[SOLVED] ClamaV did not catch virus

[CyberGuy]

Hi Guys,

We use proxmox mail gateway but seems like clamaV did not catch the virus:

MIME type: application/octet-stream File name: RFQ#1180004562&1180004538.gz File size: 187.80 kB Virus name: VIRUS: Trojan.Zmutzy.867 Antivirus: Kerio Antivirus engine version/Signature count: (AVCORE v2.2 Windows/x86_64 11.0.1.19 (March 15, 2021)/9244659)

Current configuration:



Logs show nothing.

So my question is this normal for you guys?

Patryk

 

[hata_ph]

ClamAV's default virus signature is bad. Either use custom 3rd party virus signature or use commercial AV like Avast.

https://sanesecurity.com/usage/signatures/
https://www.avast.com/en-my/business/products/linux-antivirus

 

[CyberGuy]

Hi,

I have few questions? If anyone could reply? I would be grateful!

I might use multiple database signature or only one? I can replace the url in the Confguration -> Virust Detector -> ClamAV -> Database Mirror.
What would be the best database from this link: https://sanesecurity.com/usage/signatures/ ?

To match viruses, malware ? For example i can you use : hackingteam.hsb ? in Database Mirror?

What about Avast process installation when ClamAV is still active:
1) Stop service of ClamAV service? and disable enable?
2) Install Avast using: https://pmg.proxmox.com/wiki/index.php/Install_Avast
3) What would be another thing to do ? expect that, any tune up?


Thank you for info @hata_ph !

 

[hata_ph]

Just choose the right signature database based on the FP risk and also the update date. I notice some database from sanesecurity is quite old and may not be up-to-date.

https://ftp.swin.edu.au/sanesecurity/
https://forum.proxmox.com/threads/c...uriteinfo-90-detection-rate.91072/post-397506

For Avast https://pmg.proxmox.com/wiki/index.php/Install_Avast

 

[CyberGuy]

Thank you @hata_ph.

I created account and add data srouces from sanesecurity. Let's see if that works!

 

[hata_ph]

If you are running PMG in production and it is essential, recommend to get commercial AV as the detection rate should be better.

https://www.securiteinfo.com/servic...e-of-zero-day-malwares-for-clamav.shtml?lg=en