Antivirus Configuration¶

Configure ClamAV virus and malware scanning to protect your organization from email-borne threats.

Overview¶

Mailborder integrates ClamAV for comprehensive virus and malware detection:

Real-time virus signature database
Archive scanning (ZIP, RAR, 7z, TAR, etc.)
Office document macro detection
Executable analysis
PDF scanning
Heuristic detection for unknown threats

Accessing Antivirus Settings¶

Via Web Interface: Navigate to Email Security → Antivirus

Via Command Line:

sudo mb-config show antivirus

Enable/Disable Virus Scanning¶

Enable Antivirus¶

Default: Enabled

sudo mb-config set antivirus.enabled true

Disable Antivirus¶

Only disable if you have alternative virus protection:

sudo mb-config set antivirus.enabled false
sudo systemctl reload mb-filter

Virus Detection Actions¶

What to do when a virus is detected.

Quarantine (Recommended)¶

Hold virus-infected email for review.

sudo mb-config set antivirus.action quarantine

Advantages: - Can review false positives - Can release if needed - Maintains evidence

Reject¶

Block at SMTP level with error message.

sudo mb-config set antivirus.action reject

Advantages: - No storage used - Immediate feedback to sender - Clear rejection reason

Error message sent to sender:

550 5.7.1 Message rejected due to virus: Eicar-Test-Signature

Delete (Discard)¶

Accept but silently discard.

sudo mb-config set antivirus.action delete

Advantages: - No bounce to sender (prevent Joe Job bounces) - No quarantine storage

Disadvantages: - No notification to recipient - No evidence retained

Deliver with Warning¶

Deliver with X-Virus header (not recommended).

sudo mb-config set antivirus.action deliver
sudo mb-config set antivirus.add_header true

Not recommended - Risks delivering actual malware to users.

Scan Settings¶

Scan Archives¶

Scan compressed files (ZIP, RAR, 7z, TAR, GZ, BZ2, etc.).

Default: Enabled

sudo mb-config set antivirus.scan_archives true

Recursion Depth

How deep to scan nested archives (archives within archives).

Default: 15 levels

sudo mb-config set antivirus.max_recursion 15

Example: - malware.zip - archive.rar - nested.7z - virus.exe ← detected at depth 3

Max Archive Size

Maximum size of archive to scan.

Default: 100 MB

# 100 MB
sudo mb-config set antivirus.max_archive_size 104857600

# 50 MB (smaller, faster)
sudo mb-config set antivirus.max_archive_size 52428800

Archives larger than this are skipped (not scanned).

Scan Office Documents¶

Scan Microsoft Office documents for macros and exploits.

Default: Enabled

sudo mb-config set antivirus.scan_office true

Formats scanned: - Word (.doc, .docx, .docm) - Excel (.xls, .xlsx, .xlsm) - PowerPoint (.ppt, .pptx, .pptm) - Access (.mdb, .accdb) - OneNote (.one)

Macro Detection:

# Alert on ANY macros (strict)
sudo mb-config set antivirus.office.alert_macros true

# Or only alert on suspicious macros (default)
sudo mb-config set antivirus.office.alert_macros false

Scan PDFs¶

Scan PDF files for embedded malware and exploits.

Default: Enabled

sudo mb-config set antivirus.scan_pdf true

PDF Exploits Detected: - JavaScript exploits - Embedded executables - Form field exploits - Malformed PDF structure

Scan Executables¶

Scan executable files (.exe, .dll, .so, etc.).

Default: Enabled

sudo mb-config set antivirus.scan_executables true

Block All Executables:

Can also block ALL executables regardless of virus:

sudo mb-config set antivirus.block_all_executables true

Useful for organizations that never receive legitimate executables via email.

Encrypted Archives¶

Handle password-protected archives.

Options:

Block (recommended) - Reject encrypted archives

sudo mb-config set antivirus.encrypted_archive_action block

Allow - Let through without scanning

sudo mb-config set antivirus.encrypted_archive_action allow

Quarantine - Hold for manual review

sudo mb-config set antivirus.encrypted_archive_action quarantine

Rationale for blocking: Can't scan contents, common malware delivery method.

File Type Blocking¶

Block dangerous file types regardless of virus detection.

Default Blocked Extensions¶

Default blocked: - Executables: .exe, .com, .scr, .bat, .cmd, .pif - Scripts: .vbs, .js, .jse, .wsf, .wsh, .ps1 - System files: .sys, .dll, .drv - Other: .hta, .reg, .msi, .cpl

Add Blocked Extension¶

sudo mb-antivirus-block-ext add .scr
sudo mb-antivirus-block-ext add .vbs
sudo mb-antivirus-block-ext add .jar

Remove Blocked Extension¶

sudo mb-antivirus-block-ext remove .scr

List Blocked Extensions¶

sudo mb-antivirus-block-ext list

Block by MIME Type¶

Block by MIME type instead of extension:

sudo mb-antivirus-block-mime add "application/x-executable"
sudo mb-antivirus-block-mime add "application/x-dosexec"

Signature Updates¶

ClamAV signatures are updated regularly to detect new threats.

Automatic Updates¶

Default: Enabled, every 4 hours

sudo mb-config set antivirus.auto_update true
sudo mb-config set antivirus.update_interval 14400  # 4 hours

Manual Update¶

# Update virus signatures
sudo freshclam

# Or via Mailborder command
sudo mb-update --antivirus

Update Schedule¶

Configure when updates occur:

# Update at specific times (cron format)
sudo mb-config set antivirus.update_schedule "0 */4 * * *"  # Every 4 hours

Update Source¶

Default: Official ClamAV servers

sudo mb-config set antivirus.update_mirror "db.local.clamav.net"

Private Mirror:

For air-gapped environments, set up private mirror:

sudo mb-config set antivirus.update_mirror "mirror.internal.company.com"

Signature Database Location¶

Default: /var/lib/clamav/

Contains: - main.cvd - Main signature database - daily.cvd - Daily updates - bytecode.cvd - Bytecode signatures

Check database version:

sudo sigtool --info /var/lib/clamav/main.cvd
sudo sigtool --info /var/lib/clamav/daily.cvd

Performance Settings¶

Scan Timeout¶

Maximum time to scan a single email.

Default: 120 seconds (2 minutes)

sudo mb-config set antivirus.timeout 120

If timeout exceeded: - Email delivery deferred (retry later) - Error logged - May indicate large archive or performance issue

Max File Size¶

Maximum size of individual file to scan.

Default: 25 MB

sudo mb-config set antivirus.max_file_size 26214400  # 25 MB

Files larger than this are skipped (not scanned).

Concurrent Scans¶

Parallel scanning processes.

Default: Number of CPU cores

sudo mb-config set antivirus.concurrent_scans 4

More concurrent = higher throughput but more CPU/memory usage.

Resource Limits¶

Memory Limit per Scan:

# 512 MB per scan process
sudo mb-config set antivirus.max_memory 536870912

I/O Priority:

# Lower priority to not impact other services
sudo mb-config set antivirus.io_priority low

Heuristic Detection¶

Detect unknown threats using behavioral analysis.

Enable Heuristics¶

Default: Enabled

sudo mb-config set antivirus.heuristics.enabled true

Heuristic Sensitivity¶

Low - Fewer false positives, may miss some threats Medium - Balanced (default) High - More false positives, catches more threats

sudo mb-config set antivirus.heuristics.sensitivity medium

Heuristic Scanning Options¶

Detect Phishing:

sudo mb-config set antivirus.heuristics.phishing true

Detect Broken Executables:

sudo mb-config set antivirus.heuristics.broken_executables true

Detect Encrypted Malware:

sudo mb-config set antivirus.heuristics.encrypted_malware true

Algorithmic Detection:

sudo mb-config set antivirus.heuristics.algorithmic true

Notifications¶

Alert on Virus Detection¶

Email Notifications:

sudo mb-config set antivirus.alert.enabled true
sudo mb-config set antivirus.alert.recipients "security@example.com,admin@example.com"

Alert Contents: - Timestamp - Sender and recipient - Virus name - File name - Action taken - Message ID

Alert Frequency¶

Prevent alert spam:

# Maximum alerts per hour
sudo mb-config set antivirus.alert.max_per_hour 10

# Minimum time between alerts (seconds)
sudo mb-config set antivirus.alert.throttle 300  # 5 minutes

False Positive Handling¶

Whitelist Files¶

Exclude files from scanning (false positive workaround):

By Hash (MD5):

sudo mb-antivirus-whitelist add-hash d41d8cd98f00b204e9800998ecf8427e

By Signature:

sudo mb-antivirus-whitelist add-signature "Eicar-Test-Signature"

By Sender:

sudo mb-antivirus-whitelist add-sender trusted@example.com

By File Name:

sudo mb-antivirus-whitelist add-filename "legitimate.exe"

Report False Positive¶

To ClamAV team:

# Extract file from quarantine
sudo mb-quarantine-extract <message-id> /tmp/false-positive.zip

# Submit to ClamAV
# Visit: https://www.clamav.net/reports/fp

Custom Signatures¶

Add your own virus signatures.

Add Custom Signature¶

Hash-based (MD5):

echo "d41d8cd98f00b204e9800998ecf8427e:68:CustomMalware.Variant" | \
  sudo tee -a /var/lib/clamav/custom.hdb

Pattern-based:

echo "CustomMalware:0:*:74657374" | \
  sudo tee -a /var/lib/clamav/custom.ndb

Reload signatures:

sudo clamdscan --reload

Signature Format¶

Hash Signature (.hdb):

MD5:FileSize:MalwareName

Pattern Signature (.ndb):

MalwareName:TargetType:Offset:HexPattern

See ClamAV documentation for advanced signature creation.

Testing and Validation¶

Test Virus Detection¶

Use EICAR test file (safe, recognized by all AV):

# Create EICAR test file
echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > /tmp/eicar.txt

# Test scan
sudo clamdscan /tmp/eicar.txt

Expected result:

/tmp/eicar.txt: Eicar-Test-Signature FOUND

Test via email:

Send email with EICAR file as attachment. Should be quarantined/rejected.

Check ClamAV Status¶

# Service status
sudo systemctl status clamav-daemon

# Scan statistics
sudo clamdscan --version
sudo clamdscan --stat

# Database info
sudo sigtool --info /var/lib/clamav/daily.cvd

View Virus Detection Logs¶

# Recent virus detections
sudo grep "FOUND" /var/log/clamav/clamav.log | tail -20

# Mailborder virus logs
sudo tail -f /var/log/mailborder/filter.log | grep virus

Troubleshooting¶

ClamAV Not Running¶

Check service:

sudo systemctl status clamav-daemon

Start service:

sudo systemctl start clamav-daemon

Check logs:

sudo tail -f /var/log/clamav/clamav.log

Common issues: - Database not updated (run freshclam) - Insufficient memory (increase memory limit) - Corrupt database (delete and re-download)

Virus Not Detected¶

Update signatures:

sudo freshclam
sudo systemctl restart clamav-daemon

Check if file scanned:

sudo clamdscan /path/to/file

Verify settings:

sudo mb-config get antivirus.enabled
sudo mb-config get antivirus.scan_archives

False Positives¶

Whitelist temporarily:

sudo mb-antivirus-whitelist add-signature "SignatureName"

Report to ClamAV: https://www.clamav.net/reports/fp

Check signature details:

sudo sigtool --find-sigs SignatureName /var/lib/clamav/*.cvd

Performance Issues¶

Reduce scan depth:

sudo mb-config set antivirus.max_recursion 10
sudo mb-config set antivirus.max_file_size 10485760  # 10 MB

Increase timeout:

sudo mb-config set antivirus.timeout 180  # 3 minutes

Increase memory:

sudo mb-config set antivirus.max_memory 1073741824  # 1 GB

Reduce concurrent scans:

sudo mb-config set antivirus.concurrent_scans 2

Signature Update Failures¶

Check connectivity:

ping db.local.clamav.net

Manual update:

sudo freshclam --verbose

Check freshclam config:

sudo nano /etc/clamav/freshclam.conf

Use alternative mirror:

sudo mb-config set antivirus.update_mirror "db.us.clamav.net"

Advanced Configuration¶

ClamAV Daemon Config¶

Edit /etc/clamav/clamd.conf:

# TCP Socket (instead of Unix socket)
TCPSocket 3310
TCPAddr 127.0.0.1

# Memory limits
MaxThreads 20
MaxQueue 200
MaxFileSize 100M
MaxScanSize 500M

# Heuristics
HeuristicScanPrecedence yes
StructuredDataDetection yes

Restart after changes:

sudo systemctl restart clamav-daemon

Integration with External AV¶

Use multiple AV engines:

# Enable external AV scanner
sudo mb-config set antivirus.external.enabled true
sudo mb-config set antivirus.external.command "/usr/local/bin/custom-av-scan"
sudo mb-config set antivirus.external.timeout 60

Script should return: - Exit 0: Clean - Exit 1: Virus found - Exit 2: Error

Statistics and Reporting¶

View Virus Statistics¶

# Overall virus detections
sudo mb-antivirus-stats

# By virus name
sudo mb-antivirus-stats --by-virus

# By sender
sudo mb-antivirus-stats --by-sender

# Date range
sudo mb-antivirus-stats --since "2025-01-01" --until "2025-01-31"

Generate Report¶

# Daily report
sudo mb-report --antivirus --daily

# Email report
sudo mb-report --antivirus --daily --email admin@example.com

Export Detections¶

# Export to CSV
sudo mb-antivirus-stats --export csv > virus-detections.csv

# Export to JSON
sudo mb-antivirus-stats --export json > virus-detections.json

Best Practices¶

Keep Signatures Updated
Enable automatic updates
Monitor update logs
Test after updates
Quarantine Don't Delete
Allows false positive review
Maintains evidence
Can release if needed
Block Dangerous File Types
Executables
Scripts
Encrypted archives
Monitor Detections
Review virus logs daily
Investigate patterns
Update policies based on threats
Test Regularly
Use EICAR test file
Send test emails
Verify alerts work
Performance Monitoring
Watch scan times
Monitor resource usage
Adjust limits as needed
Report False Positives
Help improve ClamAV
Benefits entire community

Next Steps¶

Spam Filter Configuration - Configure spam detection
Email Processing Settings - Email flow configuration
Quarantine Management - Handle quarantined email
Virus Scanning Details - Deep dive into virus detection