在线检测木马病毒的网址：https://www.virustotal.com/gui/home/upload

一、简介

ClamAV（Clam AntiVirus）是Linux平台上的开源病毒扫描程序，主要应用于邮件服务器，采用多线程后台操作，可以自动升级病毒库。

二、安装

安装epel软件源

# 安装

[root@localhost ~]# yum install -y epel-release  

# 缓存

[root@localhost ~]# yum clean all && yum makecache 

安装clamav程序

[root@localhost ~]# yum -y install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd 

三、配置SELinux

配置ClamAV权限

[root@localhost ~]#  setsebool -P antivirus_can_scan_system 1

[root@localhost ~]#  setsebool -P clamd_use_jit 1 

查看设置结果

[root@localhost ~]# getsebool -a | grep antivirus

antivirus_can_scan_system --> on

antivirus_use_jit --> on 

四、配置ClamAV

1.删除示列

[root@localhost ~]# sed -i -e "s/^Example/#Example/" /etc/clamd.d/scan.conf

[root@localhost ~]# sed -i -e "s/^Example/#Example/" /etc/freshclam.conf 

2.编辑配置文件

[root@localhost ~]# vim /etc/clamd.d/scan.conf 

3.找到以下行

#LocalSocket /var/run/clamd.scan/clamd.sock 

删除#符号并保存您的更改

五、更新病毒库

[root@localhost ~]# freshclam 

病毒库保存位置：

/var/lib/clamav/daily.cvd

/var/lib/clamav/main.cvd 

设置定期更新病毒库（可选）

crontab -e

00 01,13 * * * /usr/bin/freshclam --quiet

因为freshclam不是系统服务，可新建如下

# vim /usr/lib/systemd/system/freshclam.service

[Unit]

Description = freshclam scanner

After = network.target

[Service]

Type = forking

ExecStart = /usr/bin/freshclam -d -c 2   #一天更新两次

Restart = on-failure

PrivateTmp = true

[Install]

WantedBy=multi-user.target

systemctl enable freshclam.service

systemctl start freshclam.service

systemctl status freshclam.service

六、启动Clamd服务

[root@localhost ~]# sudo systemctl start clamd@scan [root@localhost ~]# sudo systemctl enable clamd@scan

七、扫描病毒

clamscan 可用以扫描文件, 用户目录亦或是整个系统：

##扫描文件

[root@localhost ~]# clamscan targetfile  

##递归扫描home目录，并且记录日志

[root@localhost ~]# clamscan -r -i /home  -l /var/log/clamav.log  

##递归扫描home目录，将病毒文件删除，并且记录日志

[root@localhost ~]# clamscan -r -i /home  --remove  -l /var/log/clamav.log  

##扫描指定目录，然后将感染文件移动到指定目录，并记录日志

[root@localhost ~]# clamscan -r -i /home  --move=/tmp/clamav -l /var/log/clamav.log 

说明:

    -r -i 递归扫描目录

    -l 指定记录日志文件

    --remove 删除病毒文件

    --move 移动病毒到指定目录

1.重点扫描目录

clamscan -r  -i /etc --max-dir-recursion=5 -l /var/log/clamav-etc.log

clamscan -r  -i /bin --max-dir-recursion=5 -l /var/log/clamav-bin.log

clamscan -r  -i /usr --max-dir-recursion=5 -l /var/log/clamav-usr.log

clamscan -r  -i /var --max-dir-recursion=5 -l /var/log/clamav-var.log

2.扫描报告说明

----------- SCAN SUMMARY -----------

Known viruses: 9141451                  #已知病毒

Engine version: 0.102.4                 #软件版本

Scanned directories: 498                #扫描目录

Scanned files: 738                      #扫描文件

Infected files: 4                       #感染文件!!!

Data scanned: 530.25 MB                 #扫描数据

Data read: 14131.60 MB (ratio 0.04:1)   #数据读取

Time: 203.805 sec (3 m 23 s)            #扫描用时

3.查看病毒文件

cat /var/log/clamav-bin.log | grep "FOUND"

安装脚本

#!/bin/bash

echo "安装epel-release，yum缓存"

yum install -y epel-release && yum clean all && yum makecache

echo "安装clamav"

yum -y install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd

echo "配置SELinux中的ClamAV权限"

setsebool -P antivirus_can_scan_system 1 && setsebool -P clamd_use_jit 1 && getsebool -a | grep antivirus

echo "备份配置文件"

cp /etc/clamd.d/scan.conf /etc/clamd.d/scan.conf.bak

echo "删除示列"

sed -i -e "s/^Example/#Example/" /etc/clamd.d/scan.conf

sed -i -e "s/^Example/#Example/" /etc/freshclam.conf

echo "配置文件添加内容"

echo "LocalSocket /run/clamd.scan/clamd.sock" >> /etc/clamd.d/scan.conf

echo "手动更新病毒库"

freshclam

echo "一天两次自动更新病毒库"

cat >> /usr/lib/systemd/system/freshclam.service << "EOF"

[Unit]

Description = freshclam scanner

After = network.target

[Service]

Type = forking

ExecStart = /usr/bin/freshclam -d -c 2

Restart = on-failure

PrivateTmp = true

[Install]

WantedBy=multi-user.target

EOF

systemctl enable freshclam.service && systemctl start freshclam.service && systemctl status freshclam.service

echo "开机启动，启动服务，查看状态"

systemctl start clamd@scan && systemctl enable clamd@scan && systemctl status clamd@scan

echo "重点扫描目录"

clamscan -r -i /etc --max-dir-recursion=5 -l /var/log/clamav-etc.log

clamscan -r -i /bin --max-dir-recursion=5 -l /var/log/clamav-bin.log

clamscan -r -i /usr --max-dir-recursion=5 -l /var/log/clamav-usr.log

clamscan -r -i /var --max-dir-recursion=5 -l /var/log/clamav-var.log

巴特西

Linux病毒扫描工具ClamAV（Clam AntiVirus）安装使用

安装脚本

最新文章

热门文章