/home/bill/web/binvirus/4_virus information.txt
#] 
#] *********************
#] "$d_bin"'virus/0_virus clamscan notes.txt'
# www.BillHowell.ca  21Jan2012 initial, 24Dec2020 new file, 04Feb2024 merged
# view in text editor, using constant-width font (eg courier), tabWidth = 3


see "$d_bin"'virus/1_virus.link.txt'
#48************************************************48



#24************************24
# Table of Contents, generate with :
# $ grep  "^#]"  "$d_bin"'virus/0_virus clamscan notes.txt'  |  sed "s/^#\]/  /"  >"$d_bin"'virus/0_virus clamscan notes TblOfCont.txt'
#
   *********************


#24************************24




08********08
#] make sure the following are installed! : 
	clamav ?? 
	freshclam ??
	clamav-demon
	clamav-testfiles, clamav-testfiles-rar
		Clam AntiVirus is an anti-virus toolkit for Unix. The main purpose of this software is the integration with mail servers (attachment scanning). The package provides a flexible and scalable multi-threaded daemon in the clamav-daemon package, a command-line scanner in the clamav package, and a tool for automatic updating via the Internet in the clamav-freshclam package. The programs are based on libclamav, which can be used by other software.
		This package contains files 'infected' with a test signature. The test signature (ClamAV-Test-Signature) should be detectable by all anti-virus programs.
	clamav-docs
		This package contains the documentation for the ClamAV suite.

>> AWESOME: one of the above created /etc/clamav/clamd.conf!!!


08********08
#] freshclam updates are [specified, edited] in the anacron sh : 
$ kwrite "/media/bill/PROJECTS/System_maintenance/Linux/cron & anacron daily Howell.txt"
$ sudo 
01Sep2018 - freshclam may also be updated via a root crontab?  
	but it's NOT in /etc/crontab
freshclam view log : 
$ sudo cat "/var/log/clamav/freshclam.log" 


08********08
#] To download a virus sample :
FireFox menu -> Preferences -> Privacy & Security -> Security :
x	Deceptive Content and Dangerous Software Protection
x	Block dangerous and deceptive content (Learn more) 
x	Block dangerous downloads
x	Warn you about unwanted and uncommon software
>> temporarily uncheck "Block dangerous downloads" & see what happens
>> OK - works!
DANGEROUS!!!  Don't forget to reset FireFox "Block dangerous downloads" when done!!!!


08********08
#] Quick notes :  
29Mar2021	WEIRD! Even if clamsacan finds viruses in a folder, when the folder is split into text files 
				for each email, no viruses show up!!??!!???!
29Mar2021	folders with "Heuristics.Phishing.Email.SpoofedDomain FOUND" - these are probably OK


08********08
#] "$d_virus???"' key infected : 
"/media/bill/Virus_samples"  
/media/bill/Virus_samples/Ikarus viruses/eicar_com.zip: Win.Test.EICAR_HDB-1 FOUND
/media/bill/Virus_samples/Ikarus viruses/eicar.com: Win.Test.EICAR_HDB-1 FOUND
/media/bill/Virus_samples/infected/210328/z_Archive: Email.Phishing.VOF1-6314019-0 FOUND
/media/bill/Virus_samples/infected/210328/Trash: Win.Trojan.Generickd-395 FOUND


08********08
#] clamscan example output

#Example 21Jun2020
#~/PROJECTS
#$ clamscan -ri
#/home/bill/PROJECTS/System_maintenance/security/viruses quarantined/.tar: Unix.Malware.Agent-1415284 FOUND
#
#----------- SCAN SUMMARY -----------
#Known viruses: 7303710
#Engine version: 0.102.3
#Scanned directories: 612
#Scanned files: 11853
#Infected files: 1
#Data scanned: 12649.51 MB
#Data read: 12065.58 MB (ratio 1.05:1)
#Time: 1474.317 sec (24 m 34 s)