HOWTO : ClamAV 0.99 on Ubuntu 16.04 LTS

Clam AntiVirus (ClamAV) is a free and open-source, cross-platform antivirus software tool-kit able to detect many types of malicious software, including viruses.

This guide will lead you to set up ClamAV for "Scan On Access" instead of "Scan On Demand". It is also target to Desktop usage only.

The current version at this writing is ClamAV 0.99.

Step 1 :

sudo apt-get install clamav clamav-freshclam clamav-daemon libclamunrar7

Step 2 :

sudo nano /etc/clamav/clamd.conf

To make the entries looking like the following. Make sure to replace "samiux" with your username.


cd ~
mkdir quarantine

Step 3 :

sudo nano /etc/clamav/freshclam.conf

To make the entries looking like the following.



sudo systemctl enable clamav-daemon
sudo systemctl restart clamav-daemon
sudo freshclam

Remark :

Download or copy will not trigger the ClamAV scan but browsing or executing (or etc) will. If any malware or virus (no matter it is for Windows, Linux or Mac OSX) is detected, it will be moved to "quarantine" directory. You can also check the log at "/var/log/clamav/clamav.log". Be aware that ClamAV may produce a lot of false positive warning in Linux.

Testing :

You can install NO harm virus testing files for testing.

sudo apt-get install clamav-testfiles

The NO harm virus testing files are located at "/usr/share/clamav-testfiles".

Reference

AppArmor Wiki

That's all! See you.

HOWTO : ClamAV on Ubuntu 14.04 LTS

Clam AntiVirus (ClamAV) is a free and open-source, cross-platform antivirus software tool-kit able to detect many types of malicious software, including viruses.

This guide will lead you to set up ClamAV for "Scan On Access" instead of "Scan On Demand". It is also target to Desktop usage only.

The current version at this writing is ClamAV 0.98.7+dfsg.

Step 1 :

sudo apt-get install clamav clamav-freshclam clamav-daemon libclamunrar6

Step 2 :

sudo nano /etc/clamav/clamd.conf

To make the entries looking like the following. Make sure to replace "samiux" with your username.



cd ~
mkdir quarantine

Step 3 :

sudo nano /etc/clamav/freshclam.conf

To make the entries looking like the following.



sudo freshclam

Step 4 :

sudo nano /etc/apparmor.d/usr.sbin.clamd

To make the entries looking like the following.



After that, execute the following command to reload the apparmor rules.

sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.clamd

Remark :

Download or copy will not trigger the ClamAV scan but browsing or executing (or etc) will. If any malware or virus (no matter it is for Windows, Linux or Mac OSX) is detected, it will be moved to "quarantine" directory. You can also check the log at "/var/log/clamav/clamav.log".

Testing :

You can install NO harm virus testing files for testing.

sudo apt-get install clamav-testfiles

The NO harm virus testing files are located at "/usr/share/clamav-testfiles".

Reference

AppArmor Wiki

See also : Fireclam Firefox Add-ons

That's all! See you.

Undetectable Trojan on Windows 7 SP1 and AVG Anti-Virus Free Edition 2012

Maybe someone out there think that their systems are safe when anti-virus programs are installed and the firewall is enabled. However, it is not true.

This video is to proof that anti-virus program and firewall can be bypassed. This video is going to WARN you all NOT to download any pirate software and cracked software as well as NOT to download any software from any untrusted source.

The technique used in the video can be used in any file format, such as video, pdf, photo/picture, audio and executable file.

About the video

The demo Windows 7 SP1 in the video is in default settings upon installed.

- Windows 7 SP1 is fully updated as on April 11, 2012.
- AVG Anti-Virus Free Edition 2012 is installed and fully updated as on April 11, 2012.
- UAC is set to default on Windows 7 SP1.
- Firewall is enabled and no extra program is allowed (default settings).
- AVG Anti-Virus Free Edition 2012 has no whitelist set

As a result, the Trojan Injected PuTTY program is undetected by AVG Anti-Virus program and UAC/Defender on Windows 7 SP1 as well as firewall.



That's all! See you.

Undetectable Trojan on Windows 7 and AVG Anti-Virus

Maybe someone out there think that their systems are safe when anti-virus programs are installed and the firewall is enabled. However, it is not true.

This video is to proof that anti-virus programs and firewalls can be bypassed. This video is going to WARN you all NOT to download any pirate software and cracked software as well as NOT to download any software from any untrusted source.

The technique used in the video can be used in any file format, such as video, pdf, photo/picture, audio and executable file.

About the video

The demo Windows 7 in the video is in default settings upon installed.

- Windows 7 is fully updated as on April 10, 2012.
- AVG Anti-Virus is installed and fully updated as on April 10, 2012.
- UAC is set to default on Windows 7.
- Firewall is enabled and no extra program is allowed (default settings).
- AVG Anti-Virus has no whitelist set

As a result, the Trojan Injected PuTTY program is undetected by AVG Anti-Virus program and UAC/Defender on Windows 7 as well as firewall.



That's all! See you.