On home systems, like Ubuntu, you can find a great free system called ClamAV through the package manager, however on more stable systems for servers (such as Centos 5) this option is not available.
This does not mean you should forgo the effort to add one – modern viruses are sophisticated vermin that can exploit a users systems and use them to access and propagate on a web server. Script exploits could bring your server to a crawl as they feed viruses to your customers. A good antivirus is a necessity in this modern age.

Thankfully there is an answer – Dag Wieërs maintains an RPM repository supporting several pieces of software, and ClamAV is one of them. There are three steps to making your system secure – first you need to install the ClamAV packages, second you need a custom script to update and scan the system, and thirdly you need to run the script with cron to automate the process. What follows is a step-by-step tutorial for setting this up on a CentOS 5.5 server, however it should work relatively the same for any RedHat Enterprise based distribution.

Part One : Installing ClamAV from Dag’s RPM Repository

The first step is to add the repository entry:

sudo nano /etc/yum.repos.d/rpmforge.repo

In this file add the following code and save the file, then exit the editor:

[rpmforge]
name = Dag Wieers RPM Repository (rpmforge)
mirrorlist = http://apt.sw.be/redhat/el5/en/mirrors-rpmforge
gpgcheck = 1
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY.rpmforge
enabled=0

Next, get the GPG key to ensure you are getting officially signed packages:

sudo wget http://dag.wieers.com/rpm/packages/RPM-GPG-KEY.dag.txt -P /etc/pki/rpm-gpg/ -O RPM-GPG-KEY.rpmforge

You should now be ready to install the initial package:

sudo yum --enablerepo=rpmforge install clamd -y

The previous command should also install the ‘clamav‘ and ‘clamav-db‘ dependency packages. If all went well, move on to the next step.

Part Two : Creating a Script to Automate ClamAV

First, lets create a new bash script:

sudo nano /usr/local/bin/clamav-cron

The script should look roughly like the one below, change the notification and alert emails as needed:

#!/bin/bash
#============================================
# Update clam av and initiate a full system
# scan excluding virtual directories
# written by Brian Cantin, 2009-2010
#============================================
# User configuration section
#--------------------------------------------

# Notification e-mail sender (could be fake):
CAV_MAILFROM="support@example.com"

# Notification & Alert e-mail recipients:
CAV_NOTIFY_TO="notify@example.com"
CAV_ALERT_TO="alerts@example.com"

# Log file name and its path:
CAV_LOGFILE="/var/log/clamav-cron"

# Scan target
CAV_TARGET='/'

# Directories to exclude from the scan
CAV_EXCLUDE='/proc|/dev|/sys|/mnt'

#===========================================
# script revision
CAV_VERSION='0.4'

# if the log file already exists - delete it
if [ -e $CAV_LOGFILE ]
then
        /bin/rm $CAV_LOGFILE
fi

# printed on the command line:
echo -e `basename $0` "v"$CAV_VERSION

# to be written to the log file:
echo -e $HOSTNAME - $(date) >> $CAV_LOGFILE
echo -e ------------------------ >> $CAV_LOGFILE
echo -e Script : `basename $0` v$CAV_VERSION  >> $CAV_LOGFILE
echo -e Target : $CAV_TARGET on $HOSTNAME >> $CAV_LOGFILE
echo -e Exclude: $CAV_EXCLUDE >> $CAV_LOGFILE
echo -e ------------------------ >> $CAV_LOGFILE

# update the detection database
echo -e "Update (/usr/bin/freshclam):" >> $CAV_LOGFILE
/usr/bin/freshclam >> $CAV_LOGFILE
echo -e ------------------------ >> $CAV_LOGFILE

# run the scan
echo -e "Scan (/usr/bin/clamscan):" >> $CAV_LOGFILE
/usr/bin/clamscan --infected --recursive $CAV_TARGET --exclude $CAV_EXCLUDE >> $CAV_LOGFILE
CLAMSCAN=$?

