Centos | Clamav | 启动clamd@scan服务

最新推荐文章于 2025-07-10 16:55:55 发布

原创最新推荐文章于 2025-07-10 16:55:55 发布 · 9.2k 阅读

22 ·

CC 4.0 BY-SA版权

文章标签：

#linux #centos #clamav

Linux 同时被 2 个专栏收录

51 篇文章

订阅专栏

漏洞扫描

6 篇文章

订阅专栏

本文详细介绍了如何在Linux系统上安装和配置ClamAV防病毒软件，包括安装必要的组件、设置病毒库更新、配置扫描参数、启动服务以及使用clamscan和clamdscan命令进行病毒扫描。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

安装

yum install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd

病毒库默认地址是/var/lib/clamav，可以在/etc/freshclam.conf设置。

配置

配置病毒库更新

vim /etc/freshclam.conf

取消注释

DatabaseDirectory /var/lib/clamav
UpdateLogFile /var/log/freshclam.log
LogFileMaxSize 2M
LogTime yes
PidFile /var/run/freshclam.pid

配置扫描

vim /etc/clamd.d/scan.conf

取消注释

LogFile /var/log/clamd.scan
LogFileMaxSize 2M
LogTime yes
PidFile /run/clamd.scan/clamd.pid
DatabaseDirectory /var/lib/clamav
TCPAddr 0.0.0.0
TCPSocket 3310

创建日志文件，这个日志文件对应clamdscan的扫描任务

touch /var/log/clamd.scan
chown clamscan:clamscan /var/log/clamd.scan

启动服务

自动更新

systemctl start clamav-freshclam.service
systemctl enable clamav-freshclam.service 
systemctl status clamav-freshclam.service

在这里插入图片描述

手动更新

freshclam

在这里插入图片描述

可以下载数据文件到/var/lib/clamav目录下

wget http://database.clamav.net/main.cvd
wget http://database.clamav.net/daily.cvd
wget http://database.clamav.net/bytecode.cvd

启动clamd@scan扫描服务，服务启动不了的话，可以查看/var/log/clamd.scan

systemctl enable clamd@scan
systemctl start clamd@scan
systemctl status clamd@scan

clamscan命令

clamscan扫描不需要启动clamd服务

clamscan -h查看命令

clamscan -h

                       Clam AntiVirus: Scanner 0.102.4
           By The ClamAV Team: https://www.clamav.net/about.html#credits
           (C) 2020 Cisco Systems, Inc.

    clamscan [options] [file/directory/-]

    --help                -h             Show this help
    --version             -V             Print version number
    --verbose             -v             Be verbose
    --archive-verbose     -a             Show filenames inside scanned archives
    --debug                              Enable libclamav's debug messages
    --quiet                              Only output error messages
    --stdout                             Write to stdout instead of stderr. Does not affect 'debug' messages.
    --no-summary                         Disable summary at end of scanning
    --infected            -i             Only print infected files
    --suppress-ok-results -o             Skip printing OK files
    --bell                               Sound bell on virus detection

    --tempdir=DIRECTORY                  Create temporary files in DIRECTORY
    --leave-temps[=yes/no(*)]            Do not remove temporary files
    --gen-json[=yes/no(*)]               Generate JSON description of scanned file(s). JSON will be printed and also-
                                         dropped to the temp directory if --leave-temps is enabled.
    --database=FILE/DIR   -d FILE/DIR    Load virus database from FILE or load all supported db files from DIR
    --official-db-only[=yes/no(*)]       Only load official signatures
    --log=FILE            -l FILE        Save scan report to FILE
    --recursive[=yes/no(*)]  -r          Scan subdirectories recursively
    --allmatch[=yes/no(*)]   -z          Continue scanning within file after finding a match
    --cross-fs[=yes(*)/no]               Scan files and directories on other filesystems
    --follow-dir-symlinks[=0/1(*)/2]     Follow directory symlinks (0 = never, 1 = direct, 2 = always)
    --follow-file-symlinks[=0/1(*)/2]    Follow file symlinks (0 = never, 1 = direct, 2 = always)
    --file-list=FILE      -f FILE        Scan files from FILE
    --remove[=yes/no(*)]                 Remove infected files. Be careful!
    --move=DIRECTORY                     Move infected files into DIRECTORY
    --copy=DIRECTORY                     Copy infected files into DIRECTORY
    --exclude=REGEX                      Don't scan file names matching REGEX
    --exclude-dir=REGEX                  Don't scan directories matching REGEX
    --include=REGEX                      Only scan file names matching REGEX
    --include-dir=REGEX                  Only scan directories matching REGEX

