[clamav-users] LibClamAV Error

[G.W. Haywood]

Hi there,

On Mon, 14 Dec 2020, Aitor Serra Martín wrote:

> - It's update daily. I did it mannually now:
>
> ClamAV update process started at Mon Dec 14 16:14:53 2020
> daily database available for update (local version: 26016 ...

This does not appear to update the rfxn databases.

How are _they_ updated?

The reason I ask is that if there are false positives, and the
databases are not updated to remove the false positives, then you may
be running the risk of deleting files which should not be deleted.

> - The "long reports" are mails I'm getting when the cronjobs run.

Your cron jobs are not part of the ClamAV distribution.  Please may we
see them?

> It's the "output to the screen when you run the clamscan"

If the reports are difficult to handle you could for example use a
utility like procmail to send them somewhere like /home/user/mail/junk
instead of your inbox, or you could even use grep to remove lines that
you don't want to see before the messages are sent.  But neither will
address the root of the problem, that is finding out why the messages
are being produced and whether or not they are produced correctly.

> - clamd daemon it's running. I think it's because run with exim or anything 
> similar. It's the default installation on Directadmin servers. I didn't 
> change the socket.

Are you using exim?  If you are, is exim using clamd?  Please be aware
that the 'clamscan' command does not use clamd, and if something is not
using clamd then it will be using a large amount of RAM for no reason.
Perhaps some of your cron jobs use clamd?

> - I didn't check individual files, I just check the /home directories where 
> viruses could be. If there are possible virus, I preffer to delete them.

I understand.  But I would _still_ like to see an example of a file
which gives the error message which started this thread so that I can
try to find out if the message is produced correctly or if there's a
fault in ClamAV.  The output of clamscan should give file names, you
can choose one or two of them - preferably small ones - as samples.

Do you have some reason to suppose that there might be viruses in your
home directories?  Can you describe the kinds of things which you
expect will be stored in them?

-- 

73,
Ged.