# if an error or virus is encountered then send an email to alert address
# otherwise send one to the notify
if [ "$CLAMSCAN" -eq "1" ]
then
        CAV_SUBJECT="[VIRUS] ClamAV ("$HOSTNAME") $(date)"
        /bin/mail -s "$CAV_SUBJECT" $CAV_ALERT_TO -- -f $CAV_MAILFROM < $CAV_LOGFILE
elif [ "$CLAMSCAN" -gt "1" ]
then
        CAV_SUBJECT="[ERROR] ClamAV ("$HOSTNAME") $(date)"
	/bin/mail -s "$CAV_SUBJECT" $CAV_ALERT_TO -- -f $CAV_MAILFROM < $CAV_LOGFILE
else
	CAV_SUBJECT="ClamAV ("$HOSTNAME") $(date)"
	/bin/mail -s "$CAV_SUBJECT" $CAV_NOTIFY_TO -- -f $CAV_MAILFROM < $CAV_LOGFILE
fi

I think this shell script is fairly self explanatory and to the point – it will update the ClamAV software and database, run a full system scan (excluding virtual directories) and email the results to the notification address. To accentuate problems it adds [VIRUS] or [ERROR] to the email subject and sends the email instead to the alert address. You can configure these addresses to be the same, depending on your preferences. Please note you must have /bin/mail configured correctly for the email functionality to work but that is outside the scope of this article.

After creating and saving this new script, make it executable:

sudo chmod +x /usr/local/bin/clamav-cron

You should complete a test-run of your script at this point:

sudo /usr/local/bin/clamav-cron

If all goes well it should complete within a few minutes to a few hours (depending on the size of your file system) and send you an email of the results. If there where any errors, go back and correct them before moving on to part three.

Part Three : Automation

Once everything is working to your satisfaction you can edit the crontab file for a daily activation of the script:

sudo nano /etc/crontab

I added the following line to make the script run daily at 2:30am as root:

30 2 * * * root /usr/local/bin/clamav-cron

Congratulations! Your server is now configured to automatically update your antivirus, scan for threats and notify you in a timely manner, every day.

Bookmark It

After placing the jquery.js (obtained from jQuery.com) file in your website’s path (ex. yoursite.com/include/) you simply need to add two javascript references in your page header:

<script src='include/jquery.js'></script>
<script src='include/scripts.js'></script>

The scripts.js file is where all the custom functionality code goes. Here’s an example, where links clicked in a div named #nav will load the new content into the #content div without refreshing the whole page:

$(document).ready(function() {           // after page is loaded, this is called automagically $('#nav li a').click(function() {     var query = $(this).attr('href');                  // this is what appears in the href tag     $('#content').hide('slow',loadContent);            // hides the div, calls loadContent()

     function loadContent() {         $('#content').load(query,'',showNewContent()); // pull the request into the div     }                                                  // calls showNewContent()

     function showNewContent() {         $('#content').show('fast');                    // show the new page content     }     return false; // returning false indicates the event was processed });});

No change to the actual page markup was required to make this happen at all. A small hurdle I encountered working with jQuery was that having an event bound to content inside the div #content would cease to function once new content was brought in. The reason for this is that jQuery loads the event binding based on what is on the page at first load. The easy way to solve this is to add the Live Query plugin for jQuery. Put it in your include directory with the other two scripts, and reference the script after jQuery but before your site’s script:

<script src='include/jquery.js'></script>
<script src='include/jquery.livequery.js'></script>
<script src='include/scripts.js'></script>

You will need to perform the related event binding to use Live Query slightly different from a normal jQuery binding:

$(document).ready(function() {    // after page is loaded, this is called automagically $('#content a').livequery('click', function() {        // livequery auto-binds when tags change     var query = $(this).attr('href');                  // this is what appears in the href tag     alert('You clicked this link: ' + query);     return false; // returning false indicates the event was processed });});

Yup, it’s just that easy – and once again, no change was made to the page markup. There is no end to the applications of jQuery and it’s related plugins. Happy coding, and welcome to Web 2.0!

Bookmark It

After a poking around the xml template for my site, and playing around with the Digg code, I’ve figured out how to add a Digg button to my posts.
Listed below is a quick how-to for adding this functionality to your website too.

