How to remove clamav additional databases

[DevTeam9200]

Hi Team,

I initially amended this file /usr/local/cpanel/3rdparty/etc/freshclam.conf

and added for example additional cdb / databases example:
DatabaseCustomURL http://LinkRemoved/sanesecurity/foxhole_js.cdb
DatabaseCustomURL http://LinkRemoved/sanesecurity/foxhole_js.ndb
DatabaseCustomURL http://LinkRemoved/sanesecurity/foxhole_all.cdb
DatabaseCustomURL http://LinkRemoved/sanesecurity/foxhole_all.ndb
DatabaseCustomURL http://LinkRemoved/sanesecurity/foxhole_mail.cdb

for clamav and ran freshclam etc and they work and got imported. But the above ones in particular are causing HIGH false positives.

I have removed them from the /usr/local/cpanel/3rdparty/etc/freshclam.conf

Re ran freshclam etc and they are no longer appearing in the fresh clam update. but the databases are still causing issues.

I have then restarted clamav service and still no luck

I have deleted all files in here: /usr/local/cpanel/3rdparty/share/clamav/

And restarted clamav service again and then done another freshclam and still getting the below issues when trying to upload wordpress plugins via cpanel (which was the initial error and reason for needing to remove the additional false positive databases above)

The file you uploaded, codecanyon-7190695-visual-composer-extensions-addon.zip, contains a virus so the upload was canceled: Sanesecurity.Foxhole.Zip_Js_Js.UNOFFICIAL FOUND

Too me in plain terms it feels like clamav has a old database or footprint somewhere that i need to flush and delete and completely rebuild? If so how do I do this? I.e. completely delete the clamav database and cache and rebuild it from scratch?

 

[cPanelLauren]

Hi @DevTeam9200

You might try reinstalling ClamAV but the db is updated multiple times a week if not daily. Their documentation here may be helpful as well ClamavNet


Thanks!