先主要说说centos下的安装
第一步:Clamav下载
http://www.clamav.net/downloads
wget http://www.clamav.net/downloads/production/clamav-0.99.2.tar.gz
第二步:创建clamav用户和组
groupadd clamav #创建clamav组 useradd -g clamav clamav #创建clamav用户并加入clamav组
第三步:编译安装
tar -xf clamav-0.99.2.tar.gz cd clamav-0.99.2
安装依赖包
yum -y install gcc openssl openssl-devel ./configure--prefix=/usr/local/clamav make&&make install
关于debian下的安装,很不幸debian会经常报error: Your OpenSSL installation is misconfigured or missing的错误
解决方法就是用apt-get安装:
先更新一下apt-get
apt-get update apt-get upgrade
安装守护进程和杀毒本体
apt-get install clamav clamav-daemon
如果运行freshclam时出现日志文件被占用的报错,无法启动clamav的更新程序,把日志rm -f删了就行
第四步:配置
mkdir /usr/local/clamav/logs #(日志存放目录) touch /usr/local/clamav/logs/clamd.log touch /usr/local/clamav/logs/freshclam.log mkdir /usr/local/clamav/updata #(clanav 病毒库目录) chown -R root.clamav /usr/local/clamav/ chown -R clamav.clamav /usr/local/clamav/updata/ chown clamav.clamav /usr/local/clamav/logs/clamd.log chown clamav.clamav /usr/local/clamav/logs/freshclam.log cd /usr/local/clamav/etc cp clamd.conf.sample clamd.conf cp freshclam.conf.sample freshclam.conf
编辑配置文件clamd.conf
vim clamd.conf
#Example 注释掉这一行, 接着在下面改一改。注意, 写下面路径的时候, 你就在当前指定好的路径里面新建文件, 赋予足够的权限, 安装程序不会帮你自动做这件事:
LogFile /usr/local/clamav/logs/clamd.log PidFile /usr/local/clamav/updata/clamd.pid DatabaseDirectory /usr/local/clamav/updata
编辑配置文件freshclam.conf
vim freshclam.conf
#Example 注释掉这一行, 接着在下面改一改。注意事项也是一样,如果过后升级病毒库的时候提示你log文件路径不存在, 你也要自己手动去建立才行:
DatabaseDirectory /usr/local/clamav/updata UpdateLogFile /usr/local/clamav/logs/freshclam.log PidFile /usr/local/clamav/updata/freshclam.pid
第五步:升级病毒库
/usr/local/clamav/bin/freshclam
PS:这个过程很久,大概半个小时。确保网络正常
--help / -h show help --version / -V print version number and exit --verbose / -v be verbose --debug enable debug messages --quiet only output error messages --no-warnings don't print and log warnings --stdout write to stdout instead of stderr --show-progress show download progress percentage --config-file=FILE read configuration from FILE. --log=FILE / -l FILE log into FILE --daemon / -d run in daemon mode --pid=FILE / -p FILE save daemon's pid in FILE --user=USER / -u USER run as USER --no-dns force old non-DNS verification method --checks=#n / -c #n number of checks per day, 1 <= n <= 50 --datadir=DIRECTORY download new databases into DIRECTORY --daemon-notify[=/path/clamd.conf] send RELOAD command to clamd --local-address=IP / -a IP bind to IP for HTTP downloads --on-update-execute=COMMAND execute COMMAND after successful update --on-error-execute=COMMAND execute COMMAND if errors occured --on-outdated-execute=COMMAND execute COMMAND when software is outdated --list-mirrors print mirrors from mirrors.dat --enable-stats enable statistical information reporting --stats-host-id=UUID HostID in the form of an UUID to use when submitting statistical information --update-db=DBNAME only update database DBNAME
第六步:杀毒
/usr/local/clamav/bin/clamscan -r --remove #查杀当前目录并删除感染的文件 /usr/local/clamav/bin/clamscan -r --bell -i / #扫描所有文件并且显示有问题的文件的扫描结果
其他参数
> -r/--recursive[=yes/no] 所有文件 > --log=FILE/-l FILE 增加扫描报告 > # clamscan -l /var/log/clamscan.log / > --move [路径] 移动病毒文件至.. > --remove [路径] 删除病毒文件 > --quiet 只输出错误消息 > --infected/-i 只输出感染文件 > --suppress-ok-results/-o 跳过扫描OK的文件 > --bell 扫描到病毒文件发出警报声音 > --unzip(unrar) 解压压缩文件扫描
第七步:计划任务
实际生产环境应用
一般使用计划任务,让服务器每天晚上定时跟新和定时杀毒。保存杀毒日志,我的crontab文件如下
16 4 * * * /usr/local/clamav/bin/freshclam 16 5 * * * /usr/local/clamav/bin/clamscan --infected -r / --remove -l /var/log/clamscan.log
返回值
>0 : 无病毒 >1 : 发现病毒 >40: 已经通过的未知选项 >50: 数据库初始化错误 >52: 不支持的文件格式 >53: 无法打开目录 >54: 不能打开文件(ofm) >55: 读文件错误(ofm) >56: Can't stat input file / directory. >57: Can't get absolute path name of current working directory. >58: I/O 错误, 请检查文件系统 >59: 无法在/etc/passwd获得当前用户的信息 >60: 无法在/etc/passwd获得'clamav'(默认名)用户的信息 >61: Can't fork. >63: 不能创建临时文件/目录(检查权限). >64: 无法对临时目录进行写操作 (请指定另一个目录). >70: 无法分配或释放内存 (calloc). >71: 无法分配内存 (malloc).
遇到的问题
NOTE: Problem: "Update failed. Your network may be down or none of the mirrors listed in /usr/local/etc/freshclam.conf is working. Check http://www.clamav.net/doc/mirrors-faq.html for possible reasons." Resolve: from freshclam.conf file find the line #DatabaseMirror db.XY.clamav.net and uncomment it out to DatabaseMirror db.us.clamav.net #or DatabaseMirror db.ac.clamav.net