We provide ftp access to student for storing their work, song, etc in limited space. Around 100 – 150 MB for each student.

Due to report for virus that might appear in their PC in the class I have to scan and remove it in their ftp account before take action to PC level.

I use clamav from FreeBSD ports to scan virus in FTP server, here’s the steps:

*make sure to update ports to latest version*

1. Install Clamav

ftp# cd /usr/ports/security/clamav && make install

2. Edit rc.conf file and insert these lines :

clamav_freshclam_enable=”YES”

clamav_clamd_enable=”YES”

3. Starting Clamav Daemon

ftp# /usr/local/etc/rc.d/clamav-clamd start

4. Update virus database

ftp# freshclam

ClamAV update process started at Fri Dec  5 16:02:20 2008
main.cvd is up to date (version: 49, sigs: 437972, f-level: 35, builder: sven)
Downloading daily-8684.cdiff [100%]
Downloading daily-8685.cdiff [100%]
Downloading daily-8686.cdiff [100%]
Downloading daily-8687.cdiff [100%]
…………………………

Ok, its time to test scan :

ftp# clamscan -r -i -l scan.txt /home

See the report :

ftp# cat scan.txt

———– SCAN SUMMARY ———–
Known viruses: 470392
Engine version: 0.94.2
Scanned directories: 22068
Scanned files: 118646
Infected files: 4
Data scanned: 6868.50 MB
Time: 1342.066 sec (22 m 22 s)

/home/materi/prog/tools/XBOX Emulator.zip: Trojan.Clicker-1009 FOUND
/home/materi/prog/tools/new/mirc616.exe: Trojan.IRCBot-2833 FOUND

/home/materi/prog/resource/freeware/mirc616.exe: Trojan.IRCBot-2833 FOUND

ftp# f-prot -ai /home

ftp# clamscan -r -i –remove -l scan_home.txt /home/mother/Prince