DrunkenBlog

You've got worms...

I need to spend some time looking into ClamAV logging. Right now I have it set to just forward a report an account when something is caught, which is fine, but hard to keep an eye on just what the exact numbers.

Right now I'm using a sort of hackneyed bash script I whipped up that gives me a report like so for the week so I can see what's going on:

Virus & Worm Count:
+++
1 Trojan.Dropper.C
9 W32.Magistr.A
1 Worm.Bagle.E
3 Worm.Bagle.F-zippwd-3
11 Worm.Bagle.Gen-1
1 Worm.Bagle.J
1 Worm.BugBear.B
2 Worm.Cjdra.A
4 Worm.Cidra.D
8 Worm.Gibe.F
4 Worm.Klez.H
1 Worm.Mimail.J
727 Worm.SCO.A
4 Worm.Sober.D
552 Worm.SomeFool
53 Worm.SomeFool.B
48 Worm.SomeFool.B-petite
15 Worm.SomeFool.I
28 Worm.SomeFool.D
331 Worm.SomeFool.Gen-1
102 Worm.SomeFool.Gen-2
+++

Yeah, I know, I need to cleanup the output a little but it works for now. The problem is that it's only reasonably efficient, and most of the efficiency is due to it only taking me a few minutes. It's basically just sucking in a list of virus signatures and using grep to comb the files and output a number. But I'm going to have to keep updating that list as new viruses come out, which would be a drag, so I'm going to have to spend some time seeing if ClamAV offers anything, or if a 3rd party tool exists.

And yeah, that's about what I've gotten this week. I can't quite believe the original SCO.A is still out there as much as it is.

 Posted by drunkenbatman
    March 12, 2004, at 11:47 PM