • July 14, 2015 11:22

  Hello, Yes, You can integrate ClamAV with the exim. Please check ClamAV configuration docs and try to update it on your server.

  0
• 

  keat63

  • July 14, 2015 12:51

  I checked the settings in Exim Config, and they are switched on. The only thing i don't have employed is a daily cron job, as i run a check manually. In the event that ClamAV found a virus in an email, what would it do ? I don't recall seeing anything that would indicate it ever caught a virus.

  0
• 

  cPanelMichael

  • July 16, 2015 13:34

  Hello :)

  In the event that ClamAV found a virus in an email, what would it do ?

  
  You can search /var/log/exim_rejectlog to see ClamAV activity for Exim. EX:
  zgrep -Hn "This message contains a virus or other harmful content" /var/log/exim_rejectlog*
  Thank you.

  0
• 

  keat63

  • July 17, 2015 12:15

  I ran that command, but nothing was revealed. I'm having a serious AV malfunction at the moment. It seems that ClamAV is either not scanning emails or not detecting virus. and today I've discovered that my UTM has a bug with POP3 AV. So I'm having to rely on client AV and user intuition. Unfortunately i can dismiss the latter. Do i need to resort to MailScanner ?

  0
• 

  cPanelMichael

  • August 26, 2015 20:15

  I ran that command, but nothing was revealed.

  
  It's possible that ClamAV has yet to detect a virus. You can send a test email with the EICAR signature to verify it's working as intended:

  0
• 

  keat63

  • August 27, 2015 09:55

  I'm even struggling with this. My firewall won't allow access to the link you sent, so I connected via my phone. However, the AV on my phone detected the test file as a virus and wouldn't let me download it. Turning off AV on my phone allowed the file download, so now i try to send it to myself via Gmail. Only Gmail detects it as a virus so sending fails. and running " zgrep -Hn "This message contains a virus or other harmful content" /var/log/exim_rejectlog*" still fails to display anything, so I can only assume that in the 6 months i've had ClamV installed, it's failed to detect a single virus.

  0
• 

  cPanelMichael

  • August 28, 2015 19:13

  Only Gmail detects it as a virus so sending fails.

  
  You could try sending it through another email provider or your ISP in a third-party email client such as Thunderbird. Thank you.

  0

Please sign in to leave a comment.