How to Install / Configure ClamAV ?

[alexcheung]

I just install a fresh Fedora Core 5 and Install cPanel. But I found that there is no ClamAV and MailScanner.

I cannot use /script/mailscannerupdate --force to install mailscanner. I found that in my /etc folder, there is no exim_outgoing.conf, so the scripts is nothing to do.

And I also found that cPanel 11 make the maillog to single file, not like cPanel 10. Can I reconfig to rotate the log file into daily style.

Thx in advance. ^^

[cPanelDavidG]

I just install a fresh Fedora Core 5 and Install cPanel. But I found that there is no ClamAV and MailScanner.

I cannot use /script/mailscannerupdate --force to install mailscanner. I found that in my /etc folder, there is no exim_outgoing.conf, so the scripts is nothing to do.

And I also found that cPanel 11 make the maillog to single file, not like cPanel 10. Can I reconfig to rotate the log file into daily style.

Thx in advance. ^^

MailScanner is no longer supported by cPanel/WHM.

To install ClamAV, simply log into WHM, go to the cPanel section and click "Plugins." Check the box next to "clamavconnector" and click save at the bottom of the page. This will install ClamAV.

[alexcheung]

I installed the cPanel Pro and clamavconnector.

I download the eicar test virus file to test the functionality, it seem work on scan home directory, but not work in exim. I can send the email to account with the eicar.zip attachment.

If I upload the eicar.zip to home directory, it can identify by scan the home directory. But cannot detect the virus in email.

[cPanelDavidG]

I installed the cPanel Pro and clamavconnector.

I download the eicar test virus file to test the functionality, it seem work on scan home directory, but not work in exim. I can send the email to account with the eicar.zip attachment.

If I upload the eicar.zip to home directory, it can identify by scan the home directory. But cannot detect the virus in email.

In WHM -> Plugins -> ClamAV Connector, ensure that "Scan Mail" is checked.

[Flyer]

To install ClamAV, simply log into WHM, go to the cPanel section and click "Plugins." Check the box next to "clamavconnector" and click save at the bottom of the page. This will install ClamAV.

That process installs 0.90.2, which is two versions out of date. How do I upgrade to 0.91 (the latest version)?

Thanks.

[alexcheung]

In WHM -> Plugins -> ClamAV Connector, ensure that "Scan Mail" is checked.

It seem not work too. I also make user configuration -> Add All -> Checked Scan Mail. Also cannot scan the email.

[Grzeslaw]

I have other way to install the clamav on my server:

useradd clamav; groupadd clamav; cd /usr/src
wget http://freshmeat.net/redir/clamav/29355/url_tgz/clamav-0.91.tar.gz
mv /usr/local/etc/freshclam.conf /usr/local/etc/freshclam.conf.old
    mv /usr/local/etc/clamd.conf /usr/local/etc/clamd.conf.old
tar -xzf clamav-*
make && make install
sed -i 's/Example/#Example/g' /usr/local/etc/freshclam.conf
sed -i 's/Example/#Example/g' /usr/local/etc/clamd.conf
freshclam
touch /var/log/clam-update.log
chown clamav:clamav /var/log/clam-update.log
ln -s /usr/local/sbin/clamd /usr/sbin/clamd

after that, I changed, the exim.conf in the section check_message:

check_message:
#  Enabling this will make the server non-rfc compliant
#  require verify = header_sender
require verify = sender
deny message = TEXT - wrong MIME type ($demime_reason)
demime = *
condition = ${if >{$demime_errorlevel}{2}{1}{0}}
deny message = TEXT MALWARE  ($malware_name)
demime = *
malware = *
deny message = TEXT - wrong extention (.$found_extension)
demime = bat:com:pif:prf:scr:vbs:exe
warn message = X-Antivirus-Scanner: Clean mail though you should still use an Antivirus
  accept

[rachdian]

MailScanner is no longer supported by cPanel/WHM.

To install ClamAV, simply log into WHM, go to the cPanel section and click "Plugins." Check the box next to "clamavconnector" and click save at the bottom of the page. This will install ClamAV.

When install from whm/cpanel/plugins, the process never accomplish, stack at fetch progversion.bz2. What have i to do?

Got file ./html/clamavconnector/index.html ok (md5 matches)
Fetching http://httpupdate.cpanel.net/cpanels...blank.html.bz2 (0)....@208.74.123.20......connected......receiving...100%......Done
Got file ./html/clamavconnector/blank.html ok (md5 matches)
Fetching http://httpupdate.cpanel.net/cpanels...86/version.bz2 (0)....@208.74.123.20......connected......receiving...100%......Done
Got file ./version ok (md5 matches)
Fetching http://httpupdate.cpanel.net/cpanels...rogversion.bz2 (0)....@208.74.123.20......connected......receiving...100%......Done
Got file ./progversion ok (md5 matches)

[cPanelDavidG]

When install from whm/cpanel/plugins, the process never accomplish, stack at fetch progversion.bz2. What have i to do?

Got file ./html/clamavconnector/index.html ok (md5 matches)
Fetching http://httpupdate.cpanel.net/cpanels...blank.html.bz2 (0)....@208.74.123.20......connected......receiving...100%......Done
Got file ./html/clamavconnector/blank.html ok (md5 matches)
Fetching http://httpupdate.cpanel.net/cpanels...86/version.bz2 (0)....@208.74.123.20......connected......receiving...100%......Done
Got file ./version ok (md5 matches)
Fetching http://httpupdate.cpanel.net/cpanels...rogversion.bz2 (0)....@208.74.123.20......connected......receiving...100%......Done
Got file ./progversion ok (md5 matches)

For the process to not complete is abnormal, I'd recommend submitting a support request regarding this issue so our support team can diagnose and hopefully resolve the issue.

[markb14391]

In WHM -> Plugins -> ClamAV Connector, ensure that "Scan Mail" is checked.

I don't see this option, just the option to install and keep ClamAV updated (and the uninstall button).

[cPanelDavidG]

I don't see this option, just the option to install and keep ClamAV updated (and the uninstall button).

This functionality is now found in WHM -> Plugins -> Configure ClamAV Scanner

Given what you mention, it sounds like you're at WHM -> cPanel -> Manage Plugins instead. That is not the correct screen for configuring these settings.

[markb14391]

I see the options that allow users to perform scans, but how do I turn on automatic mail scanning?

Also, how can I verify that ClamAV and the automatic mail scanning are working?

Thanks,

Mark

[cPanelDavidG]

I see the options that allow users to perform scans, but how do I turn on automatic mail scanning?

Automatic mail scanning by ClamAV is turned on when the ClamAVConnector plugin is installed.

[furquan]

Hello Every one :

When i run the command : clamscan -ir / -l clamscanreport

The scan starts and says :-

Trojan-Small FOUND
Phishing.Heuristics.Email.SpoofedDomain FOUND
HTML.Phishing.Bank-1 FOUND
PHP.Shell FOUND
Phishing.Heuristics.Email.SpoofedDomain FOUND
etc ..
etc..

Many such messages like the above, but my query is, Is the scan also clearing the found virus and trojans or do we have to do some thing else to clean these files ?

any assistance will be appreciated.

[Grzeslaw]

Just read the manual. There is an option "--remove" to clean infected files.