Mailing List Archive

[clamav-users] QNAP Antivirus Updates
Hello,

I have several QNAPs on a locked down network that have the Clamav.net <http://clamav.net/> antivirus package/software installed. Something changed on the 16th and I have been unable to get updates. I have an ACL that blocks all traffic on this network unless I define its IPs/DNS addresses.

I had set the two DNS addresses that I had detected back in March in the ACL, those are as follows: clamav.net <http://clamav.net/> (199.62.84.153) which appears to check if the database as an update and database.clamav.net <http://database.clamav.net/> (198.148.79.54) which has the update file. Did the DNS names change or has the database stopped providing updates?


Thanks,
Gregory Poveda
OIT - Network Infrastructure
VBH M1D
Cell: (865) 250-0290
Office: (256) 824-7656
gap0005@uah.edu
Re: [clamav-users] QNAP Antivirus Updates [ In reply to ]
Hi there,

On Sun, 19 Sep 2021, Gregory Poveda via clamav-users wrote:

> I have several QNAPs

It might be worth searching for 'QNAP' in the list archives. At least
some of those devices will struggle to run ClamAV - or rather, ClamAV
out of the box - for lack of memory.

> on a locked down network that have the Clamav.net antivirus package/
> software installed. Something changed on the 16th and I have been
> unable to get updates. I have an ACL that blocks all traffic on this
> network unless I define its IPs/DNS addresses. I had set the two DNS
> addresses that I had detected back in March in the ACL, those are as
> follows: clamav.net (199.62.84.153) which appears to check if the
> database as an update and database.clamav.net (198.148.79.54) which
> has the update file.

If you don't mind my saying so, that's a fragile setup. IPs can and
do change without notice.

> Did the DNS names change or has the database stopped providing
> updates?

Check the very recent thread "Virus DB updates?".

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [clamav-users] QNAP Antivirus Updates [ In reply to ]
On Mon, 20 Sep 2021 08:18:01 +0100 (BST)
"G.W. Haywood via clamav-users" <clamav-users@lists.clamav.net> wrote:

> Hi there,
>
> On Sun, 19 Sep 2021, Gregory Poveda via clamav-users wrote:
>
> > I have several QNAPs
>
> It might be worth searching for 'QNAP' in the list archives. At least
> some of those devices will struggle to run ClamAV - or rather, ClamAV
> out of the box - for lack of memory.
>
> > on a locked down network that have the Clamav.net antivirus package/
> > software installed. Something changed on the 16th and I have been
> > unable to get updates. I have an ACL that blocks all traffic on this
> > network unless I define its IPs/DNS addresses. I had set the two DNS
> > addresses that I had detected back in March in the ACL, those are as
> > follows: clamav.net (199.62.84.153) which appears to check if the
> > database as an update and database.clamav.net (198.148.79.54) which
> > has the update file.
>
> If you don't mind my saying so, that's a fragile setup. IPs can and
> do change without notice.
>
> > Did the DNS names change or has the database stopped providing
> > updates?
>
> Check the very recent thread "Virus DB updates?".

=====================

Using an ACL mechanism that uses DNS names to allow outbound traffic strikes me as also a setup that is either fragile or very slow. Either it does a DNS lookup when started, so if the DNS->IP map changes while it's running, you lose. Or it does a reverse DNS (PTR) lookup for every outbound SYN to see if it's OK, and it's slow.

In my case, I use iptables (on Linux) to block almost all outbound TCP from select servers, and I use two IP addresses (only) to allow ClamAV update traffic, from/to freshclam.

These two IPs are Anycast addresses, and have been unchanged for well over 2 years. (Anycast addresses don't have to change even if the physical servers change, that's their point!) They are:

104.16.218.84
104.16.219.84

I don't know if they are appropriate for non-freshclam ways of obtaining the updates, e.g., updating a mirror. (And I don't know if they work world-wide.)

