LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 08-12-2004, 03:29 AM   #1
rooch84
Member
 
Registered: Aug 2004
Posts: 33

Rep: Reputation: 15
Clamav scan on demmand


I am looking for a Linux antivirus that will scan files as they are modified, downloaded and created.

My other option is to make clamscan run every minute and only check files that have been modified in that passed minute.

So far I have:

# find / -cmin -1 | clamscan

However this runs the same as

# clamscan

And only checks the current directory.

Any got any ideas?

It this an efficient way of doing it? I m running it on got dual Xeon 3.2 Gig pros with 2 gigs of RAM.

Thanks

Chris
 
Old 08-12-2004, 08:29 AM   #2
stickman
Senior Member
 
Registered: Sep 2002
Location: Nashville, TN
Posts: 1,552

Rep: Reputation: 53
Get all the options with:
clamscan --help

Since it looks like clamscan wants an aurgument list, you could try these:
find / -cmin 1 | xargs clamscan
clamscan `find / -cmin 1`

Last edited by stickman; 08-12-2004 at 08:33 AM.
 
Old 08-12-2004, 08:36 AM   #3
stickman
Senior Member
 
Registered: Sep 2002
Location: Nashville, TN
Posts: 1,552

Rep: Reputation: 53
Nevermind. It tested them both, and clamscan complains about the file name being to long. Try something like:

for FILE in `find / -cmin 1 -type f`
do
clamscan $FILE
done
 
Old 08-12-2004, 09:14 AM   #4
rooch84
Member
 
Registered: Aug 2004
Posts: 33

Original Poster
Rep: Reputation: 15
Works fine

thanks

Don't suppose you have any better ideas for on demmand scanning?
 
Old 08-12-2004, 12:56 PM   #5
stickman
Senior Member
 
Registered: Sep 2002
Location: Nashville, TN
Posts: 1,552

Rep: Reputation: 53
You could use Clamuko to do on-access scanning. You wouldn't have to worry about finding files that have changed in the last time window.
 
Old 08-13-2004, 04:04 AM   #6
rooch84
Member
 
Registered: Aug 2004
Posts: 33

Original Poster
Rep: Reputation: 15
I suppose it would always help to read the instruction.

‘Clamuko is at special thread in clamd that performs on-access scanning under Linux’

I think I've got it running properly, but how do can I test it? How am I notified if clamuko does find a virus?

Thanks

Chris
 
Old 08-13-2004, 09:10 AM   #7
stickman
Senior Member
 
Registered: Sep 2002
Location: Nashville, TN
Posts: 1,552

Rep: Reputation: 53
There is a test sample bundled with the source if you happen to have it handy.
 
Old 08-13-2004, 09:26 AM   #8
rooch84
Member
 
Registered: Aug 2004
Posts: 33

Original Poster
Rep: Reputation: 15
I have copied the 'infected' test files around my system and clamuko appears to have not responded. I'm not sure if clamd is working properly. clamscan works tho.

How do I use the ping, reload, sigterm,etc.... commands with clamd?

What should clamuko do when it finds an infected file?

Thanks

Chris
 
Old 08-16-2004, 09:00 AM   #9
stickman
Senior Member
 
Registered: Sep 2002
Location: Nashville, TN
Posts: 1,552

Rep: Reputation: 53
Did you get /dev/dazuko setup? Also, did you add the include and exclude paths in clamav.conf?
 
Old 08-16-2004, 10:38 AM   #10
rooch84
Member
 
Registered: Aug 2004
Posts: 33

Original Poster
Rep: Reputation: 15
yes and yes

What is actually supposed to happen when clamuko finds a virus?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
ClamAV scan with a LiveCD AvatarofVirgo Linux - Security 4 10-12-2007 06:08 PM
To SCAN or not to SCAN? HP750xi Suse 9.2 Pro newtwolinux Linux - Hardware 4 06-22-2005 05:02 PM
How do I send daily clamav scan logs to my work e-mail account rwtreke SUSE / openSUSE 3 05-20-2005 01:05 PM
What is the best way to get clamav to scan emails? luca2005 Linux - Software 0 12-12-2004 05:52 AM
1st ClamAV scan.. 48 files infected... What??!! sh1ft Linux - Security 2 06-29-2004 11:06 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 08:54 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration