Install ClamAV and set up scheduled scans.

Install Epel:

# yum install epel-release

Install ClmAV

# yum install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: mirror.lax.hugeserver.com
 * epel: dl.fedoraproject.org
 * extras: dallas.tx.mirror.xygenhosting.com
 * updates: linux.mirrors.es.net
Package clamav-data-0.98.7-1.el7.noarch already installed and latest version
Package clamav-filesystem-0.98.7-1.el7.noarch already installed and latest version
Package clamav-lib-0.98.7-1.el7.x86_64 already installed and latest version
Resolving Dependencies
--> Running transaction check
---> Package clamav.x86_64 0:0.98.7-1.el7 will be installed
---> Package clamav-devel.x86_64 0:0.98.7-1.el7 will be installed
---> Package clamav-scanner-systemd.noarch 0:0.98.7-1.el7 will be installed
--> Processing Dependency: clamav-scanner = 0.98.7-1.el7 for package: clamav-scanner-systemd-0.98.7-1.el7.noarch
---> Package clamav-server.x86_64 0:0.98.7-1.el7 will be installed
--> Processing Dependency: nc for package: clamav-server-0.98.7-1.el7.x86_64
---> Package clamav-server-systemd.noarch 0:0.98.7-1.el7 will be installed
---> Package clamav-update.x86_64 0:0.98.7-1.el7 will be installed
--> Running transaction check
---> Package clamav-scanner.noarch 0:0.98.7-1.el7 will be installed
---> Package nmap-ncat.x86_64 2:6.40-7.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

===================================================================================================================================================================================================
 Package                                                   Arch                                      Version                                         Repository                               Size
===================================================================================================================================================================================================
Installing:
 clamav                                                    x86_64                                    0.98.7-1.el7                                    epel                                    806 k
 clamav-devel                                              x86_64                                    0.98.7-1.el7                                    epel                                     37 k
 clamav-scanner-systemd                                    noarch                                    0.98.7-1.el7                                    epel                                     19 k
 clamav-server                                             x86_64                                    0.98.7-1.el7                                    epel                                     93 k
 clamav-server-systemd                                     noarch                                    0.98.7-1.el7                                    epel                                     19 k
 clamav-update                                             x86_64                                    0.98.7-1.el7                                    epel                                     89 k
Installing for dependencies:
 clamav-scanner                                            noarch                                    0.98.7-1.el7                                    epel                                     26 k
 nmap-ncat                                                 x86_64                                    2:6.40-7.el7                                    base                                    201 k

Transaction Summary
===================================================================================================================================================================================================
Install  6 Packages (+2 Dependent packages)

Total download size: 1.3 M
Installed size: 3.0 M
Is this ok [y/d/N]: y
Downloading packages:
(1/8): clamav-0.98.7-1.el7.x86_64.rpm                                                                                                                                       | 806 kB  00:00:00
(2/8): clamav-devel-0.98.7-1.el7.x86_64.rpm                                                                                                                                 |  37 kB  00:00:00
(3/8): clamav-scanner-0.98.7-1.el7.noarch.rpm                                                                                                                               |  26 kB  00:00:00
(4/8): clamav-scanner-systemd-0.98.7-1.el7.noarch.rpm                                                                                                                       |  19 kB  00:00:00
(5/8): clamav-server-0.98.7-1.el7.x86_64.rpm                                                                                                                                |  93 kB  00:00:00
(6/8): clamav-server-systemd-0.98.7-1.el7.noarch.rpm                                                                                                                        |  19 kB  00:00:00
(7/8): clamav-update-0.98.7-1.el7.x86_64.rpm                                                                                                                                |  89 kB  00:00:00
(8/8): nmap-ncat-6.40-7.el7.x86_64.rpm                                                                                                                                      | 201 kB  00:00:00
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                                                                              1.3 MB/s | 1.3 MB  00:00:00
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : 2:nmap-ncat-6.40-7.el7.x86_64                                                                                                                                                   1/8
  Installing : clamav-server-0.98.7-1.el7.x86_64                                                                                                                                               2/8
  Installing : clamav-server-systemd-0.98.7-1.el7.noarch                                                                                                                                       3/8
  Installing : clamav-scanner-0.98.7-1.el7.noarch                                                                                                                                              4/8
  Installing : clamav-scanner-systemd-0.98.7-1.el7.noarch                                                                                                                                      5/8
  Installing : clamav-0.98.7-1.el7.x86_64                                                                                                                                                      6/8
  Installing : clamav-update-0.98.7-1.el7.x86_64                                                                                                                                               7/8
  Installing : clamav-devel-0.98.7-1.el7.x86_64                                                                                                                                                8/8
  Verifying  : clamav-scanner-systemd-0.98.7-1.el7.noarch                                                                                                                                      1/8
  Verifying  : clamav-server-0.98.7-1.el7.x86_64                                                                                                                                               2/8
  Verifying  : clamav-scanner-0.98.7-1.el7.noarch                                                                                                                                              3/8
  Verifying  : clamav-devel-0.98.7-1.el7.x86_64                                                                                                                                                4/8
  Verifying  : clamav-server-systemd-0.98.7-1.el7.noarch                                                                                                                                       5/8
  Verifying  : clamav-update-0.98.7-1.el7.x86_64                                                                                                                                               6/8
  Verifying  : 2:nmap-ncat-6.40-7.el7.x86_64                                                                                                                                                   7/8
  Verifying  : clamav-0.98.7-1.el7.x86_64                                                                                                                                                      8/8

Installed:
  clamav.x86_64 0:0.98.7-1.el7                        clamav-devel.x86_64 0:0.98.7-1.el7          clamav-scanner-systemd.noarch 0:0.98.7-1.el7         clamav-server.x86_64 0:0.98.7-1.el7
  clamav-server-systemd.noarch 0:0.98.7-1.el7         clamav-update.x86_64 0:0.98.7-1.el7

Dependency Installed:
  clamav-scanner.noarch 0:0.98.7-1.el7                                                                nmap-ncat.x86_64 2:6.40-7.el7

Complete!

Copy a the clamd.conf template, in case you don’t have a configuration file yet:

# cp /usr/share/clamav/template/clamd.conf /etc/clamd.d/clamd.conf

Change the file and Comment out “Example”

# nano /etc/clamd.d/clamd.conf

Change this…

# Comment or remove the line below.
Example

To this…

# Comment or remove the line below.
#Example

Configure SELinux for ClamAV.

Check if selinux in on:

# getenforce
Enforcing
[root@database ~]# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      28

Write this command to get it working with SELinux if this is active:


# setsebool -P antivirus_can_scan_system 1

Enabling and Disabling SELinux


nano /etc/sysconfig/selinux

To enable…set this to enforcing


# SELINUX=enforcing

To disable, set to permissive

# SELINUX=permissive

Reboot after changes

Or, to make temp changes:

# setenforce permissive

Enable Freshclam

# cp /etc/freshclam.conf /etc/freshclam.conf.bak

Edit the config file to comment out example

# nano /etc/freshclam.conf
# Comment or remove the line below.
#Example

Creat a file

# nano /usr/lib/systemd/system/clam-freshclam.service

Add

# Run the freshclam as daemon
[Unit]
Description = freshclam scanner
After = network.target
 
[Service]
Type = forking
ExecStart = /usr/bin/freshclam -d -c 4
Restart = on-failure
PrivateTmp = true
 
[Install]
WantedBy=multi-user.target

Let’s enable and start the service

# systemctl enable clam-freshclam.service
# systemctl start clam-freshclam.service

rename the /usr/lib/systemd/system/clamd@.service file

# mv /usr/lib/systemd/system/clamd@.service /usr/lib/systemd/system/clamd.service

change the clamd@scan service as well. Change this line in /usr/lib/systemd/system/clamd@scan.service and remove the @ sign

# nano /usr/lib/systemd/system/clamd@scan.service

From…

# .include /lib/systemd/system/clamd@.service

to…

# .include /lib/systemd/system/clamd.service

change the clamd service file /usr/lib/systemd/system/clamd.service:

[Unit]
Description = clamd scanner daemon
After = syslog.target nss-lookup.target network.target
 
[Service]
Type = simple
ExecStart = /usr/sbin/clamd -c /etc/clamd.d/clamd.conf --nofork=yes
Restart = on-failure
PrivateTmp = true
 
[Install]
WantedBy=multi-user.target

Start all services

#cd /usr/lib/systemd/system
# systemctl enable clamd.service
# systemctl enable clamd@scan.service
# systemctl start clamd.service
# systemctl start clamd@scan.service.

Run a scan

# clamscan -i -r --log=/var/log/clamscan-date.txt /var/www/vhosts/*

----------- SCAN SUMMARY -----------
Known viruses: 4159219
Engine version: 0.98.7
Scanned directories: 3
Scanned files: 116
Infected files: 0
Data scanned: 13.64 MB
Data read: 39.54 MB (ratio 0.34:1)
Time: 10.738 sec (0 m 10 s)

Set up a cron to run a scan (example is for a plesk server for the virtual hosts

# nano /etc/cron.daily/clamscan
#!/bin/bash
# setup the scan location and scan log
CLAM_SCAN_DIR="/var/www/vhosts"
CLAM_LOG_FILE="/var/log/clamav/dailyscan.log"
# update the virus database
/usr/bin/freshclam
# run the scan
/usr/bin/clamscan -i -r $CLAM_SCAN_DIR >> $CLAM_LOG_FILE
MAILTO=user@domain.com

Set the cron file as an executible


# chmod 555 /etc/cron.daily/clamscan

Test your installation and cron job


# /etc/cron.daily/clamscan

##
## Example config file for the Clam AV daemon
## Please read the clamd.conf(5) manual before editing this file.
##

# Comment or remove the line below.
#Example

# Uncomment this option to enable logging.
# LogFile must be writable for the user running daemon.
# A full path is required.
# Default: disabled
LogFile /var/log/clamav/clamd.log

# By default the log file is locked for writing – the lock protects against
# running clamd multiple times (if want to run another clamd, please
# copy the configuration file, change the LogFile variable, and run
# the daemon with –config-file option).
# This option disables log file locking.
# Default: no
#LogFileUnlock yes

# Maximum size of the log file.
# Value of 0 disables the limit.
# You may use ‘M’ or ‘m’ for megabytes (1M = 1m = 1048576 bytes)
# and ‘K’ or ‘k’ for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don’t use modifiers. If LogFileMaxSize is enabled, log
# rotation (the LogRotate option) will always be enabled.
# Default: 1M
LogFileMaxSize 2M

# Log time with each message.
# Default: no
#LogTime yes

# Also log clean files. Useful in debugging but drastically increases the
# log size.
# Default: no
#LogClean yes

# Use system logger (can work together with LogFile).
# Default: no
LogSyslog yes

# Specify the type of syslog messages – please refer to ‘man syslog’
# for facility names.
# Default: LOG_LOCAL6
#LogFacility LOG_MAIL

# Enable verbose logging.
# Default: no
#LogVerbose yes

# Enable log rotation. Always enabled when LogFileMaxSize is enabled.
# Default: no
#LogRotate yes

# Log additional information about the infected file, such as its
# size and hash, together with the virus name.
#ExtendedDetectionInfo yes

# This option allows you to save a process identifier of the listening
# daemon (main thread).
# Default: disabled
PidFile /var/run/clamd.pid

# Optional path to the global temporary directory.
# Default: system specific (usually /tmp or /var/tmp).
#TemporaryDirectory /var/tmp

# Path to the database directory.
# Default: hardcoded (depends on installation options)
DatabaseDirectory /var/clamav

# Only load the official signatures published by the ClamAV project.
# Default: no
#OfficialDatabaseOnly no

# The daemon can work in local mode, network mode or both.
# Due to security reasons we recommend the local mode.

# Path to a local socket file the daemon will listen on.
# Default: disabled (must be specified by a user)
LocalSocket /tmp/clamd.socket

# Sets the group ownership on the unix socket.
# Default: disabled (the primary group of the user running clamd)
#LocalSocketGroup virusgroup

# Sets the permissions on the unix socket to the specified mode.
# Default: disabled (socket is world accessible)
#LocalSocketMode 660

# Remove stale socket after unclean shutdown.
# Default: yes
#FixStaleSocket yes

# TCP port address.
# Default: no
TCPSocket 3310

# TCP address.
# By default we bind to INADDR_ANY, probably not wise.
# Enable the following to provide some degree of protection
# from the outside world. This option can be specified multiple
# times if you want to listen on multiple IPs. IPv6 is now supported.
# Default: no
TCPAddr 127.0.0.1

# Maximum length the queue of pending connections may grow to.
# Default: 200
MaxConnectionQueueLength 30

# Clamd uses FTP-like protocol to receive data from remote clients.
# If you are using clamav-milter to balance load between remote clamd daemons
# on firewall servers you may need to tune the options below.

# Close the connection when the data size limit is exceeded.
# The value should match your MTA’s limit for a maximum attachment size.
# Default: 25M
StreamMaxLength 55M

# Limit port range.
# Default: 1024
#StreamMinPort 30000
# Default: 2048
#StreamMaxPort 32000

# Maximum number of threads running at the same time.
# Default: 10
MaxThreads 20

# Waiting for data from a client socket will timeout after this time (seconds).
# Default: 120
ReadTimeout 300

# This option specifies the time (in seconds) after which clamd should
# timeout if a client doesn’t provide any initial command after connecting.
# Default: 5
#CommandReadTimeout 5

# This option specifies how long to wait (in miliseconds) if the send buffer is full.
# Keep this value low to prevent clamd hanging
#
# Default: 500
#SendBufTimeout 200

# Maximum number of queued items (including those being processed by MaxThreads threads)
# It is recommended to have this value at least twice MaxThreads if possible.
# WARNING: you shouldn’t increase this too much to avoid running out of file descriptors,
# the following condition should hold:
# MaxThreads*MaxRecursion + (MaxQueue – MaxThreads) + 6< RLIMIT_NOFILE (usual max is 1024) # # Default: 100 #MaxQueue 200 # Waiting for a new job will timeout after this time (seconds). # Default: 30 #IdleTimeout 60 # Don't scan files and directories matching regex # This directive can be used multiple times # Default: scan all #ExcludePath ^/proc/ #ExcludePath ^/sys/ # Maximum depth directories are scanned at. # Default: 15 #MaxDirectoryRecursion 20 # Follow directory symlinks. # Default: no #FollowDirectorySymlinks yes # Follow regular file symlinks. # Default: no #FollowFileSymlinks yes # Scan files and directories on other filesystems. # Default: yes #CrossFilesystems yes # Perform a database check. # Default: 600 (10 min) #SelfCheck 600 # Execute a command when virus is found. In the command string %v will # be replaced with the virus name. # Default: no #VirusEvent /usr/local/bin/send_sms 123456789 "VIRUS ALERT: %v" # Run as another user (clamd must be started by root for this option to work) # Default: don't drop privileges User clamav # Initialize supplementary group access (clamd must be started by root). # Default: no AllowSupplementaryGroups no # Stop daemon when libclamav reports out of memory condition. #ExitOnOOM yes # Don't fork into background. # Default: no #Foreground yes # Enable debug messages in libclamav. # Default: no #Debug yes # Do not remove temporary files (for debug purposes). # Default: no #LeaveTemporaryFiles yes # Permit use of the ALLMATCHSCAN command. If set to no, clamd will reject # any ALLMATCHSCAN command as invalid. # Default: yes #AllowAllMatchScan no # Detect Possibly Unwanted Applications. # Default: no #DetectPUA yes # Exclude a specific PUA category. This directive can be used multiple times. # See https://github.com/vrtadmin/clamav-faq/blob/master/faq/faq-pua.md for # the complete list of PUA categories. # Default: Load all categories (if DetectPUA is activated) #ExcludePUA NetTool #ExcludePUA PWTool # Only include a specific PUA category. This directive can be used multiple # times. # Default: Load all categories (if DetectPUA is activated) #IncludePUA Spy #IncludePUA Scanner #IncludePUA RAT # In some cases (eg. complex malware, exploits in graphic files, and others), # ClamAV uses special algorithms to provide accurate detection. This option # controls the algorithmic detection. # Default: yes #AlgorithmicDetection yes # This option causes memory or nested map scans to dump the content to disk. # If you turn on this option, more data is written to disk and is available # when the LeaveTemporaryFiles option is enabled. #ForceToDisk yes # This option allows you to disable the caching feature of the engine. By # default, the engine will store an MD5 in a cache of any files that are # not flagged as virus or that hit limits checks. Disabling the cache will # have a negative performance impact on large scans. # Default: no #DisableCache yes ## ## Executable files ## # PE stands for Portable Executable - it's an executable file format used # in all 32 and 64-bit versions of Windows operating systems. This option allows # ClamAV to perform a deeper analysis of executable files and it's also # required for decompression of popular executable packers such as UPX, FSG, # and Petite. If you turn off this option, the original files will still be # scanned, but without additional processing. # Default: yes ScanPE yes # Certain PE files contain an authenticode signature. By default, we check # the signature chain in the PE file against a database of trusted and # revoked certificates if the file being scanned is marked as a virus. # If any certificate in the chain validates against any trusted root, but # does not match any revoked certificate, the file is marked as whitelisted. # If the file does match a revoked certificate, the file is marked as virus. # The following setting completely turns off authenticode verification. # Default: no #DisableCertCheck yes # Executable and Linking Format is a standard format for UN*X executables. # This option allows you to control the scanning of ELF files. # If you turn off this option, the original files will still be scanned, but # without additional processing. # Default: yes #ScanELF yes # With this option clamav will try to detect broken executables (both PE and # ELF) and mark them as Broken.Executable. # Default: no #DetectBrokenExecutables yes ## ## Documents ## # This option enables scanning of OLE2 files, such as Microsoft Office # documents and .msi files. # If you turn off this option, the original files will still be scanned, but # without additional processing. # Default: yes #ScanOLE2 yes # With this option enabled OLE2 files with VBA macros, which were not # detected by signatures will be marked as "Heuristics.OLE2.ContainsMacros". # Default: no #OLE2BlockMacros no # This option enables scanning within PDF files. # If you turn off this option, the original files will still be scanned, but # without decoding and additional processing. # Default: yes #ScanPDF yes # This option enables scanning within SWF files. # If you turn off this option, the original files will still be scanned, but # without decoding and additional processing. # Default: yes #ScanSWF yes ## ## Mail files ## # Enable internal e-mail scanner. # If you turn off this option, the original files will still be scanned, but # without parsing individual messages/attachments. # Default: yes ScanMail yes # Scan RFC1341 messages split over many emails. # You will need to periodically clean up $TemporaryDirectory/clamav-partial directory. # WARNING: This option may open your system to a DoS attack. # Never use it on loaded servers. # Default: no #ScanPartialMessages yes # With this option enabled ClamAV will try to detect phishing attempts by using # signatures. # Default: yes #PhishingSignatures yes # Scan URLs found in mails for phishing attempts using heuristics. # Default: yes #PhishingScanURLs yes # Always block SSL mismatches in URLs, even if the URL isn't in the database. # This can lead to false positives. # # Default: no #PhishingAlwaysBlockSSLMismatch no # Always block cloaked URLs, even if URL isn't in database. # This can lead to false positives. # # Default: no #PhishingAlwaysBlockCloak no # Detect partition intersections in raw disk images using heuristics. # Default: no #PartitionIntersection no # Allow heuristic match to take precedence. # When enabled, if a heuristic scan (such as phishingScan) detects # a possible virus/phish it will stop scan immediately. Recommended, saves CPU # scan-time. # When disabled, virus/phish detected by heuristic scans will be reported only at # the end of a scan. If an archive contains both a heuristically detected # virus/phish, and a real malware, the real malware will be reported # # Keep this disabled if you intend to handle "*.Heuristics.*" viruses # differently from "real" malware. # If a non-heuristically-detected virus (signature-based) is found first, # the scan is interrupted immediately, regardless of this config option. # # Default: no #HeuristicScanPrecedence yes ## ## Data Loss Prevention (DLP) ## # Enable the DLP module # Default: No #StructuredDataDetection yes # This option sets the lowest number of Credit Card numbers found in a file # to generate a detect. # Default: 3 #StructuredMinCreditCardCount 5 # This option sets the lowest number of Social Security Numbers found # in a file to generate a detect. # Default: 3 #StructuredMinSSNCount 5 # With this option enabled the DLP module will search for valid # SSNs formatted as xxx-yy-zzzz # Default: yes #StructuredSSNFormatNormal yes # With this option enabled the DLP module will search for valid # SSNs formatted as xxxyyzzzz # Default: no #StructuredSSNFormatStripped yes ## ## HTML ## # Perform HTML normalisation and decryption of MS Script Encoder code. # Default: yes # If you turn off this option, the original files will still be scanned, but # without additional processing. #ScanHTML yes ## ## Archives ## # ClamAV can scan within archives and compressed files. # If you turn off this option, the original files will still be scanned, but # without unpacking and additional processing. # Default: yes ScanArchive yes # Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR). # Default: no #ArchiveBlockEncrypted no ## ## Limits ## # The options below protect your system against Denial of Service attacks # using archive bombs. # This option sets the maximum amount of data to be scanned for each input file. # Archives and other containers are recursively extracted and scanned up to this # value. # Value of 0 disables the limit # Note: disabling this limit or setting it too high may result in severe damage # to the system. # Default: 100M #MaxScanSize 150M # Files larger than this limit won't be scanned. Affects the input file itself # as well as files contained inside it (when the input file is an archive, a # document or some other kind of container). # Value of 0 disables the limit. # Note: disabling this limit or setting it too high may result in severe damage # to the system. # Default: 25M #MaxFileSize 30M # Nested archives are scanned recursively, e.g. if a Zip archive contains a RAR # file, all files within it will also be scanned. This options specifies how # deeply the process should be continued. # Note: setting this limit too high may result in severe damage to the system. # Default: 16 #MaxRecursion 10 # Number of files to be scanned within an archive, a document, or any other # container file. # Value of 0 disables the limit. # Note: disabling this limit or setting it too high may result in severe damage # to the system. # Default: 10000 #MaxFiles 15000 # Maximum size of a file to check for embedded PE. Files larger than this value # will skip the additional analysis step. # Note: disabling this limit or setting it too high may result in severe damage # to the system. # Default: 10M #MaxEmbeddedPE 10M # Maximum size of a HTML file to normalize. HTML files larger than this value # will not be normalized or scanned. # Note: disabling this limit or setting it too high may result in severe damage # to the system. # Default: 10M #MaxHTMLNormalize 10M # Maximum size of a normalized HTML file to scan. HTML files larger than this # value after normalization will not be scanned. # Note: disabling this limit or setting it too high may result in severe damage # to the system. # Default: 2M #MaxHTMLNoTags 2M # Maximum size of a script file to normalize. Script content larger than this # value will not be normalized or scanned. # Note: disabling this limit or setting it too high may result in severe damage # to the system. # Default: 5M #MaxScriptNormalize 5M # Maximum size of a ZIP file to reanalyze type recognition. ZIP files larger # than this value will skip the step to potentially reanalyze as PE. # Note: disabling this limit or setting it too high may result in severe damage # to the system. # Default: 1M #MaxZipTypeRcg 1M # This option sets the maximum number of partitions of a raw disk image to be scanned. # Raw disk images with more partitions than this value will have up to the value number # partitions scanned. Negative values are not allowed. # Note: setting this limit too high may result in severe damage or impact performance. # Default: 50 #MaxPartitions 128 # This option sets the maximum number of icons within a PE to be scanned. # PE files with more icons than this value will have up to the value number icons scanned. # Negative values are not allowed. # WARNING: setting this limit too high may result in severe damage or impact performance. # Default: 100 #MaxIconsPE 200 ## ## On-access Scan Settings ## # Enable on-access scanning. Currently, this is supported via fanotify. # Clamuko/Dazuko support has been deprecated. # Default: no #ScanOnAccess yes # Don't scan files larger than OnAccessMaxFileSize # Value of 0 disables the limit. # Default: 5M #OnAccessMaxFileSize 10M # Set the include paths (all files inside them will be scanned). You can have # multiple OnAccessIncludePath directives but each directory must be added # in a separate line. (On-access scan only) # Default: disabled #OnAccessIncludePath /home #OnAccessIncludePath /students # Set the exclude paths. All subdirectories are also excluded. # (On-access scan only) # Default: disabled #OnAccessExcludePath /home/bofh # With this option you can whitelist specific UIDs. Processes with these UIDs # will be able to access all files. # This option can be used multiple times (one per line). # Default: disabled #OnAccessExcludeUID 0 ## ## Bytecode ## # With this option enabled ClamAV will load bytecode from the database. # It is highly recommended you keep this option on, otherwise you'll miss detections for many new viruses. # Default: yes #Bytecode yes # Set bytecode security level. # Possible values: # None - no security at all, meant for debugging. DO NOT USE THIS ON PRODUCTION SYSTEMS # This value is only available if clamav was built with --enable-debug! # TrustSigned - trust bytecode loaded from signed .c[lv]d files, # insert runtime safety checks for bytecode loaded from other sources # Paranoid - don't trust any bytecode, insert runtime checks for all # Recommended: TrustSigned, because bytecode in .cvd files already has these checks # Note that by default only signed bytecode is loaded, currently you can only # load unsigned bytecode in --enable-debug mode. # # Default: TrustSigned #BytecodeSecurity TrustSigned # Set bytecode timeout in miliseconds. # # Default: 5000 # BytecodeTimeout 1000 ## ## Statistics gathering and submitting ## # Enable statistical reporting. # Default: no #StatsEnabled yes # Disable submission of individual PE sections for files flagged as malware. # Default: no #StatsPEDisabled yes # HostID in the form of an UUID to use when submitting statistical information. # Default: auto #StatsHostID auto # Time in seconds to wait for the stats server to come back with a response # Default: 10 #StatsTimeout 10 [/bash]

