Linux系统环境下ClamAV杀毒软件的安装与常见操作【测试成功】

巴韭特锁螺丝 2024-09-05

557

一、ClamAV的安装

yum安装命令：

yum -y install epel-release
yum -y install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd

启动并设置开机自启：

systemctl enable clamd@scan.service
systemctl start clamd@scan.service

启动报错：ailed to start clamd scanner (scan) daemon.

1月 02 11:34:32 ICS systemd[1]: clamd@scan.service: Start request repeated too quickly.
1月 02 11:34:32 ICS systemd[1]: clamd@scan.service: Failed with result 'exit-code'.
-- Subject: Unit failed
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
-- 
-- The unit clamd@scan.service has entered the 'failed' state with result 'exit-code'.
1月 02 11:34:32 ICS systemd[1]: Failed to start clamd scanner (scan) daemon.
-- Subject: clamd@scan.service 单元已失败
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
-- 
-- clamd@scan.service 单元已失败。
-- 
-- 结果为“failed”。

解决：查看详细日志信息journalctl -u clamd@scan.service

[root@ICS ~]# journalctl -u clamd@scan.service
-- Logs begin at Thu 2023-12-28 11:18:09 CST, end at Tue 2024-01-02 11:35:28 CST. --
1月 02 11:34:31 ICS systemd[1]: Starting clamd scanner (scan) daemon...
1月 02 11:34:31 ICS clamd[765905]: Received 0 file descriptor(s) from systemd.
1月 02 11:34:31 ICS clamd[765905]: Please define server type (local and/or TCP).
1月 02 11:34:31 ICS clamd[765905]: ERROR: Please define server type (local and/or TCP).
1月 02 11:34:31 ICS systemd[1]: clamd@scan.service: Control process exited, code=exited status>
1月 02 11:34:31 ICS systemd[1]: clamd@scan.service: Failed with result 'exit-code'.
1月 02 11:34:31 ICS systemd[1]: Failed to start clamd scanner (scan) daemon.
1月 02 11:34:31 ICS systemd[1]: clamd@scan.service: Service RestartSec=100ms expired, scheduli>
1月 02 11:34:31 ICS systemd[1]: clamd@scan.service: Scheduled restart job, restart counter is >
1月 02 11:34:31 ICS systemd[1]: Stopped clamd scanner (scan) daemon.
1月 02 11:34:31 ICS systemd[1]: Starting clamd scanner (scan) daemon...
1月 02 11:34:31 ICS clamd[765911]: Received 0 file descriptor(s) from systemd.
1月 02 11:34:31 ICS clamd[765911]: Please define server type (local and/or TCP).
1月 02 11:34:31 ICS clamd[765911]: ERROR: Please define server type (local and/or TCP).
1月 02 11:34:31 ICS systemd[1]: clamd@scan.service: Control process exited, code=exited status>
1月 02 11:34:31 ICS systemd[1]: clamd@scan.service: Failed with result 'exit-code'.
1月 02 11:34:31 ICS systemd[1]: Failed to start clamd scanner (scan) daemon.
1月 02 11:34:32 ICS systemd[1]: clamd@scan.service: Service RestartSec=100ms expired, scheduli>
1月 02 11:34:32 ICS systemd[1]: clamd@scan.service: Scheduled restart job, restart counter is >
1月 02 11:34:32 ICS systemd[1]: Stopped clamd scanner (scan) daemon.
1月 02 11:34:32 ICS systemd[1]: Starting clamd scanner (scan) daemon...
1月 02 11:34:32 ICS clamd[765917]: Received 0 file descriptor(s) from systemd.
1月 02 11:34:32 ICS clamd[765917]: Please define server type (local and/or TCP).
1月 02 11:34:32 ICS clamd[765917]: ERROR: Please define server type (local and/or TCP).

处理报错：Please define server type (local and/or TCP).

vim etc/clamd.d/scan.conf

LocalSocket var/run/clamd.scan/clamd.sock

再次执行重启，可以发现服务状态正常：

systemctl start clamd@scan.service

源码编译安装：

1、下载地址：http://www.clamav.net/downloads/

2、安装依赖环境

yum install gcc openssl openssl-devel -y

3、编译安装

 cd clamav-xxxxx/
./configure --prefix=/usr/local/clamav --with-pcre
 make && make install
echo $?

