Manjaro

Difference between revisions of "ClamAV"

ClamAV (view source)

Revision as of 10:04, 16 January 2022

1,424 bytes added ,  2 years ago
Add crontab setup and formatting
(Marked this version for translation)
(Add crontab setup and formatting)
Line 6: Line 6:


<!--T:2-->
<!--T:2-->
[[File:Clam.png|left]] Clam AntiVirus (ClamAV) is a free, cross-platform antivirus software tool-kit able to detect many types of malicious software, including viruses. One of its main uses is on mail servers as a server-side email virus scanner. The application was developed for Unix and has third party versions available for AIX, BSD, HP-UX, Linux, OS X, OpenVMS, OSF (Tru64) and Solaris. As of version 0.97.5, ClamAV builds and runs on Microsoft Windows. Both ClamAV and its updates are made available free of charge.
[[File:Clam.png|left]] [https://www.clamav.net/ ClamAV] is an open-source antivirus engine for detecting trojans, viruses, malware & other malicious threats. One of its main uses is on mail servers as a server-side email virus scanner. The application was developed for Unix and has third party versions available for AIX, BSD, HP-UX, Linux, macOS, OpenVMS, OSF (Tru64) and Solaris. As of version <code>0.97.5</code>, ClamAV builds and runs on Microsoft Windows. Both ClamAV and its updates are made available free of charge.
 
Sourcefire, now acquired by Cisco, a maker of intrusion detection products and the owner of Snort, announced on 17 August 2007 that it had acquired the trademarks and copyrights to ClamAV from five key developers.
Sourcefire, now acquired by Cisco, a maker of intrusion detection products and the owner of Snort, announced on 17 August 2007 that it had acquired the trademarks and copyrights to ClamAV from five key developers.


<!--T:3-->
<!--T:3-->
ClamAV includes a number of utilities: a command-line scanner, automatic database updater and a scalable multi-threaded daemon, running on an anti-virus engine from a shared library.
ClamAV includes a number of utilities: a command-line scanner, automatic database updater and a scalable multi-threaded daemon, running on an anti-virus engine from a shared library.
The application also features a Milter interface for sendmail and on-demand scanning. It has support for Zip, RAR, Tar, Gzip, Bzip2, OLE2, Cabinet, CHM, BinHex, SIS formats, most mail file formats, ELF executables and Portable Executable (PE) files compressed with UPX, FSG, Petite, NsPack, wwpack32, MEW, Upack and obfuscated with SUE, Y0da Cryptor. It also supports many document formats, including Microsoft Office, HTML, Rich Text Format (RTF) and Portable Document Format (PDF).
The application also features a Milter interface for sendmail and on-demand scanning. It has support for Zip, RAR, Tar, Gzip, Bzip2, OLE2, Cabinet, CHM, BinHex, SIS formats, most mail file formats, ELF executables and Portable Executable (PE) files compressed with UPX, FSG, Petite, NsPack, wwpack32, MEW, Upack and obfuscated with SUE, Y0da Cryptor. It also supports many document formats, including Microsoft Office, HTML, Rich Text Format (RTF) and Portable Document Format (PDF).
The ClamAV virus database is updated several times each day and as of 30 October 2011 contained 1,063,024 virus signatures with the daily update Virus DB number at 13867.
The ClamAV virus database is updated several times each day and as of 30 October 2011 contained 1,063,024 virus signatures with the daily update Virus DB number at 13867.


<!--T:4-->
<!--T:4-->
ClamAV is currently tested daily in comparative tests against other antivirus products on Shadowserver. In 2011, Shadowserver tested over 25 million samples against ClamAV and numerous other antivirus products. Out of the 25 million samples tested, ClamAV scored 76.60% ranking 12 out of 19, a higher rating than some much more established competitors.
ClamAV is currently tested daily in comparative tests against other antivirus products on Shadowserver. In 2011, Shadowserver tested over 25 million samples against ClamAV and numerous other antivirus products. Out of the 25 million samples tested, ClamAV scored 76.60% ranking 12 out of 19, a higher rating than some much more established competitors.
ClamAV was included in comparative tests against other antivirus products. In the 2008 AV-Test it rated: on-demand: very poor, false positives: poor, on-access: poor, response time: very good, rootkits: very poor.
ClamAV was included in comparative tests against other antivirus products. In the 2008 AV-Test it rated: on-demand: very poor, false positives: poor, on-access: poor, response time: very good, rootkits: very poor.
In a Shadowserver six-month test between June and December 2011, ClamAV detected over 75.45% of all viruses tested, putting it in fifth place behind AhnLab, Avira, BitDefender and Avast. AhnLab, the top antivirus, detected 80.28% [http://en.wikipedia.org/wiki/Clam_AntiVirus]
In a Shadowserver six-month test between June and December 2011, ClamAV detected over 75.45% of all viruses tested, putting it in fifth place behind AhnLab, Avira, BitDefender and Avast. AhnLab, the top antivirus, detected 80.28% [http://en.wikipedia.org/wiki/Clam_AntiVirus]


