Cannot install ClamAV via clamavconnector plugin - conflicting antivirus software

[benito]

Hi

I got a new server two days ago an i cant install CLAMAV plugin. I got this error 10 times and stop:

etching http://httpupdate.cpanel.net/cpanelsync/addons/modules/clamavconnector-Linux-x86_64/clamav-0.95.3.tar.gz.bz2 (1)[email protected]%...2%...3%...4%...5%...6%...7%...8%...9%...10%...11%...12%...13%...14%...15%...16%...17%...18%...19%...20%...21%...22%...23%...24%...25%...26%...27%...28%...29%...30%...31%...32%...33%...34%...35%...36%...37%...38%...39%...40%...41%...42%...43%...44%...45%...46%...47%...48%...49%...50%...51%...52%...53%...54%...55%...56%...57%...58%...59%...60%...61%...62%...63%...64%...65%...66%...67%...68%...69%...70%...71%...72%...73%...74%...75%...76%...77%...78%...79%...80%...81%...82%...83%...84%...85%...86%...87%...88%...89%...90%...91%...92%...93%...94%...95%...96%...97%...98%...99%...100%......Done
md5sum mismatch (actual: ) (expected: eaf9fccc3cc3567605a9732313652967) (size: 0)
Fetching http://httpupdate.cpanel.net/cpanelsync/addons/modules/clamavconnector-Linux-x86_64/clamav-0.95.3.tar.gz (1)[email protected]%...2%...3%...4%...5%...6%...7%...8%...9%...10%...11%...12%...13%...14%...15%...16%...17%...18%...19%...20%...21%...22%...23%...24%...25%...26%...27%...28%...29%...30%...31%...32%...33%...34%...35%...36%...37%...38%...39%...40%...41%...42%...43%...44%...45%...46%...47%...48%...49%...50%...51%...52%...53%...54%...55%...56%...57%...58%...59%...60%...61%...62%...63%...64%...65%...66%...67%...68%...69%...70%...71%...72%...73%...74%...75%...76%...77%...78%...79%...80%...81%...82%...83%...84%...85%...86%...87%...88%...89%...90%...91%...92%...93%...94%...95%...96%...97%...98%...99%...100%......Done
md5sum mismatch (actual: ) (expected: eaf9fccc3cc3567605a9732313652967) (size: 0)
Download Failed... trying again...in....60....59....58....57....56....55....54....53....52....51....50....49....48....47....46....45....44....43....42....41....40....39....38....37....36....35....34....33....32....31....30....29....28....27....26....25....24....23....22....21....20....19....18....17....16....15....14....13....12....11....10....9....8....7....6....5....4....3....2....1..Fetching http://httpupdate.cpanel.net/cpanelsync/addons/modules/clamavconnector-Linux-x86_64/clamav-0.95.3.tar.gz.bz2 (0)[email protected]%...2%...3%...4%...5%...6%...7%...8%...9%...10%...11%...12%...13%...14%...15%...16%...17%...18%...19%...20%...21%...22%...23%...24%...25%...26%...27%...28%...29%...30%...31%...32%...33%...34%...35%...36%...37%...38%...39%...40%...41%...42%...43%...44%...45%...46%...47%...48%...49%...50%...51%...52%...53%...54%...55%...56%...57%...58%...59%...60%...61%...62%...63%...64%...65%...66%...67%...68%...69%...70%...71%...72%...73%...74%...75%...76%...77%...78%...79%...80%...81%...82%...83%...84%...85%...86%...87%...88%...89%...90%...91%...92%...93%...94%...95%...96%...97%...98%...99%...100%......Done
md5sum mismatch (actual: ) (expected: eaf9fccc3cc3567605a9732313652967) (size: 0)
...skipping 69.73.140.17...Download Failed... trying again...in....60....59....58....57....56....55....54....53....52....51.

My server is using: cPanel 11.25.0-S43473 - WHM 11.25.0 - X 3.9
REDHAT Enterprise 5.5 x86_64 standard

 

[MikeDVB]

Are you still experiencing this issue?

I'm on 11.25 Release and this isn't happening to me.

 

[benito]

Yes, i still have this problem. Using stable branch.

