Open source antivirus engine ClamAV

The software in this article is Windowstossed at the request of netizens;

What is ClamAV?

ClamAVis an open source ( GPLv2) antivirus toolkit designed for email scanning on mail gateways. It provides many utilities, including a flexible and extensible multi-threaded daemon, a command-line scanner, and advanced tools for automatic database updates. The core of the package is an antivirus engine provided as a shared library.

ClamAVSupport multi-platform installation, including Windows, macOS , Linux, Dockeretc.

But it should be noted that

• ClamAVNot a traditional antivirus or endpoint security suite;
• Whether you're using an official ClamAV dockermirror or ClamAVa third-party mirror running , you need to make sure you have enough RAM.

ClamAVRecommendations RAM(as of 2020/09/20):

• lowest:3 G
• Preferred:4 G

Install

Install it in Docker mode on Synology.

At the time of writing this article, latestthe corresponding version is stable, that is, the stable version, and the corresponding version number is 1.1.0;

If you are familiar with the command line, it may be docker clifaster to use .

Use SSHthe client to log in to the Synology host, and then execute the following command on the command line. In dockerthe folder, create a new folder clamavand create a subfolder in it data, where datathe subdirectory is used to save and persist the virus database

# 新建文件夹 clamav 和 子目录
mkdir -p /volume2/docker/clamav/data

# 进入 clamav 目录
cd /volume2/docker/clamav

# 下载镜像
docker pull clamav/clamav:latest

run

Download virus database

The first time you run it, you need to download and update the virus database

ClamAVContainers actually run freshclamand clamddaemonize both by default. To control the behavior of a service started inside a container, you need to control it through environment variables.

Official instructions: https://docs.clamav.net/manual/Installing/Docker.html#controlling-the-container

#  更新病毒数据库
docker run -it \
   --rm \
   --name clamav \
   -v $(pwd)/data:/var/lib/clamav \
   -e CLAMAV_NO_FRESHCLAMD=false \
   clamav/clamav:latest

Download time depends on network conditions

When you see SelfCheck: Database status OK., you can use Ctrl+Cto exit the running of the container, --rmthe parameter ensures that the container will be cleaned up after exiting

Back FileStation, datayou can see the downloaded virus database file in

Run a Clam(D) scan

DockerUnable to access any hosts files. Therefore, to Dockerscan for these files in , they need to be mounted using a bind mount so that they can be accessed.

For example: /path/to/scanmount the host directory in the container as /scandir, and then call clamcanon /scandirto complete the scan

# 扫描主机 /path/to/scan 目录
docker run -it \
   --rm \
   --name clamav \
   -v /path/to/scan:/scandir \
   -v $(pwd)/data:/var/lib/clamav \
   clamav/clamav:latest \
   clamscan /scandir

dockerThe following example is to scan after mounting the directory of Synology

Before the hard disk crashed, Lao Su's dockerdirectory was volume2on ;

# 示例：扫描 docker 目录
docker run -it \
   --rm \
   --name clamav \
   -v /volume2/docker:/scandir \
   -v $(pwd)/data:/var/lib/clamav \
   clamav/clamav:latest \
   clamscan /scandir

Can directly see the details of the scan

reference documents

Cisco-Talos/clamav: ClamAV - Documentation is here: https://docs.clamav.net
地址：https://github.com/Cisco-Talos/clamav

clamav/README.Docker.md at main · Cisco-Talos/clamav · GitHub
地址：https://github.com/Cisco-Talos/clamav/blob/main/README.Docker.md

ClamAVNet
address: https://www.clamav.net/

Introduction - ClamAV Documentation
地址：https://docs.clamav.net/

ClamAV® blog
address: https://blog.clamav.net/