Filtering out viruses and malware

My usual rant: I consider virus scanners snake oil. If anyone wants to seriously infect a computer by sending an infected attachment then virus scanners won’t help you. They are based on patterns of known malware and (if you are lucky) a working heuristic algorithm trying to detect unusual behavior. It has been proven time and again that a custom-made virus – even a slightly altered variant or a well-known virus – goes easily undetected by your virus scanner. So why do they even exist? FUD. IT managers know well about the weaknesses of this approach. But if any Wind*ws computer gets infected they can tell senior management that they employed all common measures. I have talked to several managers and they all tell the same story. Seems like the digital religion of the 21st century. 🙂 Anyway – if you decide that you want virus scanning let’s add it to your mail server.

Pros and cons of ClamAV

As usual I prefer to stay with open-source components. So the obvious choice is the famous ClamAV virus scanner. But its detection rate is ridiculously low with its default signatures. I heard of a study telling that in their tests ClamAV showed a 100% detection rate. Another gave it rank 2 of all the scanners they tested. I myself have been scanning multiple infected emails with it (that have been found by another software) and it did not even find one infection.

So I started researching the alternatives – like a free-beer virus scanner from Sophos that worked well with the amavis-milter in the past. Its detection rate is pretty good. And the rspamd developers even said that their antivirus module supports Sophos. But no matter what I tried – I couldn’t get the two to work together. And to be honest… the documentation of rspamd’s antivirus module is incomplete to put say the least.

Then suddenly a friendly nerd pointed me to the SaneSecurity project that adds anti-virus signatures to ClamAV to make it actually useful. And this finally became the recommended solution for the ISPmail guide. In a commercial setup where your customers rely on better virus scanning you probably cannot avoid spending money on a commercial variant though. Why do I tell you all this? Mainly as an excuse that it took two weeks to just write this page. 🙂

ClamAV

Let’s get going and start ClamAV. First install the necessary package:

apt install clamav clamav-daemon

The daemon is a permanent process running on your system waiting for connections from other programs. That makes it faster than starting a process to scan email attachments time and again. The default configuration works well so there it nothing to do.

Check if the daemon is running already:

service clamav-daemon status

Look for the “Active” line in the output. Does it say “Active: active (running)”? Very good. Or does it say “Active: inactive (dead)”? Don’t worry. Most likely it has not downloaded the antivirus patterns yet. ClamAV comes with the “freshclam” daemon that does these updates automatically. But after a fresh installation you may want to save time and download the patterns manually once. Stop the freshclam daemon and do an update:

service clamav-daemon stop
freshclam
service clamav-daemon start

Run “service clamav-daemon status” again and check that it is running now.

Did you get a message like…?

WARNING: Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.99.2 Recommended version: 0.99.3
DON'T PANIC! Read http://www.clamav.net/documents/upgrading-clamav

Do as it says: don’t panic. 🙂 Debian Stretch comes with version 0.99.2 which is perfectly fine. You do not need to do anything about it.

Let rspamd use ClamAV

Finally you have to tell rspamd how to talk to the clamav daemon. Unfortunately the documentation is a bit misleading or at least incomplete which confused me at first. The ClamAV daemon is by default creating a socket file on your server at /var/run/clamav/clamd.ctl. Sockets look like files and work as interfaces for interprocess communication. rspamd can communicate through that socket to ask ClamAV if a certain email contains a virus.

The default configuration can be seen in /etc/rspamd/modules.d/antivirus.conf. Let’s improve it a bit. Create a new file /etc/rspamd/override.d/antivirus.conf with this content to replace the default section:

clamav {
 attachments_only = false;
 symbol = "CLAM_VIRUS";
 type = "clamav";
 action = "reject";
 servers = "/var/run/clamav/clamd.ctl";
}

So what does this mean?

  • attachment_only… actually defines whether just attachments are scanned or whether the entire email including images gets scanned. This setting appears to be broken and skip attachments, so I recommen setting it to false.
  • symbol… If a virus is found by ClamAV then rspamd adds a symbol named CLAM_VIRUS. You may remember that these symbols can be assigned scores or added as email headers to see which criteria matched. You can call it whatever you want.
  • type… sets a few defaults in the antivirus module that tell rspamd how to talk to ClamAV
  • action… is an optional parameter that we use to instantly reject the email if a virus is found. We do not add a value to the spam score. Instead we refuse to accept the email during the incoming SMTP connection.
  • servers… defines the way to communicate with ClamAV. In this case we define the path of the socket that the ClamAV daemon opened for us.

Restart rspamd:

service rspamd reload

Virus scanning should now be working. Let’s see if it works as expected.

Testing

As mentioned earlier there exists a test signature for virus scanners called EICAR. It is not a virus – just a file that can be fed to your virus scanner to see if it is generally working. Download the test file from their website:

wget https://secure.eicar.org/eicar.com

If you installed the swaks tool as suggested earlier you can use it to send a test email with EICAR attached:

swaks --to john@example.org --attach - --server localhost < eicar.com

One of the last lines should read…

<** 554 5.7.1 clamav: virus found: \”Eicar-Test-Signature\”

This proves that Postfix send the email through rspamd which in turn checked the email using ClamAV which again found the test signature and rejected the email.

Better detection signatures

As said at the beginning the detection rate of the signatures provided by ClamAV are pretty ridiculous. We do not want to spoon feed our vacuum cleaner – we want a clean living room. Fortunately the SaneSecurity people help make ClamAV actually find real-life viruses. The have been providing virus signatures for over a decade and claim that they find over 97% of all viruses while ClamAV usually just finds about 14%.

Friendly nerds have created an automated update script that can be found at Github. Setting it up takes a few steps but is then completely automatic. First get their newest installation archive:

wget https://github.com/extremeshok/clamav-unofficial-sigs/archive/master.tar.gz

Unpack it:

tar xvzf master.tar.gz

The archive has been unpacked into a directory called clamav-unofficial-sigs-master. Go there:

cd clamav-unofficial-sigs-master

Then copy the script itself to /usr/local/sbin where administrative user-installed scripts live:

cp clamav-unofficial-sigs.sh /usr/local/sbin/

Create a new directory for the configuration files:

mkdir /etc/clamav-unofficial-sigs

Copy the configuration template for Debian Stretch to that directory:

cp config/os.debian9.conf /etc/clamav-unofficial-sigs/os.conf

Copy the two other required files:

cp config/{master.conf,user.conf} /etc/clamav-unofficial-sigs/

To enable the update script you need to edit the /etc/clamav-unofficial-sigs/user.conf file and at the end set:

user_configuration_complete="yes"

Install a logrotate configuration to compress and archive older log files created from the script:

/usr/local/sbin/clamav-unofficial-sigs.sh --install-logrotate

Install the manual page (man 8 clamav-unofficial-sigs) for the script:

/usr/local/sbin/clamav-unofficial-sigs.sh --install-man

Copy the systemd configuration for recurring updates (works like cron):

cp systemd/* /etc/systemd/

Try updating the signatures manually:

/usr/local/sbin/clamav-unofficial-sigs.sh

If the update worked successfully you can now check which additional signatures ClamAV recognizes:

clamscan --debug 2>&1 /dev/null | grep "loaded"

The output should look like:

