ClamAV Scan Tool

Prepare two machines for testing.

A testing machine 192.168.251.134

A machine under test 192.168.3.24

On the machine under test.

Install the ClamAV before installing the zlib or the installation process will be error.

TAR-ZXVF zlib-1.2.3.tar.gz

CD zlib-1.2.3

./configure

Make

Make Install (zlib compilation installation)

Because I'm installing with a source package, I need to manually create a CLAMAV user

Groupadd ClamAV (Create ClamAV Group

Useradd-g ClamAV ClamAV (create ClamAV user and join ClamAV Group)

TAR-ZXVF clamav-0.95.2.tar.gz (Unzip)

CD clamav-0.95.2 (enter directory)

./configure--prefix=/usr/local/clamav

Make

Make install (compile and install)

After the installation of this ClamAV, let ClamAV start up.

First create a directory.

Mkdir/usr/local/clamav/logs (log storage directory)

Mkdir/usr/local/clamav/updata (clanav virus Library directory)

Vi/usr/local/clamav/etc/clamd.conf

There may be clamd.conf.simple files you can modify this file again

CP Clamd.conf.simple clamd.conf

That's it.

# Example comment out this line. Line 8th

Logfile/usr/local/clamav/logs/clamd.log Delete the previous comment directory and change to logs below line 14th

Pidfile/usr/local/clamav/updata/clamd.pid Delete the previous comment path and change the 57th line.

Databasedirectory/usr/local/clamav/updata Ibid. 65th

Vi/usr/local/clamav/etc/freshclam.conf

# Example comment out this line. Line 8th

Databasedirectory/usr/local/clamav/updata

Updatelogfile/usr/local/clamav/logs/freshclam.log

Pidfile/usr/local/clamav/updata/freshclam.pid (Forget to write the number of lines to find it yourself.)

Create the log file below

Touch/usr/local/clamav/logs/freshclam.log

Chown Clamav:clamav/usr/local/clamav/logs/freshclam.log

Touch/usr/local/clamav/logs/clamd.log

Chown Clamav:clamav/usr/local/clamav/logs/clamd.log

Chown Clamav:clamav/usr/local/clamav/updata

/usr/local/clamav/bin/freshclam (upgrade virus database) to ensure that your Linux can be the normal Internet oh.

[attachment=43384]

It takes a little time.

Waiting for me half an hour to finally download the finished.

At the same time as the update can be in the detection machine write script 192.168.251.134

Before writing, be aware of the need to install PYCLAMAD environment

Download the source package in http://xael.org/pages/pyclamd-en.html

Unpacking and installing Python setup.py install

After installation vim pyclamd.py

#!/usr/bin/python

#-*-Coding:utf-8-*-

Import time

Import PYCLAMD

From threading Import Thread

Class Scan (Thread):

def __init__ (self,ip,scan_type,file):

"" "Construction method, Parameter initialization" ""

Thread.__init__ (self)

Self. IP = IP

Self.scan_type = Scan_type

Self.file = File

Self.connstr = ""

Self.scanresult = ""

def run (self):

"" "multi-Process Run method" ""

Try

cd = Pyclamd. Clamdnetworksocket (self. ip,3310) #创建套接字对象

If Cd.ping (): #探测连通性

Self.connstr = self. ip+ "Connection[ok]"

Cd.reload () #重载clamd病毒特征库, it is recommended to do reload () operation after updating the virus database

if Self.scan_type = = "Contscan_file":

self.scanresult= "{0}\n". Format (Cd.contscan_file (self.file))

Elif self.scan_type== "Multiscan_file":

self.scanresult= "{0}\n". Format (Cd.multiscan_file (self.file))

Elif self.scan_type== "Scan_file":

self.scanresult= "{0}\n". Format (Cd.scan_file (self.file))

Time.sleep (1)

Else

Self.connstr=self. ip+ "Ping Error,exit"

Except Exception,e:

Self.connstr=self. Ip+ "" +str (E)

ips=[' 192.168.3.24 '] #指定扫描主机列表

ScanType = "Multiscan_file" #指定扫描模式, support Multiscan_file,contscan_file,scan_file

Scanfile = "/tmp" #指定扫描路径

I=1

Threadnum = 2 #指定启动的线程数

Scanlist = [] #存储扫描Scan类线程对象列表

For IP in IPs:

CURRP = Scan (ip,scantype,scanfile) #创建扫描Scan类对象, parameters (IP, scan mode, scan path)

Scanlist.append (CURRP) #追加对象到列表

If I%threadnum==0 or I==len (IPs): #当达到指定的线程或IP列表数后启动, Exit thread

For task in Scanlist:

Task.start () #启动线程

For task in Scanlist:

Task.join () #等待所有子线程退出, and output scan results

Print Task.connstr #打印服务器连接信息

Scanlist = []

I+=1

-------------------------------------------------------------------------------

Complete the script, don't rush to run directly

Start the service on the 192.168.3.24 server and open the listening port

First sed-i =e '/^tcpaddr/{s/127.0.0.1/0.0.0.0/;} '/usr/local/etc/clamv/clamv.conf

Perhaps this has been commented out, it is better to direct vim in manual change

/USR/LOCAL/CLAMV/SBIN/CLAMD start

Open port is 3310

Lsof-i:3310 Detect if Listening

If the listener succeeds

Run the script on the detection server to

ClamAV Scan Tool