This explains how to install a windows share that is scanned when files are uploaded or changed there.

We use:

• clamav
• inotify-tools

Install those.

I presume you have setup already:

• /etc/clamd.conf
• freshclam works.
• The samba share already exists and works.

What the script does is:

1. find all files in the share $SHARE
2. listen on changes using inotify
3. output from those two is given clam(d)scan, which analyses the $FILE
4. If the $FILE contains a virus, it is moved to $VIRUSDIR, and $FILE.txt is created containing a report

What to do? How to install?

1. Save the script below to something in your $PATH, like /usr/local/bin/scanshares
2. (Set the variables according to your setup)
3. Make sure $SHARE and $VIRUSDIR is owned by the user “nobody”
4. Call it using

   sudo -u nobody scanshares >/var/log/scanshares

5. Watch /var/log/scanshares while you put a test virus file from EICAR into your share. After some seconds, it should be replaced by a text file.

#!/bin/bash
# if you manage to create a file containing a virus,
# which filename signatures a virus, you will send this script
# in a infinite loop ;-)
TMPFILE=/tmp/lastscanresult.txt
SHARE=/srv/samba/
VIRUSDIR=/srv/samba/hasvirus/
VIRUSDB=/var/clamav/
#INOTIFYWAIT=/home/johannes/inotify-tools-3.13/src/inotifywait
INOTIFYWAIT=inotifywait
# if you have no clamd
CLAMSCAN="clamscan --database $VIRUSDB --block-encrypted -i"
# if you have clamd (faster)
CLAMSCAN="clamdscan"
{
# initial check
find $SHARE -type f | while read line; do echo "$line|CLOSE_WRITE"; done;
# await changes
# we need to listen to create, otherwise inotifywait doesn't follow in subdirs :-(
$INOTIFYWAIT -q -m -r -e create -e close_write "$SHARE" --format '%w%f|%e';
} |
grep '|CLOSE_WRITE' --line-buffered | sed -u 's/|.*//g' | # remove create events again
grep -v --line-buffered  $VIRUSDIR | # we know THOSE have virus
while read file; do
echo "scanning $file"
$CLAMSCAN --no-summary "$file" > $TMPFILE
if [ "$?" == "1" ]; then
mv "$file" $VIRUSDIR
{
echo 'The file contained a virus and was therefore removed.'
cat $TMPFILE
} > "$file.txt"
fi
echo "scanning $file done."
done

This manual is also available on gentoo-wiki.