Install and use clamav AntiVirus software in linuxes5

Install and use clamav AntiVirus software in linuxes5-Linux general technology-Linux technology and application information. For details, refer to the following section. I. Introduction

Clam AntiVirus is a free anti-virus software based on UNIX/LINUX operating systems. It supports online updating of virus libraries.

Features 1.1

GNU open-source software
Quick Scan
It can detect 35000 types of viruses, including Microsoft Office documents and macro viruses.
Ability to detect compressed files (Zip RAR Tar Gzip Bzip2 ......)
Powerful email Scanning
High scalability

1.2 virus submission

If you find a virus that ClamVA cannot kill, you can enter relevant information on the following URL:
Http://www.clamav.net/sendvirus.html

Ii. Software Installation

Operating System Environment: redhat linux es5


Generally, two files need to be installed. gmp is mainly used to update the virus database.

$ Rpm-vih gmp-4.1.4-3.el5.i386.rpm clamav-0.91.2-31.el5.i386.rpm

3. Configure clamav. conf and freshclam. conf

After installation, the configuration file is in the/etc/directory, clamav. conf is the main configuration file of anti-virus software, freshclam. conf is the configuration file for updating the virus database. Below are the configuration instances of the two files, which can be modified according to the environment:

Note: You need to comment out the "Example" at the beginning of the clamd. conf and freshclam. conf files"

$ Vi/etc/clamav. conf

LogFile/var/log/clamd
LogTime
LogSyslog
PidFile/var/lib/clamav/clamd. pid
DatabaseDirectory/var/lib/clamav
TCPSocket 3310
TCPAddr 127.0.0.1
MaxDirectoryRecursion 15
User vscan
Foreground
ScanOLE2
ScanMail
ScanArchive
ArchiveMaxFileSize 10 M
ArchiveMaxRecursion 5
ArchiveMaxFiles 1000
ArchiveMaxCompressionRatio 200

$ Vi/etc/freshclam. conf

UpdateLogFile/var/log/freshclam. log
LogSyslog
DatabaseMirror database.clamav.net
MaxAttempts 3
Checks 12

After the configuration is complete, start clam:
$/Etc/init. d/clamd start

Start update:
$ Freshclam
ERROR: Cant't open/var/log/freshclam. log in append mode.
ERROR: Problem with internal logger.

If the above error occurs, create the file and set the permission:
$ Touch/var/log/freshclam. log
$ Chmod 777/var/log/freshclam. log

Run the command freshclam again.
$ Freshclam
ClamAV update process started at Thu Nov 10 15:04:26 2005
Reading CVD header (main. cvd): OK
Downloading main. cvd

Main. cvd updated (version: 34, sigs: 39625, f-level: 5, builder: tkojm)
......

When the above prompt appears, it means that the update has started. view the/var/log/freshclam. log file. The record of each update will be recorded in this file, as shown below:
$ Cat/var/log/freshclam. log
--------------------------------------
ClamAV update process started at Thu Nov 10 15:04:26 2005
Main. cvd updated (version: 34, sigs: 39625, f-level: 5, builder: tkojm)
WARNING: Your ClamAV installation is OUTDATED-please update immediately!
WARNING: Current functionality level = 2, required = 5
Daily. cvd updated (version: 1166, sigs: 1607, f-level: 6, builder: tomek)
WARNING: Your ClamAV installation is OUTDATED-please update immediately!
WARNING: Current functionality level = 2, required = 6
Database updated (41232 signatures) from database.clamav.net (140.128.9.18 ).

4. virus detection and removal

There are two Commands: clamscan and clamdscan. These two commands are used in a similar way. Here we will mainly introduce clamscan.

Example
(0) scan the specified file:

Clamscan file

(1) scan the current directory:

Clamscan

(2) scan all files (including subdirectories) in the/home directory ):

Clamscan-r/home

Clamscan-r/(scan all directories and Their subdirectories)


(3) Load database from selected file and limit disk usage to 50 Mb:

Clamscan-d/tmp/newclamdb -- max-space = 50 m-r/tmp

(4) scan data streams:

Cat testfile | clamscan-

(5) check the mail directory:

Clamscan-r -- mbox/var/spool/mail

Other differences
-L [path] [file name] add scan report
# Clamscan-l/var/log/clamscan. log/
-- Move [path] to move the virus file ..
-- Remove [path] Delete Virus files
-- Unzip (unrar) decompress the compressed file for scanning

Return Value

0: no virus

1: virus discovered

40: Unknown options passed

50: Database initialization error

52: Unsupported File Format

53: the directory cannot be opened.

54: file cannot be opened (ofm)

55: File Read error (ofm)

56: Can't stat input file/directory.

57: Can't get absolute path name of current working directory.

58: I/O error. Check the file system.

59: the current user information cannot be obtained in/etc/passwd.

60: the user information of 'clamav' (default name) cannot be obtained in/etc/passwd.

61: Can't fork.

63: temporary files/directories cannot be created (check permissions ).

64: the temporary directory cannot be written (please specify another directory ).

70: memory cannot be allocated or released (calloc ).

71: memory cannot be allocated (malloc ).