Disable and stop ClamAV without uninstalling

Community Support Mail
1

How can I disable and stop clamav correctly on the system without uninstalling it?

Following these steps:

Clamav and spamassassin - #4 by eris
Remove clamav-daemon and spamd - #6 by sahsanu

  1. I ran:
systemctl disable clamav-daemon
systemctl stop clamav-daemon
  1. In /etc/exim4/exim4.conf.template I uncommented # CLAMD = yes

But in the exim4 mainlog i get:

2025-12-10 12:26:14 1vTIKk-XXX-1QwI malware acl condition: clamd /run/clamav/clamd.ctl : unable to connect to UNIX socket (/run/clamav/clamd.ctl): No such file or directory
2025-12-10 12:27:09 1vTILc-XXX-3ZIP malware acl condition: clamd /run/clamav/clamd.ctl : unable to connect to UNIX socket (/run/clamav/clamd.ctl): No such file or directory
2025-12-10 12:27:59 1vTIMR-XXX-0TCf malware acl condition: clamd /run/clamav/clamd.ctl : unable to connect to UNIX socket (/run/clamav/clamd.ctl): No such file or directory

Than i ran:

sudo systemctl stop clamav-daemon.socket
sudo systemctl disable clamav-daemon.socket

But no luck. Did i miss something?
Do i need to also uncomment in exim4 config?:

.ifdef CLAMD
av_scanner = clamd: /run/clamav/clamd.ctl
.endif

So ideally i would end up:

UNIT FILE                                    STATE           PRESET
clamav-clamonacc.service                     disabled        enabled
clamav-daemon.service                        disabled        enabled
clamav-freshclam-once.service                disabled        enabled
clamav-freshclam.service                     enabled         enabled
2

Did you restart exim to apply the changes?

systemctl restart exim4

Also, don’t forget:

v-change-sys-config-value ANTIVIRUS_SYSTEM ''
1 Like
3

Awesome! It’s working now, recap:

v-change-sys-config-value ANTIVIRUS_SYSTEM ''

systemctl disable clamav-daemon
systemctl stop clamav-daemon

sudo systemctl stop clamav-daemon.socket
sudo systemctl disable clamav-daemon.socket

In /etc/exim4/exim4.conf.template

# CLAMD = yes

Note: CLAMD = no did not work for me.
And also in /etc/exim4/exim4.conf.template I uncommented:

#.ifdef CLAMD
#av_scanner = clamd: /run/clamav/clamd.ctl
#.endif

systemctl restart exim4

Than i checked services with:

systemctl list-unit-files --type=service

for desired outcome:

UNIT FILE                                    STATE           PRESET
clamav-clamonacc.service                     disabled        enabled
clamav-daemon.service                        disabled        enabled
clamav-freshclam-once.service                disabled        enabled
clamav-freshclam.service                     enabled         enabled

And did some testing sending emails. No more exim mainlog errors like these: malware acl condition: clamd /run/clamav/clamd.ctl : unable to connect to UNIX socket (/run/clamav/clamd.ctl): No such file or directory Thanks!

Follow-up:

1 Like
4

It doesn’t matter what text you assign to the CLAMD variable in Exim, it only checks whether the variable is defined or not. So the only way is to comment out that line… or remove it :wink:

You don’t need to comment out those lines but it won’t hurt :wink:

I would disable freshclam too, if clamav is disabled, you shouldn’t have the freshclam service enabled.

Thanks for sharing the recap :slight_smile:

1 Like
5

Thanks for following up @sahsanu!

  • The CLAMD = no suggestion i got here in another post.
  • Good to know, i read it in the same post but at least now it’s very clear that ifdef CLAMD is not active :stuck_out_tongue:
  • Thanks that you mention that clamav-freshclam.service shouldn’t be enabled. I thought i leave it for now just in case i want to reenable ClamAV in a short time. I’ll disable it too.
sudo systemctl disable clamav-freshclam.service
sudo systemctl disable clamav-freshclam-once.service
sudo systemctl stop clamav-freshclam.service
sudo systemctl stop clamav-freshclam-once.service
1 Like