LibClamAV debug: /var/lib/clamav/sigwhitelist.ign2 loaded
LibClamAV debug: daily.info loaded
LibClamAV debug: daily.cfg loaded
LibClamAV debug: daily.ign loaded
LibClamAV debug: daily.crb loaded
LibClamAV debug: daily.hdb loaded
LibClamAV debug: daily.pdb loaded
LibClamAV debug: daily.sfp loaded
LibClamAV debug: daily.fp loaded
LibClamAV debug: daily.ldb loaded
LibClamAV debug: daily.msb loaded
LibClamAV debug: daily.ftm loaded
LibClamAV debug: daily.hsb loaded
LibClamAV debug: daily.cdb loaded
LibClamAV debug: daily.ign2 loaded
LibClamAV debug: daily.idb loaded
LibClamAV debug: daily.wdb loaded
LibClamAV debug: daily.mdb loaded
LibClamAV debug: daily.ndb loaded
LibClamAV debug: /var/lib/clamav/daily.cld loaded
LibClamAV debug: /var/lib/clamav/hackingteam.hsb loaded
LibClamAV debug: main.info loaded
LibClamAV debug: main.hdb loaded
LibClamAV debug: main.hsb loaded
LibClamAV debug: main.mdb loaded
LibClamAV debug: main.msb loaded
LibClamAV debug: main.ndb loaded
LibClamAV debug: main.fp loaded
LibClamAV debug: main.sfp loaded
LibClamAV debug: main.crb loaded
LibClamAV debug: /var/lib/clamav/main.cvd loaded
LibClamAV debug: /var/lib/clamav/spamimg.hdb loaded
LibClamAV debug: /var/lib/clamav/bofhland_cracked_URL.ndb loaded
LibClamAV debug: load_oneyara: successfully loaded YARA.zeus_js
LibClamAV debug: cli_loadyara: loaded 1 of 1 yara signatures from /var/lib/clamav/EK_Zeus.yar
LibClamAV debug: /var/lib/clamav/EK_Zeus.yar loaded
LibClamAV debug: /var/lib/clamav/sanesecurity.ftm loaded
LibClamAV debug: load_oneyara: successfully loaded YARA.AnglerEKredirector
LibClamAV debug: load_oneyara: successfully loaded YARA.angler_flash
LibClamAV debug: load_oneyara: successfully loaded YARA.angler_flash2
LibClamAV debug: load_oneyara: successfully loaded YARA.angler_flash4
LibClamAV debug: load_oneyara: successfully loaded YARA.angler_flash5
LibClamAV debug: load_oneyara: successfully loaded YARA.angler_flash_uncompressed
LibClamAV debug: load_oneyara: successfully loaded YARA.angler_html
LibClamAV debug: load_oneyara: successfully loaded YARA.angler_html2
LibClamAV debug: load_oneyara: successfully loaded YARA.angler_jar
LibClamAV debug: load_oneyara: successfully loaded YARA.angler_js
LibClamAV debug: cli_loadyara: loaded 10 of 10 yara signatures from /var/lib/clamav/EK_Angler.yar
LibClamAV debug: /var/lib/clamav/EK_Angler.yar loaded
LibClamAV debug: /var/lib/clamav/scam.ndb loaded
LibClamAV debug: load_oneyara: successfully loaded YARA.zeroaccess_css
LibClamAV debug: load_oneyara: successfully loaded YARA.zeroaccess_css2
LibClamAV debug: load_oneyara: successfully loaded YARA.zeroaccess_htm
LibClamAV debug: load_oneyara: successfully loaded YARA.zeroaccess_js
LibClamAV debug: load_oneyara: successfully loaded YARA.zeroaccess_js2
LibClamAV debug: load_oneyara: successfully loaded YARA.zeroaccess_js3
LibClamAV debug: load_oneyara: successfully loaded YARA.zeroaccess_js4
LibClamAV debug: cli_loadyara: loaded 7 of 7 yara signatures from /var/lib/clamav/EK_ZeroAcces.yar
LibClamAV debug: /var/lib/clamav/EK_ZeroAcces.yar loaded
LibClamAV debug: /var/lib/clamav/blurl.ndb loaded
LibClamAV debug: /var/lib/clamav/antidebug_antivm.yar loaded
LibClamAV debug: /var/lib/clamav/spamattach.hdb loaded
LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html
LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html10
LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html11
LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html2
LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html3
LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html4
LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html5
LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html6
LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html7
LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html8
LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html9
LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_jar
LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_jar2
LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_jar3
LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_pdf
LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_pdf2
LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_pdf3
LibClamAV debug: cli_loadyara: loaded 17 of 17 yara signatures from /var/lib/clamav/EK_Phoenix.yar
LibClamAV debug: /var/lib/clamav/EK_Phoenix.yar loaded
LibClamAV debug: /var/lib/clamav/winnow_malware.hdb loaded
LibClamAV debug: bytecode.info loaded
LibClamAV debug: 3986185.cbc loaded
LibClamAV debug: 3986187.cbc loaded
LibClamAV debug: 3986188.cbc loaded
LibClamAV debug: 3986206.cbc loaded
LibClamAV debug: 3986212.cbc loaded
LibClamAV debug: 3986214.cbc loaded
LibClamAV debug: 3986215.cbc loaded
LibClamAV debug: 3986216.cbc loaded
LibClamAV debug: 3986217.cbc loaded
LibClamAV debug: 3986218.cbc loaded
LibClamAV debug: 3986219.cbc loaded
LibClamAV debug: 3986220.cbc loaded
LibClamAV debug: 3986221.cbc loaded
LibClamAV debug: 3986222.cbc loaded
LibClamAV debug: 3986223.cbc loaded
LibClamAV debug: 3986224.cbc loaded
LibClamAV debug: 3986229.cbc loaded
LibClamAV debug: 3986230.cbc loaded
LibClamAV debug: 3986231.cbc loaded
LibClamAV debug: 3986232.cbc loaded
LibClamAV debug: 3986233.cbc loaded
LibClamAV debug: 3986234.cbc loaded
LibClamAV debug: 3986235.cbc loaded
LibClamAV debug: 3986236.cbc loaded
LibClamAV debug: 3986242.cbc loaded
LibClamAV debug: 3986244.cbc loaded
LibClamAV debug: 3986249.cbc loaded
LibClamAV debug: 3986259.cbc loaded
LibClamAV debug: 3986282.cbc loaded
LibClamAV debug: 3986283.cbc loaded
LibClamAV debug: 3986289.cbc loaded
LibClamAV debug: 3986292.cbc loaded
LibClamAV debug: 3986301.cbc loaded
LibClamAV debug: 3986303.cbc loaded
LibClamAV debug: 3986305.cbc loaded
LibClamAV debug: 3986306.cbc loaded
LibClamAV debug: 3986310.cbc loaded
LibClamAV debug: 3986321.cbc loaded
LibClamAV debug: 3986322.cbc loaded
LibClamAV debug: 3986326.cbc loaded
LibClamAV debug: 3986327.cbc loaded
LibClamAV debug: 3986328.cbc loaded
LibClamAV debug: 3986334.cbc loaded
LibClamAV debug: 3986337.cbc loaded
LibClamAV debug: 4306126.cbc loaded
LibClamAV debug: 4306157.cbc loaded
LibClamAV debug: 4307467.cbc loaded
LibClamAV debug: 4310114.cbc loaded
LibClamAV debug: 4416867.cbc loaded
LibClamAV debug: 4510302.cbc loaded
LibClamAV debug: 4526683.cbc loaded
LibClamAV debug: 4553522.cbc loaded
LibClamAV debug: 4970075.cbc loaded
LibClamAV debug: 5044126.cbc loaded
LibClamAV debug: 5588995.cbc loaded
LibClamAV debug: 5819336.cbc loaded
LibClamAV debug: 5999914.cbc loaded
LibClamAV debug: 5999936.cbc loaded
LibClamAV debug: 6300337.cbc loaded
LibClamAV debug: 6311970.cbc loaded
LibClamAV debug: 6316126.cbc loaded
LibClamAV debug: 6324281.cbc loaded
LibClamAV debug: 6327695.cbc loaded
LibClamAV debug: 6329916.cbc loaded
LibClamAV debug: 6329917.cbc loaded
LibClamAV debug: 6333894.cbc loaded
LibClamAV debug: 6334209.cbc loaded
LibClamAV debug: 6335427.cbc loaded
LibClamAV debug: 6335443.cbc loaded
LibClamAV debug: 6335540.cbc loaded
