----- "Jeff Thurston" <[EMAIL PROTECTED]> wrote: > Im running clamav 91.2 (90.3 did the same thing). > After about an hour or so the clamd process gets stuck at 100%. > I've checked various logs for the cause and haven't found anything. > > Clamav is being run by amavis-new 2.3 if that info is of any > interest. > > This is a recent problem, I ran 88.4 just fine for MONTHS, then 90.3 > since > the day after its release, Wednesday this started happening. I > upgraded to > 91.2 last night and the problem persists. > > Even though the clamd process is stuck at max cpu usage, it is still > able to > scan and detect viruses. > > Where should I start looking?
I had exactly the same problem today on several MX servers. I managed to reproduce the problem by finding one of the cause emails and running clamscan on it. I found it was caused by the phishing url check. I've put the word CLAM in the url below just in case it causes problems for anyone else's scanners on this list. LibClamAV debug: Phishcheck: Phishing scan result: Host not listed in .pdb -> not checked LibClamAV debug: Phishcheck:Checking url 3D"http://wellCLAMcause.cn"->Click Here URLe z 0 q ; e x 4 8 8 2------=_NextPart_001_000F_01C81760.DED09510-- ------=_NextPart_000_000E_01C81760.DED09510 Content-Type: image/gif; name="" Content-Transfer-Encoding: base64 Content-ID: R0lGODlhwAF5AfcAAAAAAIAAAACAAICAAAAAgIAAgACAgICAgMDAwP8AAAD/AP//AAAA//8A/wD/ /// <snip> Running clamscan with the --no-phishing-scan-urls option solved the problem so I updated my clamd.conf file to include this (PhishingScanURLs no). Matt. _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