Error:

[stextbox id=”warning”]ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).
ERROR: Can’t open /var/log/clamav/freshclam.log in append mode (check permissions!).[/stextbox]

# cd /var/log/clamav
# ls -la freshclam.log
-rw-r--r-- 1 clamav clamav 0 Oct 20 03:43 freshclam.log

# nano /etc/freshclam.conf

# By default when started freshclam drops privileges and switches to the
# "clamav" user. This directive allows you to change the database owner.
# Default: clamav (may depend on installation options)
DatabaseOwner clam

Change to clamav

# nano /etc/clamd.conf
# Run as another user (clamd must be started by root for this option to work)
# Default: don't drop privileges
User clam

Change to clamav

Clamav-cron
Summary:
This is a simple Bash script for those who want to schedule the following tasks via cron:
Source: https://code.google.com/p/clamav-cron/

update the ClamAV virus database (freshclam);
perform personal system scan (clamscan);
send a brief report via e-mail;
without any knowledge about ClamAV configuration files (such as clamd.conf or freshclam.conf) and without running the ClamAV daemon. You just have to configure the e-mail address(es) that will receive the report.

Dependencies:

To succesfilly run clamav-cron the following dependencies needs to be satisfied:

the ClamAV engine (look at ClamAV download center);
a mail server like Sendmail;
How to use:
Download clamav-cron somewhere like /usr/local/bin/ and give it execute permission:


wget http://clamav-cron.googlecode.com/files/clamav-cron-0.6 -O /usr/local/bin/clamav-cron


chmod 755 /usr/local/bin/clamav-cron

Simply open the clamav-cron script with your editor and edit the “User configuration” section following the instructions;
schedule the clamav-cron script via Cron in the preferred way. For example, you can install the clamav-cron in the crontab typing crontab -e from the user shell and entering a line like this:


45 23 * * 6 /usr/local/bin/clamav-cron /home

Cron will run clamav-cron every Saturday at 23:45 (11:45 pm) to recursevly scan the whole /home tree. At the end of task it will send a notification e-mail to the users specified at point 2. For more crontab option type man 5 crontab.