[clamav-users] whitelist with clamav-milter

Discussion:

Jerry

2018-09-26 11:56:50 UTC

I am running clamav version 0.100.1 on a FreeBSD 11.2 / amd64 machine. I
also have the clamav-milter installed. My problem is that even though I am
trying to whitelist some addresses, they get marked as Spam.

This is an example of one such address: ☀ Puritan's Pride <***@e.puritan.com>

I entered this into the white list file: From:***@e.puritan.com

I then restarted the milter. Unfortunately, the email is still marked as
Spam. I thought that clamav-milter would simply ignore the file.

X-Virus-Status: Infected (SecuriteInfo.com.Spam-4701.UNOFFICIAL)
X-Virus-Scanned: clamav-milter 0.100.1 at scorpio.seibercom.net

This is the output from "clamconf"

Checking configuration files in /usr/local/etc

Config file: clamd.conf
-----------------------
BlockMax disabled
PreludeEnable disabled
PreludeAnalyzerName disabled
LogFile = "/var/log/clamav/clamd.log"
LogFileUnlock disabled
LogFileMaxSize = "1048576"
LogTime disabled
LogClean disabled
LogSyslog disabled
LogFacility = "LOG_LOCAL6"
LogVerbose disabled
LogRotate = "yes"
ExtendedDetectionInfo disabled
PidFile = "/var/run/clamav/clamd.pid"
TemporaryDirectory disabled
DatabaseDirectory = "/var/db/clamav"
OfficialDatabaseOnly disabled
LocalSocket = "/var/run/clamav/clamd.sock"
LocalSocketGroup disabled
LocalSocketMode disabled
FixStaleSocket = "yes"
TCPSocket disabled
TCPAddr disabled
MaxConnectionQueueLength = "200"
StreamMaxLength = "26214400"
StreamMinPort = "1024"
StreamMaxPort = "2048"
MaxThreads = "10"
ReadTimeout = "120"
CommandReadTimeout = "5"
SendBufTimeout = "500"
MaxQueue = "100"
IdleTimeout = "30"
ExcludePath disabled
MaxDirectoryRecursion = "15"
FollowDirectorySymlinks disabled
FollowFileSymlinks disabled
CrossFilesystems = "yes"
SelfCheck = "600"
DisableCache disabled
VirusEvent disabled
ExitOnOOM disabled
AllowAllMatchScan = "yes"
Foreground disabled
Debug disabled
LeaveTemporaryFiles disabled
User = "clamav"
Bytecode = "yes"
BytecodeSecurity = "TrustSigned"
BytecodeTimeout = "5000"
BytecodeUnsigned disabled
BytecodeMode = "Auto"
DetectPUA disabled
ExcludePUA disabled
IncludePUA disabled
AlgorithmicDetection = "yes"
ScanPE = "yes"
ScanELF = "yes"
DetectBrokenExecutables disabled
ScanMail = "yes"
ScanPartialMessages disabled
PhishingSignatures = "yes"
PhishingScanURLs = "yes"
PhishingAlwaysBlockCloak disabled
PhishingAlwaysBlockSSLMismatch disabled
PartitionIntersection disabled
HeuristicScanPrecedence disabled
StructuredDataDetection disabled
StructuredMinCreditCardCount = "3"
StructuredMinSSNCount = "3"
StructuredSSNFormatNormal = "yes"
StructuredSSNFormatStripped disabled
ScanHTML = "yes"
ScanOLE2 = "yes"
OLE2BlockMacros disabled
ScanPDF = "yes"
ScanSWF = "yes"
ScanXMLDOCS = "yes"
ScanHWP3 = "yes"
ScanArchive = "yes"
ArchiveBlockEncrypted disabled
ForceToDisk disabled
MaxScanSize = "104857600"
MaxFileSize = "26214400"
MaxRecursion = "16"
MaxFiles = "10000"
MaxEmbeddedPE = "10485760"
MaxHTMLNormalize = "10485760"
MaxHTMLNoTags = "2097152"
MaxScriptNormalize = "5242880"
MaxZipTypeRcg = "1048576"
MaxPartitions = "50"
MaxIconsPE = "100"
MaxRecHWP3 = "16"
PCREMatchLimit = "100000"
PCRERecMatchLimit = "5000"
PCREMaxFileSize = "26214400"
ScanOnAccess disabled
OnAccessMountPath disabled
OnAccessIncludePath disabled
OnAccessExcludePath disabled
OnAccessExcludeRootUID disabled
OnAccessExcludeUID disabled
OnAccessMaxFileSize = "5242880"
OnAccessDisableDDD disabled
OnAccessPrevention disabled
OnAccessExtraScanning disabled
DevACOnly disabled
DevACDepth disabled
DevPerformance disabled
DevLiblog disabled
DisableCertCheck disabled

Config file: freshclam.conf
---------------------------
LogFileMaxSize = "2097152"
LogTime disabled
LogSyslog disabled
LogFacility = "LOG_LOCAL6"
LogVerbose disabled
LogRotate = "yes"
PidFile = "/var/run/clamav/freshclam.pid"
DatabaseDirectory = "/var/db/clamav"
Foreground disabled
Debug disabled
UpdateLogFile = "/var/log/clamav/freshclam.log"
DatabaseOwner = "clamav"
Checks = "24"
DNSDatabaseInfo = "current.cvd.clamav.net"
DatabaseMirror = "db.US.clamav.net", "database.clamav.net"
PrivateMirror disabled
MaxAttempts = "3"
ScriptedUpdates = "yes"
TestDatabases = "yes"
CompressLocalDatabase disabled
ExtraDatabase disabled
DatabaseCustomURL disabled
HTTPProxyServer disabled
HTTPProxyPort disabled
HTTPProxyUsername disabled
HTTPProxyPassword disabled
HTTPUserAgent disabled
NotifyClamd = "/usr/local/etc/clamd.conf"
OnUpdateExecute disabled
OnErrorExecute disabled
OnOutdatedExecute disabled
LocalIPAddress disabled
ConnectTimeout = "30"
ReceiveTimeout = "30"
SafeBrowsing = "yes"
Bytecode = "yes"

