Linux系统查毒软件ClamAV (online)

ClamAV是一个可用于Linux平台上的开源杀毒引擎，可检测木马、病毒、恶意软件和其他恶意的威胁。

官网：http://www.clamav.net/

一、CentOS环境安装

# yum install -y epel-release
# yum install -y clamav

二、病毒库更新检查：freshclam

# freshclam
ClamAV update process started at Fri Sep  ::
main.cld is up to date (version: , sigs: , f-level: , builder: sigmgr)
Downloading daily-.cdiff [%]
daily.cld updated (version: , sigs: , f-level: , builder: neo)
bytecode.cld is up to date (version: , sigs: , f-level: , builder: neo)
Database updated ( signatures) from db.local.clamav.net (IP: 203.178.137.175)

三、帮助文档

# clamscan --help

                       Clam AntiVirus Scanner 0.99.
           By The ClamAV Team: http://www.clamav.net/about.html#credits
           (C) - Cisco Systems, Inc.

    --help                -h             Print this help screen
    --version             -V             Print version number
    --verbose             -v             Be verbose
    --archive-verbose     -a             Show filenames inside scanned archives
    --debug                              Enable libclamav's debug messages
    --quiet                              Only output error messages
    --stdout                             Write to stdout instead of stderr
    --no-summary                         Disable summary at end of scanning
    --infected            -i             Only print infected files
    --suppress-ok-results -o             Skip printing OK files
    --bell                               Sound bell on virus detection

    --tempdir=DIRECTORY                  Create temporary files in DIRECTORY
    --leave-temps[=yes/no(*)]            Do not remove temporary files
    --database=FILE/DIR   -d FILE/DIR    Load virus database from FILE or load
                                         all supported db files from DIR
    --official-db-only[=yes/no(*)]       Only load official signatures
    --log=FILE            -l FILE        Save scan report to FILE
    --recursive[=yes/no(*)]  -r          Scan subdirectories recursively
    --allmatch[=yes/no(*)]   -z          Continue scanning within file after finding a match
    --cross-fs[=yes(*)/no]               Scan files and directories on other filesystems
    --follow-dir-symlinks[=/(*)/]     Follow directory symlinks ( = never,  = direct,  = always)
    --follow-file-symlinks[=/(*)/]    Follow file symlinks ( = never,  = direct,  = always)
    --file-list=FILE      -f FILE        Scan files from FILE
    --remove[=yes/no(*)]                 Remove infected files. Be careful!
    --move=DIRECTORY                     Move infected files into DIRECTORY
    --copy=DIRECTORY                     Copy infected files into DIRECTORY
    --exclude=REGEX                      Don't scan file names matching REGEX
    --exclude-dir=REGEX                  Don't scan directories matching REGEX
    --include=REGEX                      Only scan file names matching REGEX
    --include-dir=REGEX                  Only scan directories matching REGEX

    --bytecode[=yes(*)/no]               Load bytecode from the database
    --bytecode-unsigned[=yes/no(*)]      Load unsigned bytecode
    --bytecode-timeout=N                 Set bytecode timeout (in milliseconds)
    --statistics[=none(*)/bytecode/pcre] Collect and print execution statistics
    --detect-pua[=yes/no(*)]             Detect Possibly Unwanted Applications
    --exclude-pua=CAT                    Skip PUA sigs of category CAT
    --include-pua=CAT                    Load PUA sigs of category CAT
    --detect-structured[=yes/no(*)]      Detect structured data (SSN, Credit Card)
    --structured-ssn-format=X            SSN format (=normal,=stripped,=both)
    --structured-ssn-count=N             Min SSN count to generate a detect
    --structured-cc-count=N              Min CC count to generate a detect
    --scan-mail[=yes(*)/no]              Scan mail files
    --phishing-sigs[=yes(*)/no]          Signature-based phishing detection
    --phishing-scan-urls[=yes(*)/no]     URL-based phishing detection
    --heuristic-scan-precedence[=yes/no(*)] Stop scanning as soon as a heuristic match is found
    --phishing-ssl[=yes/no(*)]           Always block SSL mismatches in URLs (phishing module)
    --phishing-cloak[=yes/no(*)]         Always block cloaked URLs (phishing module)
    --partition-intersection[=yes/no(*)] Detect partition intersections in raw disk images using heuristics.
    --algorithmic-detection[=yes(*)/no]  Algorithmic detection
    --scan-pe[=yes(*)/no]                Scan PE files
    --scan-elf[=yes(*)/no]               Scan ELF files
    --scan-ole2[=yes(*)/no]              Scan OLE2 containers
    --scan-pdf[=yes(*)/no]               Scan PDF files
    --scan-swf[=yes(*)/no]               Scan SWF files
    --scan-html[=yes(*)/no]              Scan HTML files
    --scan-xmldocs[=yes(*)/no]           Scan xml-based document files
    --scan-hwp3[=yes(*)/no]              Scan HWP3 files
    --scan-archive[=yes(*)/no]           Scan archive files (supported by libclamav)
    --detect-broken[=yes/no(*)]          Try to detect broken executable files
    --block-encrypted[=yes/no(*)]        Block encrypted archives
    --block-macros[=yes/no(*)]           Block OLE2 files with VBA macros
    --nocerts                            Disable authenticode certificate chain verification in PE files
    --dumpcerts                          Dump authenticode certificate chain in PE files