LibClamAV debug: 6335560.cbc loaded
LibClamAV debug: 6335564.cbc loaded
LibClamAV debug: 6335669.cbc loaded
LibClamAV debug: 6336035.cbc loaded
LibClamAV debug: 6336074.cbc loaded
LibClamAV debug: 6336630.cbc loaded
LibClamAV debug: 6336737.cbc loaded
LibClamAV debug: /var/lib/clamav/bytecode.cvd loaded
LibClamAV debug: /var/lib/clamav/winnow_bad_cw.hdb loaded
LibClamAV debug: load_oneyara: successfully loaded YARA.zerox88_js2
LibClamAV debug: load_oneyara: successfully loaded YARA.zerox88_js3
LibClamAV debug: cli_loadyara: loaded 2 of 2 yara signatures from /var/lib/clamav/EK_Zerox88.yar
LibClamAV debug: /var/lib/clamav/EK_Zerox88.yar loaded
LibClamAV debug: load_oneyara: successfully loaded YARA.bleedinglife2_adobe_2010_1297_exploit
LibClamAV debug: load_oneyara: successfully loaded YARA.bleedinglife2_adobe_2010_2884_exploit
LibClamAV debug: load_oneyara: successfully loaded YARA.bleedinglife2_jar2
LibClamAV debug: load_oneyara: successfully loaded YARA.bleedinglife2_java_2010_0842_exploit
LibClamAV debug: cli_loadyara: loaded 4 of 4 yara signatures from /var/lib/clamav/EK_BleedingLife.yar
LibClamAV debug: /var/lib/clamav/EK_BleedingLife.yar loaded
LibClamAV debug: /var/lib/clamav/malwarehash.hsb loaded
LibClamAV debug: load_oneyara: successfully loaded YARA.OITC_pdf_with_emb_docm
LibClamAV debug: load_oneyara: successfully loaded YARA.INDICATOR_IMPLANT_Loader
LibClamAV debug: load_oneyara: successfully loaded YARA.INDICATOR_Implant_Loader2
LibClamAV debug: load_oneyara: generic string: [File {0} has been uploaded in {1}] => [46696c65207b307d20686173206265656e2075706c6f6164656420696e207b317d]
LibClamAV debug: load_oneyara: successfully loaded YARA.IMPLANT2_3
LibClamAV debug: load_oneyara: successfully loaded YARA.CryptoWall_Resume_phish
LibClamAV debug: load_oneyara: successfully loaded YARA.java_JSocket_20151217
LibClamAV debug: load_oneyara: successfully loaded YARA.detect_powershell_precursor_downloader
LibClamAV debug: load_oneyara: successfully loaded YARA.kmon_cred_phish
LibClamAV debug: load_oneyara: successfully loaded YARA.rtf_phishing_script_lines
LibClamAV debug: cli_loadyara: loaded 9 of 9 yara signatures from /var/lib/clamav/winnow_malware.yara
LibClamAV debug: /var/lib/clamav/winnow_malware.yara loaded
LibClamAV debug: /var/lib/clamav/bofhland_malware_attach.hdb loaded
LibClamAV debug: /var/lib/clamav/phishtank.ndb loaded
LibClamAV debug: /var/lib/clamav/winnow_extended_malware.hdb loaded
LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_jar
LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_jar2
LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_jar3
LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_pdf
LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole_basic
LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole1_jar
LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_css
LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_htm
LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_htm10
LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_htm11
LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_htm12
LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_htm3
LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_htm4
LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_htm5
LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_htm6
LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_htm8
LibClamAV debug: cli_loadyara: loaded 16 of 16 yara signatures from /var/lib/clamav/EK_Blackhole.yar