Config file: clamav-milter.conf
-------------------------------
LogFile = "/var/log/clamav/clamav-milter.log"
LogFileUnlock disabled
LogFileMaxSize = "2097152"
LogTime = "yes"
LogSyslog disabled
LogFacility = "LOG_LOCAL6"
LogVerbose disabled
LogRotate = "yes"
PidFile = "/var/run/clamav/clamav-milter.pid"
TemporaryDirectory disabled
FixStaleSocket = "yes"
MaxThreads = "10"
ReadTimeout = "120"
Foreground disabled
User = "clamav"
MaxFileSize = "26214400"
ClamdSocket = "unix:/var/run/clamav/clamd.sock"
MilterSocket = "/var/run/clamav/clmilter.sock"
MilterSocketGroup disabled
MilterSocketMode disabled
LocalNet = "192.168.0.101/32", "192.168.0.192/32"
OnClean = "Accept"
OnInfected = "Accept"
OnFail = "Defer"
RejectMsg disabled
AddHeader = "Add"
ReportHostname disabled
VirusAction disabled
Chroot disabled
Whitelist = "/usr/local/etc/whitelisted_addresses.txt"
SkipAuthenticated = "file:/usr/local/etc/clamav_exclusions.txt"
LogInfected = "basic"
LogClean disabled
SupportMultipleRecipients = "yes"

Software settings
-----------------
Version: 0.100.1
Optional features supported: MEMPOOL IPv6 BIGSTACK AUTOIT_EA06 BZIP2 LIBXML2 PCRE JSON RAR

Database information
--------------------
Database directory: /var/db/clamav
[3rd Party] EK_Zeus.yar: 28 sigs
[3rd Party] foxhole_mail.cdb: 23 sigs
[3rd Party] securiteinfopdf.hdb: 3367 sigs
[3rd Party] foxhole_generic.cdb: 211 sigs
[3rd Party] EK_Crimepack.yar: 49 sigs
[3rd Party] CVE-2010-1297.yar: 15 sigs
[3rd Party] spearl.ndb: 150 sigs
[3rd Party] foxhole_all.cdb: 145 sigs
[3rd Party] spamimg.hdb: 184 sigs
daily.cld: version 24983, sigs: 2100133, built on Tue Sep 25 22:39:15 2018
[3rd Party] spear.ndb: 15009 sigs
[3rd Party] spamattach.hdb: 14 sigs
[3rd Party] winnow.attachments.hdb: 182 sigs
[3rd Party] Maldoc_Hidden_PE_file.yar: 23 sigs
[3rd Party] malware.expert.hdb: 388 sigs
[3rd Party] winnow.complex.patterns.ldb: 3 sigs
[3rd Party] porcupine.ndb: 4012 sigs
[3rd Party] winnow_phish_complete.ndb: 9320 sigs
[3rd Party] phishtank.ndb: 27161 sigs
[3rd Party] scam.ndb: 12501 sigs
[3rd Party] EK_ZeroAcces.yar: 211 sigs
[3rd Party] foxhole_js.ndb: 4 sigs
[3rd Party] securiteinfohtml.hdb: 54089 sigs
[3rd Party] MiscreantPunch099-INFO-Low.ldb: 21 sigs
[3rd Party] jurlbl.ndb: 17854 sigs
[3rd Party] lott.ndb: 2335 sigs
[3rd Party] rfxn.hdb: 12674 sigs
[3rd Party] EK_Fragus.yar: 210 sigs
main.cvd: version 58, sigs: 4566249, built on Wed Jun 7 17:38:10 2017
[3rd Party] winnow_spam_complete.ndb: 931 sigs
[3rd Party] phish.ndb: 27425 sigs
[3rd Party] winnow_malware_links.ndb: 4623 sigs
[3rd Party] CVE-2013-0074.yar: 17 sigs
[3rd Party] sanesecurity.ftm: 170 sigs
[3rd Party] securiteinfoold.hdb: 2213713 sigs
[3rd Party] jurlbla.ndb: 1682 sigs
[3rd Party] CVE-2010-0887.yar: 21 sigs
[3rd Party] foxhole_filename.cdb: 1971 sigs
[3rd Party] EK_Blackhole.yar: 453 sigs
[3rd Party] EK_Phoenix.yar: 483 sigs
[3rd Party] spam_marketing.ndb: 23032 sigs
[3rd Party] securiteinfoandroid.hdb: 99086 sigs
[3rd Party] bofhland_malware_attach.hdb: 1835 sigs
[3rd Party] Sanesecurity_spam.yara: 46 sigs
[3rd Party] winnow_extended_malware_links.ndb: 1 sig
bytecode.cvd: version 327, sigs: 91, built on Wed Aug 8 20:43:48 2018
[3rd Party] winnow_malware.hdb: 293 sigs
[3rd Party] CVE-2015-5119.yar: 22 sigs
[3rd Party] malwarepatrol.ndb: 0 sig
[3rd Party] EK_BleedingLife.yar: 112 sigs
[3rd Party] foxhole_js.cdb: 48 sigs
[3rd Party] malware.expert.ndb: 855 sigs
[3rd Party] winnow_extended_malware.hdb: 245 sigs
[3rd Party] spam.ldb: 2 sigs
[3rd Party] porcupine.hsb: 873 sigs
[3rd Party] maldoc_somerules.yar: 283 sigs
[3rd Party] securiteinfo.hdb: 1377783 sigs
[3rd Party] rfxn.ndb: 2034 sigs
[3rd Party] foxhole_all.ndb: 101 sigs
[3rd Party] EK_Eleonore.yar: 165 sigs
[3rd Party] scamnailer.ndb: 50995 sigs
[3rd Party] shelter.ldb: 15 sigs
[3rd Party] blurl.ndb: 108974 sigs
[3rd Party] CVE-2013-0422.yar: 21 sigs
[3rd Party] javascript.ndb: 44092 sigs
[3rd Party] securiteinfoascii.hdb: 98180 sigs
[3rd Party] rogue.hdb: 6761 sigs
[3rd Party] malwarehash.hsb: 771 sigs
[3rd Party] malware.expert.ldb: 142 sigs
[3rd Party] MiscreantPunch099-Low.ldb: 1208 sigs
[3rd Party] EK_Angler.yar: 283 sigs
[3rd Party] Javascript_exploit_and_obfuscation.yar: 59 sigs
safebrowsing.cld: version 47916, sigs: 2840247, built on Wed Sep 26 00:56:14 2018
[3rd Party] bofhland_cracked_URL.ndb: 24 sigs
[3rd Party] Sanesecurity_sigtest.yara: 54 sigs
[3rd Party] badmacro.ndb: 501 sigs
[3rd Party] bofhland_phishing_URL.ndb: 186 sigs
[3rd Party] winnow_bad_cw.hdb: 1 sig
[3rd Party] bofhland_malware_URL.ndb: 60 sigs
[3rd Party] CVE-2010-0805.yar: 14 sigs
[3rd Party] hackingteam.hsb: 435 sigs
[3rd Party] EK_Sakura.yar: 62 sigs
[3rd Party] crypto.yar: 1 sig
[3rd Party] malware.expert.fp: 42 sigs
[3rd Party] EK_Zerox88.yar: 55 sigs
Total number of signatures: 13738144

Platform information
--------------------
uname: FreeBSD 11.2-RELEASE-p3 FreeBSD 11.2-RELEASE-p3 #0: Thu Sep 6 07:14:16 UTC 2018 roo amd64
OS: freebsd11.2, ARCH: amd64, CPU: amd64
zlib version: 1.2.11 (1.2.11), compile flags: a9
platform id: 0x03235c5c0800000000040201

Build information
-----------------
Clang: 4.2.1 Compatible FreeBSD Clang 6.0.0 (tags/RELEASE_600/final 326565) (4.2.1)
CPPFLAGS: -I/usr/local/include
CFLAGS: -O2 -pipe -march=core2 -fstack-protector -fno-strict-aliasing -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
CXXFLAGS: -O2 -pipe -march=core2 -fstack-protector -fno-strict-aliasing
LDFLAGS: -lthr -L/usr/local/lib -Wl,-rpath,/usr/local/lib -fstack-protector
Configure: '--libdir=/usr/local/lib' '--with-dbdir=/var/db/clamav' '--with-zlib=/usr' '--disable-clamuko' '--disable-clamav' '--enable-bigstack' '--enable-readdir_r' '--enable-gethostbyname_r' '--disable-dependency-tracking' '--disable-zlib-vcheck' '--enable-clamdtop' '--enable-xml' '--disable-experimental' '--without-iconv' '--enable-ipv6' '--with-libjson' '--enable-milter' '--with-pcre' '--disable-check' '--enable-unrar' '--with-sendmail=/usr/sbin/sendmail' '--prefix=/usr/local' '--localstatedir=/var' '--mandir=/usr/local/man' '--disable-silent-rules' '--infodir=/usr/local/info/' '--build=amd64-portbld-freebsd11.2' 'build_alias=amd64-portbld-freebsd11.2' 'CC=cc' 'CFLAGS=-O2 -pipe -march=core2 -fstack-protector -fno-strict-aliasing ' 'LDFLAGS= -lthr -L/usr/local/lib -Wl,-rpath,/usr/local/lib -fstack-protector ' 'LIBS=' 'CPPFLAGS=-I/usr/local/include' 'CPP=cpp'
sizeof(void*) = 8
Engine flevel: 92, dconf: 92

If some one could tell me what I am doing incorrectly, I would appreciate it.
--
Jerry
_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#

Ted Hatfield

2018-09-26 19:29:25 UTC

Permalink

Jerry,

A quick google search comes up with this information from 2009.

Whitelisting is NOT based on the mail header fields (To:, From:) but on
the "MAIL FROM" and "RCPT TO" SMTP commands.

Is perhaps the "MAIL FROM" not the same as the From address.

Look at the full headers of the message for the "envelope-from" address
and see if it matches.

I run clamav-milter on a freebsd 11.2-stable machine and your
configuration looks good to me.

Ted Hatfield

I am running clamav version 0.100.1 on a FreeBSD 11.2 / amd64 machine. I
also have the clamav-milter installed. My problem is that even though I am
trying to whitelist some addresses, they get marked as Spam.
I then restarted the milter. Unfortunately, the email is still marked as
Spam. I thought that clamav-milter would simply ignore the file.
X-Virus-Status: Infected (SecuriteInfo.com.Spam-4701.UNOFFICIAL)
X-Virus-Scanned: clamav-milter 0.100.1 at scorpio.seibercom.net
This is the output from "clamconf"
Checking configuration files in /usr/local/etc
Config file: clamd.conf
-----------------------
BlockMax disabled
PreludeEnable disabled
PreludeAnalyzerName disabled
LogFile = "/var/log/clamav/clamd.log"
LogFileUnlock disabled
LogFileMaxSize = "1048576"
LogTime disabled
LogClean disabled
LogSyslog disabled
LogFacility = "LOG_LOCAL6"
LogVerbose disabled
LogRotate = "yes"
ExtendedDetectionInfo disabled
PidFile = "/var/run/clamav/clamd.pid"
TemporaryDirectory disabled
DatabaseDirectory = "/var/db/clamav"
OfficialDatabaseOnly disabled
LocalSocket = "/var/run/clamav/clamd.sock"
LocalSocketGroup disabled
LocalSocketMode disabled
FixStaleSocket = "yes"
TCPSocket disabled
TCPAddr disabled
MaxConnectionQueueLength = "200"
StreamMaxLength = "26214400"
StreamMinPort = "1024"
StreamMaxPort = "2048"
MaxThreads = "10"
ReadTimeout = "120"
CommandReadTimeout = "5"
SendBufTimeout = "500"
MaxQueue = "100"
IdleTimeout = "30"
ExcludePath disabled
MaxDirectoryRecursion = "15"
FollowDirectorySymlinks disabled
FollowFileSymlinks disabled
CrossFilesystems = "yes"
SelfCheck = "600"
DisableCache disabled
VirusEvent disabled
ExitOnOOM disabled
AllowAllMatchScan = "yes"
Foreground disabled
Debug disabled
LeaveTemporaryFiles disabled
User = "clamav"
Bytecode = "yes"
BytecodeSecurity = "TrustSigned"
BytecodeTimeout = "5000"
BytecodeUnsigned disabled
BytecodeMode = "Auto"
DetectPUA disabled
ExcludePUA disabled
IncludePUA disabled
AlgorithmicDetection = "yes"
ScanPE = "yes"
ScanELF = "yes"
DetectBrokenExecutables disabled
ScanMail = "yes"
ScanPartialMessages disabled
PhishingSignatures = "yes"
PhishingScanURLs = "yes"
PhishingAlwaysBlockCloak disabled
PhishingAlwaysBlockSSLMismatch disabled
PartitionIntersection disabled
HeuristicScanPrecedence disabled
StructuredDataDetection disabled
StructuredMinCreditCardCount = "3"
StructuredMinSSNCount = "3"
StructuredSSNFormatNormal = "yes"
StructuredSSNFormatStripped disabled
ScanHTML = "yes"
ScanOLE2 = "yes"
OLE2BlockMacros disabled
ScanPDF = "yes"
ScanSWF = "yes"
ScanXMLDOCS = "yes"
ScanHWP3 = "yes"
ScanArchive = "yes"
ArchiveBlockEncrypted disabled
ForceToDisk disabled
MaxScanSize = "104857600"
MaxFileSize = "26214400"
MaxRecursion = "16"
MaxFiles = "10000"
MaxEmbeddedPE = "10485760"
MaxHTMLNormalize = "10485760"
MaxHTMLNoTags = "2097152"
MaxScriptNormalize = "5242880"
MaxZipTypeRcg = "1048576"
MaxPartitions = "50"
MaxIconsPE = "100"
MaxRecHWP3 = "16"
PCREMatchLimit = "100000"
PCRERecMatchLimit = "5000"
PCREMaxFileSize = "26214400"
ScanOnAccess disabled
OnAccessMountPath disabled
OnAccessIncludePath disabled
OnAccessExcludePath disabled
OnAccessExcludeRootUID disabled
OnAccessExcludeUID disabled
OnAccessMaxFileSize = "5242880"
OnAccessDisableDDD disabled
OnAccessPrevention disabled
OnAccessExtraScanning disabled
DevACOnly disabled
DevACDepth disabled
DevPerformance disabled
DevLiblog disabled
DisableCertCheck disabled
Config file: freshclam.conf
---------------------------
LogFileMaxSize = "2097152"
LogTime disabled
LogSyslog disabled
LogFacility = "LOG_LOCAL6"
LogVerbose disabled
LogRotate = "yes"
PidFile = "/var/run/clamav/freshclam.pid"
DatabaseDirectory = "/var/db/clamav"
Foreground disabled
Debug disabled
UpdateLogFile = "/var/log/clamav/freshclam.log"
DatabaseOwner = "clamav"
Checks = "24"
DNSDatabaseInfo = "current.cvd.clamav.net"
DatabaseMirror = "db.US.clamav.net", "database.clamav.net"
PrivateMirror disabled
MaxAttempts = "3"
ScriptedUpdates = "yes"
TestDatabases = "yes"
CompressLocalDatabase disabled
ExtraDatabase disabled
DatabaseCustomURL disabled
HTTPProxyServer disabled
HTTPProxyPort disabled
HTTPProxyUsername disabled
HTTPProxyPassword disabled
HTTPUserAgent disabled
NotifyClamd = "/usr/local/etc/clamd.conf"
OnUpdateExecute disabled
OnErrorExecute disabled
OnOutdatedExecute disabled
LocalIPAddress disabled
ConnectTimeout = "30"
ReceiveTimeout = "30"
SafeBrowsing = "yes"
Bytecode = "yes"
Config file: clamav-milter.conf
-------------------------------
LogFile = "/var/log/clamav/clamav-milter.log"
LogFileUnlock disabled
LogFileMaxSize = "2097152"
LogTime = "yes"
LogSyslog disabled
LogFacility = "LOG_LOCAL6"
LogVerbose disabled
LogRotate = "yes"
PidFile = "/var/run/clamav/clamav-milter.pid"
TemporaryDirectory disabled
FixStaleSocket = "yes"
MaxThreads = "10"
ReadTimeout = "120"
Foreground disabled
User = "clamav"
MaxFileSize = "26214400"
ClamdSocket = "unix:/var/run/clamav/clamd.sock"
MilterSocket = "/var/run/clamav/clmilter.sock"
MilterSocketGroup disabled
MilterSocketMode disabled
LocalNet = "192.168.0.101/32", "192.168.0.192/32"
OnClean = "Accept"
OnInfected = "Accept"
OnFail = "Defer"
RejectMsg disabled
AddHeader = "Add"
ReportHostname disabled
VirusAction disabled
Chroot disabled
Whitelist = "/usr/local/etc/whitelisted_addresses.txt"
SkipAuthenticated = "file:/usr/local/etc/clamav_exclusions.txt"
LogInfected = "basic"
LogClean disabled
SupportMultipleRecipients = "yes"
Software settings
-----------------
Version: 0.100.1
Optional features supported: MEMPOOL IPv6 BIGSTACK AUTOIT_EA06 BZIP2 LIBXML2 PCRE JSON RAR
Database information
--------------------
Database directory: /var/db/clamav
[3rd Party] EK_Zeus.yar: 28 sigs
[3rd Party] foxhole_mail.cdb: 23 sigs
[3rd Party] securiteinfopdf.hdb: 3367 sigs
[3rd Party] foxhole_generic.cdb: 211 sigs
[3rd Party] EK_Crimepack.yar: 49 sigs
[3rd Party] CVE-2010-1297.yar: 15 sigs
[3rd Party] spearl.ndb: 150 sigs
[3rd Party] foxhole_all.cdb: 145 sigs
[3rd Party] spamimg.hdb: 184 sigs
daily.cld: version 24983, sigs: 2100133, built on Tue Sep 25 22:39:15 2018
[3rd Party] spear.ndb: 15009 sigs
[3rd Party] spamattach.hdb: 14 sigs
[3rd Party] winnow.attachments.hdb: 182 sigs
[3rd Party] Maldoc_Hidden_PE_file.yar: 23 sigs
[3rd Party] malware.expert.hdb: 388 sigs
[3rd Party] winnow.complex.patterns.ldb: 3 sigs
[3rd Party] porcupine.ndb: 4012 sigs
[3rd Party] winnow_phish_complete.ndb: 9320 sigs
[3rd Party] phishtank.ndb: 27161 sigs
[3rd Party] scam.ndb: 12501 sigs
[3rd Party] EK_ZeroAcces.yar: 211 sigs
[3rd Party] foxhole_js.ndb: 4 sigs
[3rd Party] securiteinfohtml.hdb: 54089 sigs
[3rd Party] MiscreantPunch099-INFO-Low.ldb: 21 sigs
[3rd Party] jurlbl.ndb: 17854 sigs
[3rd Party] lott.ndb: 2335 sigs
[3rd Party] rfxn.hdb: 12674 sigs
[3rd Party] EK_Fragus.yar: 210 sigs
main.cvd: version 58, sigs: 4566249, built on Wed Jun 7 17:38:10 2017
[3rd Party] winnow_spam_complete.ndb: 931 sigs
[3rd Party] phish.ndb: 27425 sigs
[3rd Party] winnow_malware_links.ndb: 4623 sigs
[3rd Party] CVE-2013-0074.yar: 17 sigs
[3rd Party] sanesecurity.ftm: 170 sigs
[3rd Party] securiteinfoold.hdb: 2213713 sigs
[3rd Party] jurlbla.ndb: 1682 sigs
[3rd Party] CVE-2010-0887.yar: 21 sigs
[3rd Party] foxhole_filename.cdb: 1971 sigs
[3rd Party] EK_Blackhole.yar: 453 sigs
[3rd Party] EK_Phoenix.yar: 483 sigs
[3rd Party] spam_marketing.ndb: 23032 sigs
[3rd Party] securiteinfoandroid.hdb: 99086 sigs
[3rd Party] bofhland_malware_attach.hdb: 1835 sigs
[3rd Party] Sanesecurity_spam.yara: 46 sigs
[3rd Party] winnow_extended_malware_links.ndb: 1 sig
bytecode.cvd: version 327, sigs: 91, built on Wed Aug 8 20:43:48 2018
[3rd Party] winnow_malware.hdb: 293 sigs
[3rd Party] CVE-2015-5119.yar: 22 sigs
[3rd Party] malwarepatrol.ndb: 0 sig
[3rd Party] EK_BleedingLife.yar: 112 sigs
[3rd Party] foxhole_js.cdb: 48 sigs
[3rd Party] malware.expert.ndb: 855 sigs
[3rd Party] winnow_extended_malware.hdb: 245 sigs
[3rd Party] spam.ldb: 2 sigs
[3rd Party] porcupine.hsb: 873 sigs
[3rd Party] maldoc_somerules.yar: 283 sigs
[3rd Party] securiteinfo.hdb: 1377783 sigs
[3rd Party] rfxn.ndb: 2034 sigs
[3rd Party] foxhole_all.ndb: 101 sigs
[3rd Party] EK_Eleonore.yar: 165 sigs
[3rd Party] scamnailer.ndb: 50995 sigs
[3rd Party] shelter.ldb: 15 sigs
[3rd Party] blurl.ndb: 108974 sigs
[3rd Party] CVE-2013-0422.yar: 21 sigs
[3rd Party] javascript.ndb: 44092 sigs
[3rd Party] securiteinfoascii.hdb: 98180 sigs
[3rd Party] rogue.hdb: 6761 sigs
[3rd Party] malwarehash.hsb: 771 sigs
[3rd Party] malware.expert.ldb: 142 sigs
[3rd Party] MiscreantPunch099-Low.ldb: 1208 sigs
[3rd Party] EK_Angler.yar: 283 sigs
[3rd Party] Javascript_exploit_and_obfuscation.yar: 59 sigs
safebrowsing.cld: version 47916, sigs: 2840247, built on Wed Sep 26 00:56:14 2018
[3rd Party] bofhland_cracked_URL.ndb: 24 sigs
[3rd Party] Sanesecurity_sigtest.yara: 54 sigs
[3rd Party] badmacro.ndb: 501 sigs
[3rd Party] bofhland_phishing_URL.ndb: 186 sigs
[3rd Party] winnow_bad_cw.hdb: 1 sig
[3rd Party] bofhland_malware_URL.ndb: 60 sigs
[3rd Party] CVE-2010-0805.yar: 14 sigs
[3rd Party] hackingteam.hsb: 435 sigs
[3rd Party] EK_Sakura.yar: 62 sigs
[3rd Party] crypto.yar: 1 sig
[3rd Party] malware.expert.fp: 42 sigs
[3rd Party] EK_Zerox88.yar: 55 sigs
Total number of signatures: 13738144
Platform information
--------------------
uname: FreeBSD 11.2-RELEASE-p3 FreeBSD 11.2-RELEASE-p3 #0: Thu Sep 6 07:14:16 UTC 2018 roo amd64
OS: freebsd11.2, ARCH: amd64, CPU: amd64
zlib version: 1.2.11 (1.2.11), compile flags: a9
platform id: 0x03235c5c0800000000040201
Build information
-----------------
Clang: 4.2.1 Compatible FreeBSD Clang 6.0.0 (tags/RELEASE_600/final 326565) (4.2.1)
CPPFLAGS: -I/usr/local/include
CFLAGS: -O2 -pipe -march=core2 -fstack-protector -fno-strict-aliasing -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
CXXFLAGS: -O2 -pipe -march=core2 -fstack-protector -fno-strict-aliasing
LDFLAGS: -lthr -L/usr/local/lib -Wl,-rpath,/usr/local/lib -fstack-protector
Configure: '--libdir=/usr/local/lib' '--with-dbdir=/var/db/clamav' '--with-zlib=/usr' '--disable-clamuko' '--disable-clamav' '--enable-bigstack' '--enable-readdir_r' '--enable-gethostbyname_r' '--disable-dependency-tracking' '--disable-zlib-vcheck' '--enable-clamdtop' '--enable-xml' '--disable-experimental' '--without-iconv' '--enable-ipv6' '--with-libjson' '--enable-milter' '--with-pcre' '--disable-check' '--enable-unrar' '--with-sendmail=/usr/sbin/sendmail' '--prefix=/usr/local' '--localstatedir=/var' '--mandir=/usr/local/man' '--disable-silent-rules' '--infodir=/usr/local/info/' '--build=amd64-portbld-freebsd11.2' 'build_alias=amd64-portbld-freebsd11.2' 'CC=cc' 'CFLAGS=-O2 -pipe -march=core2 -fstack-protector -fno-strict-aliasing ' 'LDFLAGS= -lthr -L/usr/local/lib -Wl,-rpath,/usr/local/lib -fstack-protector ' 'LIBS=' 'CPPFLAGS=-I/usr/local/include' 'CPP=cpp'
sizeof(void*) = 8
Engine flevel: 92, dconf: 92
If some one could tell me what I am doing incorrectly, I would appreciate it.
--
Jerry
_______________________________________________
clamav-users mailing list
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Jerry

2018-09-26 22:08:49 UTC

Permalink

Post by Ted Hatfield

Post by Jerry
I am running clamav version 0.100.1 on a FreeBSD 11.2 / amd64 machine. I
also have the clamav-milter installed. My problem is that even though I am
trying to whitelist some addresses, they get marked as Spam.
This is an example of one such address: ? Puritan's Pride
I then restarted the milter. Unfortunately, the email is still marked as
Spam. I thought that clamav-milter would simply ignore the file.
X-Virus-Status: Infected (SecuriteInfo.com.Spam-4701.UNOFFICIAL)
X-Virus-Scanned: clamav-milter 0.100.1 at scorpio.seibercom.net
This is the output from "clamconf"
Checking configuration files in /usr/local/etc
Config file: clamd.conf
-----------------------
BlockMax disabled
PreludeEnable disabled
PreludeAnalyzerName disabled
LogFile = "/var/log/clamav/clamd.log"
LogFileUnlock disabled
LogFileMaxSize = "1048576"
LogTime disabled
LogClean disabled
LogSyslog disabled
LogFacility = "LOG_LOCAL6"
LogVerbose disabled
LogRotate = "yes"
ExtendedDetectionInfo disabled
PidFile = "/var/run/clamav/clamd.pid"
TemporaryDirectory disabled
DatabaseDirectory = "/var/db/clamav"
OfficialDatabaseOnly disabled
LocalSocket = "/var/run/clamav/clamd.sock"
LocalSocketGroup disabled
LocalSocketMode disabled
FixStaleSocket = "yes"
TCPSocket disabled
TCPAddr disabled
MaxConnectionQueueLength = "200"
StreamMaxLength = "26214400"
StreamMinPort = "1024"
StreamMaxPort = "2048"
MaxThreads = "10"
ReadTimeout = "120"
CommandReadTimeout = "5"
SendBufTimeout = "500"
MaxQueue = "100"
IdleTimeout = "30"
ExcludePath disabled
MaxDirectoryRecursion = "15"
FollowDirectorySymlinks disabled
FollowFileSymlinks disabled
CrossFilesystems = "yes"
SelfCheck = "600"
DisableCache disabled
VirusEvent disabled
ExitOnOOM disabled
AllowAllMatchScan = "yes"
Foreground disabled
Debug disabled
LeaveTemporaryFiles disabled
User = "clamav"
Bytecode = "yes"
BytecodeSecurity = "TrustSigned"
BytecodeTimeout = "5000"
BytecodeUnsigned disabled
BytecodeMode = "Auto"
DetectPUA disabled
ExcludePUA disabled
IncludePUA disabled
AlgorithmicDetection = "yes"
ScanPE = "yes"
ScanELF = "yes"
DetectBrokenExecutables disabled
ScanMail = "yes"
ScanPartialMessages disabled
PhishingSignatures = "yes"
PhishingScanURLs = "yes"
PhishingAlwaysBlockCloak disabled
PhishingAlwaysBlockSSLMismatch disabled
PartitionIntersection disabled
HeuristicScanPrecedence disabled
StructuredDataDetection disabled
StructuredMinCreditCardCount = "3"
StructuredMinSSNCount = "3"
StructuredSSNFormatNormal = "yes"
StructuredSSNFormatStripped disabled
ScanHTML = "yes"
ScanOLE2 = "yes"
OLE2BlockMacros disabled
ScanPDF = "yes"
ScanSWF = "yes"
ScanXMLDOCS = "yes"
ScanHWP3 = "yes"
ScanArchive = "yes"
ArchiveBlockEncrypted disabled
ForceToDisk disabled
MaxScanSize = "104857600"
MaxFileSize = "26214400"
MaxRecursion = "16"
MaxFiles = "10000"
MaxEmbeddedPE = "10485760"
MaxHTMLNormalize = "10485760"
MaxHTMLNoTags = "2097152"
MaxScriptNormalize = "5242880"
MaxZipTypeRcg = "1048576"
MaxPartitions = "50"
MaxIconsPE = "100"
MaxRecHWP3 = "16"
PCREMatchLimit = "100000"
PCRERecMatchLimit = "5000"
PCREMaxFileSize = "26214400"
ScanOnAccess disabled
OnAccessMountPath disabled
OnAccessIncludePath disabled
OnAccessExcludePath disabled
OnAccessExcludeRootUID disabled
OnAccessExcludeUID disabled
OnAccessMaxFileSize = "5242880"
OnAccessDisableDDD disabled
OnAccessPrevention disabled
OnAccessExtraScanning disabled
DevACOnly disabled
DevACDepth disabled
DevPerformance disabled
DevLiblog disabled
DisableCertCheck disabled
Config file: freshclam.conf
---------------------------
LogFileMaxSize = "2097152"
LogTime disabled
LogSyslog disabled
LogFacility = "LOG_LOCAL6"
LogVerbose disabled
LogRotate = "yes"
PidFile = "/var/run/clamav/freshclam.pid"
DatabaseDirectory = "/var/db/clamav"
Foreground disabled
Debug disabled
UpdateLogFile = "/var/log/clamav/freshclam.log"
DatabaseOwner = "clamav"
Checks = "24"
DNSDatabaseInfo = "current.cvd.clamav.net"
DatabaseMirror = "db.US.clamav.net", "database.clamav.net"
PrivateMirror disabled
MaxAttempts = "3"
ScriptedUpdates = "yes"
TestDatabases = "yes"
CompressLocalDatabase disabled
ExtraDatabase disabled
DatabaseCustomURL disabled
HTTPProxyServer disabled
HTTPProxyPort disabled
HTTPProxyUsername disabled
HTTPProxyPassword disabled
HTTPUserAgent disabled
NotifyClamd = "/usr/local/etc/clamd.conf"
OnUpdateExecute disabled
OnErrorExecute disabled
OnOutdatedExecute disabled
LocalIPAddress disabled
ConnectTimeout = "30"
ReceiveTimeout = "30"
SafeBrowsing = "yes"
Bytecode = "yes"
Config file: clamav-milter.conf
-------------------------------
LogFile = "/var/log/clamav/clamav-milter.log"
LogFileUnlock disabled
LogFileMaxSize = "2097152"
LogTime = "yes"
LogSyslog disabled
LogFacility = "LOG_LOCAL6"
LogVerbose disabled
LogRotate = "yes"
PidFile = "/var/run/clamav/clamav-milter.pid"
TemporaryDirectory disabled
FixStaleSocket = "yes"
MaxThreads = "10"
ReadTimeout = "120"
Foreground disabled
User = "clamav"
MaxFileSize = "26214400"
ClamdSocket = "unix:/var/run/clamav/clamd.sock"
MilterSocket = "/var/run/clamav/clmilter.sock"
MilterSocketGroup disabled
MilterSocketMode disabled
LocalNet = "192.168.0.101/32", "192.168.0.192/32"
OnClean = "Accept"
OnInfected = "Accept"
OnFail = "Defer"
RejectMsg disabled
AddHeader = "Add"
ReportHostname disabled
VirusAction disabled
Chroot disabled
Whitelist = "/usr/local/etc/whitelisted_addresses.txt"
SkipAuthenticated = "file:/usr/local/etc/clamav_exclusions.txt"
LogInfected = "basic"
LogClean disabled
SupportMultipleRecipients = "yes"
Software settings
-----------------
Version: 0.100.1
Optional features supported: MEMPOOL IPv6 BIGSTACK AUTOIT_EA06 BZIP2
LIBXML2 PCRE JSON RAR
Database information
--------------------
Database directory: /var/db/clamav
[3rd Party] EK_Zeus.yar: 28 sigs
[3rd Party] foxhole_mail.cdb: 23 sigs
[3rd Party] securiteinfopdf.hdb: 3367 sigs
[3rd Party] foxhole_generic.cdb: 211 sigs
[3rd Party] EK_Crimepack.yar: 49 sigs
[3rd Party] CVE-2010-1297.yar: 15 sigs
[3rd Party] spearl.ndb: 150 sigs
[3rd Party] foxhole_all.cdb: 145 sigs
[3rd Party] spamimg.hdb: 184 sigs
daily.cld: version 24983, sigs: 2100133, built on Tue Sep 25 22:39:15 2018
[3rd Party] spear.ndb: 15009 sigs
[3rd Party] spamattach.hdb: 14 sigs
[3rd Party] winnow.attachments.hdb: 182 sigs
[3rd Party] Maldoc_Hidden_PE_file.yar: 23 sigs
[3rd Party] malware.expert.hdb: 388 sigs
[3rd Party] winnow.complex.patterns.ldb: 3 sigs
[3rd Party] porcupine.ndb: 4012 sigs
[3rd Party] winnow_phish_complete.ndb: 9320 sigs
[3rd Party] phishtank.ndb: 27161 sigs
[3rd Party] scam.ndb: 12501 sigs
[3rd Party] EK_ZeroAcces.yar: 211 sigs
[3rd Party] foxhole_js.ndb: 4 sigs
[3rd Party] securiteinfohtml.hdb: 54089 sigs
[3rd Party] MiscreantPunch099-INFO-Low.ldb: 21 sigs
[3rd Party] jurlbl.ndb: 17854 sigs
[3rd Party] lott.ndb: 2335 sigs
[3rd Party] rfxn.hdb: 12674 sigs
[3rd Party] EK_Fragus.yar: 210 sigs
main.cvd: version 58, sigs: 4566249, built on Wed Jun 7 17:38:10 2017
[3rd Party] winnow_spam_complete.ndb: 931 sigs
[3rd Party] phish.ndb: 27425 sigs
[3rd Party] winnow_malware_links.ndb: 4623 sigs
[3rd Party] CVE-2013-0074.yar: 17 sigs
[3rd Party] sanesecurity.ftm: 170 sigs
[3rd Party] securiteinfoold.hdb: 2213713 sigs
[3rd Party] jurlbla.ndb: 1682 sigs
[3rd Party] CVE-2010-0887.yar: 21 sigs
[3rd Party] foxhole_filename.cdb: 1971 sigs
[3rd Party] EK_Blackhole.yar: 453 sigs
[3rd Party] EK_Phoenix.yar: 483 sigs
[3rd Party] spam_marketing.ndb: 23032 sigs
[3rd Party] securiteinfoandroid.hdb: 99086 sigs
[3rd Party] bofhland_malware_attach.hdb: 1835 sigs
[3rd Party] Sanesecurity_spam.yara: 46 sigs
[3rd Party] winnow_extended_malware_links.ndb: 1 sig
bytecode.cvd: version 327, sigs: 91, built on Wed Aug 8 20:43:48 2018
[3rd Party] winnow_malware.hdb: 293 sigs
[3rd Party] CVE-2015-5119.yar: 22 sigs
[3rd Party] malwarepatrol.ndb: 0 sig
[3rd Party] EK_BleedingLife.yar: 112 sigs
[3rd Party] foxhole_js.cdb: 48 sigs
[3rd Party] malware.expert.ndb: 855 sigs
[3rd Party] winnow_extended_malware.hdb: 245 sigs
[3rd Party] spam.ldb: 2 sigs
[3rd Party] porcupine.hsb: 873 sigs
[3rd Party] maldoc_somerules.yar: 283 sigs
[3rd Party] securiteinfo.hdb: 1377783 sigs
[3rd Party] rfxn.ndb: 2034 sigs
[3rd Party] foxhole_all.ndb: 101 sigs
[3rd Party] EK_Eleonore.yar: 165 sigs
[3rd Party] scamnailer.ndb: 50995 sigs
[3rd Party] shelter.ldb: 15 sigs
[3rd Party] blurl.ndb: 108974 sigs
[3rd Party] CVE-2013-0422.yar: 21 sigs
[3rd Party] javascript.ndb: 44092 sigs
[3rd Party] securiteinfoascii.hdb: 98180 sigs
[3rd Party] rogue.hdb: 6761 sigs
[3rd Party] malwarehash.hsb: 771 sigs
[3rd Party] malware.expert.ldb: 142 sigs
[3rd Party] MiscreantPunch099-Low.ldb: 1208 sigs
[3rd Party] EK_Angler.yar: 283 sigs
[3rd Party] Javascript_exploit_and_obfuscation.yar: 59 sigs
safebrowsing.cld: version 47916, sigs: 2840247, built on Wed Sep 26
00:56:14 2018 [3rd Party] bofhland_cracked_URL.ndb: 24 sigs
[3rd Party] Sanesecurity_sigtest.yara: 54 sigs
[3rd Party] badmacro.ndb: 501 sigs
[3rd Party] bofhland_phishing_URL.ndb: 186 sigs
[3rd Party] winnow_bad_cw.hdb: 1 sig
[3rd Party] bofhland_malware_URL.ndb: 60 sigs
[3rd Party] CVE-2010-0805.yar: 14 sigs
[3rd Party] hackingteam.hsb: 435 sigs
[3rd Party] EK_Sakura.yar: 62 sigs
[3rd Party] crypto.yar: 1 sig
[3rd Party] malware.expert.fp: 42 sigs
[3rd Party] EK_Zerox88.yar: 55 sigs
Total number of signatures: 13738144
Platform information
--------------------
uname: FreeBSD 11.2-RELEASE-p3 FreeBSD 11.2-RELEASE-p3 #0: Thu Sep 6
07:14:16 UTC 2018 roo amd64 OS: freebsd11.2, ARCH: amd64, CPU: amd64
zlib version: 1.2.11 (1.2.11), compile flags: a9
platform id: 0x03235c5c0800000000040201
Build information
-----------------
Clang: 4.2.1 Compatible FreeBSD Clang 6.0.0 (tags/RELEASE_600/final
326565) (4.2.1) CPPFLAGS: -I/usr/local/include
CFLAGS: -O2 -pipe -march=core2 -fstack-protector -fno-strict-aliasing
-lthr -L/usr/local/lib -Wl,-rpath,/usr/local/lib -fstack-protector
Configure: '--libdir=/usr/local/lib' '--with-dbdir=/var/db/clamav'
'--with-zlib=/usr' '--disable-clamuko' '--disable-clamav'
'--enable-bigstack' '--enable-readdir_r' '--enable-gethostbyname_r'
'--disable-dependency-tracking' '--disable-zlib-vcheck'
'--enable-clamdtop' '--enable-xml' '--disable-experimental'
'--without-iconv' '--enable-ipv6' '--with-libjson' '--enable-milter'
'--with-pcre' '--disable-check' '--enable-unrar'
'--with-sendmail=/usr/sbin/sendmail' '--prefix=/usr/local'
'--localstatedir=/var' '--mandir=/usr/local/man' '--disable-silent-rules'
'--infodir=/usr/local/info/' '--build=amd64-portbld-freebsd11.2'
'build_alias=amd64-portbld-freebsd11.2' 'CC=cc' 'CFLAGS=-O2 -pipe
-march=core2 -fstack-protector -fno-strict-aliasing ' 'LDFLAGS= -lthr
-L/usr/local/lib -Wl,-rpath,/usr/local/lib -fstack-protector ' 'LIBS='
92, dconf: 92
If some one could tell me what I am doing incorrectly, I would appreciate it.
--
Jerry

