Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

ClamAV is not disinfecting mails

Discussion in 'E-mail Discussion' started by Kent Brockman, Jan 25, 2011.

  1. Kent Brockman

    Kent Brockman Well-Known Member

    Joined:
    Jan 20, 2008
    Messages:
    1,182
    Likes Received:
    7
    Trophy Points:
    168
    Location:
    Buenos Aires, Argentina
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hi there. I'm testing clam and noticed that when running the scan from the cpanel, and given that I purposedly sent several mails with the Eicar Test attached, I found that clamAV is detecting those mails as infected, but it is unable to disinfect (delete the attachment) or destroy (delete) those mails. Is this normal as these are Eicar Tests? or should I be worried about the impossibility to sanitize really infected mails in the future? May be this behaviour be due to a permissions issue? (clam can read, but cannot write)

    I'm running the last Stable cPanel with the last Clam from the plugin manager, on a CentOS 4 VPS.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #1 Kent Brockman, Jan 25, 2011
  2. LinuxTechie

    LinuxTechie Well-Known Member

    Joined:
    Jan 22, 2011
    Messages:
    502
    Likes Received:
    5
    Trophy Points:
    68
    cPanel Access Level:
    Root Administrator
    Hi Kent,

    Clamscan will only list the files infected in the clamscan log. There are no options to auto destroy the vulnerable files. I thinks you should give a try on Linux Malware Detect. We can quarantine the vulnerable files using this. Please have a look at the URL given below as a reference.

    http://forums.cpanel.net/f77/linux-malware-detect-lmd-intro-howto-157194.html

    One limitation of this security feature is that there is no plugin available in cPanel for this and you need to perform this via SSH.
    Still I thinks you should give a try!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #2 LinuxTechie, Jan 25, 2011
  3. Kent Brockman

    Kent Brockman Well-Known Member

    Joined:
    Jan 20, 2008
    Messages:
    1,182
    Likes Received:
    7
    Trophy Points:
    168
    Location:
    Buenos Aires, Argentina
    cPanel Access Level:
    Root Administrator
    Twitter:
    Yes, but I'm talking about the Clam Scan icon present in every cPanel account control panel. It allows you to scan the entire public_html dir or scan the allocated emails. when it detects infections, shows you a list with possible actions: disinfect, destroy, quarantine, ignore. The first two ones, appear to be correctly done after being selected, but a new scan will show the same infections again: clam is not disinfecting anything.

    In the other hand, I sent emails with the Eicar test attached and they get to the inbox without even being noticed by clam.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #3 Kent Brockman, Jan 26, 2011
  4. Kent Brockman

    Kent Brockman Well-Known Member

    Joined:
    Jan 20, 2008
    Messages:
    1,182
    Likes Received:
    7
    Trophy Points:
    168
    Location:
    Buenos Aires, Argentina
    cPanel Access Level:
    Root Administrator
    Twitter:
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #4 Kent Brockman, Jan 26, 2011
(You must log in or sign up to post here.)
Loading...
Similar Threads - ClamAV disinfecting mails
  1. DevTeam9200

    How to remove clamav additional databases

    DevTeam9200, Oct 4, 2018, in forum: General Discussion
    Replies:
    1
    Views:
    53
    cPanelLauren
    Oct 8, 2018
  2. Michaelit

    SOLVED Bypassing ClamAV Scan question

    Michaelit, Sep 11, 2018, in forum: Security
    Replies:
    11
    Views:
    421
    Michaelit
    Sep 20, 2018
  3. Peter Smith

    ClamAV duplicate database Warning

    Peter Smith, Sep 10, 2018, in forum: Security
    Replies:
    4
    Views:
    156
    cPanelMichael
    Sep 12, 2018
  4. Bdzzld

    ClamAV whitelist e-mail address

    Bdzzld, Sep 10, 2018, in forum: E-mail Discussion
    Replies:
    6
    Views:
    118
    cPanelLauren
    Sep 14, 2018
  5. Venomous21

    SOLVED [CPANEL-21749] ClamAV version 0.100.1

    Venomous21, Aug 15, 2018, in forum: Security
    Replies:
    2
    Views:
    206
    cPanelMichael
    Oct 1, 2018

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice