Virus Detection

We use ClamAV to detect viruses in incoming email.

ClamAV is invoked by clamsmtp so that Postfix simply sends all email through clamsmtp which then re-injects all email without viruses back into the postfix queue.

Sometimes ClamAV has a false positive - you can find them by searching the elastic search logs for:

message: "250 Virus Detected; Discarded Email"

You can then search, on the specified mailfilter server, for the reason via journalctl -u clamsmtp, e.g.:

Jul 24 12:41:49 mailfilter001 clamsmtpd[2855182]: 100028: from=alerts@info6.citi.com, to=freescout-info-email@mailstore002.mayfirst.org, status=VIRUS:Heuristics.Phishing.Email.SpoofedDomain

By default, we don’t quarantine these email messages, but you can temporarily change that by adding:

Quarantine: on

To /etc/clamsmtpd.conf and restarting clamsmtp on all mailfilter servers and then resending the message.

The clamsmtp log will log with something like this (much later in the file):

quarantined virus file as: /tmp/virus.DOT5sH

Or, you can just lok in /tmp.

Lastly, you can report the false positive here: https://www.clamav.net/reports/fp