Topic: avg antivirus a bash script to scan new emails with avg

[purvis]

After having many email viruses passing through Clamav undetected on the sme server and not being identified up by Clamav for several days.
I decided to try AVG ANTIVIRUS for Linux.
After scanning the directory /home/e-smith/files on a production server . AVG identified man false positives as other software has identified the same files as suspicious viruses or trojans or just a bad file.
I wanted another one or two more antivirus software to do virus scanning of emails coming in. Mostly some kind of spam.
The command line options are not as good as Clamav and the output is not very human friendly.

Here is a bash script that will be started on our machines at boot up to do a second scan on email that passed through ClamAV. I discovered the all mail comes into the folder under the user's account named "Maildir/new". Any files placed there will get scanned with this script and deleted by AVG if AVG finds the email contains bad stuff.
Hopefully the email will be deleted rapid enough it will not get further on our systems.  Nothing is perfect as far as timing goes.  Because i do not know how to make AVG plugins or perl script. I had to approach the email scanning in this way.
I would suppose if the mail got delivered into a temporary holding directory until all scanning antivirus scanning software had a chance to scan it. This will be the way for now.
The script can be easily changed.
The scipt makes use of the AVG daemon in memory and the inotifywait program from the inotify-tools rpm. This is the first time that i have used inotifywait so this is new to me and there may be unknown issues. I am not sure how this will work on a heavily used email server. If you have a heavily used email server. Maybe there is a way to save files in directories other than the "new". Then they could be processed.
As far as I can tell, AVG makes use of the /tmp directory to store temporary files and the names seem to be different. So i do not see conflicts of running running the avgscan software with AVG.

You can get the two rpms, AVG and Inotify-tools off my website. I had posted that in another over the last 30 days
You can find all my current bash scripts at the website too including this one.

You may want to play around with avgscan command line options. So far, they are kind of vague and I am still playing around with avgscan.

Code: [Select]

#!/bin/bash

# avgdeletebademails
# routine created on 03-23-2013 12:58:00
#  routine will scan all new emails for viruses with the avg antivirus

####################### variables that must be set
# LOG FILE NAMING
   logitdirectory="/home/e-smith/files/ibays/Primary/html/serverstatus"
   logitfilename="avgdeletebademails.txt"
# DIRECTORIES TO WATCH
   directorytowatch="/home/e-smith/files/users/*/Maildir/new"
# SET THE FLAG TO 1 TO SCAN EMAILS COMING TO MAILLOG ACCOUNT
   flagscanmaillog=0
# SET DELAY TIME BEFORE THE PROGRAM STARTS
   delayatstartup=0

####################### end of variables

###################### start of functions
function getemailbasefilename() {
fullfilename=""
#emailbasefilename=""
if [ -z $1 ];then return 0;fi
fullfilename=$(echo  ${xfilename// CREATE /})
#emailbasefilename=$(echo $1 | rev)
}

function scanthefile {
     getemailbasefilename $(echo $xfilename | rev) "$xfilename"
     avgscan $fullfilename  -a --delete 1>/dev/null 2>/dev/null
     if [ ! -f "$fullfilename" ];then
     TODAY=$(date +"%Y%m%d %T")
     echo "$TODAY avgscan deleted $fullfilename" >> $logit
     fi
}
###################### end of functions



mkdir -p  $logitdirectory
chmod 755 $logitdirectory
logit=$logitdirectory/$logitfilename


sleep $delayatstartup
# THE NEXT LINE WILL RESTART THE avg service
#/etc/init.d/avgd restart 2>/dev/null 1> /dev/null
sleep 10


inotifywait -m -e create $directorytowatch 2>&1 /dev/null | \
while read xfilename 
   do
     # TEST IF THE EMAILS TO MAILLOG ACCOUNT IS TO SCANNED     
     tempstring=$(echo ${xfilename/maillog\/Maildir\//})
     if [ "$xfilename" != "$tempstring" ]
        then
        if [ $flagscanmaillog -eq 1 ]
           then
           scanthefile
        fi
     else
       scanthefile
     fi
   done
   
exit 0


[purvis]

If you are going to run AVG and scan many files in a group or a sweep through a directory.
I would suggest using these instructions before your avgscan instruction.

Code: [Select]

/bin/nice -n 19 /usr/bin/ionice -c3 -n7
like

Code: [Select]

/bin/nice -n 19 /usr/bin/ionice -c3 -n7 avgscan /home/e-smith/files/ibays  [then avg any other options]
You can find tune both the nice number and ionice -n number.
This makes a big difference on a single core single processor and single core with a not so speedy drive.

As far as I have been able to see in my test, AVG appears to be do multitasking on files when scanning directories.
When you scan directories when you want to remove the infected files. It may be beneficial to move the infected files in a
directory because the output of AVG is in a odd format, at least to me.

[purvis]

I removed the line in the above script that starts the avg service.
Make sure if you use the code above, the avg anti virus service is running.
As soon as I can test avg more, i will be changing the code in the script to test for the avg being installed and the service running.
If you are running the above script, you should comment out line with the avg start service.