1. Make sure your blog is set to enable Post Pages and you are using the new Blogger, not the classic version
2. Go to the customization section of your blog, on the Template tab select Edit HTML
3. Make sure to click Download Full Template and save a backup copy to disk – just in case.
4. Put a check in Expand Widget Templates.
5. Search for <p><data:post.body/></p>
   Update: November 5th, 2008

   It has come to my attention that some templates use a slightly different formatting. If you cannot find the text listed above – try searching for <data:post.body/> and follow the rest of the instructions.

6. Paste this on the line directly before it:
   <div style='float:right; margin-left:10px;'>
<script type='text/javascript'>
digg_url=&quot;<data:post.url/>&quot;;</script>
<script src='http://digg.com/tools/diggthis.js' type='text/javascript'/>
</div>
7. Preview your template to make sure it looks right – the Digg icon should appear at the top right of all your posts. Hover your cursor over it and make sure the link URL matches your post URL.
8. If all looks well, click Save Template and then View your blog

Happy DIGGing!

Bookmark It

Thankfully it reverts to a low setting at least allowing me into the desktop to load a terminal and start correcting my errors.

First off – if you can’t figure out what you did, just blast it and start over with this command:

sudo dpkg-reconfigure -phigh xserver-xorg

This will load the /etc/X11/xorg.conf file back as it was at install. Restart your x-server and things should be operational from a clean slate, unless you get the following message:
md5sum: /etc/X11/xorg.conf: No such file or directory

In which case, something you did wiped out your configuration entirely, and dpkg doesn’t want to reload it. This is easily recoverable:

sudo touch /etc/X11/xorg.conf
sudo dpkg-reconfigure -phigh xserver-xorg

This places an empty file in the location, allowing dpkg to do it’s thing without error.

Bookmark It

When you manage a group of PCs in an Internet-connected network, one of the top concerns always ends up being security. This is no easy task, since there is an enormous amount of effort in the underground community to create software that can defeat whatever software you’re using to keep it out.

We’ve all heard the stories of how hackers exploit holes in the Windows operating system, and Microsoft’s solution to this (with Vista) is to prompt the user for nearly everything – which brings me to today’s point. Even the best designed security system can (and likely will) fail at the user level.

There’s a virus worming itself around the Internet at the moment that exploits this relatively well. On an infected system it hijacks MSN Messenger, sending a message to all users on the contact list with rather innocent seeming text. It asks them if they are appearing in a particular picture on a website with a URL that seems to plausibly point to a social networking or photo hosting site. With the rising popularity of these kinds of sites (such as Facebook or MySpace) it’s almost forgivable to be duped by this. The particular message is ‘is that you on this photo [url not included] ’.

Of course, once the link is clicked and Internet Explorer loads the URL, an application is downloaded and executed on the victim’s system – instantly hooking itself into the operating system and loading a bundle of adware, virus and malware onto the PC. It then hijacks MSN on the new host PC and continues to spread in the same manner.
If your Windows PC is up to date with service packs and updates, Explorer will prompt you, asking if you want to execute this application – clicking ‘no’ leaves your PC unaffected.
Clicking ‘yes’ will run an application named ‘oo.exe’ which will place itself in multiple locations on the hard-drive, as well as a file called ‘Net’ that looks like an application installer.

For non-technical people, here’s where things get really ugly. Instantly the adware starts loading pop-ups on your screen, the malware attacks MSN and attaches itself into your OS, and finally a couple of viruses start stealing your personal information and trying to open a back door into the system to enable remote control of the PC. Other than the pop-ups, you’d have no way of knowing this was happening.

Some of the virus activity will be detected by Norton Antivirus (or other available product) and deleted, however the other components (particularly the hook into the OS) go undetected. The virus that gets deleted will invariably reloaded within a half-hour if you’re still connected online.
The easy solution? Immediately pull the plug on your Internet connection, back up your data to a CD, and perform a system restore before your PC joins the zombie army.

Anyone who has had to do this before knows it’s a huge pain to doing a Windows restore, re-install your applications and recover your data. Now, before I get into the nitty-gritty geek details of the more difficult solution, let me just make a little prediction – with the shift in security focus from software to user on Vista, we’re going to see a lot more of these evil programs faking their way through, using the user themselves as the weakest link.

Ok, so you’ve got things to do and feel technically competent enough to take over where your security software failed. What follows is how I removed this particular threat from two PCs under my care. I make no guarantee that this will work for you, and cannot stress enough that you should make a backup of anything you don’t want to lose – one mistake and you could render your system unusable and be doing a system restore anyways!

Step 1) Reduce the Threat

Go to the Add or Remove Programs in the Control Panel and uninstall Messenger. Next, you need to open the Task Manager (by pressing ctrl-alt-delete) and kill all running processes related to MSN Messenger (generally ‘msnmsgr.exe’). Follow this by opening your Program Files folder and renaming all MSN Messenger related folders to something else. Since we can’t easily shutdown the virus on a live system (more on that in a minute) we need to do the next best thing and prevent it from being able to spread or reactivate itself further.

Step 2) Track Down the Source

From the Internet Options in the Control Panel, you need to clear your temporary files.
Next – you’re going to need is a copy of a program called ‘HijackThis!’. Scan your system – look for a strangely named .dll file in the c:\windows\system32\ directory that is listed as both a BHO (browser helper object) and further down as being part of ‘Winlogon Notify:‘. If you’re not familiar with the system32 directory they will all look like strange names – make sure it appears in the two listed places above, on a normal system that would not be the case.

Write down the name of this file. These entries also gave me a clue as to how this threat operates.

Step 3) Know Thine Enemy

By hooking into ‘winlogon.exe‘, the virulent .dll tricks Windows into protecting it from deletion – even in safe mode. This key component to the Windows operating system is even used in safe mode the same as normal. You cannot terminate the ‘winlogon.exe‘ process without the system crashing or restarting, so Windows prevents you from doing this. Since you can’t terminate the process, you can’t delete the file while the system is running. Since you can’t delete it, it loads with the OS at startup no matter what you do.

Step 4) Take a cue from the Daleks: EXTERMINATE!

Now, here’s where things get a little tricky – you need to restart the PC with a Windows XP install CD. If you’re running a brand name PC, you likely don’t have one, you’ll have a restore CD instead… This is not the same thing, and will be of no use for this purpose.
Be very-very careful at this point – selecting an incorrect option could render your system unusable, or erase all of your data!
Make sure you’re booting from the CD-ROM or DVD-ROM, not your hard-disc. Once everything is loaded you’ll be on a blue screen with three options – we want the second one, the Recovery Console. This will ask you which Windows installation you want to work with – in most cases there is just one, and you’ll enter 1, followed by your Administrator password when prompted.

This brings us to a command line reminiscent of DOS. Many old DOS commands work and will be used. First off, you need to type ‘cd system32′. Remember that file name we wrote down from ‘HijackThis!‘ … type ‘del {filename.dll}’. That effectively kills the virus’ OS hook. Type ‘exit’ and reboot normally.

Step 5) Cross Your Fingers

After you logon, it might appear to take a little longer than usual – this is OK, Windows is looking for the file we deleted and happily cannot find it.

Step 6) Clean Up Afterwards

Now that we’re back up, run ‘HijackThis!’ again, and click a check in the box beside the two entries from before. Click ‘fix’ and when it’s done, run a scan again. If those two entries are gone, congratulations! Make sure your anti-virus is up-to-date and run a full system scan. If they didn’t go away, it’s likely you have either a different virus, or other issues as well.
Running a complete spyware scan with one or many utilities available would likely be prudent at this point as well.

You’ll have to download and reinstall Messenger to be able to use it again. Although I’ve tried to be as basic and concise about these instructions, if you have doubts about any of these steps – just do the System Restore.

Step 6) Where To Go From Here

A few final technical notes – the virus generates several files in the system32 folder, which you’ll likely want to remove as well. Assuming you’re doing this right away after discovering the virus, sorting the files (in details view) by date should pop the recently created files to the top (or bottom) – check each one’s properties – if it doesn’t say it was created by Microsoft and was made on the same day or after you got the infection, you can (probably) delete it. You will also want to do a search for ‘oo.exe’ – open the folder each occurrence appears in and delete it as well as the Net application.

Did this help? I’ve recently edited the solution for clarity. Please leave a comment.

Bookmark It