 

[MikeDVB]

Yes, i still have this problem. Using stable branch.

Execute this on your server and post the results:
"whereis md5sum"

 

[benito]

root@julieta [~]# whereis md5sum
md5sum: /usr/bin/md5sum /usr/share/man/man1/md5sum.1.gz
root@julieta [~]#

And just to me sure it works...

root@julieta [~]# md5sum cmm.tgz 
52eefd558a21861b78b87ff896ecf832  cmm.tgz
root@julieta [~]#

 

[cPanelDon]

Hi

I got a new server two days ago an i cant install CLAMAV plugin. I got this error 10 times and stop:

etching http://httpupdate.cpanel.net/cpanelsync/addons/modules/clamavconnector-Linux-x86_64/clamav-0.95.3.tar.gz.bz2 (1)[email protected]%...2%...3%...4%...5%...6%...7%...8%...9%...10%...11%...12%...13%...14%...15%...16%...17%...18%...19%...20%...21%...22%...23%...24%...25%...26%...27%...28%...29%...30%...31%...32%...33%...34%...35%...36%...37%...38%...39%...40%...41%...42%...43%...44%...45%...46%...47%...48%...49%...50%...51%...52%...53%...54%...55%...56%...57%...58%...59%...60%...61%...62%...63%...64%...65%...66%...67%...68%...69%...70%...71%...72%...73%...74%...75%...76%...77%...78%...79%...80%...81%...82%...83%...84%...85%...86%...87%...88%...89%...90%...91%...92%...93%...94%...95%...96%...97%...98%...99%...100%......Done
md5sum mismatch (actual: ) (expected: eaf9fccc3cc3567605a9732313652967) (size: 0)
Fetching http://httpupdate.cpanel.net/cpanelsync/addons/modules/clamavconnector-Linux-x86_64/clamav-0.95.3.tar.gz (1)[email protected]%...2%...3%...4%...5%...6%...7%...8%...9%...10%...11%...12%...13%...14%...15%...16%...17%...18%...19%...20%...21%...22%...23%...24%...25%...26%...27%...28%...29%...30%...31%...32%...33%...34%...35%...36%...37%...38%...39%...40%...41%...42%...43%...44%...45%...46%...47%...48%...49%...50%...51%...52%...53%...54%...55%...56%...57%...58%...59%...60%...61%...62%...63%...64%...65%...66%...67%...68%...69%...70%...71%...72%...73%...74%...75%...76%...77%...78%...79%...80%...81%...82%...83%...84%...85%...86%...87%...88%...89%...90%...91%...92%...93%...94%...95%...96%...97%...98%...99%...100%......Done
md5sum mismatch (actual: ) (expected: eaf9fccc3cc3567605a9732313652967) (size: 0)
Download Failed... trying again...in....60....59....58....57....56....55....54....53....52....51....50....49....48....47....46....45....44....43....42....41....40....39....38....37....36....35....34....33....32....31....30....29....28....27....26....25....24....23....22....21....20....19....18....17....16....15....14....13....12....11....10....9....8....7....6....5....4....3....2....1..Fetching http://httpupdate.cpanel.net/cpanelsync/addons/modules/clamavconnector-Linux-x86_64/clamav-0.95.3.tar.gz.bz2 (0)[email protected]%...2%...3%...4%...5%...6%...7%...8%...9%...10%...11%...12%...13%...14%...15%...16%...17%...18%...19%...20%...21%...22%...23%...24%...25%...26%...27%...28%...29%...30%...31%...32%...33%...34%...35%...36%...37%...38%...39%...40%...41%...42%...43%...44%...45%...46%...47%...48%...49%...50%...51%...52%...53%...54%...55%...56%...57%...58%...59%...60%...61%...62%...63%...64%...65%...66%...67%...68%...69%...70%...71%...72%...73%...74%...75%...76%...77%...78%...79%...80%...81%...82%...83%...84%...85%...86%...87%...88%...89%...90%...91%...92%...93%...94%...95%...96%...97%...98%...99%...100%......Done
md5sum mismatch (actual: ) (expected: eaf9fccc3cc3567605a9732313652967) (size: 0)
...skipping 69.73.140.17...Download Failed... trying again...in....60....59....58....57....56....55....54....53....52....51.

My server is using: cPanel 11.25.0-S43473 - WHM 11.25.0 - X 3.9
REDHAT Enterprise 5.5 x86_64 standard

So that we can more accurately diagnose the issue, it will help to have some additional information.

Please run the following commands via root SSH access and let us know the output that is displayed:

# ls -ahl /usr/local/cpanel/modules-install/clamavconnector*/*.tar.*
# lsattr -a /usr/local/cpanel/modules-install/clamavconnector*/*.tar.*

 

[benito]

Done

root@julieta [~]# ls -ahl /usr/local/cpanel/modules-install/clamavconnector*/*.tar.*
-rw-r--r-- 1 root root 72 Mar  4 18:36 /usr/local/cpanel/modules-install/clamavconnector-Linux-x86_64/clamav-0.95.3.tar.gz.sig
root@julieta [~]# lsattr -a /usr/local/cpanel/modules-install/clamavconnector*/*.tar.*
------------- /usr/local/cpanel/modules-install/clamavconnector-Linux-x86_64/clamav-0.95.3.tar.gz.sig
root@julieta [~]#

 

[cPanelJamyn]

<snip>
[B]md5sum mismatch (actual: ) (expected: eaf9fccc3cc3567605a9732313652967) (size: 0)
Download Failed[/B]... trying again...<snip>
Fetching http://httpupdate.cpanel.net/cpanelsync/addons/modules/clamavconnector-Linux-x86_64/clamav-0.95.3.tar.gz.bz2 (0)[email protected].<snip>

The file is not being saved to your server for some reason. Note the "size: 0" result, and the null md5sum (since the file did not download properly, it will not have a MD5 signature). If you still have this issue, I recommend you open a support ticket to have us look into the root cause. Thanks.

 

[benito]

My cpanel comes with the server on theplanet. I still can open a ticket or need to contact theplanet?

 

[cPanelDon]

My cpanel comes with the server on theplanet. I still can open a ticket or need to contact theplanet?

As a first step I recommend contacting your license provider, (e.g., The Planet), as they can ensure higher priority if your request needs to be escalated; however, if there is any difficulty receiving assistance you are welcome to contact us directly, such as via the following page: Additional Support Options - cPanel Inc.

 

[benito]

As a first step I recommend contacting your license provider, (e.g., The Planet), as they can ensure higher priority if your request needs to be escalated; however, if there is any difficulty receiving assistance you are welcome to contact us directly, such as via the following page: Additional Support Options - cPanel Inc.

I have opened a support ticket with cpanel.

Your Request id is: 612065.

 

[cPanelDon]

I have opened a support ticket with cpanel.

Your Request id is: 612065.

Thank you for the inquiry. Through the investigation it was discovered that a conflicting, preexisting anti-virus software product, that of Symantec Endpoint Antivirus, was detecting data in the normal ClamAV installation archive as a possible threat and subsequently quarantined the pertinent files involved causing the desired installation process to fail unexpectedly.

The solution is to ensure that there is only one anti-virus software product installed at any given time as having multiple will induce conflicts.

For reference, the following initialization script and manual "man" documentation may be used if needing to temporarily or manually stop the Symantec Endpoint Protection/Security daemon:

# /etc/init.d/rtvscand
Usage: /etc/init.d/rtvscand {start|stop|status|report|restart|condrestart}
# man rtvscand

The aforementioned anti-virus software daemon was noted to exist at the following installation path:

/opt/Symantec/symantec_antivirus/rtvscand

To help others that may experience the same situation, here are multiple variations of the relevant entries saved within the system "messages" log (at "/var/log/messages"); these entries are munged examples with "server" representing the system hostname:

/var/log/messages:2996:Apr  6 21:46:11 server rtvscand: Threat Found!Threat: Trojan Horse in File: /usr/local/cpanel/modules-install/clamavconnector-Linux-x86_64/clamav-0.95.3.tar.gz-cpanelsync>>/usr/loc...>>clamav-0... by: Auto-Protect scan.  Action: Quarantine succeeded : Access allowed.  Action Description: The file was quarantined successfully.
/var/log/messages:2997:Apr  6 21:46:12 server rtvscand: Threat Found!Threat:  in File: /usr/local/cpanel/modules-install/clamavconnector-Linux-x86_64/clamav-0.95.3.tar.gz-cpanelsync by: Auto-Protect scan.  Action: Quarantine succeeded : Access allowed.  Action Description: The file was quarantined successfully.

