Python uses ClamAV for virus scanning (PYCLAMAD)

Install ClamAV First

Yum install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel Clamav-lib clamav-server-systemd-y

Sed-i ' s/^example/#Example/g '/etc/freshclam.conf #必须关闭Example otherwise startup will fail

Sed-i ' s/^example/#Example/g '/etc/clamd.d/scan.conf

SYSTEMCTL enable [email protected]

Ln-s/usr/lib/systemd/system/[email protected]/etc/systemd/system/multi-user.target.wants/[email protected]

Modify Configuration

cat/etc/clamd.d/scan.conf |grep-v "#" |grep-v "^$"

Logsyslog Yes

Localsocket/var/run/clamd.scan/clamd.sock #使用本地socket

TCPADDR 0.0.0.0 #监听地址

User Clamscan

Allowsupplementarygroups Yes

Update virus Database

/usr/bin/freshclam

Start

Systemctl start [email protected]

SYSTEMCTL status [email protected]

# #注意: The detected machine must be installed and started [email protected] 3310 port normal to be detected by the script in the following example

Installing PYCLAMD

Download module

Open https://pypi.org/project/pyClamd/#files

wget https://files.pythonhosted.org/packages/13/73/97a0518b59f1b6aefa2ac851566038d2c9128f8a5503bcf4cd0adf8b0072 /pyclamd-0.4.0.tar.gz

Tar zxf pyclamd-0.4.0.tar.gz

CD pyClamd-0.4.0

Python setup.py Install

Test script example:

#!/usr/bin/env python# -*- coding: utf-8 -*-import timeimport pyclamdfrom  threading import threadclass scan (Thread):         def __init__  (Self,ip,scan_type,file):                 thread.__init__ (self)                  self. Ip=ip                self.scan _type=scan_type                 self.file=file                 self.connstr= ""                  self.scanresult= ""         def&nbsP;run (self):                 try:                         cd=pyclamd. Clamdnetworksocket (self. ip,3310)                          if cd.ping ():                                  self.connstr=self. ip+ " connection [ok"                                   cd.reload ()                & nbsp;                if  self.scan_type== "Contscan_file":                                          self.scanresult= "{0}\n". Format (Cd.contscan_file ( Self.file))                                  elif  self.scan_type== "Multiscan_file":                                          self.scanresult= "{0}\n". Format (Cd.multiscan_file ( Self.file))                                  elif self.scan_type== "Scan_file":                                           self.scanresult= "{0}\n". Format (Cd.scan_file (self.file))                                   time.sleep (1)                          else:                                  self.connstr=self. ip+ " ping error,exit"                                   return                 except exception,e:                         self.connstr=self. ip+ " " +str (e) ips=[' 192.168.1.124 ', ' 192.168.1.116 ']scantype= "Multiscan_file" scanfile= "/home/python/test" i= 1threadnum=2scanlist=[]for ip in ips:        currp=scan (ip,scantype,scanfile)         scanlist.append (CURRP)          if i%threadnum==0 or i==len (IPS):    &NBSp;            for task in scanlist :                         task.start ()                  for task in scanlist:                          Task.join ()                          print task.connstr                          print task.scanresult                 scanlist=[]&nBsp;       i+=1 

Execute a command to produce a virus test file

Python 2.7.5 (default, Oct one, 17:47:16) [GCC 4.8.3 20140911 (Red Hat 4.8.3-9)] on Linux2type "help", "copyright", "C Redits "or" license "for more information.>>> import pyclamd>>> cd=pyclamd. Clamdnetworksocket () >>> void = open ('/home/python/test/eicar ', ' W '). Write (CD. EICAR ()) >>>

Execute script to detect viruses

Python clamd.py192.168.1.124 connection [ok]{u '/home/python/test/eicar ': (' FOUND ', ' Eicar-test-signature ')} 192.168.1.116 Could not reach CLAMD using Network (192.168.16.116, 3310)

Information display 1.124 virus test files found on the machine

1.116 the machine is not connected successfully #被检测机器上必须安装clamav and 3310 ports are started

Python uses ClamAV for virus scanning (Pyclamad)