Last night, I received Ali Yun's short message and email to persuade the server to be poisoned. The contents are as follows:
After testing the malicious outsourcing behavior of your cloud server (ip), in order to avoid affecting the normal use of your server, you must pay attention to it and deal with it as soon as possible. You need to find out your security risks as soon as possible. At present, the system will not punish your machine, but you must pay attention to it.
Afraid of being punished (near the small black house), so hurry to log on to the server and find nothing unusual after going up, but find that the machine has been running naked, quickly install the firewall, everything is normal, until this afternoon I received Ali Yun's text messages and emails, the server simply can not log on, the cpu and bandwidth are praised, very slowly, wait a while or not. Enter, directly manage the background to restart the machine, log in immediately after restart, open the firewall, only allow specific ip access, cut off all other access.
Installation of Antivirus Software ClamAV
ClamAV is a virus checking software on the command line, because it does not take antivirus as its main function. By default, it can only detect viruses in your computer, but it can not clear, at most delete files. ClamAV can work on many platforms, but a few can't support it, depending on the popularity of the platforms you use. In addition, it mainly protects against some WINDOWS virus and Trojan horse programs. In addition, this is a server-oriented software.
Download the ClamAV installation package
Official website: http://www.clamav.net/downloa...
wget http://www.clamav.net/downloads/production/clamav-0.99.2.tar.gz
wget http://nchc.dl.sourceforge.net/project/libpng/zlib/1.2.7/zlib-1.2.7.tar.gz
tar xvzf zlib-1.2.7.tar.gz cd zlib-1.2.7 ./configure make && make install
Add user group clamav and group member clamav
[root@iZwz92o4464Z zlib-1.2.7]# groupadd clamav [root@iZwz92o4464Z zlib-1.2.7]# useradd -g clamav -s /bin/false -c "Clam AntiVirus" clamav
Installation of Clamav-0.99.2
[root@iZwz92o4464Z tmp]# tar xvzf clamav-0.99.2.tar.gz [root@iZwz92o4464Z tmp]# cd clamav-0.99.2 [root@iZwz92o4464Z clamav-0.99.2]# ./configure --prefix=/opt/clamav --disable-clamav [root@iZwz92o4464Z clamav-0.99.2]# make [root@iZwz92o4464Z clamav-0.99.2]# make install
Configure Clamav
1: Create directories
[root@iZwz92o4464Z clamav-0.99.2]# mkdir /opt/clamav/logs [root@iZwz92o4464Z clamav-0.99.2]# mkdir /opt/clamav/updata
2: Create files
[root@iZwz92o4464Z clamav-0.99.2]# touch /opt/clamav/logs/freshclam.log [root@iZwz92o4464Z clamav-0.99.2]# touch /opt/clamav/logs/clamd.log [root@iZwz92o4464Z clamav-0.99.2]# cd /opt/clamav/logs [root@iZwz92o4464Z clamav-0.99.2]# cd logs [root@iZwz92o4464Z clamav-0.99.2]# ls clamd.log freshclam.log [root@LNX17 logs]# ls -lrt total 0 -rw-r--r--. 1 root root 0 Aug 21 22:10 freshclam.log -rw-r--r--. 1 root root 0 Aug 21 22:10 clamd.log
3: Modify ownership
[root@iZwz92o4464Z logs]# chown clamav:clamav clamd.log [root@iZwz92o4464Z logs]# chown clamav:clamav freshclam.log [root@iZwz92o4464Z logs]# ls -lrt total 0 -rw-r--r--. 1 clamav clamav 0 Aug 21 22:10 freshclam.log -rw-r--r--. 1 clamav clamav 0 Aug 21 22:10 clamd.log [root@iZwz92o4464Z logs]#
4: Modify the configuration file
root@AY14061209501523080aZ: vim /opt/clamav/etc/clamd.conf
# Example annotates this line. Line 8 LogFile/logs/clamd.log deletes the previous comment directory and changes it to/opt/clamav/logs/clamd.log PidFile/opt/clamav/updata/clamd.pid deletes the previous comment path and changes to/opt/clamav/updata/clamd.pid Database Directory/opt/clamav/updata, ibid.
root@AY14061209501523080aZ:/opt/clamav# vim
/opt/clamav/etc/freshclam.conf
Comment out the line Example. Otherwise, the following errors may occur in updating the anti-virus database
ERROR: Please edit the example config file /opt/clamav/etc/freshclam.conf ERROR: Can't open/parse the config file /opt/clamav/etc/freshclam.conf
5: Upgrade Virus Library
[root@AY14061209501523080aZ etc]# /opt/clamav/bin/freshclam ERROR: Can't change dir to /opt/clamav/share/clamav
If the above error occurs, create a folder directly and authorize clamav users.
[root@AY14061209501523080aZ etc]# mkdir -p /opt/clamav/share/clamav [root@AY14061209501523080aZ etc]# /opt/clamav/etc# chown clamav:clamav /opt/clamav/share/clamav
Continue updating (very slow)
[root@AY14061209501523080aZ:/opt/clamav/etc]# /opt/clamav/bin/freshclam ClamAV update process started at Thu Mar 9 18:33:03 2017 WARNING: Your ClamAV installation is OUTDATED! WARNING: Local version: 0.97.6 Recommended version: 0.99.2 DON'T PANIC! Read http://www.clamav.net/support/faq Downloading main.cvd [100%] main.cvd updated (version: 57, sigs: 4218790, f-level: 60, builder: amishhammer) Downloading daily.cvd [ 4%]
Since ClamAV is not the latest version, there is warning information. You can ignore or upgrade the latest version. Virus libraries need to be upgraded regularly, such as the next day when I upgrade them
6: ClamAV usage
You can use / opt/clamav/bin/clamscan -h to view the corresponding help information
· Scanning all users'home directories uses clamscan-r/home
· Scanning all files on your computer and displaying the results of scanning all files, use clamscan-r/
· Scanning all the files on your computer and displaying the scanning results of the files in question, use clamscan-r--bell-i/
Execute the following command to scan all files under the root directory. As follows: 56 files were infected. Basically it's Linux.Trojan.Agent and Linux.Backdoor.Gates and so on.
/opt/clamav/bin/clamscan -r --bell -i