/var/log/messages:3752:Apr  7 16:12:05 server rtvscand: Threat Found!Threat: Trojan Horse in File: /usr/local/cpanel/modules-install/clamavconnector-Linux-x86_64/clamav-0.95.3.tar.gz>>/usr/loc...>>clamav-0... by: Auto-Protect scan.  Action: Quarantine succeeded : Access allowed.  Action Description: The file was quarantined successfully.
/var/log/messages:3753:Apr  7 16:12:06 server rtvscand: Threat Found!Threat:  in File: /usr/local/cpanel/modules-install/clamavconnector-Linux-x86_64/clamav-0.95.3.tar.gz by: Auto-Protect scan.  Action: Quarantine succeeded : Access allowed.  Action Description: The file was quarantined successfully.

/var/log/messages:4561:Apr  8 17:17:30 server rtvscand: Threat Found!Threat: Trojan Horse in File: /clamavconnector-Linux-x86_64/clamav-0.95.3.tar.gz>>/clamavc...>>clamav-0... by: Auto-Protect scan.  Action: Quarantine succeeded : Access allowed.  Action Description: The file was quarantined successfully.
/var/log/messages:4562:Apr  8 17:17:30 server rtvscand: Threat Found!Threat:  in File: /clamavconnector-Linux-x86_64/clamav-0.95.3.tar.gz by: Auto-Protect scan.  Action: Quarantine succeeded : Access allowed.  Action Description: The file was quarantined successfully.

/var/log/messages:4563:Apr  8 17:18:00 server rtvscand: Threat Found!Threat: Trojan Horse in File: /clamav-0.95.3.tar.gz-cpanelsync>>/clamav-0.95.3.tar.gz-cpanelsync>>clamav-0... by: Auto-Protect scan.  Action: Quarantine succeeded : Access allowed.  Action Description: The file was quarantined successfully.
/var/log/messages:4564:Apr  8 17:18:01 server rtvscand: Threat Found!Threat:  in File: /clamav-0.95.3.tar.gz-cpanelsync by: Auto-Protect scan.  Action: Quarantine succeeded : Access allowed.  Action Description: The file was quarantined successfully.

/var/log/messages:4567:Apr  8 17:19:36 server rtvscand: Threat Found!Threat: Trojan Horse in File: /root/clamav-0.95.3.tar.gz>>/root/clamav-0.95.3.tar>>clamav-0... by: Auto-Protect scan.  Action: Quarantine succeeded : Access allowed.  Action Description: The file was quarantined successfully.
/var/log/messages:4568:Apr  8 17:19:36 server rtvscand: Threat Found!Threat:  in File: /root/clamav-0.95.3.tar.gz by: Auto-Protect scan.  Action: Quarantine succeeded : Access allowed.  Action Description: The file was quarantined successfully.

/var/log/messages:4605:Apr  8 18:23:06 server rtvscand: Threat Found!Threat: Trojan Horse in File: /root/clam/clamav-0.96.tar.gz>>/root/cl...>>clamav-0.96/test/.split/split.clam-pespin.exeaa by: Auto-Protect scan.  Action: Quarantine succeeded : Access allowed.  Action Description: The file was quarantined successfully.
/var/log/messages:4606:Apr  8 18:23:11 server rtvscand: Threat Found!Threat:  in File: /root/clam/clamav-0.96.tar.gz by: Auto-Protect scan.  Action: Quarantine succeeded : Access allowed.  Action Description: The file was quarantined successfully.

 

[cPanelDon]

Friendly Moderator Note

The thread title has been revised to better reflect the specific issue that was identified and to minimize possible confusion.

 

[benito]

This is really hard to find, in case anyone need it, Symantec Endpoint removal from linux.

Manually uninstalling Symantec AntiVirus for Linux 1.0