変奏現実

アンチウィルスソフト導入(Clam AntiVirus)
Clam AntiVirusインストール
/etc/clamd.conf　を　clamd設定ファイル編集

#User clam　とコメントアウトする

起動してみる

/etc/rc.d/init.d/clamd start
Starting Clam AntiVirus Daemon:
LibClamAV Warning: **************************************************
LibClamAV Warning: ***  The virus database is older than 7 days!  ***
LibClamAV Warning: ***   Please update it as soon as possible.    ***
LibClamAV Warning: **************************************************
                                                           [  OK  ]

clamd自動起動設定
 

chkconfig clamd on

ウィルス定義ファイル更新機能の有効化

sed -i ‘s/Example/#Example/g’ /etc/freshclam.conf
 
ウィルス定義ファイル最新化

freshclam
ClamAV update process started at Mon Jul  9 01:33:45 2012
WARNING: DNS record is older than 3 hours.
WARNING: Invalid DNS reply. Falling back to HTTP mode.
Reading CVD header (main.cvd): OK
main.cvd is up to date (version: 54, sigs: 1044387, f-level: 60, builder: sven)
Reading CVD header (daily.cvd): OK
WARNING: getfile: daily-13811.cdiff not found on remote server (IP: 211.10.155.48)
WARNING: getpatch: Can't download daily-13811.cdiff from db.jp.clamav.net
WARNING: getfile: daily-13811.cdiff not found on remote server (IP: 203.212.42.128)
WARNING: getpatch: Can't download daily-13811.cdiff from db.jp.clamav.net
WARNING: getfile: daily-13811.cdiff not found on remote server (IP: 27.96.54.66)
WARNING: getpatch: Can't download daily-13811.cdiff from db.jp.clamav.net
WARNING: Incremental update failed, trying to download daily.cvd
connect_error: getsockopt(SO_ERROR): fd=5 error=110: Connection timed out
Can't connect to port 80 of host db.jp.clamav.net (IP: 219.106.242.51)
Downloading daily.cvd [100%]
daily.cvd updated (version: 15117, sigs: 228019, f-level: 63, builder: guitar)
Downloading bytecode.cvd [100%]
bytecode.cvd updated (version: 187, sigs: 37, f-level: 63, builder: neo)
Database updated (1272443 signatures) from db.jp.clamav.net (IP: 211.10.155.48)
大丈夫なのか？
 freshclam
ClamAV update process started at Mon Jul  9 01:34:50 2012
WARNING: DNS record is older than 3 hours.
WARNING: Invalid DNS reply. Falling back to HTTP mode.
Reading CVD header (main.cvd): OK
main.cvd is up to date (version: 54, sigs: 1044387, f-level: 60, builder: sven)
Reading CVD header (daily.cvd): OK (IMS)
daily.cvd is up to date (version: 15117, sigs: 228019, f-level: 63, builder: guitar)
Reading CVD header (bytecode.cvd): OK (IMS)
bytecode.cvd is up to date (version: 187, sigs: 37, f-level: 63, builder: neo)
２度目でＯＫらしい。
ではテスト

 clamscan --infected --remove --recursive
----------- SCAN SUMMARY -----------
Known viruses: 1267143
Engine version: 0.97.3
Scanned directories: 5
Scanned files: 12
Infected files: 0
Data scanned: 1.70 MB
Data read: 0.57 MB (ratio 2.95:1)
Time: 4.153 sec (0 m 4 s)
実行スクリプト作成

virusscan
ーーーココからーーー

#!/bin/bash
PATH=/usr/bin:/bin
# clamd update
yum -y update clamd > /dev/null 2>&1
# excludeopt setup
excludelist=/root/clamscan.exclude
if [ -s $excludelist ]; then
    for i in `cat $excludelist`
    do
        if [ $(echo "$i"|grep \/$) ]; then
            i=`echo $i|sed -e 's/^\([^ ]*\)\/$/\1/p' -e d`
            excludeopt="${excludeopt} --exclude-dir=^$i"
        else
            excludeopt="${excludeopt} --exclude=^$i"
        fi
    done
fi
# virus scan
CLAMSCANTMP=`mktemp`
clamscan --recursive --remove ${excludeopt} / > $CLAMSCANTMP 2>&1
[ ! -z "$(grep FOUND$ $CLAMSCANTMP)" ] && \
# report mail send
grep FOUND$ $CLAMSCANTMP | mail -s "Virus Found in `hostname`" root
rm -f $CLAMSCANTMP
ーーーココまでーーー

chmod +x virusscan

echo "/proc/" >> clamscan.exclude

echo "/sys/" >> clamscan.exclude
移動

mv virusscan /etc/cron.daily/