Topic: Update your ClamAV Installation now

[Knuddi]

Henk,

The first is from rkhunter since they haven't updated their database and indicated this new version of clamav is secure.

The second message is a bit more strange. Did you configure the server to scan all disks every night? Clamscan is the "disk" scan engine.

[Henk]

Henk,

The first is from rkhunter since they haven't updated their database and indicated this new version of clamav is secure.

The second message is a bit more strange. Did you configure the server to scan all disks every night? Clamscan is the "disk" scan engine.

I configured the server to scan all users every night. I also get these message when I start Clamscan using the console (clamscan -v -i). Not by email, but in the console of course.

If I don't use the disk scanning option, I don't get the second message.

As far as I can find the message is harmless, and caused by this: PE is the header on dos/windows executables (exe
files). Clam's scanner probably only knows regular dos/windows PE
headers and WindowsCE apparently has a slightly different header (since
it's another architecture).

This gives some more info, and maybe Knuddi understands what to do with it:

http://www.mail-archive.com/clamav-users@lists.clamav.net/msg13989.html

[len_chan]

Hi.

I just did this upgrade. A few notes, that might help others:  I previously had whatever was installed in the 6.01 Custom distribution that was floating around these forums.  

The upgrade seems to have worked well.  I had to manually uninstall one RPM, but the install script told me exactly what to do.

After the install, I had to manually start ClamD. (/etc/init.d clamd start).  

This seems to work WAY better than what I had before.  It also caught the antivirus test message service from here:
http://www.gfi.com/emailsecuritytest/

So far so good!

[del]

Hi All,
I have the server manager virus panel from dungog.net, anyone know if this script will work or will it replace Stephen Knoble's panel with the Knuddi one?
Regards,
Del

[irule]

I also have the dungog version and the upgrade didn't work.....
How can I uninstall the dungog version and install the knuddie version?

[Knuddi]

The latest script will now also detect the dungog.net version of ClamAV (dungog-antivirus.RPM) and suggest how to uninstall. You should be able to do the suggested rpm -e dungog-antivirus-version.rpm manually and then run the script again.

I do not have the dungog-antivirus package myself so if above works please let me know for the benefit of the rest.

Rgds,
Jesper

[irule]

I did a manual uninstall (rpm -e dungog-antivirus-version (without the .rpm!)) and installed your version. everything seems to work like a charm!


Only at the end of the installation something couldn't be found....

patching file AMAVIS/MTA/Qmail.pm
patching file AMAVIS.pm
Starting clamd:                                            [   OK   ]
Updating the Clam Virus database - Please wait....
ClamAV update process started at Wed Nov 24 09:49:35 2004
ERROR: main.cvd not found on remote server
ERROR: Can't download main.cvd from 67.159.6.26
Update of Antivirus has successfully completed.

[Knuddi]

By default the install script tries to download the latest database from db.ud.clamav.net which is a round-robin DNS with the following servers:

Name:   db.us.clamav.net
Address: 206.58.251.131
Name:   db.us.clamav.net
Address: 207.201.202.73
Name:   db.us.clamav.net
Address: 209.8.40.140
Name:   db.us.clamav.net
Address: 209.200.146.2
Name:   db.us.clamav.net
Address: 209.204.175.217
Name:   db.us.clamav.net
Address: 216.24.174.245
Name:   db.us.clamav.net
Address: 38.136.139.7
Name:   db.us.clamav.net
Address: 64.246.44.108
Name:   db.us.clamav.net
Address: 65.77.42.207
Name:   db.us.clamav.net
Address: 67.19.5.178
Name:   db.us.clamav.net
Address: 67.159.6.26
Name:   db.us.clamav.net
Address: 69.44.153.29
Name:   db.us.clamav.net
Address: 69.93.108.98
Name:   db.us.clamav.net

You were very unlucky that the servers that was resolved when you installed was down (and still is).

Rgds,
Jesper

[funkusmunkus]

hi all and Knuddi,

the script is fantastic but i seem to be getting this error on both machines i installed it on:

Code: [Select]


Can't open /var/log/amavis-ng/amavis-ng.log: No such file or directory


seeing as i'm a noob i won't try and solve it my self  
cheers

[irian]

Can't open /var/log/amavis-ng/amavis-ng.log: No such file or directory

Creat the file:

touch /var/log/amavis-ng/amavis-ng.log

That solved it for me.
MDV