CalmAV Scan Warning cli_tnef: file truncated, returning CLEAN LibClamAV Warning: cli_tnef: file truncated,

[Develop]

[root@server custombuild]# ./build versions
Latest version of DirectAdmin: 1.59.5
Installed version of DirectAdmin: 1.59.5

Latest version of Let's Encrypt client: 1.1.37
Installed version of Let's Encrypt client: 1.1.37

Latest version of CustomBuild plugin: 1.0.31
Installed version of CustomBuild plugin: 1.0.31

Latest version of Apache: 2.4.41
Installed version of Apache: 2.4.41

Latest version of Pure-FTPD: 1.0.49
Installed version of Pure-FTPd: 1.0.49

Latest version of libpng: 1.6.37
Installed version of libpng: 1.6.37

Latest version of libwebp: 1.0.3
Installed version of libwebp: 1.0.3

Latest version of nghttp2: 1.40.0
Installed version of nghttp2: 1.40.0

Latest version of libspf2: 1.2.10
Installed version of libspf2: 1.2.10

Latest version of libjpeg: 9c
Installed version of libjpeg: 9c

Latest version of mod_ruid2: 0.9.8
Installed version of mod_ruid2: 0.9.8

Latest version of ICU4C: 64.2
Installed version of ICU4C: 64.2

Latest version of libsodium: 1.0.18
Installed version of libsodium: 1.0.18

Latest version of libxml2: 2.9.9
Installed version of libxml2: 2.9.9

Latest version of libxslt: 1.1.33
Installed version of libxslt: 1.1.33

Latest version of iconv: 1.16
Installed version of iconv: 1.16

Latest version of PCRE: 8.20
Installed version of PCRE: 8.20

Latest version of curl: 7.67.0
Installed version of curl: 7.67.0

Latest version of FreeType: 2.10.1
Installed version of FreeType: 2.10.1

Latest version of dovecot: 2.3.9
Installed version of dovecot: 2.3.9

Latest version of dovecot.conf: 0.4
Installed version of dovecot.conf: 0.4

Latest version of Exim: 4.92.3
Installed version of Exim: 4.92.3

Latest version of s-nail: 14.9.15
Installed version of s-nail: 14.9.15

Latest version of exim.conf: 4.5.18
Installed version of exim.conf: 4.5.18

Latest version of BlockCracking: 1.10
Installed version of BlockCracking: 1.10

Latest version of Easy Spam Fighter: 1.31
Installed version of Easy Spam Fighter: 1.31

Latest version of SpamAssassin: 3.4.2
Installed version of SpamAssassin: 3.4.2

Latest version of ClamAV: 0.102.1
Installed version of ClamAV: 0.102.1

Latest version of MySQL: 5.7.27
Installed version of MySQL: 5.7.27

Latest version of PHP 7.2: 7.2.25
Installed version of PHP 7.2: 7.2.25

Latest version of PHP (mod_php): 5.6.40
Installed version of PHP (mod_php): 5.6.40

Latest version of RoundCube webmail: 1.4.1
Installed version of RoundCube webmail: 1.4.1

Latest version of phpMyAdmin: 4.9.2-all-languages
Installed version of phpMyAdmin: 4.9.2-all-languages

Latest version of ionCube: 10.3.9
Installed version of ionCube: 10.3.9

If you want to update all the available versions run: ./build update_versions
[root@server custombuild]#

 

[factor]

good

 

[factor]

run
./build custombuild_plugin

make sure CB plugin is good

 

[Develop]

./build rewrite_confs
after that httpd is running

 

[Develop]

Now I think everything is seems fine.

 

[Develop]

Thank you for help again.
About 3-4 hours later a new clamscan cronjob will be run automaticly. maybe this error won't repeat who knows.

[root@server custombuild]# timedatectl status
Local time: Fri 2019-12-06 02:32:07 +03
Universal time: Thu 2019-12-05 23:32:07 UTC
RTC time: Thu 2019-12-05 23:32:06
Time zone: Europe/Istanbul (+03, +0300)
NTP enabled: yes
NTP synchronized: yes
RTC in local TZ: no
DST active: n/a
[root@server custombuild]#

 

[factor]

Ok we will follow tomorrow.
Looks good for now. Go sleep.

 

[Develop]

You are welcome = > Turkish: Rica ederim. (That's true one)

 

[Develop]

Thank you and see you. Have a nice day/night!
Best regards.

 

[Develop]

/etc/cron.daily/manual_clamscan:

LibClamAV Warning: cli_tnef: file truncated, returning CLEAN LibClamAV Warning: cli_tnef: file truncated, returning CLEAN LibClamAV Warning: cli_tnef: file truncated, returning CLEAN LibClamAV Warning: cli_tnef: file truncated, returning CLEAN LibClamAV Warning: cli_tnef: file truncated, returning CLEAN LibClamAV Warning: cli_tnef: file truncated, returning CLEAN LibClamAV Warning: cli_tnef: file truncated, returning CLEAN LibClamAV Warning: cli_tnef: file truncated, returning CLEAN LibClamAV Warning: cli_tnef: file truncated, returning CLEAN

----------- SCAN SUMMARY -----------
Known viruses: 6584684
Engine version: 0.102.1
Scanned directories: 10198
Scanned files: 98387
Infected files: 0
Data scanned: 8907.28 MB
Data read: 6143.52 MB (ratio 1.45:1)
Time: 4118.383 sec (68 m 38 s)

 

[factor]

Found this https://lists.gt.net/clamav/users/59900

There must be a TNEF [Transport Neutral Encapsulation Format] file that is
triggering it during your scans. The message is at warning level and is
being scraped by the script and sent to you. It is not reporting the
filename because (as it says) the file is being simply treated as clean.
That is because this message is caused by a parsing problem, not an alert.

TNEF is a Microsoft format for email.
Looks like there are some emails that have this on your server. It appears the
LibClamAV Warning: cli_tnef: file truncated, returning CLEAN
Is letting you know when it scans these file they appear to be empty which to the scanner means Clean = Not infected.

If the server is yours and not clients all over it. You might dump the Trash and spam folders and see if that helps. Otherwise you would need to search all the mail directories to find it. However what file you find should be empty.

 

[Develop]

Hello,
How can I scan it? How to find?
And what will I search?
Thanks