ClamAV email blocked by MailScanner

Discuss the ConfigServer MailScanner Front-End script
Post Reply
omgwalt
Junior Member
Posts: 2
Joined: 28 Aug 2015, 15:17

ClamAV email blocked by MailScanner

Post by omgwalt »

I have MailScanner set to check all inbound and outbound email using ClamAV.

I have ClamAV set up to send me an email each day informing me of any possible infections.

For about a week or two now, this email has failed to arrive.

My admins found the problem. ClamAV is apparently blocking itself via MailScanner.

From the maillog:

[root@server ~]# grep 1cqtVW-0002rF-UX /var/log/maillog
Mar 22 23:33:50 server MailScanner: Filename Checks: Allowing 1cqtVW-0002rF-UX clamav-2017-03-22.log (no rule matched)
Mar 22 23:33:51 server MailScanner: Filetype Checks: Allowing 1cqtVW-0002rF-UX clamav-2017-03-22.log
Mar 22 23:33:51 server MailScanner: Clamd::INFECTED:: YARA.r57shell_php_php.UNOFFICIAL :: ./1cqtVW-0002rF-UX/clamav-2017-03-22.log
Mar 22 23:33:51 server MailScanner: Infected message 1cqtVW-0002rF-UX came from 127.0.0.1
Mar 22 23:33:51 server MailScanner: 1cqtVW-0002rF-UX: Received for MailControl Database
Mar 22 23:33:51 server MailScanner: 1cqtVW-0002rF-UX: MailControl cannot insert row: %%C7RPN1O2FYP5LGSYVTBFOC2X10OGEDRXXIPRGRGJJJI5KDWFI8S

We tried whitelisting root@server or 127.0.0.1, but it didn't help.

Any ideas?
Sergio
Junior Member
Posts: 1685
Joined: 12 Dec 2006, 14:56

Re: ClamAV email blocked by MailScanner

Post by Sergio »

go to mailscanner configuration and search for the word "unofficial" under clamav and that will give you an idea on what to check
Post Reply