    --max-filesize=#n                    Files larger than this will be skipped and assumed clean
    --max-scansize=#n                    The maximum amount of data to scan for each container file (**)
    --max-files=#n                       The maximum number of files to scan for each container file (**)
    --max-recursion=#n                   Maximum archive recursion level for container file (**)
    --max-dir-recursion=#n               Maximum directory recursion level
    --max-embeddedpe=#n                  Maximum size file to check for embedded PE
    --max-htmlnormalize=#n               Maximum size of HTML file to normalize
    --max-htmlnotags=#n                  Maximum size of normalized HTML file to scan
    --max-scriptnormalize=#n             Maximum size of script file to normalize
    --max-ziptypercg=#n                  Maximum size zip to type reanalyze
    --max-partitions=#n                  Maximum number of partitions in disk image to be scanned
    --max-iconspe=#n                     Maximum number of icons in PE file to be scanned
    --max-rechwp3=#n                     Maximum recursive calls to HWP3 parsing function
    --pcre-match-limit=#n                Maximum calls to the PCRE match function.
    --pcre-recmatch-limit=#n             Maximum recursive calls to the PCRE match function.
    --pcre-max-filesize=#n               Maximum size file to perform PCRE subsig matching.
    --enable-stats                       Enable statistical reporting of malware
    --disable-pe-stats                   Disable submission of individual PE sections in stats submissions
    --stats-timeout=#n                   Number of seconds to wait for waiting a response back from the stats server
    --stats-host-id=UUID                 Set the Host ID used when submitting statistical info.
    --disable-cache                      Disable caching and cache checks for hash sums of scanned files.

(*) Default scan settings
(**) Certain files (e.g. documents, archives, etc.) may in turn contain other
   files inside. The above options ensure safe processing of this kind of data.

四、病毒扫描：clamscan（递归扫描+扫描路径输出）

# clamscan -r /root/ --stdout
/root/.cshrc: OK
/root/.abrt/applet_dirlist: Empty file
/root/ossec-hids-2.8..tar.gz: OK
/root/virusDemo/virus/s.zip: Win.Trojan.HollandGirl-1 FOUND
/root/.gconfd/saved_state: OK
/root/rootkit.exe: Empty file
/root/clam_log_170922.txt: OK
/root/virusDemo/virus/l.zip: Win.Trojan.Radyum-2 FOUND
/root/.imsettings.log: OK
/root/virusDemo/virus/n.zip: Win.Trojan.Nympho-2 FOUND
/root/chkrootkit-0.52/ifpromisc.c: OK
/root/chkrootkit-0.52/chkrootkit.lsm: OK
/root/chkrootkit-0.52/COPYRIGHT: OK

...

----------- SCAN SUMMARY -----------
Known viruses:
Engine version: 0.99.
Scanned directories:
Scanned files: 
Infected files: 23
Data scanned: 133.68 MB
Data read: 87.24 MB (ratio 1.53:)
Time: 38.355 sec ( m  s)