    --bytecode[=yes(*)/no]               Load bytecode from the database
    --bytecode-unsigned[=yes/no(*)]      Load unsigned bytecode
    --bytecode-timeout=N                 Set bytecode timeout (in milliseconds)
    --statistics[=none(*)/bytecode/pcre] Collect and print execution statistics
    --detect-pua[=yes/no(*)]             Detect Possibly Unwanted Applications
    --exclude-pua=CAT                    Skip PUA sigs of category CAT
    --include-pua=CAT                    Load PUA sigs of category CAT
    --detect-structured[=yes/no(*)]      Detect structured data (SSN, Credit Card)
    --structured-ssn-format=X            SSN format (0=normal,1=stripped,2=both)
    --structured-ssn-count=N             Min SSN count to generate a detect
    --structured-cc-count=N              Min CC count to generate a detect
    --scan-mail[=yes(*)/no]              Scan mail files
    --phishing-sigs[=yes(*)/no]          Enable email signature-based phishing detection
    --phishing-scan-urls[=yes(*)/no]     Enable URL signature-based phishing detection
    --heuristic-alerts[=yes(*)/no]       Heuristic alerts
    --heuristic-scan-precedence[=yes/no(*)] Stop scanning as soon as a heuristic match is found
    --normalize[=yes(*)/no]              Normalize html, script, and text files. Use normalize=no for yara compatibility
    --scan-pe[=yes(*)/no]                Scan PE files
    --scan-elf[=yes(*)/no]               Scan ELF files
    --scan-ole2[=yes(*)/no]              Scan OLE2 containers
    --scan-pdf[=yes(*)/no]               Scan PDF files
    --scan-swf[=yes(*)/no]               Scan SWF files
    --scan-html[=yes(*)/no]              Scan HTML files
    --scan-xmldocs[=yes(*)/no]           Scan xml-based document files
    --scan-hwp3[=yes(*)/no]              Scan HWP3 files
    --scan-archive[=yes(*)/no]           Scan archive files (supported by libclamav)
    --alert-broken[=yes/no(*)]           Alert on broken executable files (PE & ELF)
    --alert-encrypted[=yes/no(*)]        Alert on encrypted archives and documents
    --alert-encrypted-archive[=yes/no(*)] Alert on encrypted archives
    --alert-encrypted-doc[=yes/no(*)]    Alert on encrypted documents
    --alert-macros[=yes/no(*)]           Alert on OLE2 files containing VBA macros
    --alert-exceeds-max[=yes/no(*)]      Alert on files that exceed max file size, max scan size, or max recursion limit
    --alert-phishing-ssl[=yes/no(*)]     Alert on emails containing SSL mismatches in URLs
    --alert-phishing-cloak[=yes/no(*)]   Alert on emails containing cloaked URLs
    --alert-partition-intersection[=yes/no(*)] Alert on raw DMG image files containing partition intersections
    --nocerts                            Disable authenticode certificate chain verification in PE files
    --dumpcerts                          Dump authenticode certificate chain in PE files

    --max-scantime=#n                    Scan time longer than this will be skipped and assumed clean
    --max-filesize=#n                    Files larger than this will be skipped and assumed clean
    --max-scansize=#n                    The maximum amount of data to scan for each container file (**)
    --max-files=#n                       The maximum number of files to scan for each container file (**)
    --max-recursion=#n                   Maximum archive recursion level for container file (**)
    --max-dir-recursion=#n               Maximum directory recursion level
    --max-embeddedpe=#n                  Maximum size file to check for embedded PE
    --max-htmlnormalize=#n               Maximum size of HTML file to normalize
    --max-htmlnotags=#n                  Maximum size of normalized HTML file to scan
    --max-scriptnormalize=#n             Maximum size of script file to normalize
    --max-ziptypercg=#n                  Maximum size zip to type reanalyze
    --max-partitions=#n                  Maximum number of partitions in disk image to be scanned
    --max-iconspe=#n                     Maximum number of icons in PE file to be scanned
    --max-rechwp3=#n                     Maximum recursive calls to HWP3 parsing function
    --pcre-match-limit=#n                Maximum calls to the PCRE match function.
    --pcre-recmatch-limit=#n             Maximum recursive calls to the PCRE match function.
    --pcre-max-filesize=#n               Maximum size file to perform PCRE subsig matching.
    --disable-cache                      Disable caching and cache checks for hash sums of scanned files.

Pass in - as the filename for stdin.

(*) Default scan settings
(**) Certain files (e.g. documents, archives, etc.) may in turn contain other
   files inside. The above options ensure safe processing of this kind of data.

clamdscan命令

需要启动clamd@scan服务

clamdscan -h

                  Clam AntiVirus: Daemon Client 0.102.4
       By The ClamAV Team: https://www.clamav.net/about.html#credits
       (C) 2020 Cisco Systems, Inc.

clamdscan [options] [file/directory/-]

--help              -h             Show this help
--version           -V             Print version number and exit
--verbose           -v             Be verbose
--quiet                            Be quiet, only output error messages
--stdout                           Write to stdout instead of stderr. Does not affect 'debug' messages.
                                   (this help is always written to stdout)
--log=FILE          -l FILE        Save scan report in FILE
--file-list=FILE    -f FILE        Scan files from FILE
--remove                           Remove infected files. Be careful!
--move=DIRECTORY                   Move infected files into DIRECTORY
--copy=DIRECTORY                   Copy infected files into DIRECTORY
--config-file=FILE                 Read configuration from FILE.
--allmatch            -z           Continue scanning within file after finding a match.
--multiscan           -m           Force MULTISCAN mode
--infected            -i           Only print infected files
--no-summary                       Disable summary at end of scanning
--reload                           Request clamd to reload virus database
--fdpass                           Pass filedescriptor to clamd (useful if clamd is running as a different user)
--stream                           Force streaming files to clamd (for debugging and unit testing)

扫描

递归扫描，clamscan的扫描结果不带时间戳

clamscan –ri /home

递归扫描根目录，不输出summary，并将结果存储在/etc/clamscan.log

clamscan –ri --no-summary /home  -l /etc/clamscan.log

clamdscan /home
clamdscan /home对应日志

在这里插入图片描述