Hi
Now I have question I think it would benefit all and would get this script step further.
How could I manually start this script to scan folder or folders for particular usre? It would come handy if we would have script witch could be start manualy or as cron job and would scan folders witch we set. Basiclly something like antivirus but with option to input own search string as this script offer.
Now I have question I think it would benefit all and would get this script step further.
How could I manually start this script to scan folder or folders for particular usre? It would come handy if we would have script witch could be start manualy or as cron job and would scan folders witch we set. Basiclly something like antivirus but with option to input own search string as this script offer.
The script works under FreeBSD, good job.
One problem for us, its not picking up the username correctly and thus not changing the account password of compromised accounts.
I see the following:
One problem for us, its not picking up the username correctly and thus not changing the account password of compromised accounts.
I see the following:
Code:
Subject: Gumblar Attack !!! user : home
Warning !!!
03.10.2009 11:12:43 Saturday
There is a GUMBLAR ATTACK on account home
Infected file : /usr/home/james/iframetest/test4.html
Infection : (pattern removed) at line 1
Action : File moved to : /quarantine/clamav//test4.html.20091003111243
Password might be changed to : xxxxxxxxxxx
Ret : Arrayhmmm...
please send me right user path.. example : /home/username/ in linux
I'm going to add freebsd support
Usually it will be /usr/home/usernamehmmm...
please send me right user path.. example : /home/username/ in linux
I'm going to add freebsd support
On this particular system it is something different entirely. Maybe a config option could be added to specify it?
Also, a neat feature would be to create a directory named after the username in the quarantine directory. As if more than one account becomes compromised and uploads done at the same time we could have the same files being quarantined, overwriting each other.
/quarantine/username/infectedfiles
/quarantine/username/infectedfiles
Not yet... But I'm planning to add proftpd support. But I guess proftpd has not similar function to check files after or while upload...
Whoa. This is probably the most useful script I have seen. Installed it, runned some tests, looks perfect and does it's job.
hidonet, please keep up the great job. People, if you like the script, donate. He is doing this for free.
hidonet, I would suggest one thing to fix for some future release:
1. All infected files gets transfered in /quarantine/clamav. If you could make it /quarantine/clamav<username>/ would be great!
Hello,
There is an iframe exploit, which generates .pl files and those start sending mails from server localhost.
Is this give protection for this also ?
| Thread starter | Similar threads | Forum | Replies | Date |
|---|---|---|---|---|
| M | ClamAV fails to start on CloudLinux 6 after updating to 100.0.8 solution | Security | 2 | |
|
A problem I do not know have a solution | Security | 3 | |
| J | Symlink Solution for OpenVZ / Virtuozzo | Security | 2 | |
|
Solutions for handling ddos attacks? | Security | 3 | |
| T | Hacking threat - and my idea for solution: | Security | 3 |