= Installing ClamAV = <!--T:5-->
= Install ClamAV = <!--T:5-->


<!--T:6-->
<!--T:6-->
ClamAV is available in official repository. You can install it by command:
ClamAV is available in the <code>extra</code> repository[https://archlinux.org/packages/extra/x86_64/clamav/]. You can install it by command:


  <!--T:7-->
  <!--T:7-->
<syntaxhighlight lang="shell">
sudo pacman -S clamav
sudo pacman -S clamav
</syntaxhighlight>


= Setup ClamAV = <!--T:8-->
= Set up ClamAV = <!--T:8-->


<!--T:9-->
<!--T:9-->
Line 33: Line 40:


<!--T:10-->
<!--T:10-->
* ''/etc/clamav/clamd.conf''
* <code>/etc/clamav/clamd.conf</code>
* ''/etc/clamav/freshclam.conf''
* <code>/etc/clamav/freshclam.conf</code>


<!--T:11-->
<!--T:11-->
First update database:
First update database:


<!--T:12-->
<!--T:12-->
<syntaxhighlight lang="shell">
sudo freshclam
sudo freshclam
</syntaxhighlight>


<!--T:13-->
<!--T:13-->
You may get a notification that clamd was not notified.  This is normal because we haven't started the service yet.
You may get a notification that <code>clamd</code> was not notified.  This is normal because we haven't started the service yet.


<!--T:14-->
<!--T:14-->
Start and enable service:
Start and enable service:
sudo systemctl enable --now clamav-daemon


<!--T:15-->
<syntaxhighlight lang="shell">
sudo systemctl enable --now clamav-daemon
sudo systemctl enable --now clamav-freshclam
sudo systemctl enable --now clamav-freshclam
</syntaxhighlight>


<!--T:16-->
<!--T:16-->
Line 56: Line 66:


  <!--T:17-->
  <!--T:17-->
<syntaxhighlight lang="shell">
sudo systemctl status clamav-daemon && sudo systemctl status clamav-freshclam
sudo systemctl status clamav-daemon && sudo systemctl status clamav-freshclam
</syntaxhighlight>


<!--T:18-->
<!--T:18-->
Check database version:
Check database version:


<!--T:19-->
<!--T:19-->
freshclam -V
<syntaxhighlight lang="shell">
freshclam --version
</syntaxhighlight>


= ClamTK - graphical interface of ClamAV = <!--T:20-->
== Schedule scans and updates through <code>cron</code> == <!--T:23-->
 
Run <code>crontab -e</code> to edit your <code>crontab</code> and add the following line, editing it to your needs:
 
<syntaxhighlight lang="cron">
53 8 * * 5 /usr/bin/clamdscan --fdpass --multiscan --exclude-dir="$HOME/.clam/quarantine" --move="$HOME/.clam/quarantine" --log="$HOME/.clam/logs/$(date +\%Y\%m\%d)-weekly.log" $HOME 2>/dev/null 1>&2
</syntaxhighlight>
 
This scans the entire <code>$HOME</code> directory every week on Saturday at 08:53. See <code>man 5 crontab</code> for more info on the formatting of this file and <code>man clamdscan</code> for an explanation of the options used.
 
Then run <code>sudo crontab -e -u clamav</code> to set up automatic updates. (These should be run as the <code>clamav</code> user.) Add the following line to update these at 13 past every hour:
 
<syntaxhighlight lang="cron">
13 * * * * /usr/bin/freshclam --quiet
</syntaxhighlight>
 
= Alternatively, use ClamTK = <!--T:20-->


<!--T:21-->
<!--T:21-->
ClamTK is available in the repos, you can install it with pacman:
[https://archlinux.org/packages/community/any/clamtk/ ClamTK] is a graphical user interface to setup scheduled scans and updates as well as one-off scans. It's available in the <code>community</code> repository[https://archlinux.org/packages/community/any/clamtk/], you can install it with <code>pacman</code>:


<!--T:22-->
<!--T:22-->
<syntaxhighlight lang="shell">
sudo pacman -S clamtk
sudo pacman -S clamtk
</syntaxhighlight>


=See Also= <!--T:23-->
<!--T:24-->
[http://www.clamav.net/lang/en/ ClamAV Homepage]
<!--T:25-->
[https://github.com/dave-theunsub/clamtk/ ClamTK Homepage]
</translate>
</translate>


[[Category:Contents Page{{#translation:}}]]
[[Category:Contents Page{{#translation:}}]]
[[Category:Applications{{#translation:}}]]
[[Category:Applications{{#translation:}}]]
Harm
1

edit

Retrieved from "https://wiki.manjaro.org/index.php/Special:MobileDiff/29903"