此时ClamAV已经安装完成

二、常用命令参数

1、更新病毒库:freshclam

[root@ICS ~]# freshclam
ClamAV update process started at Tue Jan  2 11:46:18 2024
daily.cld database is up-to-date (version: 27141, sigs: 2050043, f-level: 90, builder: raynman)
main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr)
bytecode.cvd database is up-to-date (version: 334, sigs: 91, f-level: 90, builder: anvilleg)

查看病毒库版本信息： clamdscan -V

[root@ICS ~]#  clamdscan -V
ClamAV 0.103.11/27141/Mon Jan  1 17:35:53 2024

2、扫描参数

全盘扫描并记录日志：

nohup clamscan -ri -l tmp/clamscan.log &

nohup clamscan -ri / -l /tmp/clamscan.log &
----------- SCAN SUMMARY -----------
Known viruses: 8681791     #
Engine version: 0.103.11    #ClamAV 引擎的版本号
Scanned directories: 37478  #扫描的目录数量
Scanned files: 58325  #扫描的文件数量
Infected files: 0  #被感染的文件数量
Total errors: 59111  #总错误数量
Data scanned: 5532.55 MB  #已扫描的数据量
Data read: 8252.05 MB (ratio 0.67:1)    #已读取的数据量
Time: 1058.357 sec (17 m 38 s)  #扫描所花费的时间
Start Date: 2024:01:02 11:47:59  #扫描开始时间
End Date:   2024:01:02 12:05:37  #扫描结束时间

扫描指定文件：clamscan +文件名

[root@ICS ~]# clamscan nohup.out 
/root/nohup.out: OK


----------- SCAN SUMMARY -----------
Known viruses: 8681791
Engine version: 0.103.11
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 10.11 MB
Data read: 4.75 MB (ratio 2.13:1)
Time: 18.733 sec (0 m 18 s)
Start Date: 2024:01:02 13:12:37
End Date:   2024:01:02 13:12:56

递归扫描目录并输出日志：

clamscan -r -i /root -l /var/log/clamav.log

[root@ICS ~]# clamscan -r -i /root -l /var/log/clamav.log


----------- SCAN SUMMARY -----------
Known viruses: 8681791
Engine version: 0.103.11
Scanned directories: 2
Scanned files: 11
Infected files: 0
Data scanned: 10.16 MB
Data read: 4.77 MB (ratio 2.13:1)
Time: 18.554 sec (0 m 18 s)
Start Date: 2024:01:02 13:14:17
End Date:   2024:01:02 13:14:36

递归扫描目录并隔离感染文件到指定目录、记录日志：

clamscan -r -i /root --move=/tmp/clamav -l /var/log/clamav.log

[root@ICS ~]# clamscan -r -i /root --move=/tmp/clamav -l /var/log/clamav.log
action_setup: Failed to get realpath of /tmp/clamav


----------- SCAN SUMMARY -----------
Known viruses: 8681791
Engine version: 0.103.11
Scanned directories: 5
Scanned files: 12
Infected files: 0
Data scanned: 10.16 MB
Data read: 4.77 MB (ratio 2.13:1)
Time: 18.617 sec (0 m 18 s)
Start Date: 2024:01:02 13:15:51
End Date:   2024:01:02 13:16:09

使用clamscan
命令来扫描整个系统，并使用--move
选项将被感染的文件移动到指定目录。例如，如果您希望将被感染的文件移动到/mvbak
目录下，命令如下：

clamscan --infected --move=/mvbak --recursive /

递归扫描目录并删除病毒文件、记录日志：

clamscan -r -i /home --remove -l /var/log/clamav.log

文章转载自巴韭特锁螺丝，如果涉嫌侵权，请发送邮件至：contact@modb.pro进行举报，并提供相关证据，一经查实，墨天轮将立刻删除相关内容。

Linux系统环境下ClamAV杀毒软件的安装与常见操作【测试成功】

评论