Topic: Clamav - amavis problem

[cc_skavenger]

This error cropped up today, Clam stopped working and started putting all e-mail into the problems directory.  I tried to restart clam and received this error.

Starting clamd: LibClamAV Error: cl_hex2str(): Malformed hexstring: 633a5c312e626174000000003a2a3a456e61626c65643a636d7373637300000053797374656d5c43757272656e74 (length: 97)
LibClamAV Error: readdb(): Malformed pattern line 1617 (file /usr/share/clamav/viruses.db2).
ERROR: Malformed database.

I renamed the viruses.db2 file and reran the cron job to update the virus pattern, but get the same error.  
I have since disabled amavis and clam, so mail is passing again.  I have also already rebooted the system, but am lost on what to do to fix this.
Using SME 5.6, with all updates and a few extras.  Trying not to update yet, have not had any success migrating the users over to a new SME6 box.

TIA

[MasterSleepy]

Hello,

I have same problem.
I also running a 5.6 sme with the install proposed by www.pagefault.org, the problem is that version of clamav are pretty old, 0.60.1.
I upgrade the old version with the last one found Here. I have to remove the old one and install first the library and then clamav rpm.
I have one problem this night with freshclam but I only have to change in /etc/cron.daily/freshclam.cron for

Code: [Select]

#!/bin/sh

/usr/bin/freshclam --quiet
Regards.

[cc_skavenger]

Thanks MasterSleepy!
Once again you have been a great help.  I was trying to get it to work without the library file.

[MasterSleepy]

I forgot some thing.
enable the following line in /etc/freshclam.conf if it's not.

Code: [Select]

NotifyClamd /etc/clamav.conf

Regs

[cc_skavenger]

MasterSleepy,
I don't have that file on my system.  What's it for?

[MasterSleepy]

Hy,
Witch rpm did you install??
I have installed
clamav-es-libs-0.72-es01.i386.rpm
and
clamav-es-0.72-es01.i386.rpm

[cc_skavenger]

Used clamav-libs-0.65-6.i386.rpm and clamav-0.65-6.i386.rpm.  I see what you installed and will update to that.

Thanks
Marco

[Jon_Reynolds]

You wouldn't happen to be running Dans Gaurdian would you? I think I had this exact same problem and it was either DG or the firewall blocking it. I just remember the error didn't match the fix. I was using IPCop as my firewall and had DG setup on it and when I set DG to just 'stealth log' rather than block it worked.

Hope that helps,

Jon

[cc_skavenger]

Jon,

No not running Dansguardian.  I think they changed something in the virus defs and the very old version of clam that I was running didn't know what to do.  It happened right after a virus def update.  I was using a very old version of clam.  I just removed the old rpms and then installed the new rpms from http://www.pagefault.org and my server was happy once again.

Thanks anyway.

Marco