LibClamAV debug: /var/lib/clamav/EK_Blackhole.yar loaded
LibClamAV debug: /var/lib/clamav/foxhole_filename.cdb loaded
LibClamAV debug: load_oneyara: successfully loaded YARA.Sanesecurity_TestSig_Type4_Hdr_2
LibClamAV debug: load_oneyara: successfully loaded YARA.Sanesecurity_TestSig_Type3_Bdy_4
LibClamAV debug: load_oneyara: successfully loaded YARA.Sanesecurity_TestSig_Type4_Bdy_3
LibClamAV debug: load_oneyara: successfully loaded YARA.Sanesecurity_PhishingTestSig_1
LibClamAV debug: cli_loadyara: loaded 4 of 4 yara signatures from /var/lib/clamav/Sanesecurity_sigtest.yara
LibClamAV debug: /var/lib/clamav/Sanesecurity_sigtest.yara loaded
LibClamAV debug: /var/lib/clamav/bofhland_malware_URL.ndb loaded
LibClamAV debug: /var/lib/clamav/phish.ndb loaded
LibClamAV debug: load_oneyara: successfully loaded YARA.Sanesecurity_Spam_test
LibClamAV debug: load_oneyara: successfully loaded YARA.Sanesecurity_Spam_pornspam
LibClamAV debug: cli_loadyara: loaded 2 of 2 yara signatures from /var/lib/clamav/Sanesecurity_spam.yara
LibClamAV debug: /var/lib/clamav/Sanesecurity_spam.yara loaded
LibClamAV debug: /var/lib/clamav/junk.ndb loaded
LibClamAV debug: /var/lib/clamav/winnow_malware_links.ndb loaded
LibClamAV debug: load_oneyara: successfully loaded YARA.sakura_jar
LibClamAV debug: load_oneyara: successfully loaded YARA.sakura_jar2
LibClamAV debug: cli_loadyara: loaded 2 of 2 yara signatures from /var/lib/clamav/EK_Sakura.yar
LibClamAV debug: /var/lib/clamav/EK_Sakura.yar loaded
LibClamAV debug: /var/lib/clamav/porcupine.ndb loaded
LibClamAV debug: load_oneyara: successfully loaded YARA.crimepack_jar
LibClamAV debug: load_oneyara: successfully loaded YARA.crimepack_jar3
LibClamAV debug: cli_loadyara: loaded 2 of 2 yara signatures from /var/lib/clamav/EK_Crimepack.yar
LibClamAV debug: /var/lib/clamav/EK_Crimepack.yar loaded
LibClamAV debug: /var/lib/clamav/rfxn.hdb loaded
LibClamAV debug: /var/lib/clamav/jurlbl.ndb loaded
LibClamAV debug: /var/lib/clamav/porcupine.hsb loaded
LibClamAV debug: load_oneyara: successfully loaded YARA.fragus_htm
LibClamAV debug: load_oneyara: successfully loaded YARA.fragus_js
LibClamAV debug: load_oneyara: successfully loaded YARA.fragus_js2
LibClamAV debug: load_oneyara: successfully loaded YARA.fragus_js_flash
LibClamAV debug: load_oneyara: successfully loaded YARA.fragus_js_java
LibClamAV debug: load_oneyara: successfully loaded YARA.fragus_js_quicktime
LibClamAV debug: load_oneyara: successfully loaded YARA.fragus_js_vml
LibClamAV debug: cli_loadyara: loaded 7 of 7 yara signatures from /var/lib/clamav/EK_Fragus.yar
LibClamAV debug: /var/lib/clamav/EK_Fragus.yar loaded
LibClamAV debug: load_oneyara: successfully loaded YARA.eleonore_jar
LibClamAV debug: load_oneyara: successfully loaded YARA.eleonore_jar2
LibClamAV debug: load_oneyara: successfully loaded YARA.eleonore_jar3
LibClamAV debug: load_oneyara: successfully loaded YARA.eleonore_js
LibClamAV debug: load_oneyara: successfully loaded YARA.eleonore_js2
LibClamAV debug: load_oneyara: successfully loaded YARA.eleonore_js3
LibClamAV debug: cli_loadyara: loaded 6 of 6 yara signatures from /var/lib/clamav/EK_Eleonore.yar
LibClamAV debug: /var/lib/clamav/EK_Eleonore.yar loaded
LibClamAV debug: /var/lib/clamav/foxhole_generic.cdb loaded
LibClamAV debug: /var/lib/clamav/winnow.attachments.hdb loaded
LibClamAV debug: /var/lib/clamav/bofhland_phishing_URL.ndb loaded
LibClamAV debug: /var/lib/clamav/rogue.hdb loaded
LibClamAV debug: /var/lib/clamav/rfxn.ndb loaded

