Virus Scanning Uploads with ClamAV

[macosxguy]

I've just installed ClamAV on my server, and now I have to try to figure out how I can use it to scan uploads for virii. i've never used the exec() function and have no clue as to the syntax or how to call an application on a Linux system.

Can anyone point me in the right direction as to how to put an exec() command in a foreach loop to scan my uploads?

Many thanks 🙂

[macosxguy]

well, the manual for clamav doesn't have any php examples, but i managed to hack together the following script to process the files. I'm not completely certain it is working because I have no virii to test with other than the infected files included with clamav and from what I can tell they are being deleted:

foreach($files as $key){
			if($key['name'] !== ""){
				$infected = virus_scan($key);
				if($infected == false){
					upload($key['tmp_name']);
				}else{
					unlink($key['tmp_name']);
				}
			}
		}

function virus_scan($file){
	$file = $file['tmp_name'];
	$last_line = system('clamscan $file',$returned); 
	return $returned;
}

If anyoen should happed to have any suggestions, I'd be happy to hear them.

[Weedpacket]

A standard test "virus" is the EICAR test file (maybe clamAV already provides it). It's text file containing

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Call it eicar.com (it's a DOS program) and see if clamAV catches it. See the documentation available from the above page (important stuff to note is there).

[macosxguy]

Thanks for that tip, Weed.. the script and ClamAV successfully discarded the EICAR files 🙂

[dalecosp]

Now, if it'll just catch "Netsky.D" 😃