ClamAv is a command line virus scanner. It runs on all the major platforms, Windown,Linux, and OSX. You can download the source and install it from there, or you can follow these simple steps to install it using MacPorts.
To install ClamAv check the ports including clam by listing these:
- If you delete this exception statement from all source files in the program, then also delete it here. 0.98.1 - ClamAV 0.98.1 provides improved support of Mac OS X platform, support for new file types, and quality improvements. These include: - Extraction, decompression, and scanning of files within Apple Disk Image (DMG) format.
- Clamav Mac Malware ClamAV Virus Database Search Search for: begins withcontainsexactregex Case-sensitive search: YesNo Search database(s): DailyMain.
- ClamXav for Mac scans your computer or selected files and folders for viruses to help keep it running smoothly. With clear controls and instructions, this program makes it easy to keep your data.
- Memorandum: How to build ClamAV® - antivirus scanning engine on Mac OS X 10.4 through macOS 10.13, Compile ClamAV on Mac OS X 10.4, Mac OS X 10.5, Mac OS X 10.6, Mac OS X 10.7, OS X 10.8, OS X 10.9, OS X 10.10, OS X 10.11, macOS 10.12, macOS 10.13, macOS 10.14, macOs 10.15, macOs 11.0, Running clamd and freshclam as 'launch daemon', Running RunFreshclam as 'launch daemon', Running ClamXav.
I use ClamXAV for my Mac and I'm trying to output all of the logs to a log file to be ingested by a different system, but can't quite figure out what I'm doing wrong. I have tried editing the clamd.conf and freshclam.conf and editing the appropriate lines (excerpt below) but it doesn't seem to generate any logs.
port search clam
Then to install the files issue:
Clamav Mac Osx
sudo port install clamav clam-server clamsmtp p5-mail-clamav
Once the ports are installed you'll need to configure ClamAv. The following is an extract from the port installation echo:
To configure clamd and freshclam look for the following files:
/opt/local/etc/clamd.conf
/opt/local/etc/freshclam.conf
If these files do not exist you can copy the sample conf files into place:
sudo cp /opt/local/etc/clamd.conf.sample /opt/local/etc/clamd.conf
sudo cp /opt/local/etc/freshclam.conf.sample /opt/local/etc/freshclam.conf
Edit /opt/local/etc/clamd.conf to your liking, example:
# Comment out 'Example' near the top if it exists
#Example
LogFile /opt/local/var/log/clamav/clamd.log
PidFile /opt/local/var/run/clamav/clamd.pid
LocalSocket /opt/local/var/run/clamav/clamd.socket
TCPSocket 3310TCPAddr 127.0.0.1
Foreground yes
Edit /opt/local/etc/freshclam.conf to your liking, example:
# Comment out 'Example' near the top if it exists
#Example
UpdateLogFile /opt/local/var/log/clamav/freshclam.log
PidFile /opt/local/var/run/clamav/freshclam.pid
NotifyClamd /opt/local/etc/clamd.conf
The important thing when editing these configuration files, is that the directories for clams and freshclam points to the same directories. I let mine point to:
/opt/local/var/log/clamav/
/opt/local/var/run/clamav/
And, make sure that the TCPSocket and TCPAddr are set, enabling you to use ClamAv from within other programs. After installation you'll need to create an entry in the ports share directory. The reason for this is that ClamAv runs in this directory and the directory is not created on installation. Create it like this:
sudo mkdir -p /opt/local/share/clamav
sudo chown clamav:clamav /opt/local/share/clamav
Now you're ready to create a fresh clam, issue:
sudo freshclam -v
Current working dir is /opt/local/share/clamav
Max retries 3
ClamAV update process started at Thu Mar 24 00:01:09 2016
Using IPv6 aware code
Querying current.cvd.clamav.net
TTL: 632
Software version from DNS: 0.99.1
main.cvd version from DNS: 57
main.cvd is up to date (version: 57, sigs: 4218790, f-level: 60, builder: amishhammer)
daily.cvd version from DNS: 21470
daily.cld is up to date (version: 21470, sigs: 83891, f-level: 63, builder: neo)
bytecode.cvd version from DNS: 275
bytecode.cvd is up to date (version: 275, sigs: 45, f-level: 63, builder: amishhammer)
ClamAv will generate a new virus signature file. When it is done, you're ready to scan your box. This is done by:
clamscan -ro ~/
----------- SCAN SUMMARY -----------
Known viruses: 4297361
Engine version: 0.99.1
Scanned directories: 132235
Scanned files: 595659
Infected files: 0
Total errors: 4
Data scanned: 72096.62 MB
Data read: 136687.80 MB (ratio 0.53:1)
Time: 22133.709 sec (368 m 53 s)
It'll take loads of time to finish. As, almost, all other codlin tools --help or man clamscan displays all the options you can pass to the program. Next, you'll need to get ClamAv running automatically. Following the installation instructions, another extract:
Two launchd startup items have been installed.
To load clamd and freshclam do the following:
sudo launchctl load -w /Library/LaunchDaemons/org.macports.clamd.plist
sudo launchctl load -w /Library/LaunchDaemons/org.macports.freshclam.plist
To unload clamd and freshclam do the following:
sudo launchctl unload -w /Library/LaunchDaemons/org.macports.clamd.plist
sudo launchctl unload -w /Library/LaunchDaemons/org.macports.freshclam.plist
Issue both of the commands that loads the deamons, then check that the clamd is running.
ps -aef | grep clamd
The result should look somewhat like this:
Clamav Windows
0 25965 1 0 4:52PM ?? 0:07.78 /opt/local/sbin/clamd
If your are using Thunderbird and Firefox you can use ClamAv to scan your downloads and your mails. Install the firefox add-on Fireclam, and the Thunderbird add-on clamdrip LIN.
The clam drip LIN extension if meant for Linux only, but it's all runnable using the port version of ClamAv. simply press the: Download for Linux anyway link anyhu!
And import the add on in Thunderbird. Ignore the *beware* message, if you do not trust me, check the contents of the plugin file, using unzip to extract it and inspect the code. It, doesn't look malicious to me.
Next, go to the Thunderbird add on, and select the clam drib preferences. Configure it to listen to the clamd available on localhost:3310.