Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

ClamAV is not disinfecting mails

Discussion in 'E-mail Discussions' started by Kent Brockman, Jan 25, 2011.

  1. Kent Brockman

    Kent Brockman Well-Known Member

    Joined:
    Jan 20, 2008
    Messages:
    1,176
    Likes Received:
    6
    Trophy Points:
    168
    Location:
    Buenos Aires, Argentina
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hi there. I'm testing clam and noticed that when running the scan from the cpanel, and given that I purposedly sent several mails with the Eicar Test attached, I found that clamAV is detecting those mails as infected, but it is unable to disinfect (delete the attachment) or destroy (delete) those mails. Is this normal as these are Eicar Tests? or should I be worried about the impossibility to sanitize really infected mails in the future? May be this behaviour be due to a permissions issue? (clam can read, but cannot write)

    I'm running the last Stable cPanel with the last Clam from the plugin manager, on a CentOS 4 VPS.
     
    #1 Kent Brockman, Jan 25, 2011
  2. LinuxTechie

    LinuxTechie Well-Known Member

    Joined:
    Jan 22, 2011
    Messages:
    502
    Likes Received:
    5
    Trophy Points:
    68
    cPanel Access Level:
    Root Administrator
    Hi Kent,

    Clamscan will only list the files infected in the clamscan log. There are no options to auto destroy the vulnerable files. I thinks you should give a try on Linux Malware Detect. We can quarantine the vulnerable files using this. Please have a look at the URL given below as a reference.

    http://forums.cpanel.net/f77/linux-malware-detect-lmd-intro-howto-157194.html

    One limitation of this security feature is that there is no plugin available in cPanel for this and you need to perform this via SSH.
    Still I thinks you should give a try!
     
    #2 LinuxTechie, Jan 25, 2011
  3. Kent Brockman

    Kent Brockman Well-Known Member

    Joined:
    Jan 20, 2008
    Messages:
    1,176
    Likes Received:
    6
    Trophy Points:
    168
    Location:
    Buenos Aires, Argentina
    cPanel Access Level:
    Root Administrator
    Twitter:
    Yes, but I'm talking about the Clam Scan icon present in every cPanel account control panel. It allows you to scan the entire public_html dir or scan the allocated emails. when it detects infections, shows you a list with possible actions: disinfect, destroy, quarantine, ignore. The first two ones, appear to be correctly done after being selected, but a new scan will show the same infections again: clam is not disinfecting anything.

    In the other hand, I sent emails with the Eicar test attached and they get to the inbox without even being noticed by clam.
     
    #3 Kent Brockman, Jan 26, 2011
  4. Kent Brockman

    Kent Brockman Well-Known Member

    Joined:
    Jan 20, 2008
    Messages:
    1,176
    Likes Received:
    6
    Trophy Points:
    168
    Location:
    Buenos Aires, Argentina
    cPanel Access Level:
    Root Administrator
    Twitter:
    #4 Kent Brockman, Jan 26, 2011
(You must log in or sign up to post here.)
Loading...
Similar Threads - ClamAV disinfecting mails
  1. Elizabeta

    SOLVED Clamav update question

    Elizabeta, Mar 21, 2018, in forum: General Discussion
    Replies:
    7
    Views:
    165
    Elizabeta
    Mar 23, 2018
  2. EneTar

    Initiated new Clamav scan through cPanel. Results location?

    EneTar, Feb 12, 2018, in forum: Security
    Replies:
    3
    Views:
    160
    cPanelMichael
    Mar 9, 2018
  3. Venomous21

    Clamav .99.2 vulnerabilities

    Venomous21, Jan 25, 2018, in forum: Security
    Replies:
    7
    Views:
    370
    cPanelMichael
    Mar 26, 2018
  4. Felipe G

    SOLVED clamav command line install

    Felipe G, Dec 3, 2017, in forum: General Discussion
    Replies:
    2
    Views:
    344
    cPanelMichael
    Dec 4, 2017
  5. equens

    SOLVED ClamAV email question

    equens, Nov 23, 2017, in forum: E-mail Discussions
    Replies:
    10
    Views:
    468
    cPanelMichael
    Feb 21, 2018

Share This Page