Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

ClamAV is not disinfecting mails

Discussion in 'E-mail Discussion' started by Kent Brockman, Jan 25, 2011.

  1. Kent Brockman

    Kent Brockman Well-Known Member

    Joined:
    Jan 20, 2008
    Messages:
    1,189
    Likes Received:
    8
    Trophy Points:
    168
    Location:
    Buenos Aires, Argentina
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hi there. I'm testing clam and noticed that when running the scan from the cpanel, and given that I purposedly sent several mails with the Eicar Test attached, I found that clamAV is detecting those mails as infected, but it is unable to disinfect (delete the attachment) or destroy (delete) those mails. Is this normal as these are Eicar Tests? or should I be worried about the impossibility to sanitize really infected mails in the future? May be this behaviour be due to a permissions issue? (clam can read, but cannot write)

    I'm running the last Stable cPanel with the last Clam from the plugin manager, on a CentOS 4 VPS.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #1 Kent Brockman, Jan 25, 2011
  2. LinuxTechie

    LinuxTechie Well-Known Member

    Joined:
    Jan 22, 2011
    Messages:
    502
    Likes Received:
    5
    Trophy Points:
    68
    cPanel Access Level:
    Root Administrator
    Hi Kent,

    Clamscan will only list the files infected in the clamscan log. There are no options to auto destroy the vulnerable files. I thinks you should give a try on Linux Malware Detect. We can quarantine the vulnerable files using this. Please have a look at the URL given below as a reference.

    http://forums.cpanel.net/f77/linux-malware-detect-lmd-intro-howto-157194.html

    One limitation of this security feature is that there is no plugin available in cPanel for this and you need to perform this via SSH.
    Still I thinks you should give a try!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #2 LinuxTechie, Jan 25, 2011
  3. Kent Brockman

    Kent Brockman Well-Known Member

    Joined:
    Jan 20, 2008
    Messages:
    1,189
    Likes Received:
    8
    Trophy Points:
    168
    Location:
    Buenos Aires, Argentina
    cPanel Access Level:
    Root Administrator
    Twitter:
    Yes, but I'm talking about the Clam Scan icon present in every cPanel account control panel. It allows you to scan the entire public_html dir or scan the allocated emails. when it detects infections, shows you a list with possible actions: disinfect, destroy, quarantine, ignore. The first two ones, appear to be correctly done after being selected, but a new scan will show the same infections again: clam is not disinfecting anything.

    In the other hand, I sent emails with the Eicar test attached and they get to the inbox without even being noticed by clam.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #3 Kent Brockman, Jan 26, 2011
  4. Kent Brockman

    Kent Brockman Well-Known Member

    Joined:
    Jan 20, 2008
    Messages:
    1,189
    Likes Received:
    8
    Trophy Points:
    168
    Location:
    Buenos Aires, Argentina
    cPanel Access Level:
    Root Administrator
    Twitter:
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #4 Kent Brockman, Jan 26, 2011
(You must log in or sign up to post here.)
Loading...
Similar Threads - ClamAV disinfecting mails
  1. keat63

    CLAMAV not working as expected

    keat63, Dec 4, 2018, in forum: E-mail Discussion
    Replies:
    2
    Views:
    308
    cPanelLauren
    Dec 5, 2018
  2. jlucho

    Problem updating ClamAV

    jlucho, Nov 26, 2018, in forum: Security
    Replies:
    11
    Views:
    306
    cPanelLauren
    Nov 28, 2018
  3. Mehmet Sen

    SOLVED Scan All Accounts with ClamAV?

    Mehmet Sen, Nov 12, 2018, in forum: Security
    Replies:
    2
    Views:
    136
    cPanelMichael
    Nov 12, 2018
  4. durangod

    Tar archive with clamav and cpaneldemo permissions

    durangod, Oct 21, 2018, in forum: Security
    Replies:
    1
    Views:
    116
    cPanelLauren
    Oct 23, 2018
  5. DevTeam9200

    How to remove clamav additional databases

    DevTeam9200, Oct 4, 2018, in forum: General Discussion
    Replies:
    1
    Views:
    121
    cPanelLauren
    Oct 8, 2018

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice