Linux – ClamAV

測試環境為 CentOS 8 x86_64

被公司 IT 部門要求在 Linux 系統下安裝掃毒軟體.

ClamAV 安裝所需套件.

[root@localhost ~]# yum install -y epel-release
[root@localhost ~]# yum install -y clamav clamav-data clamav-devel clamav-filesystem clamav-lib clamav-update

更新病毒碼.

[root@localhost ~]# freshclam

掃描有問題的目錄.

[root@localhost ~]# clamscan -r /root -l virus_check.txt

參數說明:

• -r, –recursive
  Scan directories recursively. All the sub-directories in the given directory will be scanned.
• -l FILE, –log=FILE
  Save scan report to FILE.

檢視結果

----------- SCAN SUMMARY -----------
Known viruses: 8519429
Engine version: 0.103.1
Scanned directories: 248
Scanned files: 374
Infected files: 0
Data scanned: 275.49 MB
Data read: 85.42 MB (ratio 3.23:1)
Time: 171.411 sec (2 m 51 s)
Start Date: 2021:04:12 21:29:37
End Date:   2021:04:12 21:32:28

如果有找到病毒,需要透過剛剛另存的檔案來檢視哪些檔案有中毒.

[root@localhost ~]# cat virus_check.txt |grep -i found

或是掃描時直接加上 –infected 參數,只顯示有問題的檔案.

[root@localhost ~]# clamscan -r /root -l virus_check.txt --infected

要做整個系統掃描時需使用 –exclude-dir 把 /proc , /sys , /dev 系統目錄排除.

[root@localhost ~]# clamscan --recursive --log=/root/virus_check.txt --stdout --infected --exclude-dir=^/proc/ --exclude-dir=^/sys/ --exclude-dir=^/dev/ / 

說明:
–exclude-dir=^/proc/ 其中的 ^ 標準表示式代表字頭(須以後面字串為開頭)

ClamAV 常駐服務程式,我也沒使用過.

[root@localhost ~]# systemctl list-unit-files | grep -i clamav
clamav-clamonacc.service                    disabled 
clamav-freshclam.service                    disabled