Uit DeVliegendeWiki

Linux heeft in de praktijk geen last van virussen omdat (1) het fundamenteel beter is ontworpen dan Microsoft Windows, (2) het open-source karakter zorgt voor snelle oplossingen van fouten, en (3) Linux minder aantrekkelijk is voor virusontwikkelaars, omdat het minder gebruikt wordt. De enige reden die ik zelf tot op heden ben tegengekomen om een virusscanner te installeren, is ironisch genoeg, om Windows-harde schijven op te schonen. Dit artikel gaat over ClamAV, en deze detecteert daadwerkelijk Windows-virussen (zie bronnen).

Inhoud 1 Installatie 2 Scannen 3 Switches 4 Bronnen 5 ClamAV & SystemRescueCD

Installatie

apt-get install clamav

Bijwerken van virusdefinities:

freshclam

Scannen

clamscan

of bv.

clamscan -r --remove /

Je kunt ClamAV en de verschillende opties testen door eerst alleen een subdirectory te scannen. Bv.:

clamscan -r /media/win/temp

of

clamscan -r --remove /media/win/temp

Ook aardig schijnt te zijn:

clamscan -vri /mount/win

waarbij de switches staan voor verbose, recursive en infected (besmette bestanden weergeven)

Zelf doe ik het graag met

clamscan -r --bell --remove /mount/win

Waarbij er een belletje rinkelt als er een virus wordt gevonden.

Switches

Om je een indruk van de mogelijkheden:

strompf@linz:~$ clamscan -h

                       Clam AntiVirus Scanner 0.96.3
           By The ClamAV Team: http://www.clamav.net/team
           (C) 2007-2009 Sourcefire, Inc.

    --help                -h             Print this help screen
    --version             -V             Print version number
    --verbose             -v             Be verbose
    --debug                              Enable libclamav's debug messages
    --quiet                              Only output error messages
    --stdout                             Write to stdout instead of stderr
    --no-summary                         Disable summary at end of scanning
    --infected            -i             Only print infected files
    --bell                               Sound bell on virus detection

    --tempdir=DIRECTORY                  Create temporary files in DIRECTORY
    --leave-temps[=yes/no(*)]            Do not remove temporary files
    --database=FILE/DIR   -d FILE/DIR    Load virus database from FILE or load
                                         all supported db files from DIR
    --official-db-only[=yes/no(*)]       Only load official signatures
    --log=FILE            -l FILE        Save scan report to FILE
    --recursive[=yes/no(*)]  -r          Scan subdirectories recursively
    --cross-fs[=yes(*)/no]               Scan files and directories on other filesystems
    --file-list=FILE      -f FILE        Scan files from FILE
    --remove[=yes/no(*)]                 Remove infected files. Be careful!
    --move=DIRECTORY                     Move infected files into DIRECTORY
    --copy=DIRECTORY                     Copy infected files into DIRECTORY
    --exclude=REGEX                      Don't scan file names matching REGEX
    --exclude-dir=REGEX                  Don't scan directories matching REGEX
    --include=REGEX                      Only scan file names matching REGEX
    --include-dir=REGEX                  Only scan directories matching REGEX

    --bytecode[=yes(*)/no]               Load bytecode from the database
    --bytecode-trust-all[=yes/no(*)]     Trust all loaded bytecode
    --bytecode-timeout=N		      Set bytecode timeout (in milliseconds)
    --detect-pua[=yes/no(*)]             Detect Possibly Unwanted Applications
    --exclude-pua=CAT                    Skip PUA sigs of category CAT
    --include-pua=CAT                    Load PUA sigs of category CAT
    --detect-structured[=yes/no(*)]      Detect structured data (SSN, Credit Card)
    --structured-ssn-format=X            SSN format (0=normal,1=stripped,2=both)
    --structured-ssn-count=N             Min SSN count to generate a detect
    --structured-cc-count=N              Min CC count to generate a detect
    --scan-mail[=yes(*)/no]              Scan mail files
    --phishing-sigs[=yes(*)/no]          Signature-based phishing detection
    --phishing-scan-urls[=yes(*)/no]     URL-based phishing detection
    --heuristic-scan-precedence[=yes/no(*)] Stop scanning as soon as a heuristic match is found
    --phishing-ssl[=yes/no(*)]           Always block SSL mismatches in URLs (phishing module)
    --phishing-cloak[=yes/no(*)]         Always block cloaked URLs (phishing module)
    --algorithmic-detection[=yes(*)/no]  Algorithmic detection
    --scan-pe[=yes(*)/no]                Scan PE files
    --scan-elf[=yes(*)/no]               Scan ELF files
    --scan-ole2[=yes(*)/no]              Scan OLE2 containers
    --scan-pdf[=yes(*)/no]               Scan PDF files
    --scan-html[=yes(*)/no]              Scan HTML files
    --scan-archive[=yes(*)/no]           Scan archive files (supported by libclamav)
    --detect-broken[=yes/no(*)]          Try to detect broken executable files
    --block-encrypted[=yes/no(*)]        Block encrypted archives

    --max-filesize=#n                    Files larger than this will be skipped and assumed clean
    --max-scansize=#n                    The maximum amount of data to scan for each container file (**)
    --max-files=#n                       The maximum number of files to scan for each container file (**)
    --max-recursion=#n                   Maximum archive recursion level for container file (**)
    --max-dir-recursion=#n               Maximum directory recursion level

(*) Default scan settings
(**) Certain files (e.g. documents, archives, etc.) may in turn contain other
   files inside. The above options ensure safe processing of this kind of data.

Bronnen

• https://help.ubuntu.com/community/ClamAV
• http://www.rasyid.net/2009/02/08/using-system-rescue-cd-to-scan-and-delete-virus-in-windows/

ClamAV & SystemRescueCD

ClamAV staat op de SystemRescueCD.

Indien je SystemRescueCD vanaf een USB-stick gebruikt, zou je de versie van ClamAV kunnen bijwerken. Ik weet echter niet hoe je dat moet doen: de commando's apt-get en yum herkent SystemRescueCD niet.