[purvis]

the improved bash script avgdeletebademails
I am not too happy about using the lsof command in this script to see if a files is open
I wish avgscan would open faster as well. I do not think i do nothing much about that.

I did do a lot of script improvements; checking of various sorts in program( is avgd service running, is file to be virus scanned closed?, etc)   and speeding up string searches and matching in this script
I also shortened the man program and created functions for some code located in the main program area of the script
I do not see this program changing much unless i can speed up something in it
I might add a variable to cause any scanned emails with virus related issues to be
    placed in another directory rather than them being deleted. But Clamav can delete
    those emails too.

Code: [Select]

#!/bin/bash

# avgdeletebademails
# routine created on 03-25-2013 03:00:00
# routine will scan all new emails for viruses with AVG antivirus

####################### variables that must be set
# LOG FILE NAMING
   logitdirectory="/home/e-smith/files/ibays/Primary/html/serverstatus"
   logitfilename="avgdeletebademails.txt"
# DIRECTORIES TO WATCH
   directorytowatch="/home/e-smith/files/users/"
# SET THE FLAG TO 1 TO SCAN EMAILS COMING TO MAILLOG ACCOUNT
   flagscanmaillog=0
# LOCATION AND NAME OF FILE TO START THE AVG ANTIVIRUS SERVICE
   avgservicefile="/etc/init.d/avgd"
# SECONDS OF DELAY BEFORE SCRIPT STARTS AFTER SCRIPT IS LOADED
   secondstostart=1
# SECONDS TO WAIT FOR AVG SERVICE TO START IF AVG SERVICE IS NOT RUNNING
# 900 IS 15 MINUTES
   secondstowaitforavgservice=900
####################### end of variables

###################### start of functions
function filtercodefromfilename() {
fullfilename=""
if [ -z $1 ];then return 0;fi
fullfilename=$(echo  ${xfilename// CREATE /})
}

function scanthefile {
  local counter=1
  local stemp=""
  filtercodefromfilename $(echo $xfilename | rev) "$xfilename"
  while [ $counter -eq 1 ];do
     stemp=$(lsof | grep "$fullfilename")
     if [ -z "$stemp" ];then let counter=0;fi
  done
  avgscan $fullfilename  -a --delete 1>/dev/null 2>/dev/null
  if [ ! -f "$fullfilename" ];then
     TODAY=$(date +"%Y%m%d %T")
     echo "$TODAY avgscan deleted $fullfilename" >> $logit
  fi
}

function runstartupconditionstest {
local counter=0
local avgdservice=0

if [ ! -f $avgservicefile ]
   then
   echo "the avg service file $avgservicefile does not exist."
   echo "Quitting $routinename."
   exit 0
fi
# wait for a number of seconds to start this program
# this is for when a computer may be booting up
sleep $secondstostart
#check to see if the avgd AVG antiviruse service is running
counter=$secondstowaitforavgservice
until [ $counter -lt 1 ]; do
      if [ $(pidof -x "avgd" | wc -w) -gt 0 ]
         then
         counter=0
         avgdservice=1
         sleep .25
         else
         avgdservice=0
         sleep 1
         let counter-=1
      fi
 done
if [ $avgdservice -eq 0 ]
   then
   echo "The AVG antivirus avgd service is not running."
   echo "This program cannot work with the service."
   echo "Quitting $routinename."
   exit 0
fi
}
###################### end of functions

############################################### main program start
# run the function to check start environment is  ok
mkdir -p  $logitdirectory
chmod 755 $logitdirectory
logit=$logitdirectory/$logitfilename

runstartupconditionstest

#mkdir -p  $logitdirectory
#chmod 755 $logitdirectory
#logit=$logitdirectory/$logitfilename

inotifywait -q -m -e create -r $directorytowatch 2>&1 /dev/null | \
while read xfilename
   do
   # TEST IF THE EMAILS TO MAILLOG ACCOUNT IS TO SCANNED
   if [[ $xfilename == */Maildir/new/* ]]
      then
      if  [[ $xfilename == */maillog/Maildir/* ]]
          then
          if [ $flagscanmaillog -eq 1 ]
             then
             scanthefile
          fi
      else
          scanthefile
      fi
   fi
   done
############################################## main program end
exit 0


[purvis]

If you have loaded AVG on to your sme server.
You might want to google these below instructions

Code: [Select]

avgcfgctl -w Default.setup.features.antispam=false
avgcfgctl -w Default.setup.features.oad=false
avgcfgctl -w Default.setup.features.scheduler=false
avgcfgctl -w Default.setup.features.tcpd=false


[Stefano]

After a full drive scan.

please define "full drive", thank you

[purvis]

OOPS!
I just saw where I did not comment out the line "rm -f $logit" in the avgdeletebademails script.
That deletes the log file after every start of the script and I delete the log file for testing .
I edited the script above and removed that line completely.
Sorry about any inconveniences.


Stefano
It was not a FULL DRIVE SCAN but a scan of the directory /home/e-smith/files.  Just as the daily or weekly Clamav scan.
Thanks always for reading closely and bringing that to my attention.  I edited that.