Filtering out viruses and malware

My usual rant: I consider virus scanners snake oil. If anyone wants to seriously infect a computer by sending an infected attachment then virus scanners won’t help you. They are based on patterns of known malware and (if you are lucky) a working heuristic algorithm trying to detect unusual behavior. It has been proven time and again that a custom-made virus – even a slightly altered variant or a well-known virus – goes easily undetected by your virus scanner. So why do they even exist? FUD. IT managers know well about the weaknesses of this approach. But if any Wind*ws computer gets infected they can tell senior management that they employed all common measures. I have talked to several managers and they all tell the same story. Seems like the digital religion of the 21st century. 🙂 Anyway – if you decide that you want virus scanning let’s add it to your mail server.

Pros and cons of ClamAV

As usual I prefer to stay with open-source components. So the obvious choice is the famous ClamAV virus scanner. But its detection rate is ridiculously low with its default signatures. I heard of a study telling that in their tests ClamAV showed a 100% detection rate. Another gave it rank 2 of all the scanners they tested. I myself have been scanning multiple infected emails with it (that have been found by another software) and it did not even find one infection.

So I started researching the alternatives – like a free-beer virus scanner from Sophos that worked well with the amavis-milter in the past. Its detection rate is pretty good. And the rspamd developers even said that their antivirus module supports Sophos. But no matter what I tried – I couldn’t get the two to work together. And to be honest… the documentation of rspamd’s antivirus module is incomplete to put say the least.

Then suddenly a friendly nerd pointed me to the SaneSecurity project that adds anti-virus signatures to ClamAV to make it actually useful. And this finally became the recommended solution for the ISPmail guide. In a commercial setup where your customers rely on better virus scanning you probably cannot avoid spending money on a commercial variant though. Why do I tell you all this? Mainly as an excuse that it took two weeks to just write this page. 🙂


Let’s get going and start ClamAV. First install the necessary package:

apt install clamav-daemon

The daemon is a permanent process running on your system waiting for connections from other programs. That makes it faster than starting a process to scan email attachments time and again. The default configuration works well so there it nothing to do.

Check if the daemon is running already:

service clamav-daemon status

Look for the “Active” line in the output. Does it say “Active: active (running)”? Very good. Or does it say “Active: inactive (dead)”? Don’t worry. Most likely it has not downloaded the antivirus patterns yet. ClamAV comes with the “freshclam” daemon that does these updates automatically. But after a fresh installation you may want to save time and download the patterns manually once. Stop the freshclam daemon and do an update:

service clamav-daemon stop
service clamav-daemon start

Run “service clamav-daemon status” again and check that it is running now.

Did you get a message like…?

WARNING: Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.99.2 Recommended version: 0.99.3

Do as it says: don’t panic. 🙂 Debian Stretch comes with version 0.99.2 which is perfectly fine. You do not need to do anything about it.

Let rspamd use ClamAV

Finally you have to tell rspamd how to talk to the clamav daemon. Unfortunately the documentation is a bit misleading or at least incomplete which confused me at first. The ClamAV daemon is by default creating a socket file on your server at /var/run/clamav/clamd.ctl. Sockets look like files and work as interfaces for interprocess communication. rspamd can communicate through that socket to ask ClamAV if a certain email contains a virus.

The default configuration can be seen in /etc/rspamd/modules.d/antivirus.conf. Let’s improve it a bit. Create a new file /etc/rspamd/override.d/antivirus.conf with this content to replace the default section:

clamav {
 attachments_only = false;
 symbol = "CLAM_VIRUS";
 type = "clamav";
 action = "reject";
 servers = "/var/run/clamav/clamd.ctl";

So what does this mean?

  • attachment_only… actually defines whether just attachments are scanned or whether the entire email including images gets scanned. This setting appears to be broken and skip attachments, so I recommen setting it to false.
  • symbol… If a virus is found by ClamAV then rspamd adds a symbol named CLAM_VIRUS. You may remember that these symbols can be assigned scores or added as email headers to see which criteria matched. You can call it whatever you want.
  • type… sets a few defaults in the antivirus module that tell rspamd how to talk to ClamAV
  • action… is an optional parameter that we use to instantly reject the email if a virus is found. We do not add a value to the spam score. Instead we refuse to accept the email during the incoming SMTP connection.
  • servers… defines the way to communicate with ClamAV. In this case we define the path of the socket that the ClamAV daemon opened for us.

