“Linux病毒查杀clamav”的版本间的差异
跳到导航
跳到搜索
(创建页面,内容为“=install= ==debian== sudo apt-get install clamav clamav-daemon clamtk #Graphical User Interface [https://www.poftut.com/how-to-install-and-use-clamav-antivi…”) |
|||
(未显示同一用户的3个中间版本) | |||
第6行: | 第6行: | ||
+ | ==RHEL/CentOS== | ||
+ | yum install -y epel-release | ||
+ | yum install -y clamav | ||
+ | [https://www.poftut.com/how-to-install-and-use-clamav-antivirus-software-in-linux-ubuntu-debian-mint-kali-fedora-centos-rhel/ How To Install and Use ClamAV Antivirus Software In Linux, Ubuntu, Debian, Mint, Kali, Fedora, CentOS, RHEL] | ||
+ | |||
+ | |||
+ | =Usage= | ||
+ | |||
+ | <pre> | ||
+ | #更新病毒库 | ||
+ | freshclam | ||
+ | |||
+ | |||
+ | 线上脚本 | ||
+ | |||
+ | #!/bin/bash | ||
+ | source /etc/profile | ||
+ | |||
+ | DATE=`date +%F` | ||
+ | DATE1=`date +%F -d yesterday` | ||
+ | |||
+ | #更新病毒库 | ||
+ | freshclam | ||
+ | |||
+ | #扫描病毒 | ||
+ | clamscan -r /etc /bin /sbin /usr/bin /usr/sbin > /var/log/clamscan-$DATE.log 2>&1 | ||
+ | |||
+ | if [ `grep "Infected files" /var/log/clamscan-$DATE.log|awk '{print $NF}' -ne 0` ];then | ||
+ | # 报警功能 | ||
+ | fi | ||
+ | |||
+ | rm -f /var/log/clamscan-$DATE1.log | ||
+ | |||
+ | |||
+ | 通过计划任务定时更新病毒库并删除 | ||
+ | 1 3 * * * /usr/local/clamav/bin/freshclam | ||
+ | 20 3 * * * /usr/local/clamav/bin/clamscan -r /home --remove -l /var/log/clamscan.log | ||
+ | |||
+ | |||
+ | 命令汇总 | ||
+ | clamscan:扫描程序 | ||
− | + | -r clamscan -r /home,递归扫描指定目录 | |
+ | -n 在扫描邮件时不加入 clamav的版本号 | ||
+ | -N 当用户发送带病毒的邮件时不警告发件人,而是立刻丢弃,但收件人会得到提示 | ||
+ | -q 静默方式扫描,不提示任何信息 | ||
+ | -o 对从系统向外部发的邮件做过滤 | ||
+ | -i 对从外部发到系统的邮件做过滤 | ||
+ | -l [目录] [文件名] 增加扫描报告 | ||
+ | –remove 删除病毒文件 | ||
+ | –move [目录] 移动病毒文件至指定目录 | ||
+ | –unzip(unrar) 解压压缩文件扫描 | ||
+ | clamd:多线程守护进程 | ||
+ | |||
+ | 使用libclamav来扫描文件或者病毒,可以使用Unix (local) socket或者TCP socket进行监听,该进程通过clamd.conf进行配置。clamd识别以下命令:PING ,VERSION ,RELOAD ,SHUTDOWN ,SCAN ,RAWSCAN,CONTSCAN,MULTISCAN ,INSTREAM ,FILDES ,STATS ,IDSESSION, END ,STREAM | ||
+ | |||
+ | clamdscan:配合clamd使用 | ||
+ | clamuko:配合扫描程序的中介程序,需配合dazuko | ||
+ | freshclam:病毒库更新程序 | ||
+ | |||
+ | 可以使用交互式或者守护进程式(freshclam -d)两种方式运行,定时启动升级程序,请参考cron设定(用户必须为root或者clamav,加入:N * * * * /usr/local/bin/freshclam --quiet)。 | ||
+ | sigtool:新增新病毒 | ||
+ | </pre> | ||
+ | |||
+ | |||
+ | =trouble= | ||
+ | <pre> | ||
+ | |||
+ | freshclam | ||
+ | ERROR: /var/log/clamav/freshclam.log is locked by another process | ||
+ | ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log). | ||
+ | ERROR: initialize: libfreshclam init failed. | ||
+ | ERROR: Initialization error! | ||
+ | root@debian-hyper:~# rm /var/log/clamav/freshclam.log | ||
+ | |||
+ | </pre> | ||
+ | |||
+ | =see also= | ||
+ | |||
+ | [https://blog.csdn.net/yonggeit/article/details/84960478 linux系统病毒查杀神器clamav] |
2020年9月11日 (五) 07:06的最新版本
install
debian
sudo apt-get install clamav clamav-daemon clamtk #Graphical User Interface
RHEL/CentOS
yum install -y epel-release yum install -y clamav
Usage
#更新病毒库 freshclam 线上脚本 #!/bin/bash source /etc/profile DATE=`date +%F` DATE1=`date +%F -d yesterday` #更新病毒库 freshclam #扫描病毒 clamscan -r /etc /bin /sbin /usr/bin /usr/sbin > /var/log/clamscan-$DATE.log 2>&1 if [ `grep "Infected files" /var/log/clamscan-$DATE.log|awk '{print $NF}' -ne 0` ];then # 报警功能 fi rm -f /var/log/clamscan-$DATE1.log 通过计划任务定时更新病毒库并删除 1 3 * * * /usr/local/clamav/bin/freshclam 20 3 * * * /usr/local/clamav/bin/clamscan -r /home --remove -l /var/log/clamscan.log 命令汇总 clamscan:扫描程序 -r clamscan -r /home,递归扫描指定目录 -n 在扫描邮件时不加入 clamav的版本号 -N 当用户发送带病毒的邮件时不警告发件人,而是立刻丢弃,但收件人会得到提示 -q 静默方式扫描,不提示任何信息 -o 对从系统向外部发的邮件做过滤 -i 对从外部发到系统的邮件做过滤 -l [目录] [文件名] 增加扫描报告 –remove 删除病毒文件 –move [目录] 移动病毒文件至指定目录 –unzip(unrar) 解压压缩文件扫描 clamd:多线程守护进程 使用libclamav来扫描文件或者病毒,可以使用Unix (local) socket或者TCP socket进行监听,该进程通过clamd.conf进行配置。clamd识别以下命令:PING ,VERSION ,RELOAD ,SHUTDOWN ,SCAN ,RAWSCAN,CONTSCAN,MULTISCAN ,INSTREAM ,FILDES ,STATS ,IDSESSION, END ,STREAM clamdscan:配合clamd使用 clamuko:配合扫描程序的中介程序,需配合dazuko freshclam:病毒库更新程序 可以使用交互式或者守护进程式(freshclam -d)两种方式运行,定时启动升级程序,请参考cron设定(用户必须为root或者clamav,加入:N * * * * /usr/local/bin/freshclam --quiet)。 sigtool:新增新病毒
trouble
freshclam ERROR: /var/log/clamav/freshclam.log is locked by another process ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log). ERROR: initialize: libfreshclam init failed. ERROR: Initialization error! root@debian-hyper:~# rm /var/log/clamav/freshclam.log