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [clamav-users] QNAP Antivirus Updates [ In reply to ]
> On Sep 20, 2021, at 13:08, Paul Kosinski via clamav-users <clamav-users@lists.clamav.net> wrote:
>
> These two IPs are Anycast addresses, and have been unchanged for well over 2 years. (Anycast addresses don't have to change even if the physical servers change, that's their point!) They are:
>
> 104.16.218.84
> 104.16.219.84
That’s what they are for you. Cloudflare routes you to the closest pop to your network. Your mileage may vary


> I don't know if they are appropriate for non-freshclam ways of obtaining the updates, e.g., updating a mirror. (And I don't know if they work world-wide.)

FreshClam or cvdupdate. That’s what we recommend, that’s what we enforce. Use one of those two or risk being cut off completely in the future.
Re: [clamav-users] QNAP Antivirus Updates [ In reply to ]
On Mon, 20 Sep 2021 17:17:34 +0000
"Joel Esler (jesler)" <jesler@cisco.com> wrote:

> > On Sep 20, 2021, at 13:08, Paul Kosinski via clamav-users <clamav-users@lists.clamav.net> wrote:
> >
> > These two IPs are Anycast addresses, and have been unchanged for well over 2 years. (Anycast addresses don't have to change even if the physical servers change, that's their point!) They are:
> >
> > 104.16.218.84
> > 104.16.219.84
> That’s what they are for you. Cloudflare routes you to the closest pop to your network. Your mileage may vary

===================

I thought the IP addresses, being Anycast, were what are routed to the closest POP.

No matter, when I resolve "database.clamav.net" via various DNS servers, using TCP to bypass the default local DNS server (as our firewall blocks outbound UDP port 53 otherwise), I always get these same two IP addresses as results (see below)

Given that the servers at 1.1.1.1, 8.8.8.8 and 9.9.9.9 are "public", and likely Anycast, while 71.243.0.12 is local Verizon/FIOS, I suppose that the Authoritative server and the public (Anycast) servers could conceivably be distributing different IP addresses depending on who is querying. (BIND/named has become incredibly complicated these days.) But since the two IP addresses are themselves Anycast, what would be the point?

In any case, does anyone, anywhere, get IP addresses other than

104.16.218.84
104.16.219.84

when resolving "database.clamav.net"?

------------------------------------------------------------

$ dig +tcp +all @1.1.1.1 database.clamav.net

; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> +nocomments +nostats +nocmd +tcp +all @1.1.1.1 database.clamav.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5920
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;database.clamav.net. IN A

;; ANSWER SECTION:
database.clamav.net. 31 IN CNAME database.clamav.net.cdn.cloudflare.net.
database.clamav.net.cdn.cloudflare.net. 271 IN A 104.16.219.84
database.clamav.net.cdn.cloudflare.net. 271 IN A 104.16.218.84

;; Query time: 11 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Mon Sep 20 15:28:17 2021
;; MSG SIZE rcvd: 118

---------------

$ dig +tcp +all @8.8.8.8 database.clamav.net

; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> +nocomments +nostats +nocmd +tcp +all @8.8.8.8 database.clamav.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49012
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;database.clamav.net. IN A

;; ANSWER SECTION:
database.clamav.net. 19 IN CNAME database.clamav.net.cdn.cloudflare.net.
database.clamav.net.cdn.cloudflare.net. 300 IN A 104.16.218.84
database.clamav.net.cdn.cloudflare.net. 300 IN A 104.16.219.84

;; Query time: 31 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Sep 20 15:21:13 2021
;; MSG SIZE rcvd: 118

---------------

$ dig +tcp +all @9.9.9.9 database.clamav.net

; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> +nocomments +nostats +nocmd +tcp +all @9.9.9.9 database.clamav.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29165
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;database.clamav.net. IN A

;; ANSWER SECTION:
database.clamav.net. 60 IN CNAME database.clamav.net.cdn.cloudflare.net.
database.clamav.net.cdn.cloudflare.net. 300 IN A 104.16.218.84
database.clamav.net.cdn.cloudflare.net. 300 IN A 104.16.219.84

;; Query time: 91 msec
;; SERVER: 9.9.9.9#53(9.9.9.9)
;; WHEN: Mon Sep 20 15:30:17 2021
;; MSG SIZE rcvd: 118