Jerry,
A quick google search comes up with this information from 2009.

Post by Jerry
Whitelisting is NOT based on the mail header fields (To:, From:) but on
the "MAIL FROM" and "RCPT TO" SMTP commands.

Is perhaps the "MAIL FROM" not the same as the From address.
Look at the full headers of the message for the "envelope-from" address
and see if it matches.
I run clamav-milter on a freebsd 11.2-stable machine and your
configuration looks good to me.
Ted Hatfield

I just checked the "clamav-milter.log" and noticed that all of the addresses
are enclosed in < > symbols. Perhaps I should use them to. I will give it a
try.
--
Jerry

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Ted Hatfield

2018-09-26 22:34:05 UTC

Permalink

Post by Jerry

Post by Ted Hatfield

Jerry,
A quick google search comes up with this information from 2009.

Post by Jerry
Whitelisting is NOT based on the mail header fields (To:, From:) but on
the "MAIL FROM" and "RCPT TO" SMTP commands.

Is perhaps the "MAIL FROM" not the same as the From address.
Look at the full headers of the message for the "envelope-from" address
and see if it matches.
I run clamav-milter on a freebsd 11.2-stable machine and your
configuration looks good to me.
Ted Hatfield

I just checked the "clamav-milter.log" and noticed that all of the addresses
are enclosed in < > symbols. Perhaps I should use them to. I will give it a
try.
--
Jerry
_______________________________________________
clamav-users mailing list
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml

I noted that you have set in the milter config.

OnClean = "Accept"
OnInfected = "Accept"

The possibility exists that the milter scans all messages, marks all
messages, but handles the messages in different ways.

According to the docs you can set.

# - Accept
# The message is accepted for delivery
# - Reject
# Immediately refuse delivery (a 5xx error is returned to the peer)
# - Defer
# Return a temporary failure message (4xx) to the peer
# - Blackhole (not available for OnFail)
# Like Accept but the message is sent to oblivion
# - Quarantine (not available for OnFail)
# Like Accept but message is quarantined instead of being delivered
#

None of these says anything about what headers are added to the message.

X-Virus-Status: and X-Virus-Scanned: may be added to all of the messages
regardless of how the milter is configured.

Ted Hatfield

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Ted Hatfield

2018-09-26 23:53:40 UTC

Permalink

Post by Ted Hatfield
None of these says anything about what headers are added to the message.
X-Virus-Status: and X-Virus-Scanned: may be added to all of the messages
regardless of how the milter is configured

no
the whole purpose of this header is to signal if the message was scanned

Reindl,

Can you tell us when the whitelist entry is processed. Does it occur
before or after the message is scanned by clamd?

Ted Hatfield

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

조정환

2018-09-27 00:55:23 UTC

Permalink

조정환

2018-09-27 00:56:37 UTC

Permalink

Reindl Harald

2018-09-27 08:19:02 UTC

Permalink

Post by Ted Hatfield

no
the whole purpose of this header is to signal if the message was scanned

Reindl,
Can you tell us when the whitelist entry is processed. Does it occur
before or after the message is scanned by clamd?

before - anything else don't make sense at all

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#m

Matus UHLAR - fantomas

2018-09-27 08:36:16 UTC

Permalink

spam? clamav is s virus scanner, not spam scanner.

Post by Jerry
I then restarted the milter. Unfortunately, the email is still marked as
Spam. I thought that clamav-milter would simply ignore the file.
X-Virus-Status: Infected (SecuriteInfo.com.Spam-4701.UNOFFICIAL)
X-Virus-Scanned: clamav-milter 0.100.1 at scorpio.seibercom.net

do you mean this under "marked as spam"?
--
Matus UHLAR - fantomas, ***@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
99 percent of lawyers give the rest a bad name.
_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.n

Benny Pedersen

2018-09-27 10:49:34 UTC

Permalink

Post by Matus UHLAR - fantomas

spam? clamav is s virus scanner, not spam scanner.

Post by Matus UHLAR - fantomas

Post by Jerry
This is an example of one such address: ☀ Puritan's Pride
I then restarted the milter. Unfortunately, the email is still marked as
Spam. I thought that clamav-milter would simply ignore the file.
X-Virus-Status: Infected (SecuriteInfo.com.Spam-4701.UNOFFICIAL)
X-Virus-Scanned: clamav-milter 0.100.1 at scorpio.seibercom.net

do you mean this under "marked as spam"?

imho would be nice if clamav-milter could reject based on official
signatures, and tag only on 3dr party signatures

lastly i agree clamav is a good spam scanner aswell if used correct
_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vr

Arnaud Jacques

2018-09-27 09:04:17 UTC

Permalink

Hello Jerry,

You can whitelist the signature this way :
https://www.securiteinfo.com/services/anti-spam-anti-virus/whitelisting_clamav_signatures.shtml
--
Cordialement / Best regards,

Arnaud Jacques
Gérant de SecuriteInfo.com

Téléphone : +33-(0)3.44.39.76.46
E-mail : ***@securiteinfo.com
Site web : https://www.securiteinfo.com
Facebook : https://www.facebook.com/pages/SecuriteInfocom/132872523492286
Twitter : @SecuriteInfoCom

Securiteinfo.com
La Sécurité Informatique - La Sécurité des Informations.
266, rue de Villers
60123 Bonneuil en Valois

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

Ted Hatfield

2018-09-28 16:19:13 UTC

Permalink

Post by Arnaud Jacques

https://www.securiteinfo.com/services/anti-spam-anti-virus/whitelisting_clamav_signatures.shtml

clamav-milter has exactly one whitelist which prevents clamd scanning
the message as a whole - that's it
if you use some middleware to configure your stuff consult the docs of
that middleware
clamilt 928 0.0 0.0 991272 5028 ? SNsl Sep14 1:36
/usr/sbin/clamav-milter -c /etc/mail/clamav-milter.conf
Whitelist /etc/mail/clamav-milter-whitelist.conf
From:seclists.org
From:securityfocus.com
From:spamassassin.apache.org
(the strange from where seen in maillogs and created as honeypots to
catch bayes-trainings-corpus....)

Thanks for the clarification. Very helpful.

Ted Hatfield

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml