Add a New Comment Rich Markup
The fact that your system performance is slow is probably due to the speed of the ClamAV engine. You can help this by only scanning directories that you know to be read-write. This will reduce the amount of files that ClamAV must scan. The shutdown-freezing problem is probably because the ClamAV service is not being shut down soon enough. The FAQ may have more information for you about this: http://www.dazuko.org/tgen.shtml#HANG-ON-SHUTDOWN
Thank you very much for the explanation. Now, I fully understand the process. I’m sorry for not explaining clearly my problem. By the way I have another concern. I noticed that my PC slows down when I set / in the IncludePath of Clamuko. I tried putting /proc on the ExcludePath of Clamuko but the performance is still the same. Also, the PC does not respond when I shutdown it. It seems that the system freezes. As an alternative, is it ok to put only shared directories on the IncludePath and schedule a daily full system scan? Any suggestions would be really helpful? Thank you very much.
Perhaps you should begin by explaining what you expect to happen for close events. When you copy a file over (for example, a virus), there are 3 basic steps that happen: 1. The target file is opened. Dazuko catches this event. (At this moment, the file is empty, so a virus-scanner would not block this.) 2. The contents of the virus are written to the new file. This is done using write operations. Dazuko does not monitor these operations. (By the end of this step, the virus is completely copied and available.) 3. The new file is closed. This is a technical step that exists so that the operating system can free resources. However, it is not related to the contents of the file. (Dazuko reacts to this event and an anti-virus scanner provides the appropriate notification. It makes no sense to block this event, because the contents of the file already exist (from step 2). Blocking this event would only lead to resource leaks in the operating system.) If you feel uncomfortable letting viruses sit on the hard drive, you can probably configure your anti-virus scanner to move the file to some other quarentine directory. This would have the effect of the file being removed after it was copied. However, keep in mind that the "close" events do not offer realtime protection. They are simply there as a convenience to offer more events. It is the "open" event that will work most effectively and reliably for realtime protection. (This is because the contents of the file are written in step 2.) If you want an on-access scanner that performs scanning with each read/write of a block of data, the only solution I am aware of is avfs. But I believe this is only a research project and is not supported by professional anti-virus companies. http://www.am-utils.org/docs/avfs-security04/index.html
I compiled dazuko 2.3.3 on kernel 2.6.9 with options ./configure --sct-readonly --enable-syscalls --mapfile=/boot/System.map-2.6.9-mybuild My problem is on_close event does not work well. on_open and on_exec events denies access to the file, but when i save a copy of an infected file to a protected directory. I only received notifications that there is a virus and the infected file is saved. Am I missing something?
(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)
Attach Files: Comment:
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
Please enter the title of George Orwell's famous dystopian book (it's a date):
Follow 2 latest changes.
Copyright © 2023 Free Software Foundation, Inc. Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved. The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team. Source Code
Powered by Savane 3.12