---------------

$ dig +tcp +all @71.243.0.12 database.clamav.net

; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> +nocomments +nostats +nocmd +tcp +all @71.243.0.12 database.clamav.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12056
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;database.clamav.net. IN A

;; ANSWER SECTION:
database.clamav.net. 60 IN CNAME database.clamav.net.cdn.cloudflare.net.
database.clamav.net.cdn.cloudflare.net. 144 IN A 104.16.218.84
database.clamav.net.cdn.cloudflare.net. 144 IN A 104.16.219.84

;; Query time: 16 msec
;; SERVER: 71.243.0.12#53(71.243.0.12)
;; WHEN: Mon Sep 20 15:21:39 2021
;; MSG SIZE rcvd: 118



_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [clamav-users] QNAP Antivirus Updates [ In reply to ]
>On Mon, 20 Sep 2021 17:17:34 +0000
>"Joel Esler (jesler)" <jesler@cisco.com> wrote:
>
>> > On Sep 20, 2021, at 13:08, Paul Kosinski via clamav-users <clamav-users@lists.clamav.net> wrote:
>> >
>> > These two IPs are Anycast addresses, and have been unchanged for well over 2 years. (Anycast addresses don't have to change even if the physical servers change, that's their point!) They are:
>> >
>> > 104.16.218.84
>> > 104.16.219.84
>> That’s what they are for you. Cloudflare routes you to the closest pop to your network. Your mileage may vary

On 20.09.21 20:16, Paul Kosinski via clamav-users wrote:
>I thought the IP addresses, being Anycast, were what are routed to the closest POP.

how's this different from what Joel said?

> No matter, when I resolve "database.clamav.net" via various DNS servers,
> using TCP to bypass the default local DNS server (as our firewall blocks
> outbound UDP port 53 otherwise), I always get these same two IP addresses
> as results (see below)

yes, becaue those two IP are anycast... they are router to the nearest POP.

> Given that the servers at 1.1.1.1, 8.8.8.8 and 9.9.9.9 are "public", and
> likely Anycast, while 71.243.0.12 is local Verizon/FIOS, I suppose that
> the Authoritative server and the public (Anycast) servers could
> conceivably be distributing different IP addresses depending on who is
> querying. (BIND/named has become incredibly complicated these days.) But
> since the two IP addresses are themselves Anycast, what would be the
> point?

the point is, not to provide different IPs via anycast DNS but to provide
anycast IPs via any DNS.

> In any case, does anyone, anywhere, get IP addresses other than
>
> 104.16.218.84
> 104.16.219.84
>
> when resolving "database.clamav.net"?

--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I just got lost in thought. It was unfamiliar territory.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [clamav-users] QNAP Antivirus Updates [ In reply to ]
Cool ????????????????