Restart rspamd:

service rspamd reload

Virus scanning should now be working. Let’s see if it works as expected.


As mentioned earlier there exists a test signature for virus scanners called EICAR. It is not a virus – just a file that can be fed to your virus scanner to see if it is generally working. Download the test file from their website:


If you installed the swaks tool as suggested earlier you can use it to send a test email with EICAR attached:

swaks --to --attach - --server localhost <

One of the last lines should read…

<** 554 5.7.1 clamav: virus found: \”Eicar-Test-Signature\”

This proves that Postfix send the email through rspamd which in turn checked the email using ClamAV which again found the test signature and rejected the email.

Better detection signatures

As said at the beginning the detection rate of the signatures provided by ClamAV are pretty ridiculous. We do not want to spoon feed our vacuum cleaner – we want a clean living room. Fortunately the SaneSecurity people help make ClamAV actually find real-life viruses. The have been providing virus signatures for over a decade and claim that they find over 97% of all viruses while ClamAV usually just finds about 14%.

Friendly nerds have created an automated update script that can be found at Github. Setting it up takes a few steps but is then completely automatic. First get their newest installation archive:


Unpack it:

tar xvzf master.tar.gz

The archive has been unpacked into a directory called clamav-unofficial-sigs-master. Go there:

cd clamav-unofficial-sigs-master

Then copy the script itself to /usr/local/sbin where administrative user-installed scripts live:

cp /usr/local/sbin/

Create a new directory for the configuration files:

mkdir /etc/clamav-unofficial-sigs

Copy the configuration template for Debian Stretch to that directory:

cp config/os.debian9.conf /etc/clamav-unofficial-sigs/os.conf

Copy the two other required files:

cp config/{master.conf,user.conf} /etc/clamav-unofficial-sigs/

To enable the update script you need to edit the /etc/clamav-unofficial-sigs/user.conf file and at the end set:


Install a logrotate configuration to compress and archive older log files created from the script:

/usr/local/sbin/ --install-logrotate

Install the manual page (man 8 clamav-unofficial-sigs) for the script:

/usr/local/sbin/ --install-man

Copy the systemd configuration for recurring updates (works like cron):

cp systemd/* /etc/systemd/

Try updating the signatures manually:


If the update worked successfully you can now check which additional signatures ClamAV recognizes:

clamscan --debug 2>&1 /dev/null | grep "loaded"

8 thoughts on “Filtering out viruses and malware

  • 2018-02-22 at 20:17

    cp /usr/local/sbin/ results in “cp: cannot stat ‘’: No such file or directory”

    The command needs to be updated to “cp clamav-unofficial-sigs-master/ /usr/local/sbin/”

    Thanks for this wonderful tutorial 🙂

    • 2018-02-22 at 22:33

      Thanks for the hint. I have added a “cd” so it’s clear you have to enter the directory first before copying.

  • 2018-02-23 at 11:14

    Works perfect, thanks a lot 🙂

  • 2018-03-04 at 10:52

    You are correct, with the sanesecurity people clamav signatures, the detection rate has improved substantially. Thanks for writing the guide, it really helps me in making clamav useful.

  • 2018-03-05 at 20:42

    There seems to be missing the “next page” link on bottom.

    • 2018-03-05 at 20:55

      Thanks. Fixed. I wished WordPress was better in handling multi-page sections…

  • 2018-03-13 at 00:15

    Where is the

    <** 554 5.7.1 clamav: virus found: \”Eicar-Test-Signature\”

    line supposed to appear? I've run through the steps including the unofficial signatures and it doesn't show in the swaks output at least.

    • 2018-03-13 at 14:50

      FWIW, I had just upgraded to Debian 9.4 which included a new clamav version.


Leave a Reply

Your email address will not be published. Required fields are marked *

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.