anti-malware

#!/bin/bash

# MCSS Fedora Version 1.1

# Set SERVER to 1 if this is running on a server.  If running on a server,
# the following actions are not executed automatically:
#
# - Notification is not sent to all users or added to the /etc/bashrc file.
#
# It is expected that servers will be monitored more closely.
SERVER=0

LOG=/var/log/anti-malware.log
ROOT=/root/mcss
EXCLUSIONS=$ROOT/malware-exclude
EXCLUDE=""
DATE=`date`

# Make sure clamscan is not still running from a previous invocation.
if pgrep clamscan &>/dev/null; then
    echo "$DATE: Found previous clamscan run still active." >>$LOG
    exit 1
fi

if [ -f $EXCLUSIONS ]; then
    for e in `sed 's/#.*$//' $EXCLUSIONS`; do
        if [ -d "$e" ]; then
            EXCLUDE="--exclude-dir=$e $EXCLUDE"
        else
            EXCLUDE="--exclude=$e $EXCLUDE"
        fi
    done
fi

echo $DATE >>$LOG
clamscan -l $LOG -r -i $EXCLUDE / &>/dev/null

if [ $? -eq 1 ] && [ $SERVER -eq 0 ]; then
    if ! egrep '^echo -e "ANTI-MALWARE:' /etc/bashrc &>/dev/null; then
        cat >>/etc/bashrc <<EOF
echo -e "ANTI-MALWARE:  The anti-malware script found viruses.\n\nCheck the $LOG file.\n\nOnce investigated, remove this message by deleting this echo line from\n/etc/bashrc (should be near the end).\n"
EOF
    fi

    cat <<EOF >/tmp/notify-message.$$
The anti-malware script found viruses.

Check the $LOG file.

Once investigated, remove this message by deleting this echo line from
/etc/bashrc (should be near the end).

EOF
    if [ $SERVER -eq 0 ]; then
        wall </tmp/notify-message.$$
    fi
    rm -f /tmp/notify-message.$$
fi

echo >>$LOG