ClamAV病毒掃描工具安裝使用

1. 安裝1.1 yum安裝ClamAV1.2 配置SELinux1.3 配置文件修改 2 離線安裝ClamAV3. 掃描

【資料圖】

1. 安裝

1.1 yum安裝ClamAV

yum install -y epel-releaseyum clean all && yum makecacheyum -y install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd

1.2 配置SELinux

setsebool -P antivirus_can_scan_system 1 setsebool -P clamd_use_jit 1

1.3 配置文件修改

vim /etc/clamd.d/scan.conf#添加以下內容 病毒庫保存位置DatabaseDirectory /home/clamav/lib

vim /etc/freshclam.conf#添加以下內容 病毒庫保存位置DatabaseDirectory /home/clamav/lib

2 離線安裝ClamAV

# 解壓tar -zxvf clamav-0.103.2.tar.gzcd clamav-0.103.2# 安裝到/usr/local/clamav下面./configure --prefix=/usr/local/clamavmake && make install

# 創建組groupadd clamav# 創建用戶并添加組useradd -g clamav clamav# 創建掃掃描出來的病毒存放目錄mkdir /home/clamav/virus# 創建掃描日志目錄mkdir /home/clamav/scan-log# 給用戶組目錄權限chown -R clamav:clamav /home/clamav/

cp  /usr/local/clamav/etc/clamd.conf.sample /usr/local/clamav/etc/clamd.confcp /usr/local/clamav/etc/freshclam.conf.sample /usr/local/clamav/etc/freshclam.conf

vim /usr/local/clamav/etc/clamd.conf#添加以下內容LogFile /home/clamav/clamd.logPidFile /home/clamav/clamd.pidDatabaseDirectory /home/clamav/lib

vim /usr/local/clamav/etc/freshclam.conf#添加以下內容DatabaseDirectory /home/clamav/libUpdateLogFile /home/clamav/freshclam.logPidFile /home/clamav/freshclam.pid

3. 掃描

# yum直接運行freshclam # 離線安裝需要進入/usr/local/clamav/bin./freshclam

掃描參數說明

參數說明

-r遞歸掃描目錄

-d以指定的文件作為病毒庫 , 默認配置的病毒庫

-i僅僅打印被感染的文件

-l指定記錄日志文件

–quiet使用安靜模式，僅僅打印出錯誤信息

–remove刪除病毒文件

–move移動病毒到指定目錄

–max-dir-recursion指定目錄深度

./clamscan -r  -i /etc --move=/home/clamav/virus -l /home/clamav/scan-log/clamav-etc.log./clamscan -r  -i /bin --move=/home/clamav/virus -l /home/clamav/scan-log/clamav-bin.log./clamscan -r  -i /usr --move=/home/clamav/virus -l /home/clamav/scan-log/clamav-usr.log./clamscan -r  -i /var --move=/home/clamav/virus -l /home/clamav/scan-log/clamav-var.log./clamscan -r  -i /opt --move=/home/clamav/virus -l /home/clamav/scan-log/clamav-opt.log./clamscan -r  -i /tmp --move=/home/clamav/virus -l /home/clamav/scan-log/clamav-tmp.log./clamscan -r  -i /boot --move=/home/clamav/virus -l /home/clamav/scan-log/clamav-boot.log

掃描結果說明:

名稱說明

Known viruses已知病毒

Engine versionclamav版本

Scanned directories掃描目錄個數

Scanned files掃描文件個數

Infected files感染文件個數

Data scanned掃描數據MB

Data read數據讀取MB

Time掃描用時

Start Date開始時間

End Date結束時間

cat /home/clamav/secan-log/clamav-usr.log | grep "FOUND"