Comments on: Automated ClamAV Virus Scanning

By: Dennis Y.

Dennis Y. — Fri, 23 Dec 2011 17:35:34 +0000

Good Stuff. Thanks for the script works perfectly.

By: Devon

Devon — Sun, 11 Dec 2011 00:21:55 +0000

Sure thing:

http://pastebin.com/bFpYgnrb

By: Daniel

Daniel — Sat, 10 Dec 2011 15:13:58 +0000

Would there be any way that the clamscan_daily script can be put on the same site where the clamscan_hourly script was? The site where you could paste directly from. Having trouble getting the daily script to work properly. Getting the error: /etc/cron.daily/clamscan_daily: line 9: syntax error: unexpected end of file and: /etc/cron.daily/clamscan_daily: line 7: unexpected EOF while looking for matching `”

By: Devon

Devon — Fri, 02 Dec 2011 21:10:26 +0000

What do you want it to do? Using my scripts it will just e-mail you if a scan finds something, leaving you to take manual action. You can configure clam to automatically delete or quarantine flagged files as well, but that’s something you should read the clamav docs for.

By: alsahh

alsahh — Fri, 02 Dec 2011 20:18:37 +0000

ah ok thank u for the explanation!

i still workin on getting clamd startet for scanning files on-access. while beeing an linux-noob i cannot get clamd reacting on uploaded test files. clamdscan is working but the daemon itself doesnt react on infected files, dont know what to do so… :(

By: Devon

Devon — Fri, 02 Dec 2011 19:54:51 +0000

Sure. Basically this is finding files which have been modified in the past 61 minutes, ignoring files under /sys/ and /proc/ which are often file representations of system data/ports/etc… and will show up as changed all the time but be unscanable/slow to scan/etc…

By checking only files created or changed in the past hour the hourly scan can quickly check for potential new viruses, without doing a full hard drive scan, which happens nightly just in case.

By: alsahh

alsahh — Fri, 02 Dec 2011 16:07:47 +0000

Can u please explain me what is the hourly script doin in

find / -not -wholename ‘/sys/*’ -and -not -wholename ‘/proc/*’ -mmin -61 -type f -print0

I wanna understand why this so solution is performing so well. Thank u !

By: Devon

Devon — Tue, 22 Nov 2011 03:11:16 +0000

Something is wrong as the clamscan_hourly script only has 31 lines. If you’re getting errors on lines 33 and 37 there must have been an issue with the copy/paste. Try this: http://pastebin.com/GcZAhqcA

By: Dave

Dave — Sat, 19 Nov 2011 02:20:57 +0000

Hi There

When the hourly cron runs, I get the following e-mail:

/etc/cron.hourly/clamscan_hourly:

/etc/cron.hourly/clamscan_hourly: line 33: unexpected EOF while looking for matching `”
/etc/cron.hourly/clamscan_hourly: line 37: syntax error: unexpected end of file

Can you please help me to resolve.

Thanks

By: Chris

Chris — Wed, 29 Sep 2010 16:01:50 +0000

The find command can list files that match on separate criteria, i.e. or/union. This should list the same files as your two-pass approach in one pass, without duplicates:

find / \( -wholename ‘/proc’ -o -wholename ‘/sys’ \) -prune -o -type f \( -cmin -61 -o -mmin -61 \) -print0