Skip to content

Clamav

On demand scan

Debian/Ubuntu based live CD: clamav-freshclam systemd service gets started automatically after installation, so there is no need to update manually.

Mount disks, install clamav:

cryptsetup open /dev/nvme0n1p5 root
mount /dev/varac/root /mnt  # for encrypted lvm volumes
mount /dev/nvme0n1p1 /mnt/boot
apt update
apt install clamav

Scan, showing only infected files:

time clamscan --recursive --infected --max-filesize=2000M --max-scansize=2000M /mnt

To see which files are currently scanned start this in onother terminal:

watch lsof -a -d 0-999 -c clamscan /mnt

Setup

Install clamav and other malware definition files (clamav-unofficial-sigs is outdated):

pamac install clamav python-fangfrisch

Add user to clamav group:

sudo usermod -a -G clamav varac
newgrp clamav

Configure malware definition services:

sudo touch /var/log/clamav/freshclam.log
sudo chown clamav:clamav /var/log/clamav/freshclam.log
sudo freshclam
sudo systemctl enable clamav-freshclam.service
sudo systemctl start clamav-freshclam.service

Configure ClamAV Resource Limits but make sure the VirusEvent still works, because when setting limits too strictly, it doesn't and virus files stay unnoticed.

Start clamav in daemon mode:

sudo systemctl enable clamav-daemon.service
sudo systemctl start clamav-daemon.service

Additional malware definitions

These packages ship additional malware definition files:

fangfrisch

  • Config: /etc/fangfrisch/fangfrisch.conf
  • db: /var/lib/fangfrisch/db.sqlite

Setup:

pamac install clamav python-fangfrisch
sudo -u clamav /usr/bin/fangfrisch --conf /etc/fangfrisch/fangfrisch.conf initdb
sudo systemctl enable fangfrisch.timer
sudo systemctl start fangfrisch.timer

Test

$ curl https://secure.eicar.org/eicar.com.txt | clamscan -
...
stdin: Win.Test.EICAR_HDB-1 FOUND

On-Access scanning

On-Access scanning setup

  • FANOTIFY needs to be enabled in the kernel (which is enabled in default Arch linux/Manjaro kernels): zgrep FANOTIFY /proc/config.gz

First, edit the /etc/clamav/clamd.conf configuration file by adding the following to the end of the file (see config in the Arch wiki: On-Access Scanning). Don't forget to adjust all mount points.

Next, allow the clamav user to run notify-send as any user with custom environment variables via sudo:

sudo vi /etc/sudoers.d/clamav

and paste the following content:

# https://wiki.archlinux.org/title/ClamAV#OnAccessScan
clamav ALL = (ALL) NOPASSWD: SETENV: /usr/bin/notify-send

Edit clamav-clamonacc.service:

sudo systemctl edit clamav-clamonacc.service

and insert:

[Service]
ExecStart=
ExecStart=/usr/sbin/clamonacc -F --fdpass --log=/var/log/clamav/clamonacc.log

systemctl enable clamav-clamonacc.service
systemctl start clamav-clamonacc.service

On-Access scanning test

CLI:

wget https://secure.eicar.org/eicar.com.txt -O ~/tmp/eicar.com.txt
cat ~/tmp/eicar.com.txt

Browser: Download EICAR anti malware testfile

  • Doesn't trigger an alert when downloading, only when accessing with i.e. cat

On-Access issues

Issue: VirusEvent does not trigger