Clam AV nuts and bolts

[crazybill]

To install Clam Antivirus:

sudo apt-get install clamav
(Providing that your /etc/apt/sources.list file is up to date, you will get a good recent version of Clam antivirus installed on your machine.)

To update your virus definitions:

freshclam

To check files in your home directory:

clamscan

To check files in the entire home directory:

clamscan -r /home

To check files on the entire drive (displaying everything):

clamscan -r /

To check files on the entire drive but only display infected files and ring a bell when found:

clamscan -r --bell --mbox -i /

Run Clam AV from a terminal window!

Why would you run an antivirus scan on an Ubuntu Linux Hoary computer. At this time, the only reason is if you transfer files back and forth to a Windows machine or transfer/serve email. There are yet no known virus/worm/trojan/root-violation problems with properly set-up Ubuntu computers. However, if you use a Hoary distribution as a computer to transfer files from one location to another, they originate/end up on Windows machines, or if you want to scan a network.. this can be useful.

Here is a sample readout from: clamscan -r --bell --mbox -i /home

clamscan -r --bell --mbox -i /home (infected file would be listed here) ----------- SCAN SUMMARY ----------- Known viruses: 33840 Scanned directories: 145 Scanned files: 226 Infected files: 1 Data scanned: 54.22 MB I/O buffer size: 131072 bytes Time: 20.831 sec (0 m 20 s)

Here is a sample readout from freshclam :

root@ubuntu4:/etc/clamav # freshclam ClamAV update process started at Wed Apr 27 00:06:47 2005 main.cvd is up to date (version: 31, sigs: 33079, f-level: 4, builder: tkojm) daily.cvd is up to date (version: 855, sigs: 714, f-level: 4, builder: ccordes)

To find out what version you have:

root@ubuntu4:/etc/clamav # clamscan -V ClamAV 0.83/855/Tue Apr 26 06:40:32 2005

You can use the --remove flag (clamscan --remove) too automatically remove virus-infected files, but it is not recommended it. Sometimes, clam AV will figure a file is a virus when it is not. Thus, I look at the results and make a decision whether a file should be removed.

For learning about more flags for clamscan, try man clamscan or info clamscan

You can use the at command to schedule clamscan and/or freshclam.
For example:
at 3:30 tomorrow
at>freshclam
at> <CTRL-D>
job 3 at 2005-04-28 03:30
(You have scheduled and confirmed that the Clam AV update will occur at 3:30 AM tomorrow.


I hope this helps and clears some confusion out there.

[lao_V]

There's a great quote I saw at The Register: "To mess up a Linux box, you need to work at it; to mess up your Windows box, you just need to work on it", writes SecurityFocus columnist Scott Granneman.

I hope this tradition continues

[crazybill]

Iao V, only use the best:

OpenBSD for webserver
Ubuntu Linux for desktop applications
Windows for Solitare

[lao_V]

I wouldn't even use Windows for solitaire

[Chayyiel]

Thanks for the HOWTO!

[crazybill]

No problem

[stubby]

Cheers mate, I appreciate the HOWTO

[benplaut]

<offtopic>i still don't get it! what's the point of antivirus in a "virus free" operating system?!?! </offtopic>

lao_V: great quote!

[rum beverage]

a virus free operating system hasn't been written yet and never will be.

[Arthemys]

Originally Posted by rum beverage a virus free operating system hasn't been written yet and never will be.

That's not wishful thinking now is it? Aspire to be great (linux), and you will be. It gives you something to develop towards, a goal that will prove to be an ever changing target.