32 thoughts on “Filtering out viruses and malware”

  1. Hi,
    cp clamav-unofficial-sigs.sh /usr/local/sbin/ results in “cp: cannot stat ‘clamav-unofficial-sigs.sh’: No such file or directory”

    The command needs to be updated to “cp clamav-unofficial-sigs-master/clamav-unofficial-sigs.sh /usr/local/sbin/”

    Thanks for this wonderful tutorial 🙂

    1. Christoph Haas

      Thanks for the hint. I have added a “cd” so it’s clear you have to enter the directory first before copying.

  2. Christoph,
    You are correct, with the sanesecurity people clamav signatures, the detection rate has improved substantially. Thanks for writing the guide, it really helps me in making clamav useful.

    1. Christoph Haas

      Thanks. Fixed. I wished WordPress was better in handling multi-page sections…

  3. Where is the

    <** 554 5.7.1 clamav: virus found: \”Eicar-Test-Signature\”

    line supposed to appear? I've run through the steps including the unofficial signatures and it doesn't show in the swaks output at least.

  4. Justin L. Franks

    For the last command, where the list of signatures is listed, what should the output look like? I’m not seeing anything being loaded from /var/lib/clamav-unofficial-sigs, only /var/lib/clamav.

      1. Andi Olsen

        Last command isn’t giving me any output either.
        I would imagine that its related to the following:
        ===============================================
        ERROR: clamscan binary (clamscan_bin) not found
        ===============================================

        I get this error when running /usr/local/sbin/clamav-unofficial-sigs.sh

        1. Andi Olsen

          Fixed it. clamscan_bin is not included in the clamav_daemon package.
          You will need to install the regular clamav package as well (apt install clamav)

  5. Hi,
    does anybody know how to change the reject message (554 5.7.1 clamav: virus found: \”Eicar-Test-Signature\”)?

  6. just installed ispmail (debian) and got a warning CLAM_VIRUS [clamav]: Using attachments_only is deprecated. Please use scan_mime_parts = false on /etc/rspamd/override.d/antivirus.conf. i am still trying to understand the significance of mime and attachment

  7. chang thai tang

    I had installed additional virus definitions from securiteinfo.com and malwarepatrol.net and now the total virus signatures is about 11 millions – without installing sanesecurity.com (clamav-unofficial) is about 4 millions. But the memory consumption has increased to 1.5 gbyte (and more)

  8. When I get to the step:
    Copy the systemd configuration for recurring updates (works like cron)

    And I run the command:
    cp systemd/* /etc/systemd/

    I get the error:
    cp: cannot stat ‘systemd/*’: No such file or directory

    What exactly does this step do? Is it important? And is it a big deal if I skip it?

  9. Hi Chris,

    I tried to install ISPmail on Debian 10 which is little so fresh for your tutorial :-). Actually install process is very smooth but I stuck on sentence:

    /usr/local/sbin/clamav-unofficial-sigs.sh –install-logrotate

    The bash said:
    -bash: /usr/local/sbin/clamav-unofficial-sigs.sh: Permission denied

    if I use next sentence with –install-man, everything is okay.

    So I investigated what’s going on… the chmod +x on clamav-unofficial-sigs.sh isneeded.

    Thanks for the best ISP tutorial ever!

  10. @pancio

    If you’re connected as root you can run:
    bash: /usr/local/sbin/clamav-unofficial-sigs.sh

    Otherwise you need to run:
    sudo bash: /usr/local/sbin/clamav-unofficial-sigs.sh

  11. @pancio, Christoph
    On debian10 (buster) you can skip the lengthy installation of clamav-unofficial-sigs as above and instead just
    apt install clamav-unofficial-sigs
    It works out of the box, cf. /var/log/clamav-unofficial-sigs.log (after some hours it contains similar output as above).

  12. @Christoph Haas,
    Why don’t you suggest to put it in a crontab?
    /usr/local/sbin/clamav-unofficial-sigs.sh

  13. Christoph Haas

    Sorry for not replying earlier. I have taken a note but i’m currently spending my spare time on the Buster guide. 🙂

  14. Validating the config gives a warning:

    # rspamadm configtest
    CLAM_VIRUS [clamav]: Using attachments_only is deprecated. Please use scan_mime_parts = false instead
    syntax OK

    Is that what you meant by “attachment_only… This setting appears to be broken and skip attachments, so I recommend setting it to false”

    Do we need to set scan_mime_parts? If so what value?

    Thanks

  15. The tutorial is overall good but this page is really garbage. Also a warning to users of systems with low memory. claimav will consume about 1-1,2 GB of RAM. Virusscans are also very computationally intensive. So on larger systems with more mail boxes, a better bet would be to not install it.

    There are several errors in this tutorial and no hint activating the update service via systemd after copying it.

    The directory for the systemd files should be /etc/systemd/system/

    After that you need to activate the scripts.

    systemctl enable clamav-unofficial-sigs.service
    systemctl enable clamav-unofficial-sigs.timer
    systemctl start clamav-unofficial-sigs.timer

    The best bed would be to stick with the installation guide from the page

    https://github.com/extremeshok/clamav-unofficial-sigs/blob/master/INSTALL.md

    1. Go out there and find how many people are offering something useful and updated for decades… For free.

      I personally use this guide since Debian Woody, so it is just a lot of time… And while I’m a seasoned sysadmin I still use it because I can rely on it.
      Mainly because someone who cares more about reliability than shiny fancy new unreliable things (like me) has spent time putting things together.

      And I like it, even if sometime I need to fix a typo or a minor issue myself. Moreover I think if you cannot fix them by yourself you should not run a public faced service.

      Thanks Chris for your work.

      1. Christoph Haas

        Thanks a lot for the nice feedback. Especially since you have been following the guide for so long. I wish there were more sysadmins who tried to understand the technology they are using.

Leave a Reply

Your email address will not be published. Required fields are marked *

Scroll to Top