Clamav misses virus mails.

[ozgurerdogan]

I double checked that clam av is integrated with exim and updated it. But when I send test virus mails, they are being passed. Even some eicar viruses are passed but not all them.

Even I manually scan those virus attachment, clamd does not detect any virus. By the way, attachment are decoded .js files. Maybe clamd is not good enough.

Any better way for mail anvitirus solution?

 

[Cyberdevil]

I have exactly the same problem. Lots of virus mails that reach the server while clamav is running.
Sometime I see a message in the log like : "malware acl condition: clamd [127.0.0.1]:3310 : unable to read from socket (Connection timed out)" but the virusscanner is actually running fine. Even for mails that I don't see this message, it just passes clamav while Avira on the client does detects it.

Clamav is installed by custombuild and no special customisations are added. But this is really getting troubling.

 

[Cyberdevil]

Found this link: https://forums.cpanel.net/threads/reject-emails-with-zip-files-containing-exe-files.333101/

Cpanel has a way to block these files for like 10+ years. Maybe something that needs to be included in Custombuild?