Sent from my ? iPhone

> On Sep 20, 2021, at 20:17, Paul Kosinski <clamav-users@iment.com> wrote:
>
> ?On Mon, 20 Sep 2021 17:17:34 +0000
> "Joel Esler (jesler)" <jesler@cisco.com> wrote:
>
>>>> On Sep 20, 2021, at 13:08, Paul Kosinski via clamav-users <clamav-users@lists.clamav.net> wrote:
>>>
>>> These two IPs are Anycast addresses, and have been unchanged for well over 2 years. (Anycast addresses don't have to change even if the physical servers change, that's their point!) They are:
>>>
>>> 104.16.218.84
>>> 104.16.219.84
>> That’s what they are for you. Cloudflare routes you to the closest pop to your network. Your mileage may vary
>
> ===================
>
> I thought the IP addresses, being Anycast, were what are routed to the closest POP.
>
> No matter, when I resolve "database.clamav.net" via various DNS servers, using TCP to bypass the default local DNS server (as our firewall blocks outbound UDP port 53 otherwise), I always get these same two IP addresses as results (see below)
>
> Given that the servers at 1.1.1.1, 8.8.8.8 and 9.9.9.9 are "public", and likely Anycast, while 71.243.0.12 is local Verizon/FIOS, I suppose that the Authoritative server and the public (Anycast) servers could conceivably be distributing different IP addresses depending on who is querying. (BIND/named has become incredibly complicated these days.) But since the two IP addresses are themselves Anycast, what would be the point?
>
> In any case, does anyone, anywhere, get IP addresses other than
>
> 104.16.218.84
> 104.16.219.84
>
> when resolving "database.clamav.net"?
>
> ------------------------------------------------------------
>
> $ dig +tcp +all @1.1.1.1 database.clamav.net
>
> ; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> +nocomments +nostats +nocmd +tcp +all @1.1.1.1 database.clamav.net
> ; (1 server found)
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5920
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
>
> ;; QUESTION SECTION:
> ;database.clamav.net. IN A
>
> ;; ANSWER SECTION:
> database.clamav.net. 31 IN CNAME database.clamav.net.cdn.cloudflare.net.
> database.clamav.net.cdn.cloudflare.net. 271 IN A 104.16.219.84
> database.clamav.net.cdn.cloudflare.net. 271 IN A 104.16.218.84
>
> ;; Query time: 11 msec
> ;; SERVER: 1.1.1.1#53(1.1.1.1)
> ;; WHEN: Mon Sep 20 15:28:17 2021
> ;; MSG SIZE rcvd: 118
>
> ---------------
>
> $ dig +tcp +all @8.8.8.8 database.clamav.net
>
> ; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> +nocomments +nostats +nocmd +tcp +all @8.8.8.8 database.clamav.net
> ; (1 server found)
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49012
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
>
> ;; QUESTION SECTION:
> ;database.clamav.net. IN A
>
> ;; ANSWER SECTION:
> database.clamav.net. 19 IN CNAME database.clamav.net.cdn.cloudflare.net.
> database.clamav.net.cdn.cloudflare.net. 300 IN A 104.16.218.84
> database.clamav.net.cdn.cloudflare.net. 300 IN A 104.16.219.84
>
> ;; Query time: 31 msec
> ;; SERVER: 8.8.8.8#53(8.8.8.8)
> ;; WHEN: Mon Sep 20 15:21:13 2021
> ;; MSG SIZE rcvd: 118
>
> ---------------
>
> $ dig +tcp +all @9.9.9.9 database.clamav.net
>
> ; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> +nocomments +nostats +nocmd +tcp +all @9.9.9.9 database.clamav.net
> ; (1 server found)
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29165
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
>
> ;; QUESTION SECTION:
> ;database.clamav.net. IN A
>
> ;; ANSWER SECTION:
> database.clamav.net. 60 IN CNAME database.clamav.net.cdn.cloudflare.net.
> database.clamav.net.cdn.cloudflare.net. 300 IN A 104.16.218.84
> database.clamav.net.cdn.cloudflare.net. 300 IN A 104.16.219.84
>
> ;; Query time: 91 msec
> ;; SERVER: 9.9.9.9#53(9.9.9.9)
> ;; WHEN: Mon Sep 20 15:30:17 2021
> ;; MSG SIZE rcvd: 118
>
> ---------------
>
> $ dig +tcp +all @71.243.0.12 database.clamav.net
>
> ; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> +nocomments +nostats +nocmd +tcp +all @71.243.0.12 database.clamav.net
> ; (1 server found)
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12056
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
>
> ;; QUESTION SECTION:
> ;database.clamav.net. IN A
>
> ;; ANSWER SECTION:
> database.clamav.net. 60 IN CNAME database.clamav.net.cdn.cloudflare.net.
> database.clamav.net.cdn.cloudflare.net. 144 IN A 104.16.218.84
> database.clamav.net.cdn.cloudflare.net. 144 IN A 104.16.219.84
>
> ;; Query time: 16 msec
> ;; SERVER: 71.243.0.12#53(71.243.0.12)
> ;; WHEN: Mon Sep 20 15:21:39 2021
> ;; MSG SIZE rcvd: 118
>
>

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [clamav-users] QNAP Antivirus Updates [ In reply to ]
"how's this different from what Joel said?"

My reading of the following (based on normal English convention)

> > 104.16.218.84
> > 104.16.219.84
> That’s what they are for you. Cloudflare routes you to the closest pop to your network. Your mileage may vary

is that "they" refers to the IP addresses, NOT the DNS names (which hadn't even been mentioned in my email at this point).

Thus, what I inferred from Joel's statement is that "database.clamav.net" might resolve to different IPs for other users (which would be weird, given the use of Anycast). So I tested it the best I could (without traveling a lot, or setting up VMs in different countries).


On Tue, 21 Sep 2021 13:21:20 +0200
Matus UHLAR - fantomas <uhlar@fantomas.sk> wrote:

> >On Mon, 20 Sep 2021 17:17:34 +0000
> >"Joel Esler (jesler)" <jesler@cisco.com> wrote:
> >
> >> > On Sep 20, 2021, at 13:08, Paul Kosinski via clamav-users <clamav-users@lists.clamav.net> wrote:
> >> >
> >> > These two IPs are Anycast addresses, and have been unchanged for well over 2 years. (Anycast addresses don't have to change even if the physical servers change, that's their point!) They are:
> >> >
> >> > 104.16.218.84
> >> > 104.16.219.84
> >> That’s what they are for you. Cloudflare routes you to the closest pop to your network. Your mileage may vary
>
> On 20.09.21 20:16, Paul Kosinski via clamav-users wrote:
> >I thought the IP addresses, being Anycast, were what are routed to the closest POP.
>
> how's this different from what Joel said?
>
> > No matter, when I resolve "database.clamav.net" via various DNS servers,
> > using TCP to bypass the default local DNS server (as our firewall blocks
> > outbound UDP port 53 otherwise), I always get these same two IP addresses
> > as results (see below)
>
> yes, becaue those two IP are anycast... they are router to the nearest POP.
>
> > Given that the servers at 1.1.1.1, 8.8.8.8 and 9.9.9.9 are "public", and
> > likely Anycast, while 71.243.0.12 is local Verizon/FIOS, I suppose that
> > the Authoritative server and the public (Anycast) servers could
> > conceivably be distributing different IP addresses depending on who is
> > querying. (BIND/named has become incredibly complicated these days.) But
> > since the two IP addresses are themselves Anycast, what would be the
> > point?
>
> the point is, not to provide different IPs via anycast DNS but to provide
> anycast IPs via any DNS.
>
> > In any case, does anyone, anywhere, get IP addresses other than
> >
> > 104.16.218.84
> > 104.16.219.84
> >
> > when resolving "database.clamav.net"?
>

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [clamav-users] QNAP Antivirus Updates [ In reply to ]
I have already forgotten the point, but I did do some DNS
queries from our datacenters in LON, TYO, and NYC. All
reported the same results;

Non-authoritative answer:
database.clamav.net canonical name = database.clamav.net.cdn.cloudflare.net.
Name: database.clamav.net.cdn.cloudflare.net
Address: 104.16.218.84
Name: database.clamav.net.cdn.cloudflare.net
Address: 104.16.219.84

It seems it should be safe to specify these 2 IP addresses
in your firewall for the updates.


L8r
Dan

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [clamav-users] QNAP Antivirus Updates [ In reply to ]
And… there’s your answer. Thank you all! I think this thread is dead.

> On Sep 21, 2021, at 2:42 PM, Liston, Daniel (DLISTON) via clamav-users <clamav-users@lists.clamav.net> wrote:
>
> I have already forgotten the point, but I did do some DNS
> queries from our datacenters in LON, TYO, and NYC. All
> reported the same results;
>
> Non-authoritative answer:
> database.clamav.net canonical name = database.clamav.net.cdn.cloudflare.net.
> Name: database.clamav.net.cdn.cloudflare.net
> Address: 104.16.218.84
> Name: database.clamav.net.cdn.cloudflare.net
> Address: 104.16.219.84
>
> It seems it should be safe to specify these 2 IP addresses
> in your firewall for the updates.
>
>
> L8r
> Dan
>
> _______________________________________________
>
> clamav-users mailing list
> clamav-users@lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml