SOLVED [CPANEL-20678] ClamAV freshclam and clamscan binaries are different versions.

jndawson

Well-Known Member
Aug 27, 2014
303
32
78
Western US
cPanel Access Level
DataCenter Provider
We got an email alert from a server that has had the ClamAV plugin installed for at least 5 years (and Manage Plugins' indicates it's properly installed):

Code:
ClamAV freshclam and clamscan binaries are different versions. Install ClamAV within "Manage Plugins".
We just updated to v.66.0.22 last night during normal update cycle. We've received no binary mismatch notice on any other servers.

We decided to remove the plugin and reinstall it. Seemed to go well, 'Manage Plugins' indicates it's properly installed and 'Service Status' indicates it's running.

Just for grins, we restarted clamd to be sure all was copacetic:
Code:
[ [email protected] ~># /scripts/restartsrv_clamd
Waiting for âclamdâclamdâ

Service Status
        clamd (/usr/local/cpanel/3rdparty/bin/clamd) is running as root with PID 21668 (pidfile+/proc check method).

Startup Log
        LibClamAV Warning: Detected duplicate databases /usr/local/cpanel/3rdparty/share/clamav/main.cvd and /usr/local/cpanel/3rdparty/share/clamav/main.cld, please manually remove one of them

clamd restarted successfully.
Here's what we've got:

Code:
[ [email protected] ~># ls -l /usr/local/cpanel/3rdparty/share/clamav/main*
-rw-r--r-- 1 clamav clamav 307499008 Jun  7 21:09 /usr/local/cpanel/3rdparty/share/clamav/main.cld
-rw-r--r-- 1 clamav clamav 117892267 Sep 14 11:06 /usr/local/cpanel/3rdparty/share/clamav/main.cvd
main.cvd apparently created when reinstalling the plugin; main.cld apparently the old one which should be removed.

Correct?

If so, do we need to reinstall the clamAV plugin on the other servers? And any reason/speculation why this occurred?
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,908
2,218
463
ClamAV freshclam and clamscan binaries are different versions. Install ClamAV within "Manage Plugins".
Hello,

Are you sure no other installations of ClamAV exist on this system? For instance, check to see the output of the following commands:

Code:
rpm -qa|grep clam
locate freshclam
Thank you.
 

jndawson

Well-Known Member
Aug 27, 2014
303
32
78
Western US
cPanel Access Level
DataCenter Provider
Hello,

Are you sure no other installations of ClamAV exist on this system? For instance, check to see the output of the following commands:

Code:
rpm -qa|grep clam
locate freshclam
Thank you.
We already did that:
Code:
[ [email protected] ~># rpm -qa|grep clam
cpanel-clamav-0.99.2-2.cp1164.x86_64
cpanel-clamav-virusdefs-0.99.2-2.cp1164.x86_64

[ [email protected] ~># locate freshclam
/usr/local/cpanel/3rdparty/bin/freshclam
/usr/local/cpanel/3rdparty/etc/freshclam.conf
/usr/local/cpanel/3rdparty/share/man/man1/freshclam.1
/usr/local/cpanel/3rdparty/share/man/man5/freshclam.conf.5
/var/asl/data/templates/template-freshclam.conf
Still have the same questions, and no, none of our other servers have experienced the same weird error message.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,908
2,218
463
Hello,

Could you open a support ticket using the link in my signature so we can take a closer look to see why the "ClamAV freshclam and clamscan binaries are different versions" notification was sent on the affected system? It should not be sent if the only installed ClamAV instance was enabled through the "WHM >> Manager Plugins" interface.

Thank you.
 

verdon

Well-Known Member
Nov 1, 2003
923
11
168
Northern Ontario, Canada
cPanel Access Level
Root Administrator
I just received this same alert overnight.
CENTOS 6.9 standard - v66.0.27
Code:
# rpm -qa|grep clam
cpanel-clamav-0.99.2-2.cp1164.x86_64
cpanel-clamav-virusdefs-0.99.2-2.cp1164.x86_64
# locate freshclam
 /usr/local/cpanel/3rdparty/bin/freshclam
/usr/local/cpanel/3rdparty/etc/freshclam.conf
/usr/local/cpanel/3rdparty/share/man/man1/freshclam.1
/usr/local/cpanel/3rdparty/share/man/man5/freshclam.conf.5
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,908
2,218
463
Hello @verdon,

Could you open a support ticket using the link in my signature so we can take a closer look?

Thank you.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,908
2,218
463
I'm so sorry. I completely missed this reply @cPanelMichael. Is there any point after this amount of time, and an update to v.68. Is there something I can test? I have not received this notification since. Just the one time.
We could check to make sure there are no rogue copies of ClamAV or FreshClam installed on the system.

Thank you.
 

verdon

Well-Known Member
Nov 1, 2003
923
11
168
Northern Ontario, Canada
cPanel Access Level
Root Administrator
What was the result?
Only that there were no rogue/extra copies of ClamAV or FreshClam on the system. There had been an update to whm v.68 run on the server since the initial incident, and it's possible that any duplicate was cleaned up then. I suppose it's possible it was just a false positive to begin with as well. I don't know, but it is all good now.
 

PeteS

Well-Known Member
Jun 8, 2017
220
48
28
Oregon
cPanel Access Level
Root Administrator
I have the same message. It showed up in the 5/53 upcp. In the 5/22 upcp clamav updated to 0.99.4-3 and cPanel upgraded to v70.0.43. So it looks like clamav and cPanel updated at the same time, then the next upcp raised this error. Is this a bug in the update? I see the v70.0.44 just updated last night.

I can run the above checks and do an un/re-install of clamav (then recheck) but I would like to hear the results of more of the tickets that are opened. (The one that reported above seemed to indicate that the above solution was adequate.)

@cPanelMichael, it would be helpful to have an official report on what this is about and why it (apparently) happens. FYI clamav was only installed on this server through WHM and has been maintained via WHM.

-Pete
 
Last edited:

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,908
2,218
463
Hello Everyone,

The Security Advisor State Change notification (configurable in WHM >> Contact Manager) is sent when a change to the state of a security issue is detected as part of the /usr/local/cpanel/scripts/check_security_advice_changes script. This script runs automatically during the cPanel update, and includes an assessment of the freshclam and clanscan versions.

Based on the reports on this thread, it's possible the ClamAV update that occurs during the cPanel update is not completing successfully or is still in-progress when the check_security_advice_changes script runs. However, I've been unable to reproduce this issue on a test system.

Could someone facing this issue recently open a support ticket and post the ticket number here? I'll link the ticket to this forums thread so we can ensure an internal case is opened if necessary.

Thank you.
 

PeteS

Well-Known Member
Jun 8, 2017
220
48
28
Oregon
cPanel Access Level
Root Administrator
Same alert for me. I installed ClamAV via WHM yesterday on a new server received this message today.
Thanks for posting that! I think it's a different scenario (not tied to an update cPanel) that's causing this.

Can you post which cPanel version you are on now, and whether it was the same version when you installed clamav?

-Pete
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,908
2,218
463
Thanks for posting that! I think it's a different scenario (not tied to an update cPanel) that's causing this.
Hello Pete,

A quick way to verify this is by reviewing the time stamps on the notification history reports:

Code:
ls -al /var/cpanel/user_notifications/root/history
Thank you.
 

PeteS

Well-Known Member
Jun 8, 2017
220
48
28
Oregon
cPanel Access Level
Root Administrator
Based on the reports on this thread, it's possible the ClamAV update that occurs during the cPanel update is not completing successfully or is still in-progress when the check_security_advice_changes script runs. However, I've been unable to reproduce this issue on a test system.
My upcp report for 5/24 reports no issues for /usr/local/cpanel/scripts/check_security_advice_changes.
  • 5/22 upcp updated clamav and cPanel v70.0.43, no clamav error, but reported 2 out of date executables running (possibly clamav?) for which I was unable to determine the process (see: Security Advisor notifications should include process name, not just PID), which may explain the lack of a clamav warning
  • 5/23 upcp reported the clamav error
  • 5/23 upcp updated cPanel to v70.0.44 and reported no clamav error
It appears to me that it may be related to cPanel updates.

-Pete
 

PeteS

Well-Known Member
Jun 8, 2017
220
48
28
Oregon
cPanel Access Level
Root Administrator
Hello Pete,

A quick way to verify this is by reviewing the time stamps on the notification history reports:

Code:
ls -al /var/cpanel/user_notifications/root/history
Thank you.
We cross posted... :)

That's what I did, but using the emails from upcp which gives me more detail on the warnings.

-Pete
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,908
2,218
463
Hello Pete,

Could you open a support ticket to report that this continues to happen and post the ticket number here? I'll link the ticket to this forums thread so we can ensure an internal case is opened if necessary.

Thank you.