Linux病毒扫描工具ClamAV（Clam AntiVirus）安装使用
在线检测木马病毒的网址：https://www.virustotal.com/gui/home/upload
一、简介
ClamAV（Clam AntiVirus）是Linux平台上的开源病毒扫描程序，主要应用于邮件服务器，采用多线程后台操作，可以自动升级病毒库。
二、安装
安装epel软件源
# 安装
[root@localhost ~]# yum install -y epel-release
# 缓存
[root@localhost ~]# yum clean all && yum makecache
安装clamav程序
[root@localhost ~]# yum -y install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd
三、配置SELinux
配置ClamAV权限
[root@localhost ~]# setsebool -P antivirus_can_scan_system 1
[root@localhost ~]# setsebool -P clamd_use_jit 1
查看设置结果
[root@localhost ~]# getsebool -a | grep antivirus
antivirus_can_scan_system --> on
antivirus_use_jit --> on
四、配置ClamAV
1.删除示列
[root@localhost ~]# sed -i -e "s/^Example/#Example/" /etc/clamd.d/scan.conf
[root@localhost ~]# sed -i -e "s/^Example/#Example/" /etc/freshclam.conf
2.编辑配置文件
[root@localhost ~]# vim /etc/clamd.d/scan.conf
3.找到以下行
#LocalSocket /var/run/clamd.scan/clamd.sock
删除#符号并保存您的更改
五、更新病毒库
[root@localhost ~]# freshclam
病毒库保存位置：
/var/lib/clamav/daily.cvd
/var/lib/clamav/main.cvd
设置定期更新病毒库（可选）
crontab -e
00 01,13 * * * /usr/bin/freshclam --quiet
因为freshclam不是系统服务，可新建如下
# vim /usr/lib/systemd/system/freshclam.service
[Unit]
Description = freshclam scanner
After = network.target
[Service]
Type = forking
ExecStart = /usr/bin/freshclam -d -c 2 #一天更新两次
Restart = on-failure
PrivateTmp = true
[Install]
WantedBy=multi-user.target
systemctl enable freshclam.service
systemctl start freshclam.service
systemctl status freshclam.service
六、启动Clamd服务
[root@localhost ~]# sudo systemctl start clamd@scan [root@localhost ~]# sudo systemctl enable clamd@scan
七、扫描病毒
clamscan 可用以扫描文件, 用户目录亦或是整个系统：
##扫描文件
[root@localhost ~]# clamscan targetfile
##递归扫描home目录，并且记录日志
[root@localhost ~]# clamscan -r -i /home -l /var/log/clamav.log
##递归扫描home目录，将病毒文件删除，并且记录日志
[root@localhost ~]# clamscan -r -i /home --remove -l /var/log/clamav.log
##扫描指定目录，然后将感染文件移动到指定目录，并记录日志
[root@localhost ~]# clamscan -r -i /home --move=/tmp/clamav -l /var/log/clamav.log
说明:
-r -i 递归扫描目录
-l 指定记录日志文件
--remove 删除病毒文件
--move 移动病毒到指定目录
1.重点扫描目录
clamscan -r -i /etc --max-dir-recursion=5 -l /var/log/clamav-etc.log
clamscan -r -i /bin --max-dir-recursion=5 -l /var/log/clamav-bin.log
clamscan -r -i /usr --max-dir-recursion=5 -l /var/log/clamav-usr.log
clamscan -r -i /var --max-dir-recursion=5 -l /var/log/clamav-var.log
2.扫描报告说明
----------- SCAN SUMMARY -----------
Known viruses: 9141451 #已知病毒
Engine version: 0.102.4 #软件版本
Scanned directories: 498 #扫描目录
Scanned files: 738 #扫描文件
Infected files: 4 #感染文件!!!
Data scanned: 530.25 MB #扫描数据
Data read: 14131.60 MB (ratio 0.04:1) #数据读取
Time: 203.805 sec (3 m 23 s) #扫描用时
3.查看病毒文件
cat /var/log/clamav-bin.log | grep "FOUND"
安装脚本
#!/bin/bash
echo "安装epel-release，yum缓存"
yum install -y epel-release && yum clean all && yum makecache
echo "安装clamav"
yum -y install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd
echo "配置SELinux中的ClamAV权限"
setsebool -P antivirus_can_scan_system 1 && setsebool -P clamd_use_jit 1 && getsebool -a | grep antivirus
echo "备份配置文件"
cp /etc/clamd.d/scan.conf /etc/clamd.d/scan.conf.bak
echo "删除示列"
sed -i -e "s/^Example/#Example/" /etc/clamd.d/scan.conf
sed -i -e "s/^Example/#Example/" /etc/freshclam.conf
echo "配置文件添加内容"
echo "LocalSocket /run/clamd.scan/clamd.sock" >> /etc/clamd.d/scan.conf
echo "手动更新病毒库"
freshclam
echo "一天两次自动更新病毒库"
cat >> /usr/lib/systemd/system/freshclam.service << "EOF"
[Unit]
Description = freshclam scanner
After = network.target
[Service]
Type = forking
ExecStart = /usr/bin/freshclam -d -c 2
Restart = on-failure
PrivateTmp = true
[Install]
WantedBy=multi-user.target
EOF
echo "freshclam开机启动，启动服务，查看状态"
systemctl enable freshclam.service && systemctl start freshclam.service && systemctl status freshclam.service
echo "clamd@scan开机启动，启动服务，查看状态"
systemctl start clamd@scan && systemctl enable clamd@scan && systemctl status clamd@scan
echo "重点扫描目录"
clamscan -r -i /etc --max-dir-recursion=5 -l /var/log/clamav-etc.log
clamscan -r -i /bin --max-dir-recursion=5 -l /var/log/clamav-bin.log
clamscan -r -i /usr --max-dir-recursion=5 -l /var/log/clamav-usr.log
clamscan -r -i /var --max-dir-recursion=5 -l /var/log/clamav-var.log
