ClamAV stopped and does not start with custom viruses definition bases

ClamAV stopped and does not start any longer. And directadmin alerts: The service 'clamd' on server server.domain.com is currently down. Here is a possible cause and solution.

Popular installations for DirectAdmin servers suggest adding virus definition bases from Malware.Expert, they used to be free, and now they are commercial, and due to the way they changed the things on their side all the ClamAV installations are under risk. ClamAV stops working.

Remove Malware.Expert from ClamAV

First we remove broken virus definition bases

rm -f /usr/local/share/clamav/malware.expert*
cp -p /etc/freshclam.conf /etc/freshclam.conf.bak
perl -pi -e 's#^DatabaseCustomURL http://cdn.malware.expert/malware.expert.*\n##' /etc/freshclam.conf

Restart clamd process:

service clamd restart

Make sure ClamAV daemon started:

ps aux | grep clam

Remove Malware.Expert from Maldet (malware scanner)

Remove Malware.Expert from config, it's stored in options: import_custsigs_md5_url and import_custsigs_hex_url:

cp -p /usr/local/maldetect/conf.maldet /usr/local/maldetect/conf.maldet.bak
perl -pi -e 's#^import_custsigs_md5_url=.*#import_custsigs_md5_url=""#' /usr/local/maldetect/conf.maldet
perl -pi -e 's#^import_custsigs_hex_url=.*#import_custsigs_hex_url=""#' /usr/local/maldetect/conf.maldet
grep ^import_custsigs /usr/local/maldetect/conf.maldet

Since that you should be save.

Have fun.